标签：#m

On March 3, 2026, Helicone announced it was joining Mintlify. If you run Helicone in production, the practical question is not whether the acquisition is good or bad. It is what changes for you, and whether you need to do anything about it. Here is the honest version, and a checklist if you decide to move. What actually changed Helicone's founders joined Mintlify, and active feature development on the standalone product has wound down. The team has said security patches, bug fixes, and new model support will continue. New features and roadmap work are the part that stopped. For a lot of teams that is fine for a while. A logging proxy that already works does not stop working the day the roadmap freezes. But two situations make people start looking. You are on Helicone Cloud and you want to know the plan is still moving forward, not just being kept alive. Or you self-host and you were counting on features that are now unlikely to ship. Helicone was one of three observability tools acquired in a few months. ClickHouse bought Langfuse and Cisco bought Galileo in the same window. If you are picking a replacement, that pattern is worth keeping in mind. More on that at the end. Do you even need to move right now Worth saying plainly. If you self-host Helicone, you are happy with it, and you do not need anything new from it, there is no fire. The code keeps running. You can migrate on your own schedule instead of someone else's. The case for moving sooner is stronger if you are on the hosted product, if you depend on the gateway staying current with new providers and models, or if you would rather switch once now than watch and decide later. If that is you, the rest of this is for you. The migration checklist Helicone and Spanlens are both drop in proxies, so the mechanical part is short. The work is mostly finding every place your code sets a base URL and updating headers. 1. Swap the base URL This is the one required change. // Before, Helicone const openai = new OpenAI (

Reading Lilian Weng's harness engineering survey as a reliability engineer — what self-improving harness papers actually show, and the three invariants every working loop converges on.

Imagine being able to ask your AI assistant to review your code on GitHub, query a database, or draft a report in your favorite productivity tool, all from a single conversation. That's exactly what the Model Context Protocol (MCP) makes possible. An MCP Server acts as a universal translator. It allows your AI client (like Claude, VSCode, or Cursor) to communicate in a standardized way with external data sources and tools. It transforms your AI from an "isolated chat" into an assistant that can actually execute tasks in your working environment. The Power of Connection: Clients and Servers The beauty of MCP lies in its flexibility. A single MCP server can connect to multiple clients. This means you can set up your server once and use it across different platforms. According to the official documentation, you can install and connect MCP servers to popular clients like: Claude Desktop & Claude Code: For conversational and command-line interactions VS Code & Cursor: For seamless integration with your development environment GitHub Copilot CLI: To extend your coding assistant's capabilities Zed, Gemini CLI, Goose, and many more: The list keeps growing, demonstrating widespread adoption of the protocol ## How to Configure It: A Quick Look Configuration is usually straightforward and relies on JSON files. For many clients, you just need to specify the command to run your server. For example, to add a filesystem server to a VSCode project, you'd create a .vscode/mcp.json file with content like this: { "servers" : { "filesystem" : { "command" : "npx" , "args" : [ "-y" , "@modelcontextprotocol/server-filesystem" , "/path/to/your/project" ] } } } This file tells VSCode how to start the server. Configuration can be at the project level (to share with your team) or global (for personal use across all your projects). Your First Server: A Practical Example Building your own MCP server is more accessible than it might seem. The official TypeScript/JavaScript SDK lets you create a

The moment you press Enter, billions of mathematical operations begin. Let's follow that journey. Every day, millions of people ask ChatGPT, Gemini, Claude, or other AI assistants questions. The answer appears almost instantly. But have you ever wondered what actually happens after you press Enter? Why can't a normal CPU answer these questions quickly? Why do companies spend billions on GPUs? Let's take a journey from your keyboard to the AI's brain. Imagine This... Suppose your office receives 10,000 letters. You have two choices. Option 1: One super-fast employee He opens one letter after another. Very fast. But still... One at a time. This is a CPU. Option 2: 10,000 employees Each opens one letter simultaneously. The work finishes almost instantly. This is a GPU. The difference isn't that each employee is smarter. There are simply many more workers working together. CPU vs GPU Think of it like this. CPU = CEO making decisions. GPU = Thousands of factory workers building products simultaneously. Why CPUs Are Amazing Your CPU performs tasks like Opening Chrome Playing music Running Windows Calculating taxes Managing memory Running applications These jobs require decisions branches conditions interrupts This is logical thinking. CPUs are built for this. Why GPUs Exist Originally GPUs were invented for games. Imagine rendering one image. A 4K monitor contains over 8 million pixels. Each pixel needs calculations. Every frame. 60 times every second. Instead of calculating one pixel at a time... GPU calculates millions together. Gaming accidentally created the perfect hardware for AI. AI Doesn't Think Like Humans LLMs don't "think" in English. They perform mathematics. Lots of mathematics. Almost everything inside an LLM becomes... Matrix × Matrix Vector × Matrix Addition Multiplication Normalization Softmax That's all mathematics. Billions of times. Why Matrix Multiplication Matters Imagine two tables. Table A 1 2 3 4 5 6 7 8 9 Multiply with Table B 2 4 6 8 1 3 Every n

The help button is the most important button in your delivery app that your QA team almost never...

Most web applications contain at least one vulnerability from the OWASP Top 10. A typical security audit takes 2-3 weeks and costs upward of $10,000. An LLM can compress the initial audit down to a few hours because it scans code for patterns rather than specific CVEs. Below are 15 vulnerabilities found while auditing production code with Claude. Each includes the vulnerable code, the fixed version, and a prompt to reproduce the finding. Classification follows OWASP Top 10 (2021). Order reflects frequency of occurrence: most common first. Methodology: how to run an AI security audit The audit consists of three passes. First, a broad scan: the LLM receives the entire project and looks for vulnerability patterns. Second, deep analysis: each identified pattern is verified in context (middleware, ORM, framework). Third, verification: manual review of every finding, because LLMs produce false positives. Prompt for the broad scan: Perform a security audit of this code. For each finding, include: 1. CWE ID and name 2. OWASP Top 10 category 3. Severity (Critical/High/Medium/Low) 4. The vulnerable code snippet 5. Attack vector -- exactly how an attacker would exploit this 6. Fixed code Ignore stylistic comments. Focus on security only. Start with injection attacks, then broken access control, then the rest. This prompt works because it defines the output structure and prioritizes categories. Without explicit instructions, the LLM mixes critical vulnerabilities with remarks about email validation. More on structured AI code review: AI Code Review Checklist . A03:2021 -- Injection 1. SQL Injection via string concatenation The most common finding. Shows up even in projects using an ORM, because developers switch to raw queries for complex filters. Vulnerable code: // API endpoint for user search app . get ( ' /api/users ' , async ( req , res ) => { const { search , sortBy } = req . query ; const query = ` SELECT id, name, email FROM users WHERE name LIKE '% ${ search } %' ORDER

I'm writing a short series of tutorials on FlashAttention, the algorithm that largely powers modern LLMs. The core idea is to spot the associative structure hiding in the loop. Once you see it, you get two things: you can fuse the passes (in the case of attention, it is huge, because it avoids ever materializing the score matrix) and split and recombine the work across GPU threads or any parallel processor. This post is about recognizing that structure. The stable softmax operation on a vector x (part of the attention kernel) is computed as follows: m = max_j x_j softmax(x)_i = exp(x_i - m) / Σ_j exp(x_j - m) Naively, you would write something like: # pass 1 — running max m = -inf for j in 0..N: m = max(m, x[j]) # pass 2 — denominator, needs the final m d = 0 for j in 0..N: d += exp(x[j] - m) # pass 3 — normalize for j in 0..N: y[j] = exp(x[j] - m) / d The trick is not to wait for the final max before accumulating the denominator. Carry both in a small state (m, d) and rescale d whenever the max moves. Here is what the online version of the algorithm above looks like: # one pass — carry (m, d) together m, d = -inf, 0 for j in 0..N: m_new = max(m, x[j]) d = d * exp(m - m_new) + exp(x[j] - m_new) # rescale, then add m = m_new # normalize (unchanged) for j in 0..N: y[j] = exp(x[j] - m) / d It turns out this is not a one-off trick. There is a whole class of "secretly associative" loops that you can parallelize by introducing the right carrier state. The tutorial goes into detail, shows a few examples of secretly associative operations, provides the algebraic formulation for those, and gives some tools to help you recognize secretly associative loops. Overview: Safe softmax, Welford's variance, and FlashAttention belong to the same class of secretly-associative operations The twisted monoid via transport of structure, why the max-rescale coupling doesn't break associativity Third Homomorphism Theorem as a test for whether any loop is secretly associative Numerical analys

We stopped measuring retrieval quality by how many tokens we could fit into the prompt. When...

You asked your AI to help you plan a trip. It gave you a paragraph about packing layers and booking early. You needed a checklist, a hotel shortlist, a flight window, and a rough daily schedule. What you got was a thoughtful non-answer dressed up as advice. That gap — between what AI tells you and what it could actually do for you — is the gap agentic AI is designed to close. And most people don't know it exists. The Difference Between Answering and Acting Standard AI models are trained to respond. You send a prompt, they generate a reply. The entire interaction lives inside a single text exchange. Agentic AI operates differently. Instead of producing one answer, it takes a goal and breaks it into a sequence of steps — then executes them, one after another, checking its own output along the way. It can look things up, organize information, write to a document, revisit a step if something doesn't look right, and deliver a final result that's actually usable. The travel example makes this concrete. A conversational model tells you to pack a rain jacket. An agentic setup builds you the trip: it pulls destination weather data, generates a packing list specific to your travel dates, identifies hotels in your price range, and drops everything into a structured itinerary. Same goal. Completely different level of output. Author's note: The word "agentic" has been overloaded to the point of meaninglessness in tech marketing. For our purposes here, it means one specific thing — an AI that runs a loop: think, act, observe the result, decide the next action. If it's not doing all four of those things in sequence, it's not really an agent. It's just a chatbot with extra steps. Why This Loop Changes Everything The reason agentic AI feels qualitatively different isn't magic — it's architecture. The core mechanic comes from a framework called ReAct (short for Reasoning and Acting), introduced in a 2023 paper by Yao et al. and now foundational to most production agent systems. The l

Quick answer: The PromptEval Prompt Quality Report scored over 1,000 real prompts across 12 use cases. The average was 52 out of 100, and only 8% reached "good" (75+). The strongest single predictor of a good prompt is whether it defines its output format, worth 27 points on average. In 9 of 10 prompts, the weakest dimension was robustness. This is the PromptEval Prompt Quality Report . Over 1,000 real prompts have been scored on PromptEval , submitted by real users across use cases from customer support to healthcare to code. Each was scored from 0 to 100 on four structural dimensions: clarity, specificity, structure, and robustness. Every figure below comes from that set. No prompt text is stored; the analysis is anonymous and aggregate. Only 8% of the 1,000+ scored prompts reached "good" (75 or higher). Fewer than 1% reached "excellent." Source: PromptEval Prompt Quality Report, 2026 How the scores break down Here is how the scores spread across the set. The bar for "good" is 75, the point where a prompt is clear, specified, and holds up under variation. Score range Share of prompts 0 to 40 (failing) 25% 41 to 60 (below par) 31% 61 to 74 (functional but mediocre) 36% 75 to 84 (good) 8% 85 to 100 (excellent) under 1% Roughly 92% of prompts never reach "good," and almost none reach "excellent." This includes prompts from people who clearly know the tools. The gap is not talent. It is a few missing pieces that repeat. What separates a good prompt from a bad one For each structural element, we compared the average score of prompts that had it against those that did not. These are averages across the set, not a controlled experiment, so read them as correlation. But the gaps were large and consistent. The prompt... Avg with Avg without Point gap Defines the output format 58 31 +27 Has explicit constraints (what not to do) 63 41 +22 Assigns a role or persona 57 42 +15 Includes at least one example 64 51 +13 Prompts that define their output format score 27 points higher

Disclosure: I maintain Lynkr , an open-source router whose design decisions this post explains. The failure modes described are patterns widely reported across router issue trackers and local-LLM forums — the examples are representative reconstructions, not captured transcripts. The problem is real either way; ask anyone who's routed a coding agent to a 7B model. Everyone who gets their first LLM router working does the same thing within the hour: point the expensive coding agent at a free local model and watch the bill drop to zero. Then the agent tries to edit a file. The graveyard of downgraded sessions If you browse the issue tracker of any Claude Code router — or r/LocalLLaMA on any given week — you'll find the same story in a hundred variations. The routing works perfectly. The session dies anyway. The killers, in rough order of frequency: 1. Malformed tool arguments. The agent decides to call Edit , and the model produces arguments that are almost JSON: { "file_path" : "src/auth.js" , "old_string" : "if (token) {" , "new_string" : "if (token && !expired) {" One missing brace. The harness rejects the call, the model retries, produces a different malformation, and you're three turns deep into fixing nothing. Frontier models emit structurally valid tool calls with boring reliability; sub-10B models do it most of the time — and "most of the time," at 30 tool calls per session, means every session breaks. 2. Stale string matching. Edit -style tools require the old_string to match the file exactly. Small models paraphrase from memory instead of quoting — they'll "remember" the line as if (token) { when the file says if (accessToken) { . The edit fails, the model re-reads the file, burns 2,000 tokens, tries again with a different paraphrase. This is the single most reported failure, because it looks like the router's fault and is actually a capability cliff. 3. Hallucinated context. Ask a small model to run tests and it may confidently call Bash with npm test -- --g

We deployed a coding agent that hit 94% on the industry benchmark. It failed in production on the first real edge case because the benchmark measured single-turn success and our actual work was multi-turn refinement. The model could not update its beliefs correctly when new evidence arrived, something no single-turn eval would catch. This is not a hypothetical. I have watched agents shine in demo and disintegrate on the messy input that production actually serves. The gap between what we measure and what ships is real, and it is where reliability lives or dies. The benchmark misses the point FutureBench evaluates agents by asking them to predict events that occurred after their training cutoff. This removes the possibility of correct answers coming from memorized training data rather than genuine reasoning. The design matters because it tests whether an agent can reason, not whether it can recall. BayesBench showed that standard LLM evaluations score only final-turn answers in single-turn format, leaving multi-turn belief updating entirely unexamined. Across seven models, scaling improves latent inference and evidence accumulation but LLMs do not match rational Bayesian updating. In production, your agent runs many turns. The benchmark that stops at turn one is not measuring the thing that actually breaks. KINA identified three systematic flaws in knowledge benchmarks: scaling-driven designs that ignore disciplinary representativeness, flat-payment annotation that permits lazy consensus among annotators, and unaudited ranking instability under bounded test budgets. The top model reached 53.17% on an 899-item benchmark across 261 disciplines. That is not saturation. That is headroom. The demo lied I worked with a team that deployed an agentic document processing system. The demo on ten handpicked cases was flawless. The first week of production, it hit an input format the training data never saw, and the system failed silently. No error was raised. The output looked

I'll preface to say I'm not at all a programmer, so pardon me for saying anything stupid The increasing amount of slop is no secret, and but software as a whole, be it plugins or apps or even whole operating systems, has become increasing plagued by a set of kinda-unrelated problems that feel like they fall under the same umbrella. I'll keep it short, so practical issues of efficiency, privacy, security, and long-term support, and then ethical issues of being human-made. I personally believe that we're in need of novel, widespread terms to be able to describe the kind of software that in principle does not have certain traits. I attached the link because I believe the term "open source" is analagous to what I'm talking about here. Everybody has an idea of what it means and entails, but it also doesn't mean that everything has to strictly follow it to a T, because it's just a word at the end of the day. It's a pledge to the user to abide by principles of being "Open Source," and I'm saying that we need new words that similarly serve as principles such as that of, optimization, long-term support, being human-made, etc. (It's kind of like how we have terms like organic, free-run eggs, free range eggs, and of course you would end up with having a bunch of terms that dont mean anything at all, but i'm confident that a few will emerge as "standards" in the same way the term open source is.) This could go hand-in-hand with maybe making it common practice to at least disclose the development process when publishing software. In (science) research, we're beginning to see the implementation of "AI Disclosures" to detail all such usage, to be published with the paper. surely practices like these should be encouraged in software development as well. I'm sure there are (smaller) discussions on what exactly should constitute as "best practices" to the people that care about such things, but I've yet to see mainstream terms that go beyond only vaguely describing what we dont like

I spend a lot of time preaching architecture and constraints, so it is always nice when a side project gives me receipts. Adding this new feature to DumbQuestion.ai was a good reminder that a well-structured first version lets you spend your next iteration on value, not repair. Below, you will find a few relatively simple challenges and how thoughtful, upfront design made the changes effortless. To vibe or not to vibe ... Many developers jump right in and just rip out an app, ship fast, let the coding agent sort it out, come back and deal with it later. To be fair, that absolutely can get you to first release faster. But even on a solo project, a little proper SDLC discipline pays back later when you want to extend the product without turning every feature into a rescue mission, which is a theme that already runs through how I have been building DumbQuestion.ai. Extend this to the enterprise and you turn a little upfront effort into potential huge savings on token spend Roasting starup pitches (for sport) ... The core idea for Startup Roast was simple enough: take a startup pitch, roast it, and add a reality-check section so the output is not just mockery for mockery’s sake. To illustrate (and avoid just vaguely describing the feature) I picked a random but highly upvoted pitch from Product Hunt: Vida . Vida, which pitches itself as an “AI clone” that learns how you work, remembers what matters, and becomes a “second you,” with early use cases like Reply Rescue, Prompt Rescue, Resume Rescue, Workspace Cleanup, and Daily Wrap. This is a pretty common target use case of agentic AI making it a solid candidate. If you want to skip ahead, here's an example roast for Vida. Combining a preliminary web "market search" into the content yielded a result that was not just sarcastic, but informed. The roast hit the obvious AI-clone positioning, questioned whether the product was really a clone versus a macro suite, and then turned the market context into a sharper Reality Check

Amid public backlash over its smart glasses, Meta announced that it will be updating its glasses with a new feature that will disable the camera when it detects that someone has tampered with or destroyed the glasses' privacy LED light. The update is meant to address modders who have taken actions such as physically drilling […]

Meta's new AI detector has rate limits for some reason.

How is it going for you all working on projects for this platform? I’ve read that sometimes they ban you without even giving you a heads up, is that true? Also, I’d like to ask about the tests they give you for software projects before accepting you; are they actually very difficult? Do I need to have AI level problem solving skills or something similar to get accepted? How is the hourly pay working out? Is it truly hourly, and are deposits made weekly? Thanks for reading, everyone; I’m curious about remote work and want to get started. submitted by /u/ClarkKennedy929 [link] [留言]

The next Samsung Galaxy Unpacked launch is happening on July 22.

submitted by /u/lood9phee2Ri [link] [留言]

Cases have risen quickly as officials are working to identify a common source.