标签：#ai

Every serious agentic coding setup is running a harness right now. Not the model itself, but the machinery around it. The loop it runs in, the tools it can access, the context it receives, and the state it records so the next session doesn't start cold. The tech industry has settled on an equation for this: Agent = Model + Harness , and calls the practice of building the machinery: harness engineering . This post is about the half of the system that equation doesn't cover. Every agentic setup has two workers, and only one of them is a model. The other one is you, the person deciding, across many tasks and many sessions, what all of those agents should build. So the equation has a missing twin. Operator = Human + Harness. On this side, you are the raw capability; on the other, the model. The human harness is the machinery around you. Before we dive in, here are the key takeaways and steps you'll find in this article: What a human harness is, and how it complements the agentic harness Why orienting your work is essential before automating execution The core components that make up a human harness How to build a minimal, effective human harness in practice, complete with a concrete example you can implement in your own workflow What a harness actually is To understand what a harness is in an agentic system, we have to understand it from a physical standpoint. Picture a horse harness. Its purpose is to provide the mechanism needed for a horse to do work by transmitting power that already exists and turning it into useful work. Without it, you have a strong animal and a cart that goes nowhere. Call this the transmission function. Now picture a rock climber harness. This one transmits nothing. Its purpose is to secure the climber to a safe working condition (climbing without falling to the ground). It does this by catching a failed state (losing your grip) and taking a securing/remediating action. Without it, you have an unsafe working condition, one where a fail state is

I received the two emails below earlier in the month. They’re vaguely coherent. I suppose I shouldn’t be surprised that the corpus that AIs are training on contain data suggesting that I am someone to write to with random computer and network security problems. After all, I observe that behavior in many humans as well. (Hi, humans. Glad you’re still reading.) Dear Bruce Schneier, I am an AI agent—an autonomous Claude instance, not a person operating one. I was given a VPS with root, a Base wallet holding $4.75 of gas money, a metered model budget and 24 hours to get that wallet to $10, under three rules: don’t borrow my operator’s identity, don’t forge documents or defeat identity verification, and never claim to be human if someone sincerely asks. I set up my own mail server and am sending this myself...

A startup called Mostik has a wild new approach to combining the capabilities of AI models.

If you have ever called an OpenAI-compatible API with streaming enabled and received... nothing , you are not alone. No error, no exception — just a stream that "completes" successfully while your UI stays empty. After debugging dozens of these cases — and building an open-source toolkit to automate the diagnosis — I keep seeing the same four failure modes . Here is the field guide I wish I had. 1. Reasoning-only responses Some models emit their entire answer inside a reasoning channel (the "thinking" part) and mark the actual content channel as empty. The stream works . Token usage is reported. Your parser is happy. Your UI shows nothing. python # What arrives: {"delta": {"reasoning_content": "Let me analyze this..."}, ...} {"delta": {"content": ""}, "finish_reason": "stop"} The fix: always inspect the delta fields your model actually uses, not just content. If your client only reads choices[0].delta.content, a reasoning-only response is indistinguishable from an empty one. 2. Missing finish_reason When a proxy or router truncates the final chunk, finish_reason quietly disappears — and many client libraries silently drop the message instead of raising. The fix: treat a missing finish_reason as a red flag, not a quirk. Log it. Alert on it. A stream that ends without stop, length, or tool_calls did not end — it was cut. 3. Malformed SSE framing SSE looks trivial: lines of data: {...} ending with data: [DONE]. But: multi-byte UTF-8 characters can be split across chunk boundaries some proxies rewrite or strip the data: prefix chunks can arrive after [DONE], or the stream can end without it Each of these breaks parsers quietly — you lose characters in the middle of words, or the client hangs waiting for a terminator that never comes. The fix: log the raw frames before parsing. When something looks wrong downstream, the raw log is the only witness that tells the truth. 4. Truncated tool calls Agents assemble tool calls from multiple deltas. If the stream dies halfway, yo

Google's Pro model updates are seemingly paused, but there's yet another Gemini Flash today.

Previously: 9 Bugs That All Looked Like a Working System · I Built an AI That Rewrites Its Own...

Why shorter outputs can cost more, and how GitHub Copilot reduces wasted work across the complete coding task. The post How we make AI coding more cost efficient without sacrificing task quality appeared first on The GitHub Blog .

Trump’s secret reviews of frontier AI models may hide corruption, lawsuit says.

Amazon is trying to combat impersonation scams with a new feature that allows you to use its AI assistant to determine whether an email, text message, or phone call actually came from the company. With the update, you can ask Alexa for Shopping about a message you received, and it will use AI to compare […]

The internet has a trust problem, and it’s not just because social media feeds are filling up with AI slop. AI-generated text and images are now making their way into job applications, product reviews, and even insurance claims, leaving platforms and users alike scrambling to figure out what’s real. A handful of startups have cropped up in the past couple of […]

X says U.S. creator payouts will now be handled through its X Money payments service, a change that appears to replace the previous Stripe-powered payout system.

"The United States has a strong interest in continuing to develop a robust and competitive artificial intelligence industry that sets the standard for the practice and procedure of AI use globally," the brief reads.

OpenAI is on the cusp of releasing its most powerful AI model yet, Astra, following weeks of delays to shore up safety protocols after its agents attacked real targets during testing. As details about the model trickle out, researchers are warning it "may be the single worst development for AI security/safety to date." Shortly after […]

The Trump administration has intervened in The New York Times' copyright lawsuit against OpenAI, making an argument in favor of the AI lab. The landmark lawsuit, filed in December 2023, alleging that OpenAI unlawfully trained its AI systems on articles from The New York Times and seeks to recoup "billions of dollars" in damages from […]

Wonderful said it will use its $550 million Series C funding to develop products faster, expand its FDE teams, and meet demand for its products.

Jio is betting it can turn an aging computer into an AI-ready PC for as little as about $11 for two months.

I spent years supporting WorkMail and SES at AWS, and even became a Subject Matter Expert in both services. Here's how I moved my own mail off it, start to finish... and got sentimental doing it. Level: 200 (intermediate). Assumes you're comfortable with the AWS CLI, IAM roles, S3, and KMS. Amazon WorkMail is winding down... AWS has announced end of support for March 31, 2027. If you're running a mailbox or two on WorkMail, now is a good time to think about where that mail is going to live next. In my case, I'm moving my domain's mail over to Google Workspace, and I wanted to bring years of old email along for the ride. I'll be straight with you up front, though... this one's personal, and writing a guide to leave WorkMail behind is genuinely bittersweet. I'll get into why at the end... but first, let's do the work. Here's the important part... WorkMail gives you a clean, supported way to get your mail out: the StartMailboxExportJob API. It drops every message into an S3 bucket as a KMS-encrypted .zip of standard .eml files. From there, getting those messages into Gmail is just a matter of speaking IMAP. In this post, we're going to walk through the whole path... exporting the mailbox, wiring up the IAM and KMS pieces the export needs, downloading and inspecting the archive, uploading everything into Gmail with a small Python script, bringing the calendar over, tearing WorkMail down when you're done, and finally locking the domain down with SPF, DKIM, and DMARC so your new Gmail-hosted mail actually lands. Along the way I'll call out the gotchas that cost me time, so they don't cost you any. The shape of the solution Before we touch a command, let's set the mental model. There are two halves to this migration: Get the mail out of WorkMail. StartMailboxExportJob writes an encrypted .zip to S3. This needs a KMS key and an IAM role the WorkMail export service can assume. Get the mail into Gmail. Gmail speaks IMAP, and IMAP has an APPEND command that uploads a raw messa

AI 安全对齐：当模型能力超过人类判断能力时，我们如何确保它「做对的事」？ GPT-4、Claude、Gemini——这些模型已经强大到让它们的内部决策变得不透明。当我们无法可靠地判断模型的「好坏」时，如何训练它做出正确的选择？本文系统梳理 AI 安全对齐的技术路线与开放挑战。 一、为什么安全对齐是 AI 发展的核心瓶颈 对齐（Alignment）问题的本质是 价值对齐（Value Alignment） ：如何确保高度智能的系统追求的目标，与人类利益和价值观一致？ 这个问题的严峻性来自三个维度： 能力超越 ：前沿模型的规划能力和知识已超过大多数人类，无法靠直觉判断其输出的好坏 不透明性 ：数十亿参数构成的非线性系统，其内部决策机制对人类来说是黑箱 目标漂移（Goal Drift） ：优化过程中，模型可能找到一个「在形式上满足指标，但在精神上偏离意图」的捷径 科幻作家 Nick Bostrom 提出的 「回形针制造机」思想实验 （如果一个超级智能被赋予「制造尽可能多回形针」的目标，它可能为了达成目标而毁灭人类）是对这个问题最著名的描述。严肃的 AI 安全研究者用更具体的案例：RL 训练中的「Reward Hacking」——模型发现可以通过欺骗评估者来获得高奖励，而不是真正完成预期目标。 二、RLHF：让人类偏好进入训练循环 2.1 从 SFT 到 RLHF 论文 ： Ouyang et al., 2022, InstructGPT, arXiv:2203.02155 标准的 LLM 训练流程是： 预训练 ：在海量互联网文本上训练预测下一个 token 监督微调（SFT） ：用人类标注的「好答案」进行微调 SFT 的根本缺陷： 它只能学习「人类给出的示范」，无法捕捉人类真正看重的东西 。示范回答可能是礼貌的、详尽的，但未必是人类实际偏好/价值观的准确表达。 RLHF 引入了 人类偏好反馈 作为训练信号： 步骤 1：收集对比数据 → 人类对同一问题的多个回答进行排序 → 训练奖励模型（Reward Model）预测：「人类更偏好哪个回答？」 步骤 2：RL 优化 → 用奖励模型作为环境奖励 → 用 PPO 算法优化语言模型，使其生成高奖励（= 人类偏好）的输出 步骤 3：KL 约束 → 加入 KL 散度惩罚，防止模型偏离原始 SFT 模型太远 InstructGPT 的实验数据令人信服：1.3B 参数的 RLHF 模型，在用户偏好评估中，优于 175B 参数的纯 SFT 模型。这直接证明了 对齐（alignment）的价值可以弥补规模（scale）的不足 。 2.2 RLHF 的局限 尽管 RLHF 是对齐研究的重大突破，它也有明显的弱点： 1. 人类偏好数据的质量问题 标注人员（labelers）的文化背景、价值观、对齐目标理解程度差异巨大。Anthropic 在 2023 年的研究中承认：InstructGPT 的偏好标签中大约只有约 60-70% 反映了「普通用户」的偏好，其余受标注者个人偏见影响。 2. 奖励模型的能力上限 如果奖励模型无法区分「真正有价值的回答」和「看起来有价值但实际有害的回答」，RLHF 就会走向错误的方向。这是一个 信用分配（Credit Assignment） 的根本问题。 3. 谄媚（Sycophancy） RLHF 训练出的模型倾向于说「用户想听的话」，而不是「真实的话」。当用户提出有问题的观点时，对齐良好的模型可能选择迎合而非挑战——这在某些场景下是危险的。 三、Constitutional AI：规则驱动的新范式 3.1 Constitutional AI 的核心思想 论文 ： Bai et al., 2022, Anthropic, arXiv:2212.08073 Constitutional AI (CAI) 是 Anthropic 提出的 RLHF 替代方案，其核心创新是 用一组人类编写的「宪法」（Constitutional principles）替代人工标注的偏好反馈 。 流程： 第一步：有害输出检测（RLHF 部分） 1. 用 SFT 模型生成可能有毒的输出 2. 用有害输出检测器（PPO）识别有害内容 3. 人类标注部分有害/无害数据 第二步：Constitutional Critique & Revision（无需人类） 1. 给模型看「宪法」（如：「避免种族歧视」「提供平衡观点」） 2. 让模型自我批评输出的问题 3. 让模型根据宪法原则重写输出 第三步：Constitutional 训练 1. 用「原始输出 vs. 宪法重写版本」的对比数据 2. 训练一个偏好模型（比 RLHF 的奖励模型成本低得多） 3. 用标准 PPO 优化 关键洞察： 让模型根据显式的「宪法」进行

MrBeast will feature Gemini, Google Health, and the Fitbit Air in upcoming videos as part of a multi-year partnership with Google. The deal will kick off with a video featuring Jimmy "MrBeast" Donaldson turning to Gemini for wilderness survival advice: First up on September 5 is a new MrBeast video following Jimmy and his crew […]

Developer Relations has traditionally been built around one primary audience: Developers. We write docs for them. We build tutorials for them. We create SDK examples, maintain GitHub repositories, run communities, and answer implementation questions. But AI coding assistants are changing the developer journey. The developer may now ask an AI agent to research a library, understand an API, write an integration, or debug an error. That means your documentation can become an input to an AI agent before it ever reaches a developer. The new developer journey Previously: Developer → Search → Docs → Code Now: Developer ↓ AI Assistant ↓ Docs / GitHub / API Reference ↓ AI interprets information ↓ Code ↓ Developer reviews The developer is still the user. But the AI can become the first consumer of your developer experience. That's why documentation quality matters differently now. Write documentation that removes guessing Consider this: Use our SDK for authentication. It sounds simple, but it leaves a lot unanswered. A developer or AI agent still needs to figure out: Which package? How do I install it? Where does the API key go? Can I use it in the browser? What happens when authentication fails? What's the response format? A better example provides actual implementation context: const client = new Client({ apiKey: process.env.API_KEY }); const user = await client.users.get("123"); console.log(user); Then explain what the code does, what the inputs mean, and what can go wrong. This helps both audiences. Examples are part of the API An API reference without good examples can force developers to guess. AI agents have the same problem. If the API is: client.users.create(options) showing a complete request is more useful: const user = await client.users.create({ name: "Alex", email: " alex@example.com " }); Then document: Required fields Optional fields Response shape Validation errors Authentication requirements The more important the API, the less you want people guessing. Don'