AI 资讯

The Gemini exchange already paid a $5 million fine following the agency's lawsuit.

Every token your agent spends on file I/O is wasted reasoning capacity. I was building a document processing agent — the kind that reads incoming research reports, extracts key findings, and produces executive briefings. Nothing exotic. The kind of workflow thousands of teams are automating right now. The PDF I was testing with was 2MB. Dense text. A typical industry research report. When I measured the token cost of processing it inline, the number was 97,354 input tokens — just to get the text into Claude's context. At claude-sonnet-4-6 pricing, that's $0.29 per document. For a pipeline that processes 500 reports a month, you're looking at $150/month before your agent writes a single word of output. That's the problem nobody talks about in the AI agent space. Everyone optimises prompt engineering and output tokens. The silent cost is input: the files, the content, the raw data you're shoving into context before the agent can do anything useful. How the token count explodes When you pass a document to an agent inline, one of two things happens: Option A — Base64 encoding. You read the binary file, encode it, embed it in the prompt. A 2MB PDF in base64 is ~2.7MB of text. At roughly 3.5 characters per token, that's ~770,000 tokens before your agent has read a single word. This is catastrophic. Don't do this. Option B — Text extraction. You extract the raw text content first (via pdftotext , PyMuPDF, or equivalent), then pass the text to the agent. Better — but a 2MB PDF with dense content still yields ~97,000 tokens of extracted text. You've paid for every word, every header, every footnote. Either way, the document content dominates your context window, crowds out your system prompt, and you're burning money on file I/O instead of reasoning. The alternative: specialist services via MCP Model Context Protocol (MCP) is Anthropic's open standard for connecting AI agents to external tools and services. The key insight is simple: your agent doesn't need to contain the co

This is a submission for the Hermes Agent Challenge : Write About Hermes Agent I Didn't Start With Hermes Six months ago I started building a set of agent skills and personas for how I build software. Not generic prompts — opinionated role files. A /backend-architect that owns schema and recommendation logic. A /test-engineer that writes Vitest coverage and flags weak acceptance criteria. A /project-manager that maintains planning docs and closes iterations cleanly. These roles have evolved across multiple projects. They have layering rules, discovery checklists, inheritance from a base engineering discipline file. They produce consistent, reviewable work because they're scoped — the backend architect doesn't touch test files, the test engineer doesn't redesign the schema, each persona has a defined mandate and exits cleanly. When I heard about Hermes Agent, my first instinct wasn't "let me learn a new system." It was: can I run my existing system inside this? The answer is yes. That's what this article is about — what it looks like to bring a mature workflow into Hermes, what you gain, where it breaks down, and what I'd do differently. What Hermes Is (and Isn't) to Someone Who Already Has a Workflow Hermes is an LLM-agnostic orchestration layer. It has its own skill system, its own soul.md concept for persistent agent identity, built-in cron scheduling and MCP management. All of that is real and useful. But it's also a runtime. If you have skills that work, you can bring them in. I installed a local Hermes instance — few clicks, straightforward setup — and ran it inside VSCode's integrated terminal pointed at my existing persona files. No migration. No rewrite. My /backend-architect runs in Hermes the same way it runs in Claude Code. Before settling on this, I'd tried a couple of other paths — a VPS instance with a Telegram interface for ideation, and attempting to build through a browser-based terminal. The VPS was fine for sketching ideas. The browser terminal ma

🌟 Announcing the 2nd Workshop on Social Simulation with LLMs (Social Sim'26) @ COLM 📣 Welcoming Submissions! Submission here:. 🗓️ Deadline: June 23, 2026 (AoE) This year's theme is "Fidelity in Applications”, moving beyond compelling demos toward evaluation, robustness, interpretability, and empirical grounding of LLM-based simulated societies. 💬 Topics include (but aren't limited to): 🔹 Simulation evaluation & fidelity 🔹 Validation against real-world social data 🔹 LLM-based agent modeling 🔹 Persona modeling 🔹 Cultural evolution 🔹 Information diffusion in simulated populations 🔹 Human–AI hybrid simulations 🔹 Simulation interpretability 🔹 Applications: governance, platform design, societal risk analysis 🔹 Ethical, societal & policy implications of large-scale simulated societies 🤝 We invite perspectives from ML, social science, psychology, and policy — anyone building, validating, or reasoning about LLM-driven simulated societies. Hope to see you in SF! 🌉 submitted by /u/RSTZZZ [link] [留言]

GHES Key Rotation, Bug Bounty Program Refocus, AI Agent Permission Fatigue Today's Highlights This week's top security news features critical action for GitHub Enterprise Server users with a signing key rotation due to an ongoing investigation. We also cover GitHub's strategic refocusing of its bug bounty program for higher quality submissions and an interactive look at AI agent permission fatigue. Investigation update: GitHub Enterprise Server signing key rotation (GitHub Blog) Source: https://github.blog/security/investigating-unauthorized-access-to-githubs-internal-repositories/ This alert details a critical security update for GitHub Enterprise Server (GHES) customers, urging immediate action to rotate signing keys. The blog post indicates an investigation into unauthorized access to GitHub's internal repositories, which has necessitated this widespread security measure. While specific details of the breach or vulnerability are not fully disclosed, the requirement for a signing key rotation points to a potential compromise of cryptographic keys, which are fundamental to authentication and supply chain integrity. Such incidents could lead to unauthorized code signing, repository tampering, or other severe supply chain attacks, underscoring the importance of robust secrets management and incident response protocols. The advisory emphasizes a proactive stance for GHES administrators to protect their environments by following the provided guidance. This incident highlights the pervasive risk of supply chain attacks and the critical role of secure key management in enterprise environments. It reminds organizations that even trusted platforms like GitHub are targets and necessitates vigilant monitoring and swift action in response to security advisories. The prompt action from GitHub, though implying a significant security event, also showcases their commitment to transparency and securing their ecosystem by guiding customers through the necessary remediation steps to

RAG SOTA, Agent Harnessing, and Langfuse Observability for AI Frameworks Today's Highlights Today's top stories delve into optimizing RAG performance with open-source benchmarks, designing robust AI agent systems, and implementing best practices for LLM observability in production. RAG SOTA: I Tested 7 Pipelines and Built SEQUOIA (Open Source) (Dev.to Top) Source: https://dev.to/__2ddbae6bb7d/--5cec This article presents a comprehensive benchmark of seven Retrieval-Augmented Generation (RAG) pipelines, culminating in the development and open-sourcing of SEQUOIA, a new RAG system. The author details over 20 hours of compute time spent locally to rigorously test different RAG configurations against real-world tasks, providing valuable insights into their performance characteristics. The technical deep dive includes discussions on various components like chunking strategies, embedding models, vector databases, and re-rankers, along with their impact on retrieval quality and generation coherence. Readers gain an understanding of the trade-offs involved in designing effective RAG systems and the empirical evidence supporting different architectural choices. The release of SEQUOIA as an open-source project means developers can directly implement and experiment with a battle-tested RAG pipeline, offering a tangible starting point for their own projects. Comment: This is an invaluable resource for anyone building RAG. Benchmarking 7 pipelines and open-sourcing a well-performing one provides immediate practical value and a solid foundation for further experimentation. Stop Upgrading the Model. Start Engineering the Harness. (Dev.to Top) Source: https://dev.to/tacoda/stop-upgrading-the-model-start-engineering-the-harness-194 This insightful article argues that instead of solely focusing on larger or "better" base models, teams should invest in "engineering the harness" around their AI agents to improve performance. The author highlights that the supporting architecture—compri

RAG SOTA: I Tested 7 Pipelines and Built SEQUOIA (Open Source) After 20+ hours of compute time on local hardware, I benchmarked 7 RAG configurations against real-world tasks. SEQUOIA (RAPTOR tree + step-back prompting) consistently outperformed alternatives. The Full Pipeline List Method Core Approach No-RAG Direct LLM generation Classical RAG Dense retrieval (BGE-small + FAISS) Hybrid RAG BM25 + Dense + RRF + reranker LightRAG Key-value graph + dense hybrid PageIndex Two-stage hierarchical retrieval GraphRAG Entity graph + dense fallback Agentic RAG Multi-step reasoning pipeline SEQUOIA RAPTOR tree + step-back prompting SEQUOIA Pro Multi-query + rerank + compression Why LightRAG Underperformed The hype suggested graph-based RAG would revolutionize retrieval. On real banking documents and technical manuals: Graph construction is expensive (entity extraction, relationship mapping) Retrieval quality did not justify the overhead Academic benchmarks do not equal production reality Why RAPTOR Works Recursive Abstractive Processing for Tree-Organized Retrieval: Cluster leaf nodes (individual chunks) Summarize upward (hierarchical abstraction) Retrieve at multiple levels (specific details + high-level context) This mirrors how humans organize knowledge. Step-Back Prompting: Free Performance Before retrieving, generalize the query: User asks: "What's the error rate for Q3?" Step-back: "What metrics are tracked quarterly?" Retrieve broader context first, then narrow Result: ~15% improvement in recall. Zero latency cost. SEQUOIA Architecture User Query Step-back Prompting (generalize) RAPTOR Tree Retrieval (multi-level) Context Compression (summarize long contexts) Re-ranking (cross-encoder) Local LLM Generation Local LLM Evaluation I used a local model weaker than GPT-4 for judging. Key finding: relative rankings between methods stayed consistent even with a weaker evaluator. You can prototype and compare approaches without burning API credits on GPT-4 evaluations. Productio

Fine-tuning tests show "bias ... toward confidently representing the claims as true."

This is a submission for the Hermes Agent Challenge : Build With Hermes Agent What I Built Real brewing knowledge lives in human experience — in roaster guides, in community notes, in what a barista learned from last Tuesday's pour. It doesn't accumulate anywhere. Every brew is forgotten. Ask any AI and you get statistical averages: 93°C, 1:16 ratio, four minutes. Technically defensible. Practically generic. Worse still for rare origins where training data is thin. Demo For coffee drinkers Visit brew-guide-production.up.railway.app . No account. No setup. No AI client required. Pick your coffee origin, roast level, and brew method. What comes back isn't a generic recipe — it's community consensus: the grind, temperature, ratio, and brew time that real people have logged and rated for that origin, plus step-by-step technique guidance (bloom timing, pour stages, agitation style). If data is sparse for your origin, the confidence tier says so honestly and falls back to method defaults rather than making something up. This is for the person who just picked up a bag of Kenyan peaberry and wants to know how to do it justice. It works for anyone who cares about their cup — no technical knowledge required. For developers and AI clients Connect to any MCP-capable client in one line: https://brew-guide-production.up.railway.app/mcp Ask your AI: "recommend a pour over for Ethiopian light roast." What comes back is a traceable community consensus object: brew parameters, a confidence tier (high/medium/low), the source brews that contributed, and method-specific technique guidance. You can see where the knowledge came from and how certain the system is — a fundamentally different epistemic object from an AI-generated recipe. Code GitHub: yuens1002/brew-guide Five MCP tools — get_brewing_methods , recommend , log_brew , search_brews , compare_brew — over Streamable HTTP transport. Public, no auth required. My Tech Stack Layer Technology HTTP Hono 4 + @hono/node-server MCP @modelc

As AI agents move from experiments to production, AWS, Cloudflare, and others are redesigning cloud infrastructure for a future dominated by machine-generated internet traffic instead of human users.

The Care Quality Commission regulates 56,000+ healthcare and social care locations in England — care homes, GP surgeries, hospitals, dental practices, home care agencies. If you work in care sector tech, you've probably needed this data at some point. There's a CQC REST API, and I was planning to wrap it. Then I hit the auth wall. The API is now authenticated CQC migrated their API to api.service.cqc.org.uk and added bearer token authentication. You need to register at their developer portal, create an application, and include an Authorization: Bearer <token> header on every request. That's not a dealbreaker for enterprise use cases, but it creates friction for a data product — it means requiring users to register with CQC before they can run your actor. I checked the old API base ( api.cqc.org.uk/public/v1 ) as a fallback. HTTP 403. Fully blocked. The open-data file rescue CQC publishes a monthly open-data file called HSCA_Active_Locations.ods . It's a 23 MB OpenDocument Spreadsheet with every active regulated location in England — all 56,000 of them. Free, no auth, Open Government Licence. The URL is date-stamped and changes each month, but the transparency page always links to the current version. The approach: scrape the transparency page to find the current ODS URL, download the file, parse it, filter rows, push results. No API. No auth wall. The ODS parsing challenge ODS files ( .ods ) are ZIP archives containing XML. The standard tool for parsing them in Node.js is SheetJS ( xlsx package, v0.18.5 — the last Apache 2.0 release). The first surprise: the workbook has three sheets — README , HSCA_Active_Locations , and Dual_Registration_Locations . SheetJS defaults to the first sheet, which is the README with 34 rows. I added logic to find the sheet with the most rows. for ( const name of workbook . SheetNames ) { const probe = XLSX . utils . sheet_to_json ( sheet , { header : 1 }); if ( probe . length > bestCount ) { bestCount = probe . length ; bestSheet = shee

When most people think about UK data sources to scrape, they go straight to Companies House. And they should — it's an excellent dataset. But there's a more valuable register that compliance teams, fintech sales teams, and KYC workflows desperately need, and it has zero scrapers on the Apify marketplace: the FCA Financial Services Register. The Financial Conduct Authority maintains a live register of every firm authorised to provide financial services in the UK — ~50,000 firms ranging from Barclays Bank to a one-person IFA. It includes their regulated permissions (what they're actually allowed to do), their principal address, trading names, and enforcement history. It's the data source used to verify "is this firm actually regulated?" — a check every fintech, insurance company, and compliance team runs regularly. The opportunity The FCA register has a free official REST API at register.fca.org.uk/Developer . No paid tier, no scraping needed — just register an account, get a key, and start making authenticated requests. Despite this, there was literally no Apify actor for it. The US equivalent — FINRA BrokerCheck — already has two actors with thousands of users. The UK gap was sitting there, unoccupied. The architecture This is one of the simplest actor architectures I've built — no Playwright, no Cheerio, no browser automation. Pure HTTP requests with fetch . The FCA API has a few key endpoints: GET /V0.1/Search?q={query}&type=firm — search for firms by name or keyword, returns FRNs GET /V0.1/Firm/{FRN} — fetch base details for a specific firm GET /V0.1/Firm/{FRN}/Address — registered address + phone + website GET /V0.1/Firm/{FRN}/Names — trading names and historical names GET /V0.1/Firm/{FRN}/Permissions — the full list of FCA-regulated activities All endpoints require X-Auth-Email and X-Auth-Key headers. The rate limit is ~100 requests per 60 seconds, which works out to about 25 fully-enriched firms per minute at 4 API calls each. async function fcaFetch < T > ( p

When a team hits a ceiling with their coding agent, the first instinct is to reach for a better model. The reasoning feels obvious: the model is the part that produces the code, the code is the part that is wrong, therefore a smarter model will produce more correct code. Wait for the next release. Switch providers. Bump the tier. This is sometimes right. It is much more often wrong, and the cost of being wrong about it is that you spend months waiting for a model upgrade to solve a problem the model was never the cause of. The harness is the cause of the problem more often than the model. Most teams discover this only after they have exhausted the model-upgrade reflex and finally turn to look at everything else. What a model upgrade actually buys you Newer, stronger models do tangibly improve some things. They handle longer contexts more reliably. They make fewer simple reasoning errors on complex tasks. They follow nuanced instructions more closely. On a fixed prompt, with a fixed task, a better model produces a better answer. What model upgrades do not change: The fact that the agent has no idea your team prefers functional components over class components, because the convention is not in any file the agent reads. The fact that your tests do not actually fail when the code is wrong, so the agent can ship broken code that passes CI. The fact that your codebase has three different ways of handling errors and the agent picks one at random on each PR. The fact that the rule the senior engineer keeps repeating in reviews is not encoded anywhere the next session can see. None of these are fixed by a smarter model. They are fixed by a better harness. A smarter model loaded into the same broken harness will produce slightly more sophisticated versions of the same problems. The diagnostic The diagnostic is one question: when the agent fails, does it fail because it lacked information, or because it lacked capability? A capability failure looks like: the task required reas

Recently, I was working on creating a website on a cloud-based IDE (CodeHS). One night, I was editing, and then when I was done, I simply turned off my monitor and disabled my mouse and keyboard. Then, the next day at school, I continued to work on the website, and made significant changes. When I got home, I made more significant changes, but then realized something very important. What I realized is that when I continued to work on the project at home, the cloud-based IDE hadn't refreshed to the new code, and overwrote the work I did at school when I saved my new work. So, what is the purpose of me telling you this? Is it to say that you should always close your code editor when you're done working, or some other trick to prevent this from happening? No, it definitely is not. After the initial panic, I realized that the cloud-based IDE had a history section, which has a detailed log of every change that happened to every file. I then looked back at my old copy, copied the changes, and put them back into my new code. Now, imagine you aren't using a cloud-based IDE, and your just editing a file on your computer, in an IDE, or simply your terminal. To clarify, Git is not cloud-based, it is local, (sitting on your computer), that connects to the cloud (GitHub). What happens when something breaks? For some environments, this could be catastrophic, and make you loose a lot of work. When you make an update to a file, the last state and all the states before it are gone. But, this isn't the only thing that can happen. When you use a version control system (VCS), like Git, you can always go back to your previous commits, (snapshots of your code). The work I almost lost wasn't very important; that work didn't effect anyone, except myself. Imagine what would happen if I was working on something more important, or even just working on something for a job. Before learning how to manage your project, it helps to understand what Git actually is. Git is overwhelmingly the most po

How vibecoding is destroying the open source that feeds it March 3, 2026 The snake eating its own tail A year ago, vibecoding was a curiosity. Today, it’s an industry. Millions of developers — or rather prompters — generate entire applications by describing what they want to an LLM. In minutes, an API, a frontend, a deployment. Magical. But behind this magic lies a dirty secret that nobody wants to face: every line of code generated by these AIs was trained on millions of open source projects — projects that are now dying. Vibecoding would be nothing without open source. And it’s killing it. What exactly is vibecoding? For those who spent 2025 in a cave: vibecoding is the practice of creating software in natural language, relying on generative AI models (Claude, GPT-5, Gemini, and the dozens of specialized models that have emerged since). You describe a vibe , an intention, and the AI produces the code. No debugging. No reading documentation. No Stack Overflow. And above all — here’s the crux — no contributing back . The implicit pact of open source is broken The open source ecosystem has always rested on a tacit social contract: I publish my code for free. In return, others use it, find bugs, suggest improvements, contribute. The project lives because a community keeps it alive. This contract had already been severely tested by large corporations that consume open source without contributing proportionally. But at least the developers who used these libraries understood them. They opened issues. They forked. They sent pull requests. They wrote blog posts that spread the word about the project. Vibecoding has blown up this cycle. The vibecoder doesn’t know which library they’re using. They don’t know, and they don’t care. They asked “build me a payment API with webhook handling,” and the AI chose this or that dependency for them. They will never read that project’s README. They will never open an issue. They won’t even know that project exists . The chilling numbers

I was dealing with another "output not usable" issue today in our app, user left a comment saying that no matter what he does the agent returns the result in the wrong format. It took me hours to identify the mistake and AI model missed it. Curious to hear your stories about the times you shipped a feature in your AI product and it flopped. How did you figure out what was actually going wrong? What tools if any did you use? What metrics were key? submitted by /u/pauliusuza [link] [留言]

#1 Agentic AI sales leads &outreach platform for MENA Region Discussion | Link

Built an open JSON Schema for defining AI agent teams. Multi-agent systems are becoming a real deployment pattern — not single assistants, but teams with roles, handoffs, and human checkpoints. But there's no shared way to define one that travels across frameworks. Every implementation is scattered, locked to whichever tool you picked first. Built the schema to fix that. The schema lives at schema.openenvelope.org and is registered in SchemaStore, so if you drop a .envelope.json file in VS Code

Undisclosed addition in jqwik instructed AI coding agents to delete app output.