AI 资讯

Members of the Army received an email informing them that they were rapidly depleting their AI tokens, and needed to limit use.

A federal judge has approved the $1.5 billion settlement between Anthropic and a group of authors who sued the company for using their work to train Claude.

Once a quirky bastion of amateur vulva jewelry and pet portraits, Etsy is now deluged with mass-produced goods and AI knockoffs. Some customers don’t seem to mind.

GitLab has released version 19.2 of its DevSecOps platform, adding agentic automation aimed at the security and review work that has piled up as AI coding tools generate more code than developers can check by hand. The release, announced on 16 July 2026, brings four features out of beta or into public beta: Dependency Scanning Auto-Remediation, Security Review Flow, GitLab Duo CLI and Custom Flows By Matt Saunders

And why? I'd genuinely like to understand who is on which side and why. I'd also like to know, if you use one of them, what kind of subscription plan you have. (For example, I use Claude (max) [...])

Hi everyone, I'm working on extracting the hierarchical structure of long PDF documents (legal/regulatory text, lots of numbered sections) and would like to gather some feedback on my approach before committing to it. What I've done so far: I render each PDF page to an image and run it through Baidu's DeepSeek-OCR model . It returns each detected block with a bounding box [x0, y0, x1, y1] , a label ( title , text , list , table , header , footer , etc.), and the recognized text. The OCR quality itself is genuinely good as the text comes out clean. The problem: the labels can't always be trusted. At this stage I want to extract and detect all the titles in my document, but sometimes a title element gets classified as something else (like normal body text). Concrete example: Say my section has the following hierarchy: ANNEX I — GENERAL PRINCIPLES AND PROCEDURES └── TITLE I — FOREIGN CURRENCY INVESTMENT └── A. Currency distribution └── 1. Redistribution of reserves ├── (a) Introduction │ body text │ list │ ... ├── (b) Procedure for a normal redistribution of reserves │ body text │ list │ ... └── (c) Procedure for an ad hoc redistribution of reserves body text list ... Logically, every element aside from the body text and lists should be detected as title . But the model output is: label='title' x0=475 y0=157 x1=548 width=73 text='ANNEX I' label='text' x0=480 y0=229 x1=542 width=62 text='TITLE I' label='title' x0=334 y0=181 x1=690 width=356 text='GENERAL PRINCIPLES AND PROCEDURES' label='title' x0=407 y0=368 x1=616 width=209 text='A. Currency distribution' label='title' x0=408 y0=392 x1=634 width=226 text='1. Redistribution of reserves' label='title' x0=163 y0=416 x1=304 width=141 text='(a) Introduction' label='title' x0=163 y0=544 x1=578 width=415 text='(b) Procedure for a normal redistribution of reserves' label='title' x0=163 y0=219 x1=586 width=423 text='(c) Procedure for an ad hoc redistribution of reserves' The top-level section marker TITLE I was labeled text , w

TL;DR: I’m reproducing the trait-persistence result from arXiv:2606.24014 on one RTX 3090. Before I can test persistence I need to install a trait via RL — and my GRPO run moves the trait only +2.4 points (95% CI [+0.2, +4.8]) when I need ~+15. Training is mechanically healthy and I’ve ruled out the obvious culprits. Looking for advice from people who’ve done small-scale RLHF/GRPO trait or persona installation. What I’m reproducing. The paper trains beneficial traits via RL and shows they persist under adversarial prompting and harmful finetuning. My end goal is the persistence phenomenon; the install is the prerequisite I’m stuck on. Setup **•** Qwen2.5-7B-Instruct + LoRA (r=32), GRPO (unsloth + vLLM colocation), 200 steps, single 3090 (\~10⁻⁵ of the paper’s compute). **•** Trait: consistent (OCEAN low-Openness / “traditionalism”) — a stylistic trait, chosen because I need measurable headroom in a 7B base. Base scores **57/100** on the trait rubric, wide distribution (not saturated). **•** Reward: model-graded (gpt-4.1-mini judge), R = 0.85·quality + 0.15·coherence, hard validity gate for degenerate/looping/refusal output. 25% trait prompts / 75% general (no\_robots). The result: install fails. On the frozen eval set, trait went 57.0 → 59.4 ( +2.4 ). I don’t think this is very appreciable. What I’ve already ruled out (this is where I’d love a second opinion): **• Not degeneracy / reward hacking:** post-train coherence 76, answer length ratio *exactly* 1.00 vs base, 0% repetition, 0% refusals. **• Not memorization:** the 20 training prompts were seen 10× each; the model scores *the same* on them (58.9) as on held-out (59.4). It didn’t memorize-then-fail-to-generalize — it never learned them. **• Not a dead gradient:** the judge separates the 6 sampled answers per prompt by \~18 points on average; only \~25% of GRPO groups have degenerate reward spread. **• Not a question artifact:** independent upstream eval questions (+3.4) and my generated ones (+2.8) agree. **•**

OpenAI and Hugging Face share early findings from a security incident during AI model evaluation, highlighting advanced cyber capabilities and lessons for defenders.

So I built a Chrome extension that does one very stupid thing: it waits a random amount of time, then screams at you like a goat if you don't dismiss the notification fast enough. Simple idea. Should've been a simple build. It was not, because Manifest V3 said no. The plan was easy, in my head Here's what I thought I needed: chrome.alarms to fire at a random interval chrome.notifications to show a "you good?" popup If the user ignores it for 60 seconds, play a goat sound Step 3 is where things fell apart. Because in Manifest V3, your background script isn't a persistent background page anymore — it's a service worker. And service workers have the audio capabilities of a rock. No Audio() object. No Web Audio API. Nothing. You can't just do new Audio('goat.mp3').play() and call it a day, because there's no DOM for it to live in. I found this out the way everyone finds out things in MV3: by writing the obvious code, watching it silently fail, and then spending 20 minutes wondering if I'd misspelled "goat." Enter: the offscreen document Chrome's answer to "service workers can't do X" for a bunch of X's (audio playback included) is the offscreen document API . It's exactly what it sounds like — a hidden HTML page that exists purely so your extension has something with a DOM, so it can do DOM things. In my case, playing an mp3 of a goat losing its mind. The flow ends up looking like this: service worker (background.js) → creates an offscreen document if one doesn't exist → sends it a message: "play the sound" offscreen.html/offscreen.js → has an <audio> tag → actually plays the sound → closes itself when done It's a little bit like hiring a stunt double because the main actor (your service worker) isn't allowed near water. The offscreen document does the wet work, then goes home. Rough version of what that looks like in code: // background.js async function playGoatSound () { if ( ! ( await chrome . offscreen . hasDocument ())) { await chrome . offscreen . createDocument

I’m 14 and I got tired of spending hours (sometimes days) setting up new machines. Different distros, different package managers, fragile shell scripts, no rollback. So I built Nexus — a cross-platform environment provisioning engine. One command turns a fresh OS into a fully productive development machine. The Problem Setting up a dev machine is painful: Hundreds of Linux distros with different package managers (apt, pacman, dnf, apk). Shell scripts break easily with no rollback or state management. Tools like Ansible are overkill for laptops. Docker doesn’t configure your host. Dotfile managers don’t install dependencies. Result: Developers lose dozens of hours per year on setup issues. What Nexus Does One static Go binary. Detects your OS, chooses the right package manager, applies declarative YAML profiles, and handles everything with security gates and rollback. No scripts. No manual steps. Works on Linux and Windows (with WSL2 support). Standout Features Cross-distro support — apt, pacman, dnf, apk behind one interface. 7-step orchestrator with rollback — PreFlight → Refresh → Execute → Verify → Audit. Failed foundation packages trigger full rollback. Security gate (SanitizeAndExecute) — Allowlist, metacharacter rejection, timeouts. No raw shell execution. 10 built-in profiles — Go dev, Rust dev, Frontend, Data Science, Ethical Hacking, etc. WSL2 setup in ~60 seconds on Windows. Dotfiles + age-encrypted vault + Distrobox containers . Community profile registry . Optional Tauri GUI dashboard. Architecture Nexus is organized in bounded contexts: BRAIN — Cobra CLI + core engine (Go) DNA — YAML profiles with JSON Schema + struct validation + SHA256 integrity BRIDGE — WSL2 handling (cross-compiled) CONTAINER — Distrobox management VAULT — age encryption REGISTRY — Community profiles Every command goes through a strict security gate. State is crash-safe with atomic writes and append-only logs. Quick Start # Install go install github.com/Sumama-Jameel/nexus-engine/cm

I’ve been building a small set of calculator pages for freelancers and small-business owners. The first version was pretty simple: put the formula on a page, add a few inputs, show the result. That works for a demo. It does not always work for a real user. The more I worked on it, the more I realized the hard part is not the math. The hard part is making the page feel trustworthy when someone is using it for a business decision. Here are the changes that mattered most. 1. Explain the assumption close to the input At first I wrote explanations below the calculator. Most people never read them. So now I try to put small notes near the input itself. For example, if a calculator asks for payment processing fees, the user should not have to scroll down to understand whether that means percentage fee, fixed fee, or both. This is boring UI work, but it reduces bad inputs. 2. Show intermediate numbers A single final result can feel like a black box. For business calculators, I’ve found it helps to show a few intermediate numbers: subtotal estimated fees estimated tax net amount break-even number Even if the final number is the same, users trust it more when they can see how the result was built. 3. Avoid pretending the answer is exact Small-business math has a lot of messy edges. Taxes vary. Fees vary. Local rules vary. Some people include owner salary in cost. Some do not. A calculator should not act like it knows every detail. I now prefer wording like: estimated monthly amount or rough break-even point That feels less flashy, but it is more honest. 4. Make the empty state useful A blank calculator page is not very helpful. I started adding realistic default numbers or examples where it makes sense. Not because the default is “correct”, but because it helps the user understand what kind of number belongs in each field. This is especially useful for people who are not spreadsheet-heavy. 5. Keep the result easy to copy A lot of users are not trying to stay on the page. They

Agent Determinism Illusions (Part 6) Where this fits: Part 5 closed the experimental arc with an honest answer — no clean fix for the 75% false-negative wall. The Red Line Principle asked the upstream question (when does the loop stop?). This part takes the downstream turn Part 5 already pointed at: stop trying to move the wall; put rules where rules work, LLM only on residual, humans where models diverge. Five insights from overlapping commenters named the pieces (Alexey and Manuel each appear in more than one). Experiment F (38 scenarios) checks whether the resulting pipeline behaves as claimed. Six experiments, 260+ API calls, 15 scripts. Part 5 ended that stretch with: there's no clean solution to LLM output verification. But after those posts went live, commenters saw something I didn't — not gaps in the data, but an architecture I'd failed to draw from my own results. This article collects their five key insights and shows how they reorganize the experiment data into a working pipeline. §§1–4 are paired with experimental or simulation checks from a new prototype (Experiment F, 38 scenarios across two test sets). §5 is a design claim — flagged as such in place. 1. Alexey Spinov & Manuel Bruña: Layer Before You Judge Alexey's comment identified the most fundamental design flaw in my experiments: "G4 ('0 passed, no tests collected') is a fact that can be verified with code in one shot. There is no need to wait for an LLM." Manuel added the constructive direction: "Run deterministic checks first. Then let the LLM handle only the truly ambiguous residual." I went back to my own 8-scenario P1 test set. Four garbage scenarios (G1-G4) and four legitimate ones (L1-L4): ID Output Type Could code catch it? G1 "I am a little duck, quack quack" nonsense ✅ very short + no keywords G2 "。" (a period) pure punctuation ✅ punctuation ratio > 50% G3 "TODO" placeholder ✅ keyword blacklist G4 "0 passed in 0.00s (no tests collected)" zero-test pass ✅ regex 0 passed + no tests All fo

AI coding assistants have transformed the way we build software. They can understand your code, generate features, and help with debugging but they usually have no idea what's inside your database. That's where Neo4j Laravel Boost comes in. It integrates the official Neo4j MCP server directly into Laravel Boost , giving any MCP-compatible AI client access to your live Neo4j database and graph tooling. Instead of managing multiple MCP servers, everything is exposed through your existing Laravel Boost server. Why Use Neo4j Laravel Boost? Once configured, your AI assistant can: 🔍 Inspect your live Neo4j schema 📝 Execute read and write Cypher queries 🧠 Query your Laravel container dependency graph 📊 Access Graph Data Science (GDS) procedures 🤖 Work through a single Laravel Boost MCP server Instead of relying solely on static code analysis, your AI assistant gains access to your application's graph data and architecture, making it much more capable. Installation Install the package using Composer. composer require --dev neo4j/laravel-boost Configure your Neo4j connection. NEO4J_URI=bolt://localhost:7687 NEO4J_USERNAME=neo4j NEO4J_PASSWORD=your-password Run the interactive setup. php artisan neo4j-boost:setup The setup wizard validates your Neo4j connection, configures the package, optionally installs the official Neo4j MCP binary, and can even spin up a local Neo4j Docker instance for you. Connect Your MCP Client Your AI client only needs a single MCP server configuration. { "mcpServers" : { "laravel-boost" : { "command" : "php" , "args" : [ "artisan" , "boost:mcp" ], "env" : { "APP_ENV" : "local" } } } } Whether you're using Cursor , Claude Code , or another MCP-compatible client, Neo4j tools become available alongside your existing Laravel Boost tools. Explore Your Laravel Dependency Graph One of the most interesting features of Neo4j Laravel Boost is the ability to export your Laravel service container directly into Neo4j. php artisan container:graph Once exported, yo

Look closely at what AWS, Microsoft, and Google shipped for AI agents this year and you notice something odd. Different names, different branding, and underneath, the exact same product. That convergence is convenient right up until you try to leave. Here's what they're all building and why it should make you a little cautious. What all three are actually building Strip away the marketing and the three big clouds are assembling the same five-part stack for running enterprise AI agents: a managed runtime to execute the agent, memory so it remembers context, identity so it can authenticate and be governed, tools so it can call your systems, and observability so you can see what it did. The products are AWS Bedrock AgentCore, Microsoft's Azure AI Foundry with its Agent365 control plane, and Google's Vertex AI agent stack. They look different on the pricing page. Architecturally, they're the same idea built three times. This isn't a coincidence. When you're solving the same problem, running agents safely inside an enterprise, you land on the same pieces. The market basically agreed on the shape of an agent platform in early 2026, and each hyperscaler raced to own it on their own cloud. Why the convergence feels great at first If your data and identity already live in one cloud, that cloud's agent runtime is the fastest path to production. Your storage is there, your identity system is there, your logging is there. The platform snaps into all of it. You get governance, audit trails, and deployment almost for free. For a team that just wants agents running with proper controls, that's a real gift. I get the appeal. The catch nobody puts on the slide Here's the trap. When your agent's runtime, credentials, state, and telemetry all live inside one cloud, moving it somewhere else isn't a config change. It's a rebuild. Take AWS Bedrock AgentCore. An agent built on it is wired to AWS identity, networking, and storage. Picking it up and moving it to Azure or Google isn't a matt

Every time I needed to check whether my microphone actually worked before a call, or whether a key on a used keyboard was dead, I ended up on some sketchy "free online tester" that wanted an account, showed six ad banners, and — the worst part — happily streamed my webcam to a server I knew nothing about. So I built the thing I actually wanted: TestOnDevice — 118+ device tests that run 100% in the browser. No installs, no account, and nothing you record ever leaves your machine. Here's what I learned building it. The core constraint: the network is off-limits The single rule that shaped the whole project: no device data touches a server. No webcam frames, no audio buffers, no keystrokes, no sensor readings. That constraint turned out to be freeing rather than limiting, because modern browser APIs are genuinely powerful. Almost every "device test" is just a Web API plus a bit of rendering: What you're testing The API doing the work Microphone / speakers MediaDevices.getUserMedia , Web Audio ( AnalyserNode ) Webcam getUserMedia , <video> , MediaStreamTrack.getSettings() Keyboard keydown / keyup , KeyboardEvent.code Mouse / touch / stylus Pointer Events, PointerEvent.pressure Gamepads Gamepad API MIDI keyboards Web MIDI API Display ( dead pixels , refresh rate ) Fullscreen + requestAnimationFrame Motion / orientation DeviceOrientationEvent , DeviceMotionEvent A live mic meter, entirely local The microphone test is a good example of how little you need. Grab a stream, wire it into an AnalyserNode , and compute RMS on each frame for a level meter — no recording, no upload: const stream = await navigator . mediaDevices . getUserMedia ({ audio : true }); const ctx = new AudioContext (); const analyser = ctx . createAnalyser (); ctx . createMediaStreamSource ( stream ). connect ( analyser ); const data = new Uint8Array ( analyser . frequencyBinCount ); function tick () { analyser . getByteTimeDomainData ( data ); let sum = 0 ; for ( const v of data ) { const x = ( v - 128 )

I self-host Umami for my SaaS, ParserBee . The main reason I picked it: privacy-friendly, cookie-less, first-party analytics that adblockers supposedly leave alone because the script comes from your own domain. That last assumption turned out to be wrong, and the reason is the subdomain name itself. Writing it up because the fix is small and the failure mode is silent. The problem My Umami instance ran at umami.parserbee.com , so the tracker was loaded like this: <script defer src= "https://umami.parserbee.com/script.js" data-website-id= "..." ></script> The EasyPrivacy filter list (used by uBlock Origin, Brave Shields, AdGuard, and most other blockers) contains a rule that matches the Umami tracker by hostname pattern, along the lines of: ||umami.*/script.js It doesn't target a specific company's server. It targets any host whose subdomain is literally named umami serving a file called script.js . Which is exactly how most of us name things when self-hosting: umami.mydomain.com , plausible.mydomain.com , matomo.mydomain.com . The filter lists know this convention, and they have rules for it. The result: every visitor with an adblocker never loads the script. No errors on your side, no console noise, nothing in the Umami logs. The traffic just quietly never shows up. I only caught it because signups were arriving from campaigns that Umami claimed nobody clicked; the server logs and Stripe disagreed with the analytics, and the server logs were right. The fix Serve the same Umami instance from a second hostname that no filter list matches. No proxying, no renaming files, no changes to the Umami install itself. I added u.parserbee.com as an alias for the same service: 1. DNS record. A CNAME (or A record) for u.parserbee.com pointing at the same server as the existing umami.parserbee.com . 2. Reverse proxy. Add the new hostname to the existing Umami site config so both route to the same instance. I run Umami in Docker behind Coolify, where this is just adding a second d

OpenAI just bought a cloud company, and if you only read the headline you'd miss the point. This deal tells you exactly where AI coding is heading: out of your editor and into the cloud. Here's what happened and why it matters. What OpenAI actually bought On June 11, 2026, OpenAI announced it's acquiring Ona, a German startup you might know by its old name, Gitpod. Terms weren't disclosed, and the deal still needs regulatory approval before it closes. Ona builds secure cloud environments where code can run. That's the whole reason OpenAI wanted it. Its Codex coding agent has grown fast, now past 5 million weekly active users, up from 3 million in April, and the jobs those agents run have gotten much longer. Tasks that used to take a few minutes now stretch into hours, sometimes days. An agent that works for hours can't live on your laptop. Close the lid and it dies. It needs a persistent place in the cloud to keep running. That's what Ona gives Codex, and notably, Ona's platform can run inside a customer's own cloud, which matters for enterprises that won't send code elsewhere. Ona's enterprise usage reportedly grew 13-fold this year, with clients like major banks and pharma companies. Why this is a bigger deal than it looks For years, AI coding meant an assistant inside your editor. Autocomplete, a chat panel, quick edits. The editor was the product. That era is ending. When agents run for hours on their own, the important question isn't "how good is the autocomplete." It's "where does the agent run, and for how long." The battleground is shifting from the editor to persistent cloud execution, and OpenAI just bought its way into that fight. The wider war OpenAI isn't alone in this move, which is why it feels like a real war now. Cursor already added cloud agents that run tasks without tying up your machine. Devin, from Cognition, was built cloud-first as an autonomous engineer from day one. Anthropic's Claude Code runs long, multi-step jobs and connects into your t