标签：#ai

Microsoft on Tuesday took the wraps off Adaptive Spec-driven Scoring for Evaluation and Regression Testing, an open source framework for spinning up AI evaluations.

The AI agent security community has been converging on a problem. A researcher recently ran an experiment — feeding a memory-retrieval framework 10 scenarios involving certificate operations: signing, issuing, revoking, delegating. The system retrieved the right memory 8 out of 10 times. It matched the external authorization gate 7 out of 10. The conclusion: metadata per item isn't enough. You need a separate authorization gate over the proposed operation. That conclusion is correct. But I want to show what that gate actually looks like when you build it — because the primitive already exists, and it's older than LLMs. The problem is authorization, not retrieval Most agent frameworks today invest in memory and observability. The agent can recall what it did before. You can see what tools it called. Logs, traces, dashboards. What they don't have is a cryptographically enforced answer to the question: was this agent authorized to do this, before it did it? Those are different problems. Retrieval tells you what the agent remembers about its permissions. Authorization tells you what it was actually granted — signed, tamper-proof, at dispatch time. An agent that retrieves "I have revocation permissions" from memory and then revokes a certificate it shouldn't touch is not an authorization failure at the retrieval layer. It's an authorization failure at the gate layer — because there was no gate. Certificates are that gate A certificate is a signed declaration of what an entity is authorized to do. Issued once, verifiable offline in ~1ms, revocable instantly. We've used them for TLS, for IoT devices, for code signing. The same primitive works for agents. The model is simple: Orchestrator issues a certificate at dispatch time The certificate carries the agent's identity and its exact scope in meta Every tool call goes through a gate that verifies the certificate offline On completion — or abort, or timeout — the orchestrator revokes it // Orchestrator — dispatch const { cer

Google launched Universal Cart at I/O 2026 last week. An intelligent cart that follows users across Search, Gemini, YouTube, and Gmail. ALM Corp published the list of named early checkout merchants on May 20: Nike, Sephora, Target, Ulta Beauty, Walmart, Wayfair, and Shopify brands. I read that list twice looking for a Magento store. None. That's the article. Below: the five-protocol stack you'd otherwise have to read five different specs to understand, the one decision your existing payment processor has already made for you, and a thirty-day Magento-specific playbook to ship before agent-routed traffic starts flowing past your store. If your store runs on Magento or Adobe Commerce, agent-routed traffic is going to flow past you - first in the US, then Canada and Australia "in the coming months," then the UK. The agent layer isn't going to wait for Adobe Commerce to ship native UCP support. The merchants in the first cohort had thirty days of head-start. Most of that window is already gone. Here's what to ship before the rest of it closes. The five-protocol stack, compressed Four protocols define how an AI agent buys something on behalf of a user. A fifth ties payments together. UCP - the discovery layer. Your store publishes a manifest at /.well-known/ucp declaring its capabilities, transports, and payment handlers. MCP - the transport layer. Agents dispatch your commerce tool calls over MCP messages. ACP - OpenAI and Stripe's checkout protocol. Stripe-led coalition. AP2 - Google's payment-authorization protocol. Sixty-plus partners signed at launch: Adyen, American Express, Mastercard, PayPal, Coinbase, Revolut, Worldpay, and more. MPP - Stripe's machine-payments protocol. Same family as ACP. Benji Fisher's synthesis post on dev.to is the sharpest framing I've read: UCP discovers, MCP transports, ACP and AP2 authorize. Read it if you haven't. The UCP spec itself is densifying fast. A loyalty extension landed on May 19 ( #340 ). A schema-validated documentation har

I just joined DEV to explore the community and get into the habit of writing about what I'm learning. I also set up a blog on Hashnode — figuring out how the two fit together. Here's a quick code block to test formatting: ​ function greet ( name ) { console . log ( `Hello, ${ name } !` ); } greet ( " DEV " ); ​ ``` More to come as I find my way around 👋

Since the early days of GenAI, when ChatGPT launched in late 2022, we began using prompt engineering to direct chatbots (and later LLMs) with human language instructions to provide us answers to questions or take actions (in a high-level…) In 2025, companies such as OpenAI and Anthropic began releasing a new agentic concept called “AI Agent”, an autonomous system that uses an AI model as its "brain" to perceive an environment, make independent decisions, and execute multi-step tasks using digital tools. Unlike passive chatbots that just answer questions, an agent can plan its own workflow, run commands, and browse the web to achieve a specific goal without constant human supervision. In this blog post, I will explain the concept of Context-as-Code and share some coding examples. Introducing Context-as-Code Traditional prompting is a one-way street. You type out your instructions, send them off, and that text never changes. AI agents operate completely differently. Because they work on their own, every action they take creates a mountain of new data. Every time an agent opens a file, checks an error, or runs a tool, it adds more information to the pile, which quickly overwhelms a standard chat screen. Context-as-Code treats the agent like a stateless compute engine. Instead of a massive text prompt, we use version-controlled files ( CLAUDE.md , AGENTS.md ) to establish structural boundaries, separating the permanent project rules from the temporary, dynamic session memory. Context-as-Code transforms loose AI prompts into version-controlled engineering assets by using structured Markdown files to establish permanent, auditable boundaries directly within a project repository. The Discovery Stage (Onboarding the Agent) Before an agent writes a single line of code, it must parse the overall project layout. These files act as the "map" for an incoming AI. llms.txt Serves as a lightweight text directory mapped out in Markdown format. Placed at the root of a project or webs

I Built My First Token on Solana — Here's What Actually Surprised Me This week I went from zero tokens to minting, transferring, charging fees, and locking tokens so they can never move. Here's what stuck with me. Tokens don't live in your wallet Coming from Web2, I assumed tokens would just... show up in your account. Nope. On Solana, every wallet needs a separate token account for each token it holds. One mint, one folder. It felt weird at first. Now it makes sense. You can charge fees without writing a single backend The Token Extensions Program has a built-in transfer fee. One flag at mint creation time: spl-token create-token \ --program-id TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb \ --transfer-fee-basis-points 100 That's a 1% fee on every transfer, enforced by the blockchain. No middleware. No payment processor. No way to bypass it. You can make a token that literally cannot be transferred spl-token create-token \ --program-id TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb \ --enable-non-transferable I minted 10, tried to send 5, and watched the transaction get rejected. Not by my code — by the program itself. Perfect for credentials, badges, or certificates that should belong to one person forever. The biggest shift from Web2: these rules are set at creation and are permanent. You can't add a transfer fee to an existing token. You can't make a transferable token non-transferable later. It forces you to think about token design upfront, which is honestly a good constraint. solana #blockchain #webdev #beginners #100DaysOfSolana

President Donald Trump signed an executive order Tuesday creating a "voluntary framework" for AI companies to share their frontier models with the federal government before they're released "to promote secure innovation and strengthen the cybersecurity of critical infrastructure." The order says the US AI industry has succeeded in part "because we refuse to stifle this […]

A new reading subscription from Everand offers access to both ebooks and audiobooks, and Fable's book club community.

International Mathematical Union endorses warning about tech industry influence.

The caveat is that one of the world's most famous living directors is using the tech solely for storyboarding.

Microsoft announced a bunch of new in-house AI models at Build 2026, including a new "flagship" model: MAI-Thinking-1. It's an ambitious step into model development for Microsoft, which introduced its initial in-house models last year - before then, it had relied on OpenAI's models. The two companies recently renegotiated their deal to loosen ties. According […]

Launched at Build, Microsoft Scout is a new AI assistant meant to bring the power and flexibility of OpenClaw into the Microsoft 365 system.

Google's June Android feature drop includes more scam detection, more AirDrop, and yes, more AI.

The specification lets developer, compliance, and security teams define their own policies for agents to follow in portable policy files.

As people increasingly refuse to answer calls from unknown numbers, scammers are shifting their tactics by spoofing trusted phone numbers and using AI deepfake technology to sound like authority figures, family members, or employers.

Layup Parts co-founder Zack Eakin has drawn on a motorsports background, and his experience working for Palmer Luckey and Elon Musk, to tackle making faster, cheaper, and better composites.

Google is launching a new feature for its Phone app that aims to protect you from AI impersonation scams. Now, when you receive a call from a scammer that appears to be coming from the same number as one of your contacts, Phone by Google will flag the call as suspicious so you can hang […]

Much like Google, Microsoft is launching its own version of OpenClaw. Microsoft Scout is an always-on assistant that integrates into Microsoft 365 apps like Outlook, OneDrive, and Microsoft Teams, allowing businesses to assign a virtual assistant to employees to help with organizing calendars, expense reporting, email drafts, and much more. Unlike Copilot that lives inside […]

"We do not know when it will be safe to go outside. We only know that day is not this day."

A glass screen protector is one of a few essential accessories that I strongly recommend to every Switch 2 owner. In fact, it should be a priority to stick one onto the console’s screen as soon as possible to avoid accidental scratches. To test the candidates below, I installed and removed Switch 2 screen protectors […]