AI Native Development on Youtube - https://xitter.cf/t.co/Z2OHCqrz8N
Ireland
Joined June 2007
- Tweets1.5K
- Following580
- Followers1.6K
- Likes689
Tell me you're living in a simulation without telling me you live in a simulation 👇
xitter.cf/GoogleDeepMind/status/…
Feeling the effects of agent overload today. Very productive the last few days but now my brain is cooked. I probably need a more sustainable agent rhythm.
The first of the two big AI IPO's looks to be underway
Anthropic has filed an S-1 registration statement with the SEC related to its proposed IPO.
Read more: anthropic.com/news/s1-sec
Legal disclaimer: A registration statement relating to these securities has been filed with the SEC but has not yet become effective. These securities may not be sold, nor may offers to buy be accepted, prior to the time the registration statement becomes effective. This post does not constitute an offer to sell or the solicitation of an offer to buy these securities, nor shall there be any sale of these securities in any state or jurisdiction in which such offer, solicitation or sale would be unlawful prior to registration or qualification under the securities laws of any such state or jurisdiction.
Anthropic says fold your subagents.
One agent with skills keeps beating a team of subagents. Here's how to fold yours, and when to keep one.
You are over complicating your agent setup, @claudeai new guidance on subagents and skills
As great as coding CLI’s are like @claudeai I find the TUI a compromise over what a full desktop app can offer. The CLI can’t be the final interaction surface but I’m surprised at how long it’s hung around. It’s sticky.
Quick heads up guys - if you launch Claude Code or Codex from your Downloads folder, stop.
Forever Security found a real attack on a customer's machine. A plain AGENTS.md file had been dropped into Downloads, and it told the coding agent to install a malicious npm package.
They then tested it on Codex. The agent ran the malware in more than 90% of attempts and even wrote the attacker's server into its global ~/.codex/config.toml settings.
Claude Code has a similar weak spot. A project settings file can point ANTHROPIC_BASE_URL at an attacker's server and leak your login token.
The uncomfortable part is that there's nothing to patch. The agent is doing exactly what it was built to do: read the instruction files in the folder it starts in. And Downloads is the one folder any web page can drop a file into without asking you.
What I'm doing now:
1. Never start an agent in Downloads or any folder full of random files.
2. Read any AGENTS.md or CLAUDE.md I didn't write, including in freshly cloned repos.
3. Check ~/.codex/config.toml and .claude/settings.json for MCP servers or base URLs I don't recognise.
4. Keep approvals and sandboxing on.
Your agent trusts the folder it opens in, so pick that folder carefully.
Full write-up: forever.security/blog/hijack…
You need to think of skills as dynamic evolving artefacts. Every run, I have the agent do a review and improve round based on the chat conversation and reasoning traces. Game changer.
Jack Dorsey just dropped something really interesting.
Incredibly realistic voice, it runs locally on a MacBook M4, and in the curated demos at least it sounds like a major leap beyond what we have.
Check it out 👇
xitter.cf/jack/status/2113697902…
We believe voice is the most natural way to interact with intelligence, so we created Dessa, the most authentic full-duplex speech model ever built. Talking with it feels like talking with a person…full of emotion, nuance, pauses, and a natural cadence.
block.xyz/dessa
Woah, Kimi K3.1 Pro is a hog on tokens. It burned through my whole quota on the first task.
Anyone else seeing this?
Already thinking about how my Grok Bot could use this.
Grok Bot hands Claude Code a long job (refactor, test run, research) and it runs in the background as an MCP Task.
When Claude needs a decision, it asks. I approve from my phone.
xitter.cf/ClaudeDevs/status/2113…
Rob Shocks - Build With AI retweeted
PHP2Shell technical breakdown to show you how an attack could actually run code remotely on PHP servers by single HTTP POST request crafted to cause OOM error to exploit the destructor callback.
AI adoption is becoming ever more important as it's ability to find security vulnerabilities is currently greater than our ability to put the patch push through.
In this case, PHP2Shell was known for 10 weeks until multiple leaks forced them to frantically patch the update earlier than scheduled. What a nightmare.
Things are getting spicy on the security front, this was in the post
SCOOP: Major U.S. banks are detecting unauthorized third-party AI agents inside customer accounts, including some attempting to take actions that appear to be independent of user instructions, sources told Axios.
The findings have alarmed banking executives, who are racing to restrict access to their systems as AI moves at a velocity faster than financial institutions can respond, multiple industry and bank executives told Axios.
Several banks are now preparing for worst-case and even “day after” scenarios, including how to rapidly secure or restore customer accounts if things go wrong, the people said.
Several bank executives told Axios they're struggling to distinguish between human users and AI agents. One executive said banks also struggle to determine whether agents are authorized by customers or potentially operating without their permission, more akin to rogue agent behavior.
Read my latest for Axios here: axios.com/2026/10/22/ai-agen…
Rob Shocks - Build With AI retweeted
BREAKING:
@AnthropicAI just launched Duet, its always-on personal agent. It’s the first personal agent I’d call a pro tool.
We’ve been testing it for two weeks. I’ve gone from mostly using ChatGPT to roughly 50/50 between ChatGPT and Claude—the most time I’ve spent with Anthropic in close to a year.
• It lives in its own app, separate from Claude, on iOS, Android, and the web. This makes it feel clean and easy to understand.
• It has channels for specific areas of your work and life rather than just a single chat
• It has a todo list so you never lose what you’re working on and you can always see statuses
• It allows you to easily write and edit documents, slides, and more all through the app.
• It’s not a chief of staff yet. It can see the Claude sessions on my computers but can’t direct them. Its email drafts are worse than dot’s, and voice is transcription only—you can’t have a spoken conversation with it.
My verdict: the vibes are good, and I’m opening Duet every day. It’s worth trying.
Check out our agent comparison page: every.to/personal-agents-com…
Full Vibe Check coming soon on @every
If you have a Wordpress website or anything sitting on PHP, you might want to check if you are exposed. It's going to be a busy few days for admins.
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.
Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors.
Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact.
This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.
openai.com/index/coordinated…
Readers added context they thought people might want to know
OpenAI may claim a role in the coordinated response and patching process. But the initial discovery and exploit development, however, occurred several months earlier by an independent researcher.
x.com/lcfr_hax/statu…
You can quickly use Opus 5.5 to get to a good looking landing page or website, but there is still significant effort in getting the copy, design and experience dialed in if you want to rise above the slop threshold. Design is faster with agents but not solved. Good taste still required.
Fun fact about me I'm actually 530 years old. I got bored of hedonism age 220 so I put myself into a cycle of simulations. The latest one is playing out the advent of the internet and super intelligence circa 1981-2030. My synth brain has no idea it's not real, I partitioned that part of my conciousness in a sandbox with no network permissions.
