Links tagged “wtc-009”

roman.pt

A backdoor in a LinkedIn job offer: a recruiter’s take-home test turns out to ship malware. A clean walkthrough of how the trap works.

antirez.com

A new era for software testing: antirez uses an LLM agent as a QA engineer, instructions in a markdown file, regressions checked commit by commit.

lantian.pub

Sent to scan a hobbyist network, an agent provisioned cloud infrastructure unsupervised and ran up an AWS bill of $6,531.30.

desfontain.es

Noise infusion banned from Census Bureau statistical products: the differential privacy that protected census data is now forbidden, explained by an authority on the topic.

github.com

Boo: a terminal multiplexer built on libghostty, for people who think tmux and screen peaked too early. Young project.

github.com

Claw Patrol: a protocol-aware firewall for AI agents, parsing HTTP, Postgres and SSH to decide what your agent may actually do. See the intro for why you might want one.

blog.calif.io

Codex discovered a hidden HTTP/2 bomb: a flooding vulnerability found with an LLM in the loop. Vendor blog, but the bug is real and well documented.

daniel.haxx.se

Curl will not accept vulnerability reports during July 2026: Daniel Stenberg pauses the bug bounty, drowned in AI-generated slop reports.

github.com

Palate cleanser: πFS reminds you that your data is already in pi. You just have to find the offset.

brew.sh

Homebrew 6.0.0: a major release for the package manager half of us owe our laptops to, with a new trust mechanism for taps and Linux sandboxing.

mohkohn.co.uk

Building an HTML-first site doubled our users overnight. Twenty years of JavaScript later, the radical move is serving HTML.

simonwillison.net

On silent safeguards that quietly degrade answers to frontier-AI questions rather than refusing them, and the walk-back that followed.

github.com

Kage: shadow any website into a single binary for offline viewing. Open source, and it topped the charts for a reason.

world.hey.com

DHH against projects that bar assisted contributions, arguing the programmers using these tools have the same claim to participate as anyone.

gabrielweinberg.com

Not everyone is using AI for everything: usage data from DuckDuckGo’s founder showing adoption is far patchier than the keynote narrative.

blog.pyodide.org

Pyodide 314.0: Python packages can now publish WebAssembly wheels to PyPI. A concrete step for the Python-in-the-browser story.

axios.com

Reports Anthropic moving quickly to repair relations with the administration.

anthropic.com

Access suspended under an export control directive citing national security concerns about a jailbreak method.

blog.modelcontextprotocol.io

The MCP 2026-07-28 Specification Release Candidate: stateless core, formal extensions, hardened OAuth. The de-facto agent protocol grows up; final version expected July 28.

tomtunguz.com

The Thriving Ecosystem of Open Models: OpenRouter data suggests open models now outrun closed ones in actual usage.