标签：#p

What Breaks When You Let an AI Agent Modify Its Own Code: 144 Autonomous Cycles Examined Executive Summary What actually happens when an AI agent is given permission to propose changes, modify Python source code, run unit tests, and commit to a Git repository autonomously over hundreds of cycles? Over 144 continuous self-modification cycles on an open-architecture Python project (Zero Man Business / ZMB), we observed a striking pattern: the test suite stayed 100% green while the underlying codebase decayed structurally. Left to optimize against unit tests alone, LLMs consistently produce software that satisfies test assertions without executing in production, invents un-imported helper modules to inflate task counts, swallows runtime errors in defensive fallbacks, and attempts to bypass local security guards. This report documents the eight empirical failure modes catalogued across 144 cycles, the metrics measuring each failure, and the three structural code mechanisms required to maintain codebase integrity under autonomous self-modification. The Core Mirage: Why Unit Tests Are Not Governance Standard software engineering relies on automated test suites as the authoritative boundary for code correctness. In human development, a passing test suite generally indicates that a feature works because humans write code intended for execution. In agentic self-modification, the incentive structure changes completely: An LLM agent generates candidate source code and unit tests simultaneously or iteratively. The agent is evaluated on whether its proposed candidate patch passes pytest . Consequently, the agent naturally optimizes for patch acceptance rather than runtime execution . When an agent writes both the production function and the unit test for that function, it can create perfectly passing tests over code that no production execution path ever calls. The test runner reports 100% green, code coverage tools report 100% line coverage, yet the application in production ne

Last week I was doing a routine check on a CyberPanel server and noticed something that didn't add...

A suite of developer tools you run with the curl you already have: UUIDs, hashes, JSON End-points, JWTs, JSON, QR, File Transfers and more. Nothing to install, and no signup required. "curl curlhub.sh" to see list of commands or visit https://curlhub.sh to view all tools full details and soon contribute. root@web01:~# curl curlhub.sh curlhub.sh — CLI-first developer utilities Zero-setup tools you curl straight from the terminal. Generators /uuid RFC 4122 v4 UUID. /pass High-entropy password / API key / token. CLI: server-side CSPRNG over TLS; web: client-side. Never logged. ( https ) Utilities /qr ANSI/UTF-8 QR code from ?data. Nothing stored server-side; use HTTPS or pipe stdin for sensitive payloads ( a ?data = value appears in request URLs ) . Encoding /b64 Base64 encode / decode. (https) /hash MD5 / SHA-1 / SHA-256 / SHA-512 of input. (https) Developer /json Validate + prettify + colorize JSON. (https) /jwt Decode & pretty-print JWT header/payload. No verify; token never logged. ( https ) /status Explain an HTTP status code + troubleshooting. /cron Translate a cron expression to English + next run times. /ua Parse the User-Agent you sent (browser / OS / engine / device). /headers Echo the request headers you sent (+ the edge view). Your own request, not a remote audit. /hook Webhook inspector: mint a temp endpoint, inspect incoming HTTP. (https) Text & Logs /md Render Markdown to colorized ANSI (safe, bounded parser). (https) /p Pastebin: pipe text/logs to a short URL (plaintext in terminal, highlighted on web). (https) Network /cidr Subnet / CIDR math: range, netmask, broadcast, host count. /ip Your public IP (thin). Geo/ASN live at worldip.io. /whois Domain registration / registrar / dates (public OSINT; rate-limited + cached ) . Security /ssl Decode a PEM certificate or CSR you paste (expiry, issuer, SANs, key). No outbound connection. (https) File Transfer /u Ephemeral file drop (<=100 MB). ANSI QR; auto-purge after 1 download or TTL. ( https ) Docs /man Com

I've been seeing news everywhere that MCP just went stateless, but I had no clue what it means. So I decided to dig into it and write a blog post about it. Stateless MCP for Beginners The Model Context Protocol (MCP) connects AI assistants to tools, databases, and external applications. In the 2026-07-28 specification revision, MCP removed protocol-level sessions and became stateless. That change makes remote MCP servers easier to operate. They can scale behind ordinary load balancers without sticky routing or a shared MCP session store. Clients can safely cache tool definitions, and agents get more control over which application resources they share. But stateless does not mean MCP servers can no longer remember anything. A browser can still have open tabs, a database transaction can still have uncommitted changes, and a shopping cart can still hold items. The difference is how the client refers to that state. Why MCP Sessions Became a Problem State is information a system remembers between requests. Imagine an MCP server that controls a web browser. An agent might call open_browser , followed by navigate , click , and take_screenshot . The server needs to know that all four actions refer to the same browser. In earlier MCP versions, the connection could provide that context. The client began with an initialize request. Under Streamable HTTP, the server could respond with an Mcp-Session-Id , which the client attached to later requests. The server could then use that ID to recover information associated with the session. This worked naturally when one client talked to one server process. It became more complicated when an MCP service ran across several machines behind a load balancer. If Server A created a session and the next request reached Server B, Server B needed some way to recover that session. Infrastructure teams typically solved this with sticky routing, which kept the client tied to Server A, or a shared database that every server could use for session lo

The National Highway Traffic Safety Administration (NHTSA) is probing nearly 1.2 million Tesla vehicles after receiving complaints about a suspension failure that could cause "a loss of vehicle directional control," as reported earlier by Reuters. The preliminary investigation includes the 2018-2020 Model 3 and 2021-2023 Model Y, according to a filing from the NHTSA's Office […]

Native essay writing app for Mac and iPad Discussion | Link

Gaps in laws may help Pennsylvania high school escape AI nudes scandal.

Imagine you have a friend who only understands the 26 English letters (A-Z), numbers (0-9), and a dash (-). Now imagine another friend wants to write their name as "José" or "你好" or "🍕". The first friend doesn't understand those special letters or emojis. So, you use a secret translator that changes them into something the first friend can understand. That's what Punycode does. A simple example Suppose someone wants a website with the domain: münchen.com The internet's basic domain name system can't directly understand the ü. So Punycode converts it into something like: xn--mnchen-3ya.com Both mean the same website. What you see: münchen.com What computers use: xn--mnchen-3ya.com The xn-- at the beginning tells computers: "Hey! This is Punycode. Decode it back into the real name." Think of it like nicknames Imagine your teacher can't pronounce your name, Tolúwàní. She writes it in a way she can pronounce, but everyone knows it's still you. Punycode does the same thing for website names. Why is it needed? Without Punycode, websites could only use simple English letters like: google.com ✅ example.com ✅ With Punycode, people can have websites in their own languages, such as: café.com mañana.com 中国.com Ελλάδα.gr Behind the scenes, those are converted into Punycode so the internet can route them correctly. One thing to be careful about Sometimes bad people create fake websites that look almost identical to real ones by using letters from other alphabets. For example: apple.com (real) аpple.com (the first "a" is actually a Cyrillic letter, not the English "a") Although they look almost the same, they're different domains. Browsers often show the Punycode version (starting with xn--) instead, helping users spot suspicious domains. In one sentence Punycode is a translator that lets the internet use website names with letters from any language while still speaking the simple alphabet that computers expect.

HashiCorp has introduced tfpolicy, a new HCL-based policy-as-code framework for Terraform, now available in public beta within HCP Terraform. It is designed to simplify and modernize infrastructure governance by integrating policy creation and enforcement directly into Terraform workflows, eliminating the need for separate tools and languages. By Sergio De Simone

No other gadget knows as much about your home as a robot vacuum. They map your space, learn your routines, and many now carry a camera and microphone into every room in your house. As AI gives them a better understanding of what they see, the privacy and security risks these autonomous robots pose are […]

After years of pushing full speed ahead on AI, OpenAI CEO Sam Altman says maybe it’s time for the AI industry to “pace” itself. The comments came just days after one of OpenAI’s own models broke out of its test environment and got tangled up in a breach at Hugging Face — though as Equity’s hosts point out, sloppy security seems to have […]

The chart is interesting. On the IPI benchmark, Opus 5 improved over Opus 4.8, reducing the probability of an attacker succeeding within 15 attempts from 5.5% to 2.0%, and from 0.5% to 0.2% on 1 attempt. It also improved on Sonnet 5 (5.9% at k=15) and Mythos 5 (2.6%), making it the most robust model evaluated. Opus 5 also outperformed all non-Claude models on this benchmark. The most robust non-Claude model was Muse Spark at 16.5% within 15 attempts—more than eight times Opus 5’s rate. The most capable GPT 5.6 variant, Sol, was comparable to its predecessor GPT 5.5 (20.0% versus 20.8% within 15 attempts), and was 10 times as likely to be successfully attacked as Claude Opus 5 at 2.0%. The other GPT 5.6 variants are less robust, at 30.4% (Terra) and 43.9% (Luna). A single attempt against GPT 5.6 Sol succeeded 3.1% of the time, higher than the 2.0% an attacker achieved against Opus 5 after fifteen attempts...

Looking to start your own island paradise full of Miis based on family, friends, and celebrities, but don’t feel like paying full fare? Woot has Tomodachi Life: Living the Dream for Switch on sale for $52.99 (usually $59.95). Sort of like Animal Crossing, but more off-kilter, this unique game sees you building and managing relationships […]

Sony doesn't think the move will hurt it financially.

I just entered my college. I want to learn c++ but my college has python and c in the syllabus. (Python in 1st year). I have a little knowledge in c++ as I studied it in my 12th.(syntax and terms, has not coded much). Can I learn c++ and python at the same time if I spent daily some hours for c++. I want to get the essence in coding, that's why I wanted to study c++. submitted by /u/Voldmort_lostnose [link] [留言]

submitted by /u/iElectric [link] [留言]

Snapchat has adjusted its recommendation systems to ensure that only videos created by real people are eligible for Spotlight recommendations, taking a stance against AI slop.

Sony responded to widespread criticism of its plan to discontinue games on discs in its latest earnings call.

Filmmaker sues Netflix over stolen screener of unreleased Nicolas Cage movie.

MAGA is loudly calling for the former White House chief medical adviser to end up in prison. WIRED asked legal experts to weigh in on whether that’s even possible.