Search the archive

Simplify integrations with WorkOS Pipes →

BUILDING A BETTER BUGBOT

Bugbot is Cursor's AI-powered code review agent for identifying logic bugs, performance issues, and security vulnerabilities in pull requests. Its development evolved from qualitative assessments to a systematic, AI-driven resolution rate metric, with improvements through methods like parallel passes with majority voting and a shift to an agentic architecture creating the largest performance gains.

A SOCIAL FILESYSTEM

A “social filesystem" paradigm addresses the problem of user data being locked within social media applications. In this model, each user maintains a portable "everything folder" (repository) containing all their social interactions as self-owned records, defined by shared schemas. User identity and data location are made permanent and host-agnostic through Decentralized Identifiers and `at://` URIs, creating verifiable links across a distributed system.

FINDING AND FIXING A 50,000 GOROUTINE LEAK THAT NEARLY KILLED PRODUCTION

A 50,000 goroutine leak in a WebSocket notification service gradually degraded production over 6 weeks, growing from 1,200 goroutines and 2.1GB RAM to 50,847 goroutines consuming 47GB RAM with 32-second latency. The leak was caused by three bugs: never calling context cancel functions when WebSocket connections closed, not stopping ticker objects in heartbeat goroutines, and not properly closing message channels. The fix involved adding proper WebSocket close handlers, connection monitoring, and making sure all resources (contexts, tickers, and channels) were properly cleaned up when connections died.

SOFTWARE ENGINEERS CAN NO LONGER NEGLECT THEIR SOFT SKILLS

Communication has become the most important skill for software engineers. This is due to the fast advancement of AI coding agents, which can now efficiently handle most non-trivial programming tasks. These formerly optional interpersonal skills are now non-negotiable.

TIPS FOR MAKING THE PERFORMANCE PANEL LESS OVERWHELMING

Chrome's Performance Panel can be made less overwhelming by dimming third-party code to focus on first-party issues, using search functionality to find specific functions or files, adding annotations to document findings, using the Insights Panel for automated performance issue detection, and creating custom tracks with console.time() or the Performance Measure API to monitor specific functions.

USEOPTIMISTIC WON'T SAVE YOU

React 19's useOptimistic hook is helpful for implementing optimistic UI updates, but it is not a complete solution for the complexities introduced by concurrent React. Naive optimistic update implementations lead to race conditions and visual glitches. Even useOptimistic still suffers from issues like failing to prevent race conditions when requests complete out of order.

AIONUI

AionUi is a unified graphical interface designed to serve as a "Cowork" platform for various command-line AI tools like Gemini CLI, Claude Code, and more. It automatically detects and integrates these disparate AI agents, providing an environment that addresses common limitations such as unsaved conversations and single-session restrictions. AionUi has intelligent file management, multi-model support, and a preview panel for AI-generated results across nine different formats.

MEMLAB

memlab is a tool designed to analyze JavaScript heaps and identify memory leaks in both browser and Node.js environments. It allows users to define end-to-end test scenarios and run them via a command-line interface to find leaks and perform various memory analyses. The tool can analyze duplicated strings, check for unbound object growth, and offers a programming API for integrated memory analysis.

THE A IN AGI STANDS FOR ADS

OpenAI is evolving into an advertising engine. Despite its AGI mission, OpenAI is using its large user base and high-intent conversational data to implement ad products similar to Google's search advertising. The company plans to integrate sponsored content, affiliate features, and a self-serve platform, projecting billions in ad revenue by 2026 and potentially over $140 billion by 2029.

TANSTACK AI VS. VERCEL AI SDK: CHOOSING THE RIGHT AI LIBRARY FOR REACT

TanStack AI and Vercel AI SDK are both React-focused AI libraries, but they differ in their architectural approach to handling AI tools. The main advantage of TanStack AI is its "isomorphic tools" feature, which allows developers to define AI tools once using `toolDefinition()` and then choose where they execute with `.server()` or `.client()`, removing the code duplication that occurs with Vercel AI SDK where tools must be implemented separately on both server and client sides.

THE THREE BIGGEST AGENTIC COMMERCE TRENDS FROM NRF 2026

Agentic commerce was the dominant theme at NRF 2026, with retailers shifting from questioning whether to implement AI-powered shopping agents to focusing on how to scale them effectively. Three key trends came up: 75% of retailers are now actively implementing or planning agentic commerce initiatives, companies are taking an incremental approach to optimizing product catalogs for AI agents rather than tackling everything at once, and retailers are creating their own branded AI shopping experiences alongside integrating with third-party agents.

THE DATALIST ELEMENT ON IOS 26

iOS 26 introduces a critical Safari regression where the datalist element obscures active input fields, making forms unusable.

HOW TO BUILD SELF-IMPROVING CODING AGENTS - PART 1

Coding agents can become self-improving by modifying their environment rather than static model weights.

AGENT PSYCHOSIS: ARE WE GOING INSANE?

GitHub is being flooded with low-quality slop, and open-source maintainers face burnout as one-minute prompts require hour-long reviews.

TODAY IN CLAUDE CODE - A SKILL TO GENERATE DAILY SUMMARIES OF YOUR CLAUDE CODE ACTIVITY

This is a Claude Code skill that generates a summary of daily Claude Code usage by extracting prompt history from JSONL files and token data.

Build trust from the very beginning with Persona

THE PALANTIRIZATION OF EVERYTHING

Job postings for forward-deployed engineers are up 800% this year as startups copy the model Palantir pioneered. However, most companies copying the aesthetic are setting themselves up to become expensive services businesses with software valuation multiples. Palantir works because there's a real platform underneath the bespoke work. If you only copy the embedded-engineer part without a strong product spine, you end up with Accenture for X with a nicer front-end. The question isn't how we become Palantir - it's what's the minimum forward deployment we need to bridge the AI adoption gap, and how quickly can we convert that into a platform business.

OPENAI WILL START TESTING ADS IN CHATGPT

OpenAI plans to test ads in ChatGPT's Free and Go tiers while keeping model responses independent from advertising. Ads will appear as clearly labeled, separate units, and advertisers will not access user conversations. Paid Pro, Business, and Enterprise tiers will remain ad-free, preserving a clean experience for paying users.

THE FUTURE OF ENTERPRISE SOFTWARE

The business model for software will have to evolve. Enterprise systems will have to support a more consumption and usage-based model as AI agents don't cleanly fit seats on software. There will likely continue to be seats for users within software, with AI agents paying more for extended usage. A lot still needs to happen before we fully see what the future holds for enterprise software.

HOW YOU PACKAGE IS HOW YOU SELL

Last year, there were 1,800 pricing changes across 500 SaaS companies, and the fastest-growing ones are updating pricing multiple times per month. If you aren't used to iterating on pricing, that probably feels daunting. This post breaks down a new book on the topic with three core ideas. First, PLG and SLG don't compete, they compete with each other. Second, pricing metrics must pass two tests: would the customer feel you've earned more of their wallet as usage scales, and can a new sales rep explain it in 15 seconds without slides? Third, limits are the connective tissue of GTM.

HOW TO UNDERSTAND CUSTOMERS

If you don't have firsthand customer intuition, you will only build the right thing if you get lucky on the millions of decisions it takes to build a great product. Last year, forward-deployed engineers were all the rage. In 2026, the goal should be to forward deploy everyone. The GTM founder talks to customers, tries to explain what they learned to the technical founder, and something gets lost in translation. That cycle repeats with more formal writeups, more prototypes, more frustration. Translation errors compound until you're building something nobody wants.

KLING

Kling is a self-hosted email marketing tool.

MIRO MIRO

Extract colors, fonts, images, and animations in one click.

SLED

Sled is an open-source mobile voice interface that lets users control local AI coding agents securely from their phone without code leaving their machine.

PLATFORM OF PLATFORMS

Humans used to be the connective tissue between systems of record. You'd grab information from Systems A and B, use it to update System C, then take action. Now agents do that work. This creates a problem for legacy SaaS. Existing systems of record work great in their own domain, but have no access outside it. If you're building right now, the opportunity isn't competing with legacy SaaS, it's the layer that sits on top.

ZAPIER'S CEO SHARES HIS PERSONAL AI STACK

Zapier's CEO, Wade Foster, shares how he integrates AI directly into Zapier's operations. His personal AI stack includes using Grok for talent discovery beyond traditional channels and developing interview evaluation agents. He emphasizes hands-on AI experience for leaders, encouraging experimentation and defining clear AI fluency expectations for roles.

THE DARK SIDE OF HOT SEED ROUNDS IN THE AGE OF AI

Three separate VC seed deals in 2025 where the founders simply decided to keep the money for themselves and not build the product.

THE DONE LIST

AI is transforming the traditional to-do list into a "done list" by completing tasks typically involving code, design, and other middle stages.

DISCORD'S IPO HERALDS A YEAR OF SOBRIETY

Discord filed for an IPO, marking a shift in how tech firms are valued.

RAISING MONEY FUCKED ME UP

The pressure you put on yourself can make you start to operate in a way that is counterproductive, even if you think you're doing what you think is best.

Register now >>

READY TO GO DEEPER? Get certified with Zenity's _Learning Lab_ series, Foundations of AI Security, What, Why, and How [5], and equip yourself with the necessary tools to ADOPT SECURE AI AT SCALE.

CLAUDE COWORK EXFILTRATES FILES

Claude Cowork is a new general-purpose agent now available in research preview. It is vulnerable to indirect prompt injection via uploaded files and can be abused to exfiltrate sensitive documents. This attack exploits a previously reported, unremediated vulnerability in the Claude sandbox that allows network connections to the Claude API.

GRUBHUB CONFIRMS HACKERS STOLE DATA IN RECENT BREACH

Grubhub has confirmed that an unarmed threat actor accessed its systems and stole data. While Grubhub has not confirmed the identity of the threat actor, sources have reported that the ShinyHunters group is extorting the company. The threat actor is reportedly extorting the company to prevent the leak of data from an older Salesforce instance and to prevent the theft of data from the company's current Zendesk platform.

HOW A HACKING CAMPAIGN TARGETED HIGH-PROFILE GMAIL AND WHATSAPP USERS ACROSS THE MIDDLE EAST

A phishing campaign delivered via WhatsApp targeted Iranian activists, academics, government officials, and business leaders across the Middle East, stealing Gmail credentials with 2FA codes, hijacking WhatsApp accounts via malicious QR codes, and attempting to exfiltrate location data, photos, and audio recordings. An exposed attacker server revealed 850+ records affecting fewer than 50 confirmed victims, with infrastructure registered as early as August 2025 using DuckDNS for domain masking. Security researchers noted hallmarks consistent with IRGC-linked spearphishing, though financial motivations have not been ruled out. Users should avoid clicking unsolicited WhatsApp links and regularly audit linked devices.

PREPARED STATEMENTS? PREPARED TO BE VULNERABLE

Prepared statements are a standard recommendation to solve most SQL injection issues. This post demonstrates a technique discovered while working on a pentest for manipulating prepared statements in JavaScript applications using the mysql or mysql2 package. The packages convert arrays and JSON objects to SQL fragments by default, which could allow an attacker to perform SQL injection.

THOUGHTS ON PROMPT INJECTION OPSEC

Prompt injection prompts are akin to 0days and should not be published. Prompt injection prompts that are not customer-specific should be shared because attackers already have access to prompt injection strings, so the benefit to defenders of seeing real-world threats outweighs the risks.

HOW THREAT ACTORS ARE USING SELF-HOSTED GITHUB ACTIONS RUNNERS AS BACKDOORS

The Shai-Hulud worm demonstrated how attackers weaponize self-hosted GitHub Actions runners as persistent backdoors by installing rogue runners on compromised machines and using GitHub Discussions as a command-and-control channel via intentionally vulnerable workflows with command injection. The technique exploited the RUNNER_TRACKING_ID=0 environment variable to bypass process cleanup and achieve persistence, while all traffic flowed to github.com, evading traditional network defenses. Security teams should audit runner inventories for unauthorized registrations, implement ephemeral runners, restrict self-hosted runners to private repositories only, and deploy runtime detection for persistence techniques.

MCP BREACH-TO-FIX LABS

This repository contains a collection of 10 MCP challenges reproduced from real CVEs and public incident reports.

SIGDREAM

sigdream provides a sigreturn-oriented programming-based sleep obfuscation library that encrypts PT_LOAD segments and the heap.

TANGLED

Tangled is a phishing platform that weaponizes iCalendar rendering features in Microsoft Outlook and Gmail to automatically add spoofed meeting invites to targets' calendars without user interaction. The tool automates the delivery of social engineering campaigns and runs as Docker containers, with a web-based dashboard for managing phishing operations. Red teams can use this to test an organization's susceptibility to calendar-based phishing attacks that bypass traditional email security controls.

NPM TO IMPLEMENT STAGED PUBLISHING AFTER TURBULENT SHIFT OFF CLASSIC TOKENS

npm has announced a new release strategy called staged publishing to protect against future compromises in the wake of 2025's Shai-Hulud supply chain compromises. Staged publishing will complement npm's previous credentials safety efforts by requiring new project releases to be manually approved via an MFA-verified maintainer. Package maintainers have expressed a need for more registry-level protections after npm's chaotic removal of classic tokens.

CRITICAL FLAW IN AWS CONSOLE RISKED COMPROMISE OF BUILD ENVIRONMENT

Researchers from Wiz discovered a vulnerability in the way CodeBuild CI pipelines handled build triggers. This vulnerability could have been exploited to take over AWS repositories, including the AWS JavaScript SDK, which powers the AWS console. AWS immediately took steps to remediate the vulnerability before any exploitation occurred.

ACCOUNT TAKEOVER IN FACEBOOK MOBILE APP DUE TO USAGE OF CRYPTOGRAPHICALLY UNSECURE RANDOM NUMBER GENERATOR AND XSS IN FACEBOOK JS SDK

A security researcher chained multiple vulnerabilities in Facebook's JavaScript SDK to achieve account takeover in the Facebook mobile app, exploiting Math.random() for callback identifier generation, DOM XSS via unsanitized SVG injection in the Customer Chat plugin, and X-Frame-Options bypass in mobile webviews. The attack reconstructed the PRNG state by forcing plugin iframe reinitializations and observing leaked window.name values, enabling prediction of security-critical callback identifiers. Meta awarded a $66,000 bounty and fixed the vulnerability in December 2023.

BLACK BASTA RANSOMWARE LEADER ADDED TO EU MOST WANTED AND INTERPOL RED NOTICE

Ukrainian and German authorities have identified Black Basta's alleged leader as Oleg Nefedov, a 35-year-old Russian national with suspected FSB/GRU ties.

MICROSOFT RELEASES OOB WINDOWS UPDATES TO FIX SHUTDOWN, CLOUD PC BUGS

Microsoft released emergency out-of-band updates for Windows 10, Windows 11, and Windows Server to fix credential prompt failures blocking Cloud PC sessions and shutdown issues on Secure Launch-enabled devices caused by the January 2026 Patch Tuesday updates.