标签：#AI

Several users on social media reported having their Instagram accounts hacked over the weekend. Meta's own support chatbot was blamed for allowing hackers to hijack accounts.

Last week I wrote about why healthcare benefit data is still trapped in PDFs . The response told me something: people in this space know the problem is real. But extraction is only half the story. The harder question is: when an AI system pulls a copay amount from a carrier document, can you prove where that number came from? Not "the AI said so." Not a confidence score with no backing. Can you point to a specific page, a specific table cell, a specific paragraph in the source PDF and say: this value came from here? That is field-level provenance. And in healthcare, it is no longer optional. The Regulatory Floor Just Rose In January 2026, two state laws went into effect that changed the baseline for AI-generated content in healthcare. California SB 942 requires AI systems to disclose when content is AI-generated and to maintain audit trails. Texas HB 149 mandates transparency about AI decision-making processes in regulated industries, with healthcare squarely in scope. These are not theoretical. They are enforceable. And they are just the beginning. CMS transparency mandates tighten every year. Gartner declared digital provenance an enterprise baseline for 2026. The industry is not moving toward provenance. It has arrived. The Problem with Self-Reported Citations Most AI extraction systems today work like this: a language model reads a document, extracts values, and reports where it found them. The model does the extraction AND the citation. It is grading its own homework. This seems fine until you look closer. A language model that hallucinates a copay amount will also hallucinate the page number it came from. The citation and the extraction fail together, silently, in the same direction. In a coverage dispute that ends up in a regulatory proceeding, "the AI told us it found this on page 3" is not evidence. It is hearsay from a statistical model. What Deposition-Grade Provenance Looks Like Field-level provenance means every extracted value carries metadata from an

The company says it needs "significant" water resources to cool its data centers, and that access to abundant, affordable water is a challenge.

After using Claude Code, Codex, and Pi Agent for months, I wondered: how many AI agents are on my machine? I built a scanner. Here's what it found: Framework Active Archived Claude Code 192 191 Codex CLI 37 0 Pi Agent 8 sub-agents 12 scripts MCP Servers 8 - Total 448+ The Waste Duplicate calls : Same prompt → 3 agents (8-18% waste) Overqualified models : Simple tasks on expensive models (15-25% waste) Cache fragmentation : No shared prompt cache (12-20% waste) Zombie agents : Archived still indexed (2-8% waste) → 30-50% of AI API spend is wasted. The Fix AMA — Agent Management Agent bash pip install ama-core && ama scan && ama start Scans all agents across frameworks Smart routing (simple task → cheap model) Lifecycle management Local dashboard at localhost:8765 Free calculator: ama-agent-store.vercel.app/calculator MIT licensed. Feedback welcome!

From CFD and FEA to digital twins, carmaking now involves a lot of virtualization.

Lawsuit seeks $12,000 from startup that allegedly damaged home in robot tests.

Our approach to AI policy and political advocacy, transparency, support for thoughtful regulation and AI safety, and that no outside political group speaks on the company’s behalf.

Anthropic introduced Dynamic Workflows, a new capability for Claude Code designed to handle complex software engineering tasks by coordinating large numbers of AI agents within a single workflow. The feature allows Claude to dynamically create orchestration scripts, break work into subtasks, run them in parallel, and validate results before presenting a final answer. By Robert Krzaczyński

New article: “ Responsible Disclosure in the Age of AI: A Call for Urgent Action ,” by Melissa Hathaway. Abstract: Artificial intelligence is fundamentally reshaping the balance between vulnerability discovery and remediation. Frontier AI models are now capable of autonomously identifying exploitable software vulnerabilities at unprecedented speed and scale. This development exposes decades of accumulated technical debt created by a software industry that prioritized rapid deployment over secure-by-design engineering practices. Drawing on the evolution of software assurance, vulnerability disclosure frameworks, and U.S. cyber policy, this perspective argues that the current moment represents a strategic inflection point for governments, industry, and critical infrastructure operators. The author examines the growing tension between offensive and defensive equities in cyberspace, the emergence of AI-enabled vulnerability discovery capabilities in both the U.S. and China, and the increasing risks posed by unsupported legacy systems and AI-assisted code generation practices. Responsible disclosure can no longer remain a reactive or fragmented process, but must become a coordinated national and international resilience effort involving governments, software vendors, infrastructure operators, and emergency response organizations. The article concludes with an urgent call for accelerated remediation, large-scale patch management coordination, and sustained investment in automated vulnerability repair capabilities before adversaries exploit this rapidly narrowing window of opportunity...

After months of speculation about whether OpenAI or Anthropic would be first in their race to IPO, Anthropic on Monday reached a key milestone: filing to kick off the process with the U.S. Securities and Exchange Commission. The filing sets the stage for what's sure to be a massive IPO. As of its fundraise last […]

The company said Monday it has filed confidentially for an IPO.

Florida's lawsuit against OpenAI comes after a mass shooter at FSU reportedly consulted ChatGPT to plan the attack.

The company behind Claude says it confidentially submitted a draft version of its S-1 form.

Windborne Systems' newest weather forecasting model beats the best government predictions by days.

Scroll through social media today, and you'll likely come across AI-generated images everywhere. From anime-style portraits and fantasy landscapes to hyper-realistic photographs of places that don't even exist, AI image generators have quickly become one of the most fascinating applications of artificial intelligence. What makes this technology so impressive is its accessibility. A few years ago, creating professional-quality artwork required design skills, expensive software, and hours of effort. Today, anyone can generate stunning visuals simply by typing a few words. But what actually happens behind the scenes when you enter a prompt and click "Generate"? Turning Ideas into Images At a basic level, AI image generators convert text into visuals. When a user enters a prompt such as: "A futuristic Mumbai skyline at sunset with flying cars" the AI doesn't search for an existing image online. Instead, it creates a completely new image based on patterns it learned during training. These models are trained using millions of image-text pairs, allowing them to understand concepts such as objects, colors, lighting, artistic styles, and even relationships between different elements within a scene. As a result, the AI can interpret the user's description and transform it into a visual representation. Starting with Random Noise One of the most interesting aspects of modern AI image generation is that the process usually begins with random noise. Imagine the static pattern seen on an old television screen. Initially, the AI starts with something similarly meaningless. It then gradually removes the noise while adding details that match the prompt. This process is known as a diffusion model , and it is the foundation of many modern AI image generators. To understand the idea, consider the following simple Python example: import random prompt = " A futuristic Mumbai skyline at sunset " noise_level = random . randint ( 1 , 100 ) print ( f " Prompt: { prompt } " ) print ( f " Start

--- title : " Introducing rails-tenantify: Row-Level Multi-Tenancy for Rails 7+" published : true description : " A modern, safe, and robust row-level multi-tenancy gem for Ruby on Rails. Prevent data leaks, protect bulk writes, and preserve tenant context in background jobs." tags : rails, ruby, opensource, saas --- ## The Problem Every multi-tenant SaaS app eventually needs to answer the same questions: * How do we make sure School A never sees School B's data? * How do we scope every query to the right organization? * How do we keep tenant context alive in background jobs and Sidekiq retries? * How do we stop a careless `update_all` from wiping another tenant's rows? The typical answer is *"use acts_as_tenant"* or *"switch to Apartment."* But in modern Rails development, that often means: * Fighting unmaintained APIs on Rails 7+ * Losing tenant context when a background job retries * Dealing with schema-per-tenant complexity (Apartment) and heavy DevOps overhead * Rolling your own `default_scope` and crossing your fingers that nobody calls `unscoped` For most Rails apps, you just need **row-level tenancy** : one database, one `organization_id` column, and strict scoping. The pattern is simple. Getting it **safe** in production is not. --- ## What I Built **`rails-tenantify`** is a Ruby gem that adds row-level multi-tenancy directly to your Rails models and controllers. No external services, no extra databases per tenant—just your own PostgreSQL (or SQLite in dev). ruby class Project < ApplicationRecord include Tenantify::Scoped belongs_to_tenant :organization end ### Set the tenant once per request ruby class ApplicationController < ActionController::Base set_tenant_by :subdomain # acme.yourapp.com → Organization end ### Everything scopes automatically ruby Tenantify.current_tenant = current_organization Project.all # Only this org's projects Project.create!(name: "Q2 Roadmap") # organization_id is set automatically ### Switch context safely for admins or scripts

Large language models (LLMs) understand and generate text from prompts. OpenAI exposes models through the Responses API . The official openai npm package is the practical way to call it from Node.js. This post covers common patterns beyond a single prompt string. Prerequisites OpenAI account Generated API key Enabled billing Node.js version 26 openai package installed ( npm i openai ) For Markdown output: marked , dompurify , and jsdom ( npm i marked dompurify jsdom ) Client setup Create a client with your API key (read from the environment in production). import OpenAI from ' openai ' ; const client = new OpenAI ({ apiKey : process . env . OPENAI_API_KEY }); The same SDK can target other hosts that implement a compatible API by setting baseURL and apiKey : const client = new OpenAI ({ apiKey : process . env . LLM_API_KEY , baseURL : ' https://your-gateway.example/v1 ' , }); Azure OpenAI uses AzureOpenAI instead. Many third-party gateways support Chat Completions only; the examples below use client.responses.* , so confirm your provider supports the Responses API (especially for tools like web search). Basic integration Pass a string as input and read output_text from the response. const response = await client . responses . create ({ model : ' gpt-5.5 ' , input : ' Write a one-sentence bedtime story about a unicorn. ' , }); console . log ( response . output_text ); System prompt Use top-level instructions for stable behavior (tone, format, role). They take precedence over casual wording in the user message. const response = await client . responses . create ({ model : ' gpt-5.5 ' , instructions : ' Reply in one short sentence. Use plain language. ' , input : ' Explain what an LLM is. ' , }); console . log ( response . output_text ); Few-shot prompting Pass prior turns as an input array with user and assistant roles, then the new user message. Keep task rules in instructions . const response = await client . responses . create ({ model : ' gpt-5.5 ' , instructions :

Device Code Flow abuse is not a new technique. Security teams have known for some time that this OAuth feature can be leveraged in phishing attacks to obtain tokens without stealing credentials. What is new is how accessible and scalable this attack has become. In April 2026, the FBI warned about a Phishing-as-a-Service (PhaaS) platform called Kali365, which operationalizes this exact technique. It allows even low-skilled attackers to run campaigns that trick users into entering device codes on legitimate Microsoft login pages — ultimately granting attackers OAuth tokens and acess to Microsoft 365 environments without triggering traditional authentication defenses. How Device Code Flow Works Device code flow is an authentication method designed for scenarios where a device has limited input options or lacks a convenient browser interface (such as smart TVs, IoT devices, or command-line tools). Instead of entering credentials directly on the device, the application generates a verification code and displays it. The user then switches to a secondary device (such as a laptop or smartphone), navigates to https://microsoft.com/devicelogin , and enters the provided code. After successfully authenticating, the identity provider securely links the session and grants the original device access to the requested resource. Why Device Code Flow Should Be Restricted In practice, many organizations don’t have a real or current business need for device code flow, yet leave it enabled—unnecessarily expanding their attack surface. Disabling it helps reduce exposure by removing a legacy or rarely used authentication path and reinforces modern controls. Microsoft recommends getting as close as possible to a full block. Start by auditing existing usage, validate whether any legitimate scenarios still require it, and strictly limit access only to well-defined, secured, and documented use cases (e.g., specific legacy tools). In all other cases, device code flow should be disabled by defau

You know the moment. You push the branch, open the PR, and immediately see it — the undefined return on the refund path, the token logged to the console, the TODO that was supposed to be temporary six weeks ago. The reviewer catches it four hours later and you reply "good catch, fixing now" as if someone else wrote that line. The first reviewer on most pull requests should have been the author. Half the comments you will receive — the missing null check, the untested error branch, the duplicate logic that could be extracted, the import that now goes nowhere — are things you would have caught with one more careful read-through. You skip that read because you have been in the code for two days and your brain completes the sentences for you. You see what you meant to write, not what is on the page. This post is about closing that gap with a structured AI-assisted self-review before the PR opens. Not to skip the human reviewer — to walk into the review with the obvious problems already gone, the test gaps already filled, and the PR description already written. So the reviewer's attention can land on what actually needs a second pair of eyes. The tool is branchdiff : a local browser app that runs your diff on localhost , stores everything in ~/.branchdiff/ , and keeps the AI surface controlled through an explicit branchdiff agent command API. Nothing leaves your machine until you decide to push it. Why "before the PR" is the right moment If you review after opening the PR, every AI fix becomes noise: a force-push, a re-read for your reviewer, another commit in the audit trail. If a teammate is already mid-review when you discover the bug, you look careless. The patch that should have been in the original push becomes a distraction for everyone downstream. If you review before opening the PR, the AI's output is a private workspace. You act on what matters, commit the fixes into your own history (often as fixup! commits you squash before pushing), and the PR that goes up i

Get ready for some gaming news. It’s officially June, which means splashy new events from PlayStation, Xbox, and gaming hype man Geoff Keighley. But this season doesn’t just feature the big tentpole shows; there will be a bunch of smaller events, too, and they might feature some promising games as well. But this year’s events […]