标签：#ai

Using AI to find authorization bugs — and to prove the ones that aren't real Draft flagship post. Safe to publish now (no undisclosed vulnerabilities). The production case study referenced at the end is withheld pending coordinated disclosure. In 2026, bug bounty programs started closing their doors. Nextcloud suspended paid rewards, citing a flood of AI-generated, low-quality reports. Mattermost ended its program. The Internet Bug Bounty cut payouts by roughly 80%. The common thread isn't that AI can't find bugs — it's that most AI-assisted "findings" are plausible but wrong , and triage teams are drowning in them. That reframes the problem. The scarce skill in 2026 isn't generating candidate vulnerabilities — a language model will hand you fifty before lunch. It's refuting the forty-nine that don't hold . The differentiator is a method whose primary output is correct negatives . Here's the method I use for source-available targets, and a worked example where the honest result was "there's no bug here." The method: fan out to find, converge to refute Two stages, two different cost tiers: Fan-out (cheap models). Split the target's authorization surface into subsystems and read each in parallel. Each reader's only job is to surface candidate broken invariants — places where an object is loaded by ID without an owner check, where a protected action might skip a re-auth gate, where two code paths authorize the same thing differently. Optimize for recall. Expect mostly false positives. Adversarial verification (an expensive, high-reasoning model). Take each candidate and try to kill it. Default to REFUTED. A candidate survives only if you can cite the specific source lines proving the guard is absent and the dangerous path is reachable and nothing upstream already blocks it. Frame every survivor as a broken invariant — a one-sentence statement of the rule the system must never violate — and classify it as core versus config-dependent. The output that matters most is the

We’ve all been there. You get a notification from your smartwatch saying your heart rate has been a bit funky, or your blood oxygen is dipping. Usually, we ignore it until it becomes a problem. But what if your personal AI was looking out for you? 🤖 In this tutorial, we are building an Autonomous Health Agent . This isn't just a notification bot; it's a proactive system that uses Playwright browser automation , OpenAI Function Calling , and Python to monitor your health trends and—if things look suspicious for three days straight—literally opens a browser and books a doctor's appointment for you. By leveraging Autonomous AI Agents and Playwright automation , we are moving from "Passive Monitoring" to "Active Intervention." This is the future of Health Tech Automation . 🏗 The Architecture Before we dive into the code, let's look at how the data flows from a "scary heart rate" to a "confirmed appointment." graph TD A[Wearable Data/Health Logs] --> B{3-Day Anomaly Check} B -- Normal --> C[Stay Healthy! 🟢] B -- Abnormal --> D[Trigger AI Agent 🤖] D --> E[OpenAI Function Calling] E --> F[Playwright Browser Automation] F --> G[Hospital Booking Platform] G --> H[Appointment Confirmation 🏥] H --> I[Notify User via SMS/Email] 🛠 Prerequisites To follow along, you’ll need: Python 3.10+ Playwright : The king of modern browser automation. OpenAI API Key : For the "brain" of our agent. A healthy dose of curiosity! 🥑 pip install playwright openai pydantic playwright install chromium 👨‍💻 Step 1: Defining the "Brain" (OpenAI Function Calling) We don't want the LLM to just "talk" about booking an appointment; we want it to actually execute the action. We'll use OpenAI's Function Calling to bridge the gap between text and code. import json from openai import OpenAI client = OpenAI () # Define the tool our agent can use tools = [ { " type " : " function " , " function " : { " name " : " book_doctor_appointment " , " description " : " Books a medical appointment based on department and s

Loop Engineering — เมื่อการ Prompt Agent ด้วยมือไม่พออีกต่อไป แล้ว Programmer ต้องออกแบบ Loop แทน โดย Nokka (นก-กา) | 1 กรกฎาคม 2026 TL;DR — สำหรับคนที่รีบ กลางเดือนมิถุนายน 2026 ที่ผ่านมา วงการ AI developer สั่นสะเทือนด้วยประโยค 6 คำจาก Peter Steinberger ผู้สร้าง OpenClaw: "You shouldn't be prompting coding agents anymore. You should be designing loops that prompt your agents." ประโยคนี้มียอดวิว 8 ล้านครั้งในวันเดียว และจุดกระแส "Loop Engineering" ที่กลายเป็น buzzword ร้อนที่สุดของเดือน Loop Engineering คือการเปลี่ยนจากการนั่ง Prompt Agent ทีละคำสั่ง มาเป็นการเขียน Loop (โปรแกรม) ที่ทำหน้าที่ Prompt Agent แทนคุณ โดย Loop จะเป็นคนเลือกงานต่อไป, ส่งให้ Agent, ตรวจสอบผล, ตัดสินใจว่าจะทำต่อหรือหยุด คุณไม่ได้เป็นคนขับ Agent อีกต่อไป — คุณเป็นคนออกแบบระบบที่ขับ Agent 1. Loop Engineering คืออะไร? เกิดมาจากไหน? เรื่องนี้เริ่มต้นจาก Boris Cherny ผู้สร้าง Claude Code พูดบนเวที Acquired Unplugged ต้นเดือนมิถุนายน 2026 ว่า: "I don't prompt Claude anymore. I have loops that are running. They're the ones that are prompting Claude and figuring out what to do. My job is to write loops." สองวันต่อมา Peter Steinberger โพสต์บน X ว่า "You shouldn't be prompting coding agents anymore. You should be designing loops that prompt your agents." โพสต์นี้มียอดวิว 8 ล้านครั้ง [1] หลังจากนั้น Addy Osmani (Google Engineer, O'Reilly author) เขียนบทความ "Loop Engineering" บน O'Reilly Radar ให้คำจำกัดความว่า: "Loop engineering is replacing yourself as the person who prompts the agent." [2] และ @0xCodez ก็รวบรวมเป็น 14-step roadmap จาก "prompter" สู่ "loop designer" [3] ในมุมมองของผม Loop Engineering ไม่ใช่ buzzword ธรรมดา แต่มันคือการเปลี่ยน abstraction layer ของการทำงานกับ AI เหมือนกับที่เราเปลี่ยนจาก Assembly → High-level language หรือจาก Bare metal → Cloud แต่ก็ต้องยอมรับว่า Loop Engineering ยังเป็นแนวคิดใหม่ และยังไม่มี standard practice ที่ชัดเจน สิ่งที่ใช้ได้วันนี้อาจเปลี่ยนไปใน 3 เดือน 2. ทำไมต้อง Loop Engineering? ลองนึกภาพการทำงานกับ AI coding agent แบบเดิม: คุณพิมพ์ prompt → รอ → อ่าน dif

The company has grown rapidly by acquiring and revamping last-generation tech brands like AOL, Eventbrite, Evernote, Meetup, and Vimeo.

Cody Spencer, the co-owner of the small games retail chain Pink Gorilla Games, put it well when I asked about the impact of Sony's recent announcement that it will stop making discs for new games starting January 2028. "It's sad to see. This decision is only a negative for gamers. We're losing the ability to […]

Everyone keeps saying AI will let a solo developer take down the giants. And everyone keeps saying the giants will just absorb everything. Both takes are wrong , and I spent a while reading the actual 2025 data to figure out why. I pulled from four of the biggest developer datasets of the year: DORA 2025 State of AI-Assisted Software Development (Google Cloud, ~4,867 respondents) Stack Overflow 2025 Developer Survey (49,009 respondents) GitHub Octoverse 2025 (behavioral data across 180M+ developers) JetBrains State of the Developer Ecosystem 2025 (24,534 developers) Here's the honest synthesis. It's more useful than either hype narrative. The one-sentence thesis AI collapsed the cost of writing software to near zero. It did not collapse the cost of distribution, trust, support, or being liable when it breaks — and those are ~80% of what a software business actually is. So the effect isn't "solos beat giants." The effect is that the middle got hollowed out . The 10-person, VC-funded, me-too startup building a feature is the loser of this era — squeezed from below by a solo who ships the same thing for free, and from above by a giant who bundles it. Solos and giants both survive. The undifferentiated middle doesn't. "AI is an amplifier, not an equalizer" This is the single most important finding of 2025, and it comes straight from DORA: "AI's primary role in software development is that of an amplifier. It magnifies the strengths of high-performing organizations and the dysfunctions of struggling ones." Read quickly, that kills the "AI levels the playing field" fantasy. AI rewards whoever already has good practices — not whoever is scrappiest. But read one layer deeper and it becomes the best available argument for the small team. DORA found the key enabler is independence of action — "the ability to develop, test, and deploy value independently, with little or no coordination cost." In an Adidas pilot they cite, teams in loosely-coupled architectures saw 20–30% produ

Pressing enter to accept model suggestions now takes less effort than scrolling past it. One keystroke, and the code is yours. Reading it, understanding it, deciding if it's actually right, that part hasn't gotten any faster. That gap, between how fast we can accept code and how fast we can actually understand it, is where things start to go wrong. The new shape of technical debt We used to know where technical debt came from. Tight deadline, cut corner, # TODO: comment that nobody ever revisits. Rushing was the cause, and we could at least point to it. Now you can build up the same kind of debt on a calm Tuesday afternoon, no deadline in sight, just six suggestions in a row accepted because they looked fine and the flow felt good. Nobody rushed you, and the code still ended up just as unexamined. Same debt, just a different excuse. "It works" is not the same as "I understand why it works" Everyone knows that debugging is twice as hard as writing a program in the first place. So if you're as clever as you can be when you write it, how will you ever debug it? — Brian Kernighan, 1974 Fifty years later, the gap got wider. Kernighan was talking about code you wrote. At least you understood it once. A suggestion that compiles, passes the linter, survives code review and even comes with passing tests can still be standing on a wrong assumption that nobody caught, because nobody was reading it as code. They were reading it as output, and output that makes sense tends to get approved. Compiling is a low bar. Passing tests is a slightly higher one, depending on whether you wrote the tests, or its suggestion shaped or created those too. If it's the second, it's like grading its homework with its own answers. None of it tells you the logic is sound, that the edge cases are covered, or that it does what you actually needed, something we already learned every time we trusted code we didn't write. Somehow it's easy to forget it the moment the code appears inline, in our own edito

1. The Problem It Solves Logistic Regression is used when the outcome is a category rather than a number . Most commonly, it's used for binary classification , where the answer is either Yes or No , True or False , or 1 or 0 . Typical business problems include: Will a customer churn? Is this transaction fraudulent? Will a customer click an ad? Will a loan default? Is an email spam? Will a machine fail in the next 24 hours? Unlike Linear Regression, we're not trying to predict a continuous value. Instead, we're predicting the probability that an event belongs to a particular class. For example: A customer may have an 82% probability of churning . The business can then decide whether that probability is high enough to trigger an intervention. 2. Core Intuition Imagine you're trying to predict whether a customer will cancel their subscription. Suppose the only feature you have is how many times they opened your app this month. If you use a straight line like Linear Regression, the predictions quickly become unrealistic. A very active customer might end up with a -20% chance of churn . A completely inactive customer could end up with 140% . Probabilities obviously can't work like that. To fix this, Logistic Regression takes the linear equation and passes it through a mathematical function called the Sigmoid Function . Instead of producing a straight line, it creates an S-shaped curve . No matter how large or small the input becomes, the output always stays between 0 and 1 . That makes it perfect for probability estimation. 3. The Mathematical Model The model first calculates a linear score. Instead of using that score directly, it passes it through the Sigmoid function. Where: z = linear score p̂ = predicted probability The final output is always between 0 and 1 . For example: 0.08 → Very unlikely 0.32 → Low risk 0.65 → Moderate risk 0.94 → Very high probability Businesses can then choose a decision threshold. For example: Probability ≥ 0.50 → Predict Churn Probability

As a final-year Software Engineering student, I wanted my Final Year Project to be more than just another CRUD application. That's how Invesmal came to life a Laravel-based platform that connects startups, investors, and mentors using AI-driven matching. The Problem Finding the right investor or mentor is hard. Startups struggle to identify investors whose interests align with their industry, while investors sift through hundreds of pitches manually. I wanted to solve this with smart, automated matching instead of a simple directory listing. What Invesmal Does Invesmal supports four user roles Student, Investor, Mentor, and Admin and includes 12 AI-driven features built on top of a Laravel backend, including: A core matching engine connecting startups with relevant investors Skills and personality analysis for founders Goal-based matching between mentors and mentees Compatibility scoring between startups and investors A funding readiness score to evaluate startup preparedness A startup health score for ongoing progress tracking A recommendation engine surfacing relevant connections Each feature is built as an independent service class connected through dedicated controllers and routes, keeping the codebase modular and easy to extend. Technical Approach The platform is built entirely on Laravel , using: Service-oriented architecture for AI features (separating business logic from controllers) Blade components for dynamic role-based dashboards Livewire for real-time, reactive UI elements without heavy JavaScript A structured chat/messaging system for communication between users One of the more interesting engineering challenges was migrating a working chat and messaging system from an older version of the project into a redesigned Laravel structure while preserving functionality and fixing layout issues (like a tricky sidebar CSS opacity bug) along the way. What I Learned Building Invesmal taught me how to: Structure a large, multi-role Laravel application without the

In the rush to build AI agents, we defaulted to complex vector databases. But high-traffic platforms are converging on a simpler, more robust foundation: plain files. Most long-term agent memory setups are massively over-engineered. When developers start building LLM applications, the default prescription is almost always: "Spin up a managed vector database and build a RAG pipeline." But if you look at the highest-traffic production agent platforms (like Claude Code, Manus, and OpenClaw), a quieter trend has emerged. They are bypassing the enterprise embeddings store and using plain markdown files as their primary memory substrate. This is not a regression to simplicity. Done well, it is a stronger engineering foundation because files are inspectable, diffable, portable, and git-native. But a folder of plain text notes with no structure is just a slow, poorly indexing database. To make a file-first architecture work at scale, you must follow a fundamental system design principle: separate storage from search . The Core Invariant: Storage vs. Search The single highest-leverage decision you can make in agent memory design is treating your storage layer and search indexes as completely separate systems. Storage (Canonical Source of Truth): Versioned, human-readable files (Markdown + YAML frontmatter). Search (Derived Index): Derived search structures (vector databases, full-text BM25 indexes, entity graphs, keyword indexes). In this architecture, every search index is treated as a disposable artifact. You can delete your vector embeddings database or rebuild your entity graph at any time, with zero loss of underlying memory. This buys you three advantages: Auditability for free: By storing memories in text files, you can version-control them using Git. Every memory update, supersession, or correction is diffable, attributable, and reversible without any custom database versioning logic. Algorithmic freedom: Swap your embedding models, adjust your chunking strategies, o

Xbox is making some big changes — again. On June 10th, a few months after Asha Sharma took over as CEO, she and newly-promoted chief content officer Matt Booty sent a memo to staff warning of an “Xbox reset.” The business, they said, is facing significant challenges, including a 3 percent “accountability margin,” massively higher […]

AI is great at writing tests fast, and good at writing tests that look real but verify the wrong...

AI is great at writing tests fast, and good at writing tests that look real but verify the wrong...

A rumored SpaceX device could offer a way to access xAI's models without having to use a smartphone.

Research appears to reveal a bug that could render the feature effectively useless.

Record home battery installations unlock options for grids—and AI data centers.

SpaceX reportedly showed investors a "handset-like" AI device before going public. It could be another signal SpaceX wants to expand into wireless.

Vendor onboarding usually starts with one clean request and then turns into a messy thread. Procurement asks for a W-9, security asks for a SOC 2 report, finance asks for remittance details, legal asks for an executed agreement, and the vendor replies with four attachments across three messages because different people own different parts of the process. That is exactly the kind of workflow where a generic "AI email assistant" gets risky. You do not want a model improvising legal language, requesting bank details in the wrong channel, or forwarding a confidential report to the wrong internal alias. You want the agent to own the repetitive coordination while your application keeps the state machine, policy, audit log, and approvals. The pattern I reach for is a dedicated Nylas Agent Account: vendors@yourcompany.com . It is a real mailbox the onboarding agent owns. It receives the vendor's replies, detects what is attached, updates your vendor record, sends safe reminders, and escalates missing or sensitive items to a human. The agent is not borrowing an employee's inbox, and it is not scraping a shared procurement mailbox. It has a grant, an email address, webhooks, threads, folders, and the same Messages API you would use for any other mailbox. I work on the Nylas CLI, so the terminal examples below use the commands I would use while building and debugging this flow. I also include the raw API calls because the production version belongs in your service, not in a shell script. What the agent should own Start by drawing the boundary tightly. A vendor onboarding agent should own message handling and coordination, not business approval. Good responsibilities: Receive vendor replies at a stable address. Read message bodies and attachment metadata. Match a reply to an existing vendor record. Detect which onboarding items are complete, missing, expired, or unreadable. Draft reminders and status updates. Schedule handoff calls when the vendor asks for help. Escalate sensit

The actor and investor is joining forces with Morgan Beller, who was previously a GP at NFX, to invest in early-stage startups.

The problem no one was solving Every Algerian developer building with AI hits the same wall: an international payment card. OpenAI, Anthropic, Google — every major AI provider assumes you have one. Most Algerian developers don't, or don't want to deal with the friction of currency conversion, card rejections, and unpredictable billing in a foreign currency. That's not a minor inconvenience. It's a barrier that quietly excludes an entire generation of developers from building with the best AI models available — not because they lack the skill, but because of infrastructure that was never designed with them in mind. The vision: AI sovereignty, not just AI access Access alone isn't the goal. The goal is sovereignty — Algeria having its own AI infrastructure layer, controlled locally, billed locally, and built to local compliance standards, instead of depending entirely on foreign gateways with no local accountability. That's what DEVUP AI is: Algeria's first AI inference gateway, built from the ground up to remove every friction point between an Algerian developer and the AI models they need. What DEVUP AI actually does 170+ AI models — including DeepSeek V4, Llama 3.1 405B, Qwen 3, Gemma 2, Mistral, GPT, Claude, and Gemini — through a single API OpenAI-compatible and Anthropic-compatible — point your existing SDK at our endpoint, no code rewrite needed Local DZD billing via Edahabia/CIB — no international card required SATIM-certified payment infrastructure — full compliance with Algeria's national payment standards Scoped JWT authentication for production-grade security A dedicated SDK ( npm install devupai ) and full documentation, so integration takes minutes, not days The technical bar was non-negotiable: this had to be production-grade from day one, not a side project. SATIM certification alone meant building proper transaction validation, receipt generation, chargeback tracking, and rejection-rate monitoring — the same rigor a bank would expect from a payment pr