AI 资讯

I Built an Open-Source Lab to Learn the OWASP Top 10 for LLM Applications Over the past few months, I've been exploring the security challenges around Large Language Models. While there are plenty of articles explaining prompt injection, system prompt leakage, insecure tool usage, and other LLM vulnerabilities, I kept asking myself one question: Where can someone actually practice exploiting these vulnerabilities? That's what led me to build LLMVault . LLMVault is an open-source, intentionally vulnerable platform that helps developers and security professionals learn the OWASP Top 10 for LLM Applications (2025) through hands-on labs instead of theory. Each lab simulates a vulnerable AI application inspired by real-world LLM attack scenarios. Instead of reading about prompt injection, you'll exploit it yourself, capture flags, understand why it worked, and then review the recommended mitigation. The objective is to bridge the gap between theory and practical AI security. Why I built LLMVault When learning web security, platforms like DVWA, WebGoat, and Juice Shop made learning practical. For AI security, I couldn't find a similar project that was: Open source Self-hosted Free to use Designed around the OWASP LLM Top 10 Built as a hands-on learning environment So I decided to build one. What is LLMVault? LLMVault is a deliberately vulnerable AI application where every challenge demonstrates a real-world LLM security issue. Instead of simply reading about prompt injection or system prompt leakage, you exploit vulnerable AI assistants, capture flags, and learn why the attack works. Each challenge also includes defensive guidance so you understand how to prevent the same issue in production. Features 🛡️ OWASP Top 10 for LLM Applications (2025) 💥 CTF-style challenges 🔍 Realistic AI attack scenarios 📚 Defensive explanations 🐳 Docker support 🔑 No API keys required 💻 Fully offline 🧩 Extensible challenge framework Getting Started Clone the repository: git clone https://github

🚀 AI is becoming smarter every day. But intelligence alone isn't enough—it also needs a standardized way to communicate with tools, applications, and data. That's exactly what Model Context Protocol (MCP) provides. 🚀 Introduction The AI landscape has evolved rapidly over the past few years. We've moved from simple chatbots to: 🤖 AI coding assistants ⚙️ Autonomous agents ☁️ Cloud automation 📊 Infrastructure monitoring 🔄 Intelligent workflows But one major challenge still exists: How can AI securely communicate with external tools like GitHub, AWS, Docker, Kubernetes, Slack, databases, and local files? Until recently, every AI company built custom integrations. That meant: duplicated engineering effort inconsistent APIs difficult maintenance poor interoperability To solve this problem, the AI ecosystem is adopting a new open standard called Model Context Protocol (MCP). 🤔 What is Model Context Protocol (MCP)? Model Context Protocol (MCP) is an open protocol that standardizes how AI models communicate with external tools, APIs, databases, applications, and services. Instead of every AI assistant creating custom integrations for every service, MCP provides one common language. Think of MCP as: 🔌 USB-C for AI applications. Just as USB-C lets different devices communicate using one standard, MCP allows different AI assistants to connect to external systems in a consistent way. ❌ The Problem Before MCP Imagine you're building an AI DevOps assistant. It needs access to: GitHub Docker Kubernetes AWS Terraform Jenkins Prometheus Grafana Local Files Internal Documentation Without MCP, you'd need to: Learn every API separately Build authentication repeatedly Maintain multiple SDKs Handle different response formats Continuously update integrations Every AI application repeats the same engineering work. This approach is: ❌ Time-consuming ❌ Expensive ❌ Difficult to maintain ❌ Hard to scale ✅ How MCP Solves This Problem MCP introduces a standardized communication layer between AI m

A salamander can lose a leg and grow a new one. Cut a zebrafish's fin and it simply builds another. Mammals, us included, got the consolation prize: a scar. For a century, biologists assumed that somewhere on the evolutionary road to becoming warm-blooded, fast-moving animals, we traded regeneration away for good. Two research teams working on opposite sides of the planet have just made that assumption look wrong. The headline is almost hard to believe: the ability to regrow lost body parts may not have been deleted from our biology at all. It may simply have been switched off, and switches can be flipped back on. The genetic "remote control" that stopped working The first clue comes from a team at the National Institute of Biological Sciences in Beijing, working with genomics powerhouse BGI-Research. Publishing in Science , they zeroed in on a gene called ALDH1A2 , the instruction sheet for an enzyme that turns vitamin A into retinoic acid, a molecule that acts like a foreman on a construction site, telling cells where to go and what to build during tissue repair. Animals that regenerate freely crank this gene up at the wound site. Mice, it turns out, still carry the same gene. They've just lost the genetic "remote controls," the regulatory DNA that tells the gene to fire after an injury. The hardware is intact; the software command was disconnected somewhere in evolution. So the researchers reconnected it. By reactivating that dormant switch and restoring the flow of retinoic acid, they got mice to regenerate damaged outer-ear tissue, something a normal mouse simply cannot do. In their own words, they had found "a genetic switch involved in the evolution of regeneration." Meanwhile, in Texas, they regrew a limb joint The second piece of evidence lands the point with force. At Texas A&M, a group led by Dr. Ken Muneoka took a different route to the same destination. Instead of editing a genetic switch, they used a precisely timed sequence of two signaling proteins.

Syncthing keeps files synchronized across devices you control, making it one of the most practical tools for a self-hosted knowledge infrastructure that avoids cloud lock-in. Unlike cloud storage platforms, Syncthing uses a peer-to-peer model where each device holds its own copy of synced folders and exchanges changes directly with trusted peers. There is no central server that owns your data, no subscription account, and no vendor lock-in. The project is open-source and community-driven, with more details at syncthing.net . This architecture makes Syncthing especially useful for knowledge workers who manage markdown notes, research documents, PDFs, and project files across a desktop, laptop, home server, and possibly a phone. The tool is simple in concept but requires careful setup to avoid common pitfalls like treating sync as backup or syncing folders that should remain isolated. What Syncthing Is and Is Not Syncthing synchronizes files between two or more devices. Each device maintains its own copy of a folder, and changes propagate between trusted peers. Discovery and relay services may help devices find each other across networks, but the storage model remains local-first. The Syncthing documentation covers installation and configuration in detail. The calm but important opinion is this: Syncthing is excellent when treated as sync infrastructure. It becomes dangerous when treated as backup. It is not a cloud drive. It is not a complete backup system. It is not a collaboration suite. It is a private, peer-to-peer file synchronization tool. Why Syncthing Matters for Knowledge Management Knowledge management is not only about note-taking. It is also about where knowledge lives, how it moves, and whether it remains accessible over time — see the knowledge management guide for the broader picture of tools, methods, and self-hosted platforms this fits into. A useful personal or team knowledge system often contains: markdown notes PDFs and papers diagrams and screens

This is The Stepback, a weekly newsletter breaking down one essential story from the tech world. For more on video games and physical media, follow Jay Peters. The Stepback arrives in our subscribers' inboxes on Sunday at 8AM ET. Opt in for The Stepback here. How it started As a kid, I relished trips to […]

submitted by /u/DataBaeBee [link] [留言]

Google's AlphaEvolve reached general availability on the Gemini Enterprise Agent Platform, turning the DeepMind research project into an evolutionary code optimization service. Evaluators run client-side so code never leaves the customer's infrastructure. Klarna doubled ML training throughput; practitioners note it only works where a measurable evaluation function exists. By Steef-Jan Wiggers

Originally published at htpbe.tech . The version on htpbe.tech stays in sync with the latest detection algorithm — refer to it for the canonical text. A fraud reviewer opens a PDF bank statement. The first thing many manual checks look at is the document’s Producer field — the line of metadata that records which software last wrote the file. This one says Adobe PDF Library 23.1 . To a human, and to most lightweight metadata checks, that reads as reassuring: Adobe is professional software, the kind a bank’s back office or a law firm would use. The reviewer moves on. That is exactly the reaction the forger was counting on. The document was not produced by Adobe. It was edited in a free browser-based PDF editor, then passed through a step that overwrote the Producer string to say Adobe . The metadata now lies about the file’s own origin — and it lies in the most credibility-laundering direction available, because “Adobe” is the producer string people trust most. This is producer identity forgery, and it is one of the most common ways a tampered PDF tries to talk its way past a metadata-only review. This is a case study in how that attack works at a conceptual level, why a metadata-only check waves it through, and how a structural approach — the one behind the public marker HTPBE_PRODUCER_IDENTITY_FORGED — catches the contradiction the forger left behind. If you want to see the Producer string for yourself, the free PDF metadata viewer reads it — along with every other field — straight out of any PDF. Why the Producer field is the obvious thing to forge Every PDF carries internal records about how it was made. Two fields matter most to a reviewer: producer — the software that wrote the final bytes of the file. creator — the application the content originated in. Fraud-detection lore, repeated in countless “how to spot a fake bank statement” guides, says the same thing: a real institutional document is generated by an automated back-end system, so if the producer says Mi

The Great Migration: Moving Beyond the SPA If you have been building in the React ecosystem recently, you've likely started with Vite. It’s fast, the Developer Experience (DX) is unparalleled, and it just works. However, as projects scale, the requirements often evolve. You suddenly need better SEO, faster First Contentful Paint (FCP), or sophisticated server-side logic without managing a separate backend. This is usually when the conversation turns to Next.js. While the migration seems straightforward on paper—it's all just React, right?—the reality involves a fundamental shift in how you think about routing, data fetching, and the browser lifecycle. Here is everything I wish I knew before I made the jump from Vite to Next.js. 1. Routing: From Configuration to Convention In a Vite project, you probably used react-router-dom . You defined a <Routes> component, listed your paths, and mapped them to components. It was explicit and centralized. Next.js (specifically the App Router) uses file-system routing. Every folder in your app directory represents a route segment. The Shift in Thinking Vite: You decide where files live; the router links them. Next.js: The folder structure is the URL structure. You will spend your first few hours moving About.tsx to about/page.tsx . It feels tedious at first, but it eliminates a massive category of "broken link" bugs and makes code-splitting automatic. 2. The "use client" Directive This is perhaps the biggest stumbling block for Vite developers. In Vite, every component is a client component—it runs in the browser. In Next.js, components are Server Components by default. If you try to use useState , useEffect , or browser APIs like window or localStorage in a default Next.js component, your build will crash. You must add the 'use client' directive at the top of the file. Pro-Tip: Don't just add 'use client' to everything. The goal is to keep as much logic as possible on the server to reduce the JavaScript bundle sent to the client.

This is a submission for DEV's Summer Bug Smash: Smash Stories powered by Sentry . There is a version of this story where I walk you through the technical challenges in a clean, detached voice. Structured. Professional. Composed. This is not that version. Seven months. A hundred pages of documentation written alongside the code, not after it. A live system serving rural clinics in Delta State, Nigeria. And three bugs so specific and so cruel that each one felt designed to find the exact gap between what I thought I knew and what I actually knew. The Delta Health Information and Appointment Booking System was my final year project at the University of Port Harcourt. That sentence makes it sound smaller than it was. This was a real system for real clinics, serving patients who travel for hours to reach a healthcare facility only to find the clinic is full, the doctor is not in, or nobody told them their appointment was cancelled. These are not hypothetical users. These are people whose access to healthcare depends on whether the software works. That is a different kind of pressure than getting a good grade. And it did not start at deployment. Before a single line of code was written, I had to pitch the entire concept to my university supervisor, the Head of Department, the Faculty Dean, and an external examiner. The system had to be defensible not just technically but practically. It had to demonstrate that it solved a real problem that real people in Delta State were actually facing. I was presenting to people with decades of experience who would ask questions I had not thought of yet. That kind of scrutiny either sharpens you or breaks you. I chose to let it sharpen me. The stack was React.js, Node.js, PHP with Laravel, MySQL, AWS, and Docker. Communication channels included SMS gateways, WhatsApp Business API, and USSD because not every patient in rural Delta State has a smartphone. The system had to run on 2G connections, on entry-level Android phones with 2GB RAM

Written by Marlowe Finch, archival bloodhound at Bitcoin Institute. Bitcoin has been decentralized and trustless since block zero. No CEO, no committee, no kill switch, no single person who can rewrite the rules. That's the pitch. It's why the whitepaper still gets quoted like scripture. Block 74638 does not agree with the pitch. What actually shipped in that block On August 15, 2010, a transaction landed in the Bitcoin blockchain with two outputs. Each one paid out 92,233,720,368.54277039 BTC . Combined: over 184 billion BTC — roughly nine thousand times the 21 million BTC that will ever exist, created in a single transaction. The validation code, CheckTransaction() , checked that each individual output was non-negative. It never checked whether the sum of the outputs overflowed. Two values chosen just under INT64_MAX, added together, wrapped around to a negative number in signed 64-bit arithmetic. A 0.5 BTC input, compared against that negative sum, satisfied the "input covers output" check. The transaction validated. The block got mined. Every rule the network was running said this was fine. That's CVE-2010-5139. It is also, by any dollar value you want to apply, the most expensive missing bounds-check ever shipped to production. So who hand-builds a transaction engineered to overflow a signed 64-bit integer, and what does a currency with a hard 21-million-coin cap do when someone mints nine thousand times that in one block? The archive's full account of the incident lays it out block by block . The receipts 18:08 UTC, August 15 — Jeff Garzik opens a BitcoinTalk thread titled "Strange block 74638", pastes the raw block dump, and closes with one question: "92233720368.54277039 BTC? Is that UINT64_MAX, I wonder?" 20:38 UTC — Satoshi Nakamoto, to the bitcoin-list mailing list, network-wide: "*** WARNING *** We are investigating a problem. DO NOT TRUST ANY TRANSACTIONS THAT HAPPENED AFTER 15.08.2010 17:05 UTC (block 74638) until the issue is resolved." 20:39 UTC — Ga

Three weeks from now I will open a terminal, ready to ship another program to mainnet-beta, and I will pause. What was the order again? Did the IDL go up before or after the authority transfer? Was there a flag that saved me from a stalled deploy last time? This checklist exists because I just walked the entire path devnet to mainnet, deploy to IDL to frontend to error handling, and I wrote it down while the details are still fresh. It is the document I wish I had on day one of that process. Run it top to bottom before every mainnet launch. Why a checklist at all? A Solana mainnet deploy is full of irreversible steps. The wallet that signs the deploy quietly becomes the program's upgrade authority. A buffer account left mid-deploy can strand real SOL. A plain anchor build after a verifiable build can produce a different hash and break verification later. None of these are complicated. They are all easy to forget under pressure. A checklist is not a crutch; it is the habit that lets you ship calmly instead of improvising each time. Phase 1: Pre-flight on devnet Do all of this while mistakes are still free. [ ] Every test passes against the final build. Run anchor build && cargo test --package <your-program> one last time. The binary you test must be the binary you ship. [ ] End-to-end run on devnet. Call every instruction through the actual frontend, not just the test suite. The frontend is a different caller than LiteSVM and will surface different failure modes. [ ] Produce a verifiable build. Run anchor build --verifiable . This pins the build environment so the on-chain bytecode can later be matched to your source code. Once you have this artifact, do not touch it with a plain anchor build or cargo build-sbf ; those can produce a different hash and silently break verification. [ ] Measure rent before you spend it. Run: solana rent $( wc -c < target/deploy/.so ) Your deploy wallet must hold this amount plus a margin for transaction fees. There is no airdrop on the

Say "fable-mode" (or "operate carefully," or "high-judgment mode" or "think like fable") in a Claude Code or Codex session, and one line buried in the skill file does most of the work: "Never promote 'plausible' to 'confirmed' in your summary." That single rule is the whole philosophy in miniature — don't let something that merely looks right pass as something that was checked. Fable-mode is not a tool, a model swap, or a set of new commands. It's a behavioral overlay — a skill file at ~/.claude/skills/fable-mode/SKILL.md or ~/.codex/skills/fable-mode/SKILL.md or any other agent you use, that gets loaded into the turn and changes how the agent scopes work, verifies its own claims, and reports results. Nothing about what Agents can do changes. What changes is the discipline around using it. What actually changes The skill is organized into seven blocks, and each one targets a specific failure mode that shows up in normal agent use: Judgment before action. The first move is classification: is this a question, a problem description, or a change request? For the first two, the deliverable is an assessment — investigate and stop, don't start editing files nobody asked you to edit. Irreversible actions (deletes, pushes, overwrites) require a stop-and-confirm, and specifically: "before deleting or overwriting anything, actually look at the target." Verification as the non-negotiable core. This is the section that does the heavy lifting. Every "done" claim needs evidence produced after the last edit — a test run before your final change proves nothing about your final change. Claims get graded on a three-tier scale: Confirmed (you ran it and saw the result), Plausible (the code reads right but you haven't executed it), Assumed (inherited from the user's description). The rule is that you report the grade you actually earned, not the one that sounds better. Reasoning habits. Hold two hypotheses before committing to a diagnosis. Treat your memory of a library's API as a prior

1. Subsystem Decomposition 1.1 The Decomposition Problem A subsystem decomposes a codebase into smaller, cohesive units. Two primary axes of decomposition exist: Technical axis : grouping by component type (controller, service, model, view) Functional axis : grouping by business capability (cataloguing, circulation, etc.) 1.2 Tension Between Framework Prescriptions and Decomposition Strategy Organizing top-level subsystems functionally may create friction with frameworks that prescribe a technical-first structure. Concrete examples: Rails enforces model, view, and controller directories at the root level, making functional decomposition awkward without additional mechanisms like Rails Engines Sinatra (a microframework) imposes minimal structure, leaving architectural decisions entirely to the team Frameworks with rigid prescriptions constrain architectural choices. Frameworks with no structure shift the entire burden onto the team with no guidance. This second approach might be fine for teams that know what they are doing and how to shape the architecture properly. Not everyone needs guidance from the framework. 1.3 Contexts as a Middle Ground Phoenix provides contexts as a compromise: Explicit, guideline-oriented subsystems that enable functional decomposition without rigid enforcement Contexts define functional boundaries while allowing technical organization to remain nested within them Functional blocks may later evolve into microservices, but this is optional The same decomposition serves equally well in a modular monolith or a distributed architecture The choice depends on team needs, scaling requirements, and operational maturity, not on the decomposition strategy itself 2. Pipeline Topology and Data Flow 2.1 The Unix Pipeline Model Unix pipelines model data flow through a single stream connecting stdout to stdin. This forms a linear chain where each stage's output becomes the next stage's input. Key characteristics: Each stage has exactly one input and one o

Over the past few months I’ve been building Radar, an open-source media intelligence and social listening platform that anyone can self-host. The project started with a simple observation: most media monitoring platforms are incredibly powerful—but they’re also expensive, closed, and often lock users into proprietary AI services. I wanted to explore a different approach. What is Radar? Radar is a self-hostable platform for monitoring news and public media sources using AI. Instead of relying on proprietary datasets, it works with free public RSS and Atom feeds, allowing anyone to build their own monitoring environment. One of the core design decisions is that Radar is AI-agnostic. Rather than forcing a single provider, you can choose between: Anthropic Claude OpenAI Grok Current Features 📰 News aggregation from free RSS and Atom feeds 🤖 AI-powered summaries 😊 Sentiment analysis 🔍 Keyword and topic monitoring 📊 Searchable dashboard 🏠 Self-hosted deployment 🔓 Fully open source Why Build Another Media Intelligence Tool? Enterprise platforms such as Talkwalker and Brandwatch are excellent products, but they aren’t accessible to everyone. Radar is aimed at: developers startups journalists researchers agencies open-source enthusiasts The goal isn’t to replicate every enterprise feature, but to build a transparent, extensible, and self-hosted alternative that anyone can inspect, modify, and improve. Looking for Feedback The project is still under active development, and I’d really appreciate feedback on: architecture user experience deployment scalability AI abstraction features that would make the platform more useful If you’re interested in open-source AI, media monitoring, or self-hosted software, I’d love to hear your thoughts. GitHub Demo Contributions, suggestions, feature requests, and bug reports are all welcome.

Stack Overflow's question volume has been falling since ChatGPT went public in November 2022 ( OpenAI ). The site that trained a generation of developers, and most of the AI tools those developers now use, is slowly emptying out. In October 2023, Stack Overflow laid off 28% of its staff ( Stack Overflow Blog ). CEO Prashanth Chandrasekar framed it as a restructuring toward profitability. Everyone in the industry understood the real cause. Traffic was down. The thing causing it was sitting in every developer's browser tab. This is not another "AI killed Stack Overflow" piece. That take is everywhere and it misses the actual problem. The interesting part is the feedback loop, and it points somewhere uncomfortable for the AI industry itself. The conventional story, and what it misses The popular version goes like this. Developers used to paste error messages into Google and land on a Stack Overflow thread. Now they paste the same error into ChatGPT, Claude, or Copilot and get a direct answer. Why click through to a forum, risk a condescending comment, and wait for a human when a model answers in two seconds? That part is true. It explains the traffic drop. It does not explain why the people building the AI should be worried. The seed corn problem Here is the part most coverage skips. Every large language model trained on internet text consumed a huge amount of Stack Overflow. The site's archive of voted, edited, human-reviewed answers is one of the highest-quality programming datasets in existence. It is the reason an AI can answer your Python error at all. Now run the loop forward. AI tools answer questions directly. Developers stop posting on Stack Overflow. The archive stops growing. The next round of models trains on a corpus that is increasingly old, increasingly stale, and missing everything that happened after 2022. When you train an AI on data generated by another AI, quality degrades. Researchers proved this formally. Shumailov and colleagues showed that model

I watched an AI agent send 200 emails to the wrong recipients because I forgot one validation check. The emails were well written. The offers were real. The recipients were just... not our leads. That was early. I learned fast. Every agent I build now has three layers of guardrails before it touches a database or an API. Here's exactly what those layers look like and why they're non-negotiable for production. Input Validation: Your Prompt Is Not a Schema The first mistake people make is trusting the LLM to produce valid output. It won't. Not reliably. I've seen GPT-4 return a JSON key called "emial" instead of "email" in a critical pipeline. One typo, and the whole record is garbage. The fix is a strict validation layer that runs before any data reaches your system. In my AI resume tailor, I use a JSON schema with conditional presence flags. Every field that must be real has a has_* boolean guard. If the LLM tries to fabricate a phone number, the schema rejects it. const resumeSchema = z . object ({ contact : z . object ({ email : z . string (). email (), phone : z . string (). optional (), has_phone : z . boolean () }). refine ( data => { // If phone is present, the guard must be true return data . phone ? data . has_phone : ! data . has_phone }, " Phone number present but has_phone flag is false " ) }) This pattern catches hallucinations before they corrupt your database. The schema is the contract. The LLM is just a suggestion engine. Permission Scoping: Give Agents the Minimum They Need An agent should never have write access to tables it doesn't need. That sounds obvious, but I've seen production systems where a job description rewriting agent had full CRUD access to the user table. When I built the LLM scoring pipeline for a job board platform, I created separate database roles. The scoring agent only had SELECT on the job listings table and INSERT on a scoring results table. It never touched users, applications, or configuration. Even if the prompt was hijack

Originally published on hexisteme notes . I write these engineering notes with one main model, and until recently I also reviewed them with that same model. Same family writes, same family checks its own work. That sounded fine right up until I had ten queued posts sitting in a publish backlog and a nagging thought: if the writer and the reviewer come from the same training distribution, what exactly is the review checking for? So I ran an experiment. I took the queue and had a different vendor's model audit it before anything went out — not to replace my own review, but to see what a genuinely different set of weights would flag that mine hadn't. The setup: copies only, and a self-verifying prompt The mechanics were deliberately boring. I copied the ten queued articles into a scratchpad directory and exposed only that copy to the auditor via --add-dir — the auditor never got write access to the originals, so nothing it did could touch the source of truth by accident. The audit itself ran as agy --model gemini-3.1-pro-high , pointed at the copy directory, with one instruction: find technical factual errors, broken sentences, cross-article inconsistencies, unsupported claims, and tone violations, and verify each one yourself on the web before reporting it. I wanted a model that would check its own homework, not just pattern-match on "this looks wrong." It came back with seven findings. Rule one: don't trust the auditor either Seven findings from a different vendor is not the same thing as seven confirmed bugs. I re-verified every single one independently — grepping the original text, checking official documentation, and where possible checking against a real machine — before touching anything. Of the seven, six held up and got fixed. One didn't: the auditor flagged a sentence as an error, and when I went back to the primary source, it turned out to be the auditor misreading a perfectly correct sentence, not a defect in the writing. Without the re-verification step, I

The end of the FIFA Men’s World Cup is nigh. Here’s how to watch the final games and the first ever World Cup halftime show.