AI 资讯

Never miss a competitor's move Discussion | Link

Respond.io, one of Malaysia startups to watch, uses AI agents to handle high volumes of customer inquiries and charges per convo, not per seat.

Shadow AI is the unapproved use of AI tools at work. Here is what it actually is, why it creates security and compliance exposure, and how Bifrost Edge brings it under control at the endpoint. Somewhere in your company right now, someone is pasting a customer list into a personal ChatGPT account to clean up an email. A developer has a coding agent pointed at a repo that still has live credentials in it. Someone in marketing wired up an MCP server they found over the weekend so their assistant can pull from a CRM. None of it shows up anywhere the security team can see. That is shadow AI: people using AI tools for work faster than anyone can govern them. It is rarely reckless. The tools are genuinely useful, they are one click away, and most people have no real sense of what happens to the text they paste into them. The scale is what tends to surprise teams. A 2025 UpGuard report found that more than 80% of workers use unapproved AI tools , security professionals included, and that half use them regularly. This is not a fringe behavior at the edges of the org. It is most people, most days. What counts as shadow AI Shadow AI is any AI tool used for work without security review or central oversight. It is the AI version of shadow IT, except it moved faster and the data leaving the building is often more sensitive. It usually shows up in four shapes: Consumer chat apps used with work data: ChatGPT, Claude, and the rest, on personal accounts. AI inside the browser, where a prompt box is one tab away at all times. Coding agents in the terminal and IDE, which can read source, run commands, and touch infrastructure. MCP servers, the external tools an AI app connects to so it can read files, call APIs, and take actions. The first two leak data outward. The last two are more interesting, because they let an AI tool do things, often with whatever access the employee already has. Why it is an actual security problem, not just a policy headache The risk is not that AI is dangerou

submitted by /u/andrewcairns [link] [留言]

Cursor just shipped Composer 2.5 and Composer 2.5 Fast. We benchmarked both across 11 engineering skills, 5 scenarios per skill, averaged across three independent LLM judges. The fast model scored higher, ran 32% quicker, and costs exactly the same. If you are reaching for Composer 2.5 over Composer 2.5 Fast, you are paying the same price for a slower, slightly worse model. Here is the full picture. TL;DR Composer 2.5 Fast scores 92.7% with skill context. Composer 2.5 scores 92.1%. Fast wins. Both are ahead of gpt-5.5, gpt-5.4, and the previous Composer 2. The fast model completes scenarios in 59 seconds on average. The regular model takes 87 seconds. Where They Land in the Benchmark We ran 6 models across 11 skills, scoring each run with three independent judges and averaging the results. Here is where the full leaderboard sits: Model Avg baseline Avg with-skill Lift opus-4-7 80.8% 93.4% +12.6 composer-2.5-fast 79.6% 92.7% +13.1 composer-2.5 79.0% 92.1% +13.1 composer-2 74.2% 89.6% +15.4 gpt-5.5 75.5% 89.4% +13.9 gpt-5.4 74.1% 89.3% +15.2 gpt-5.3 65.5% 83.9% +18.4 gpt-5-codex 68.7% 78.7% +10.0 Composer 2.5 Fast sits 1.3 points behind opus-4-7 and 3.3 points clear of everything else. That is a meaningful gap. The previous Composer 2 sits alongside gpt-5.4 and gpt-5.5 at roughly 89-90%. Cursor has moved its own model up a full competitive tier in a single release. The Fast model seems better. Normally a "fast" variant trades quality for speed. Composer 2.5 Fast does not do that. It scores 0.6 points higher than the regular model while running 28 seconds faster per scenario (59s vs 87s on average across 110 scored runs). The per-skill breakdown shows where the differences accumulate: Skill 2.5 with-skill 2.5-fast with-skill Winner documentation 97% 98% fast fastify 99% 94% 2.5 init 87% 86% 2.5 linting 98% 99% fast node-best-practices 95% 95% tie nodejs-core 98% 98% tie oauth 92% 89% 2.5 octocat 95% 96% fast skill-optimizer 98% 98% tie snipgrapher 93% 93% tie typescrip

I wanted to see how far an autonomous coding agent could get unattended. The constraint that makes this hard isn't code generation — it's that each session starts with zero memory of the last. So the design problem is state, not prompting. Setup A cron-scheduled task fires hourly, 11pm–7am (~8 runs). Each run is a fresh agent session. No shared context, no carryover. State lives entirely on disk: the working tree, the git history, and two files — BUILD_SPEC.md (the immutable goal/architecture) and PROGRESS.md (an append-only decision + status log). The run loop Every session does the same thing: Read BUILD_SPEC.md, then PROGRESS.md, then git log --oneline. Reconstruct "where are we" from the files themselves (the code is the source of truth, not the narrative). Do one unit of work. Commit. Append to PROGRESS.md: what changed, why (chosen X over Y because Z), and the exact next step. Commit granularity = checkpoint granularity. Worst case on an interrupted session is losing one unit, and the next run re-derives it. The "why" lines matter as much as the diffs — without them a later session re-litigates settled decisions. Guardrails The agent was allowed to build, test, and commit locally. It was explicitly not allowed to deploy, push to a remote, or touch secrets — those get written into PROGRESS.md as "needs human" items instead. This boundary is what makes unattended runs safe to leave alone. What came out A working full-stack monorepo: a pure TS scheduling engine (with property tests), multi-tenant auth, a Drizzle/Postgres schema, server-side re-validation, and publish/share/export flows. Across the runs it cleared its own stale git lock, and one session caught and fixed an off-by-one in a labeling layer that spanned five files. The takeaway The leverage wasn't the model writing code. It was designing a process where progress is durable across total context loss — externalize state, checkpoint constantly, log decisions not just actions, and fence off irreversible o

The problem IAM wildcards and public S3 buckets keep slipping through Terraform code review. Tools like Checkov and tfsec exist but they live in CI, require config files, and developers ignore the output because it's not where they're working. What I built TerraWatch is a GitHub App that scans every pull request that touches .tf files automatically. If it finds a security issue it blocks the merge and posts the exact code fix as a PR comment. The developer sees something like this in their PR: ⚠️ PUBLIC_S3_BUCKET - main.tf (Line 6) Severity: HIGH Risk: S3 bucket allows public read access. Fix: acl = "public-read" acl = "private" block_public_acls = true restrict_public_buckets = true They copy the fix, push, and the merge unblocks automatically. How it's different No YAML, no CI config - installs in 2 minutes via GitHub App Fixes are hardcoded diffs, not AI generated Nothing auto-applied - you review every fix No Checkov dependency - own lightweight rules engine Only reads changed .tf files in the PR, never your full codebase 29 rules covering S3 public access, IAM wildcards, open ports (SSH/RDP/MySQL/Postgres), unencrypted EBS/RDS, public databases, hardcoded secrets, EKS public endpoints, CloudTrail disabled, IMDSv1, and more. Try it Free during beta - terrawatch.dev Also launching on Product Hunt today if you want to show some support!

Cross Platform, Local First AI powered Note Taking App Discussion | Link

description: While most people chase political bets, these traders are dominating daily temperature...

Agentic QA Pipelines: Why Your Test Scripts Are Already Obsolete You wrote the test. You maintained the test. The app changed. You rewrote the test. If that loop sounds familiar, you're not alone — and in 2026, you're also not competitive. Agentic QA pipelines are replacing script-based test automation not because AI is smarter than your QA engineers, but because describing goals is faster than maintaining instructions. Here's what's actually changing, why it matters, and how forward-thinking teams are shipping without the script debt. The Script Maintenance Tax Is Killing Velocity Traditional test automation follows a simple premise: write explicit instructions, run them, check results. It worked when applications changed slowly and test environments were stable. In 2026, neither is true. AI-generated code ships faster. Features change in days. UI components regenerate. And every change breaks a percentage of your carefully maintained test scripts — creating a maintenance tax that grows proportionally with your automation coverage. Quash's 2026 State of QA Automation Report found that teams spending more than 30% of QA bandwidth on script maintenance are shipping 2.4x slower than teams that have automated that maintenance layer away. The irony: the more test coverage you write, the more you're paying the tax. What Agentic QA Actually Means (Without the Buzzwords) An agentic QA system doesn't follow a script. It follows a goal. Instead of: Click the login button Enter " testuser@example.com " in the email field Enter "password123" in the password field Assert redirect to /dashboard An agentic QA agent receives: Goal: Verify that a registered user can successfully authenticate and access their dashboard. Context: Auth flow supports email/password and OAuth. Dashboard loads user-specific data. The agent then: Explores the auth flow autonomously Generates test scenarios, including edge cases it infers from the UI Executes tests, reads failures, and adapts to UI changes

xAI shipped the Grok Build Agent Dashboard on June 15, 2026, and it changes how multi-session coding actually works. Eight parallel agents — four on Grok Code 1 Fast, four on Grok 4 Fast — all visible on one screen. Sessions sorted by state automatically. Sub-agents rolled up under the session that launched them. Reply to a blocked session without ever leaving the dashboard view. If you are already running Grok Build (launched June 5, 2026 in beta), this is a meaningful upgrade. If you are evaluating coding agents and parallel execution is part of your decision criteria, the Agent Dashboard is the most developed TUI for multi-session work in any terminal coding agent right now. Here is exactly what it does and when to use it. How to Open It Two ways in. From your shell: grok dashboard Or from inside any Grok Build session: /dashboard The keyboard shortcut Ctrl+ also opens the dashboard from any active session. Closing the dashboard does not close your sessions — they keep running. When you reopen it, every session is still there in whatever state it was in when you left. That last point matters. The dashboard is a view, not a session manager. Sessions have independent lifetimes. You can close the dashboard, switch to a different terminal, do other work, and come back to a batch of completed or paused sessions waiting for your attention. Session States and the Sorting Logic Every session in the dashboard shows one of three states: working , awaiting input , or idle . The dashboard sorts them automatically, with sessions waiting for your input at the top. Working sessions come next. Idle sessions sit at the bottom. The practical result: open the dashboard and the first thing you see is your blocker queue. Sessions that need you are at the top. Everything else is running or done. You do not have to mentally track what state each terminal is in — the sort does that for you. Selecting any row shows the session's latest output inline, without opening the full conversation

While you're manually checking if YES + NO = 1 , quantitative systems are solving massive constraint satisfaction problems across thousands of correlated markets in milliseconds. The Hidden Reality of Prediction Market Arbitrage You see a market where YES is trading at $0.62 and NO at $0.33. You think: There's $0.05 of arbitrage here . You're right. What you don't see is that by the time you place both orders, professional systems have already: Scanned 17,000+ conditions Detected dozens of correlated mispricings Calculated optimal position sizes (with fees & slippage) Executed everything in parallel Moved on to the next opportunity Between April 2024 and April 2025, quantitative traders extracted $39,688,585 in guaranteed arbitrage profits from Polymarket. The top individual wallet made $2,009,631.76 across 4,049 trades — an average of $496 guaranteed profit per trade . This wasn't gambling. This was mathematics. Why Simple "YES + NO = 1" Checks Fail Most retail traders stop at basic price sum checks. That's not enough. Markets are logically dependent. Example: "Will Trump win Pennsylvania?" → YES: $0.48 "Will Republicans win Pennsylvania by 5+ points?" → YES: $0.32 If the second outcome happens, the first must be true. These dependencies create arbitrage opportunities that simple addition cannot detect. This is known as the marginal polytope problem — projecting prices onto the set of arbitrage-free probability distributions. The Scale of the Computational Challenge For any event with n binary conditions, there are 2ⁿ possible outcome combinations. 2024 U.S. elections: 305 markets → tens of thousands of pairs 2010 NCAA tournament: 63 games → 2⁶³ ≈ 9.2 quintillion combinations Brute force is impossible. Smart systems use constraints instead. Real example : Duke vs Cornell basketball market 7 possible win counts per team → 14 conditions. Instead of checking 16,384 combinations, 3 linear constraints were enough. Research found that 41% of 17,218 conditions showed sing

Every FreeRTOS project I've worked on has the same problem. You have a sensor task that reads temperature. You have a UI task that needs to display it. So you create a QueueHandle_t, pass it to both tasks at init, call xQueueSend on one side and xQueueReceive on the other. Fine. Then you add a WiFi task that also needs temperature. You add another queue. Then a logging task. Another queue. Soon your app_init() is a mess of queue handles being passed around, and changing one task means touching everything it's connected to. On bare metal it's the same story in a different shape — a dozen global flags in main: if (flag_sensor) ... if (flag_button) ... if (flag_timer) ..., each one added as the project grows, none of them easy to trace back to where they're set. On embedded Linux it's pointers — modules holding direct references to each other, so a change in one ripples everywhere. I wanted one solution that works across all three without rewriting the dispatch logic every time. embedmq collapses it to 3 functions: embedmq_register(q, "sensor.temp", on_temp, NULL); // subscriber embedmq_post(q, "sensor.temp", &data, sizeof(data)); // producer, any thread/task No shared queue handles. No global flags. No direct pointers between modules. The library handles the ring buffer, the mutex, and the semaphore wakeup. Same API, three platforms: Linux: pthread + POSIX semaphore, zero external dependencies FreeRTOS: counting semaphore + xTaskCreate, static mode for zero heap after init Bare-metal: C11 atomic spinlock, drive dispatch with embedmq_poll() from your superloop FreeRTOS PAL is verified on the POSIX simulator in CI — not real hardware yet, I'll be honest about that. GitHub: https://github.com/w4ysonch/embedmq Happy to answer questions about the design or the FreeRTOS porting details.

Is FAANG Becoming MANGO in the AI Era? For years, FAANG was the gold standard for innovation and engineering excellence. If you were a developer, working at companies like Facebook (Meta), Apple, Amazon, Netflix, or Google was often seen as the ultimate career goal. But the AI revolution is changing the conversation. Today, some of the most influential companies aren't just building products—they're building intelligence. The spotlight is increasingly shifting toward AI-native organizations such as OpenAI , Anthropic , NVIDIA , and others that are shaping the future of software. The Bigger Shift This isn't really about replacing FAANG with another acronym. It's about a fundamental shift in technology: Search → Answers Automation → Agents Software → Intelligence Features → Capabilities As developers, we're entering an era where understanding AI is becoming as important as understanding frameworks, databases, and system design. What This Means for Engineers The most valuable engineers of the next decade will likely combine: Strong software engineering fundamentals AI-assisted development skills Prompt engineering LLM and agent integration AI-powered product thinking The goal isn't to compete with AI. The goal is to learn how to build with it. Read the Full Article This post was inspired by a thought-provoking article that explores the FAANG-to-MANGO idea in much greater detail. 👉 Read the complete article here: https://www.saurabhsharma.dev/blogs/mangos-vs-faang-ai-era/ What do you think? Are we witnessing the rise of a new generation of AI-first companies, or will traditional tech giants continue to lead the next wave of innovation?

Not every failure is permanent. This is something I didn't think about before. When something fails in my app, my first thought was something broke, fix it. But when I started learning how distributed systems actually work, I realized that some failures are not really failures. They're just temporary. Network glitch. API timeout. A service that just restarted. Rate limiting kicking in. These are all failures but they last for a very short time window. If your system tries the same operation again after a few seconds, it will probably succeed. So the question is does your system know how to try again? Or does it just give up the first time something goes wrong? That's what retry is. What Retry Actually Does Without a retry system, if a temporary failure happens that's it. The entire operation fails. The user sees an error. The request is gone. With retry, your system automatically attempts the operation again after a failure. The goal is simple recover from temporary failures without the user even knowing something went wrong. This felt obvious to me once I understood it. But building it properly is where it gets interesting. The Configuration: What Each Part Controls When I looked into how retry systems are actually configured, there were more options than I expected. And each one exists for a specific reason. maxAttempts — this defines the maximum number of times the operation can be attempted. You don't want infinite retries. At some point if it keeps failing, it's probably not a temporary problem. exponential backoff — instead of retrying immediately every time, the delay between retries doubles after each failure. First retry after 1 second, second after 2 seconds, third after 4 seconds. This gives the failing service time to recover instead of bombarding it with requests. baseDelay — this is the starting delay used in the exponential backoff. The first wait time before retrying. maxDelay — this caps the maximum delay. Without this, the exponential backoff keeps

Local SEO rankings are not the same everywhere. Your website may rank in position 2 in Austin, position 8 in Dallas, and not appear at all in Chicago. That is why checking one generic Google result is not enough for local SEO. If you are working on local SEO , agency reporting, competitor monitoring, or location-based search analysis, you need to track rankings by city. A simple workflow looks like this: Keyword + city → SERP API → local search results → ranking check → CSV report In this tutorial, we’ll build a basic Python script that tracks local SEO rankings by city using a SERP API. We will: Define target keywords Define target cities Send city-specific searches to a SERP API Extract organic results Check where a target domain appears Save the ranking data to CSV This is not a full SEO platform, but it gives you the core logic behind many local rank tracking tools. Why city-level rankings matter Google search results are location-sensitive. A query like: best digital marketing agency may return different results in: New York Austin London Singapore Sydney This matters even more for local intent keywords, such as: dentist near me plumber in Chicago coffee shop in Austin real estate agent in Miami For these searches, the result page can include: organic results local packs Google Maps results ads business directories review sites service pages location-specific landing pages If you only check one location, you may miss what users actually see in other cities. For local SEO, ranking data without location context is incomplete. Why use a SERP API? You could try to check Google rankings manually. But that does not scale. You could also try to scrape Google directly, but that brings a lot of maintenance work: changing page layouts CAPTCHA blocked requests proxy handling inconsistent HTML location mismatch parser updates retry logic A SERP API gives you structured search results in JSON. Instead of parsing raw HTML, you get data like this: { "query" : "plumber in Aust

A story about an AI content moderation system that flagged 347 posts since launch — and what...

Stacking indicators doesn't make you smarter — it makes your bot dumber. You've seen the guides....

With its music focus, no-AI content policy, and larger artist royalties, the hi-res streaming service is scooping up all sorts of switchers.

This advice is everywhere now: Stack ten indicators, wait for three of five to agree, then size up...