标签：#t

OpenAI announced its next big model, GPT-6 Astra, and also, by the way, that "the AGI era" is here now. Today on The Vergecast, we've got an all-star panel to break down the news of the week. First, senior AI reporter Hayden Field joins us to talk about our supposed AGI era and Nvidia's acquisition […]

The Pentagon says the guidance is being updated after being online for one day.

The company says no children under 13 can ride -- even with a parent. That's more restrictive than the Model Y SUVs it's using as robotaxis.

"I think we can't get in trouble for that now. It's like 20 years ago."

It won’t work : My suspicion was that GPT 5.6-Cyber would succeed, but the frequency and manner of its success removed all doubt. We have to reassess sandboxing quality for capable AI agents, and in general the software stack with which they interact. An off-the-shelf VM is not enough to contain a modern, cyber-capable AI agent. There is simply too much attack surface. Even innocuous features (like running with a display) add extra, exploitable attack surface.

Every neuron and connection in the brain of a fly has been mapped—twice.

Public-market scrutiny will intensify pressure on the Claude maker’s unusual attempt to balance profit and purpose.

Microsoft's Copilot rarely reproduces even full sentences from news articles and books, let alone substantive chunks that could substitute for the original, the company says in new legal filings as it fights copyright claims from publishers including The New York Times and book authors. As part of the lawsuit's discovery, Microsoft provided 8.2 million Copilot […]

Saying X is “formerly Twitter” in App Store lets Musk block use of Twitter name.

AI coding agents can modify an unfamiliar file in seconds. The slower question is often more important: Why does this code look this way? The answer may be scattered across old local sessions: one turn investigated the bug, another rejected an approach, and a later turn made the edit. Git preserves the code change, but not necessarily the surrounding agent conversation. I added a local query layer to ThoughtDAG so a developer—or a coding agent—can deliberately retrieve that history before editing: npx thoughtdag why src/lib/api.ts It searches supported local agent transcripts for turns that changed, read, or discussed the file and returns links to the matching source turns. Observation is not explanation The difficult part was not text search. It was avoiding a false claim of causality. If a session record shows a file edit, ThoughtDAG can report that as an observed change: Δ storedProviders → storedProviders, storedVision… If the agent later says why it made the change, that is useful—but it is still the agent's account, not a verified causal fact. ThoughtDAG marks that separately: ≈ candidate explanation from the agent response This distinction matters when old session history becomes input to another agent. A fluent explanation should not silently harden into ground truth just because it was retrieved. Retrieval stays deliberate For regular use, the same index can be exposed through read-only MCP tools: npm install -g thoughtdag thoughtdag setup mcp The agent can then call why_check , why_file , find , and recall_turn before changing code. Retrieval is explicit; matching history is not automatically injected into every prompt. The index stays on the local machine, and source session files are never modified. The current CLI covers local Claude Code, Codex, and ThoughtDAG canvas conversations. What this does not prove This is a developer preview, not a complete audit trail. An observed edit proves that the recorded session changed a file, not that every reason for

Adding citations to an AI answer feels like the moment the system becomes trustworthy. The response looks researched. Source links appear beside the text. The model is no longer answering only from its training data. But a cited answer can still be wrong. A citation may support a nearby sentence rather than the claim the user cares about. A source may be authoritative while the retrieved passage is stale. File Search may query the wrong store or document version. The model may retrieve good evidence and then write a conclusion that goes beyond it. Grounding is a capability. Trust still requires an application contract. Series note: This is Part 6 of Reliable Google AI Agents in TypeScript . The Interactions API examples use its post-May-2026 steps schema and were checked against @google/genai 2.21.0. The API remains beta, so pin and retest the SDK before copying production code. Retrieval success is not answer success Gemini can ground responses with Google Search for current public information and File Search for indexed domain-specific documents. The Interactions API exposes the execution steps and inline citation annotations, giving the application more evidence than a text completion alone. A minimal Google Search interaction looks like this: import { GoogleGenAI } from " @google/genai " ; const ai = new GoogleGenAI ({}); const interaction = await ai . interactions . create ({ model : process . env . GEMINI_MODEL ?? " gemini-3.8-flash " , input : " What changed in the public policy this week? " , tools : [{ type : " google_search " }], }); The synthesized text is only one part of the result. The steps show whether search occurred and where citations attach. type Citation = { title ?: string ; url ?: string ; citedText : string ; }; const citations : Citation [] = []; for ( const step of interaction . steps ?? []) { if ( step . type !== " model_output " ) continue ; for ( const contentBlock of step . content ?? []) { if ( contentBlock . type !== " text " ) contin

Fala galera, Tudo beleza? Bom, acho que não é novidade para ninguém que IA no desenvolvimento de software já passou daquela fase de simplesmente completar uma linha de código ou criar um método pra gente. Hoje temos ferramentas que conseguem analisar projetos, criar arquivos, escrever testes, ajudar em refatorações e até participar de tarefas bem maiores dentro de uma Solution. Sendo nosso Copiloto, NUNCA O PILOTO (sim no futuro esse vai aparecer tbm) E claro... junto com isso começaram as comparações. Nesse artigo vou comparar 2 que gosto muito de usar no dia a dia, sim eu uso gemini e copilot. Mas tudo ao seu tempo, comparar diversos serviços diferentes sem usar bastante nunca foi meu foco então prefiro falar de algo que eu to usando mesmo, por isso demorei tanto pra escrever. Codex ou Claude Code? Qual é melhor para trabalhar com .NET? Nas minhas experiências (sim na EU, EU USANDO, EUUUUUU.. digo isso porque é normal você falar, mas eu uso como... eu to falando EUUUUU. como ponto de partida para quem principalmente ta querendo entender dos dois e usa pouco ou nunca usou) utilizando os dois, principalmente dentro do ecossistema .NET, percebi que a resposta não é tão simples. E antes que isso vire uma guerra de torcida organizada ( ou do seu politico de estimação) nos comentários: não acho que exista um vencedor absoluto aqui . Não , não tem.... Na verdade, eles possuem formas diferentes de trabalhar e, dependendo do problema que estou tentando resolver, acabo preferindo um ou outro. Então bora bater um papo sobre isso? Primeiro: eles trabalham de formas bem diferentes Uma das primeiras coisas que percebi utilizando as duas ferramentas no contexto de dev é que, apesar de ambas terem o mesmo objetivo — ajudar no desenvolvimento — a forma como chegam até a solução me parece diferente. Codex No meu uso, o Codex me passa uma sensação muito mais de controle sobre o que está acontecendo . Você consegue trabalhar de uma forma mais estruturada, analisar o que será alterado

Google OAuth 2.0 often looks simple at first: create credentials, redirect a user to Google, receive authorization, and start calling an API. The complexity appears when that flow has to work reliably for real users across multiple environments, sessions, permissions, and Google services. A production-ready Google OAuth implementation has to manage much more than the initial authorization screen. Developers need to configure redirect URIs correctly, request appropriate scopes, separate authentication from API authorization, store tokens securely, refresh credentials when they expire, handle sign-out behavior, and recover gracefully when authorization stops working. It is also important to understand that Google Sign-In and Google API authorization are related but different processes. One Tap and Sign In With Google establish who the user is and generally return an ID token. OAuth authorization determines what Google data your application can access and issues access tokens for Google APIs. Google explicitly separates these authentication and authorization flows in Google Identity Services. This guide walks through Google OAuth implementation from initial configuration to production security, One Tap, token management, common Google OAuth errors, and the choice between Firebase Authentication and Google Cloud Identity Platform. Setting Up Google OAuth 2.0: Credentials, Consent Screens, Redirect URIs, and Scopes Every Google OAuth implementation starts with a project in Google Cloud and an OAuth client that represents your application. For a typical web application, the authorization flow follows this sequence: Your application sends the user to Google's authorization service. Google identifies the application using its OAuth client ID. The user reviews the requested permissions. Google sends an authorization code back to an approved redirect URI. Your backend exchanges the authorization code for tokens. Your application uses the access token when calling permitted Go

"Let me be clear: America is not only welcome—we want you there."

The browser console showed exactly what CORS errors always show — a request blocked for violating the same-origin policy — except the response headers, visible in the network tab, clearly included Access-Control-Allow-Origin: * . The header the browser wanted was right there. The browser rejected the request anyway. The detail that's easy to miss in the network tab Chrome's network inspector, by default, coalesces duplicate header names into a single display line — so Access-Control-Allow-Origin: * shown once in the UI can actually mean the header was sent twice by the server, and the browser is showing you a merged, deduplicated view rather than the literal wire response. curl -s -D - https://api.example.com/data -o /dev/null | grep -i access-control Access-Control-Allow-Origin: * Access-Control-Allow-Origin: https://app.example.com Two separate headers, both valid individually, sent by two different layers that each thought they were the one responsible for CORS: our nginx reverse proxy had a blanket add_header Access-Control-Allow-Origin *; for general API access, and the application server behind it independently set a specific origin for authenticated routes. Neither config was wrong on its own. Together, they produced a response with the header appearing twice — and per the Fetch spec, a response with multiple Access-Control-Allow-Origin values is treated as invalid, so the browser blocks the request rather than guessing which one you meant. Why this is worse than a missing header A missing CORS header fails immediately, obviously, the same way every time. A duplicate header fails in a way that looks, from the response body alone, like the header is present and correct — because it is present, twice, which is precisely the state that trips the spec's validation. Every piece of evidence you'd normally check says "this should work," and it still doesn't. The fix Removed the blanket nginx header and let the application server be the single source of truth for COR

AI‑Powered Heritage: Practical Tools for Preserving the Past Introduction A single viral tweet—ChatGPT mistakenly labeling a centuries‑old Sevillian jar as a modern replica—sent shockwaves through the museum world. Within hours, “AI heritage” exploded on Google Trends, and professionals from the Louvre to tiny community archives began asking: Can artificial intelligence actually help us protect cultural memory, or will it become another source of misinformation? The answer is both. Modern AI can reconstruct missing fragments of a fresco, predict stone decay before it becomes visible, and make hidden collections searchable to anyone with a browser . At the same time, the same technology can generate convincing forgeries if misused. This article cuts through the hype and gives heritage workers—curators, conservators, archivists, and even enthusiastic volunteers—a hands‑on guide to turning AI into a reliable ally for cultural preservation. Quick‑Start FAQ Question TL;DR Answer One‑Line Action What is AI in heritage? Machine‑learning models that analyze visual, textual, or 3‑D data to automate documentation, restoration, and access. Explore open‑source libraries like TensorFlow , PyTorch , or OpenCV . Will AI replace conservators? No. AI augments expertise, handling repetitive tasks while humans make interpretive decisions. Start with a pilot: use AI for image classification, keep humans in the loop. Free/low‑cost AI tools for museums? Google Colab , Hugging Face Spaces , QGIS with Python plugins , and the Microsoft AI for Cultural Heritage toolkit. Sign up for a free Colab notebook and run the sample code below. How does AI aid physical preservation? Predictive models flag at‑risk objects; generative models fill in missing texture; drones + CV map structural stress. Deploy a simple damage‑prediction script on your climate sensor data. Is AI safe for sacred objects? Sensitive data can be processed locally; avoid uploading to public clouds unless you have consent. Use ON

1. Introduction In the previous article, we began studying a level 6 CrackMe and quickly reached the Serial verification routine based on the Name. Here is this routine below: 0x401510: pusha ; Save all general-purpose registers ; ------------------------------------------------------------------------- ; PHASE 1: BASE64 DECODING AND SIZE CHECK ; ------------------------------------------------------------------------- 0x401511: mov ebx,DWORD PTR [esp+0x2c]; ebx = Pointer to Serial (passed as parameter) 0x401515: mov esi,0x404200 ; esi = Destination buffer for decoded Serial 0x40151a: push ebx ; Argument 2: Serial string 0x40151b: push esi ; Argument 1: Output buffer 0x40151c: call 0x401633 ; CALL: Custom Base64 decoder 0x401521: cmp eax,0x10 ; Is the decoded buffer exactly 16 bytes (128 bits)? 0x401524: jne 0x40162f ; No -> Direct failure (Jump to failure) ; ------------------------------------------------------------------------- ; PHASE 2: CHECK AND PREPARATION OF 64-BIT INTEGERS (S1 AND S2) ; ------------------------------------------------------------------------- 0x40152a: lea edi,[esi+0x10] ; edi = Pointer to second memory block (0x404210) ; Verification of the First 64-bit Number: S1 = [esi] (0x404200) 0x40152d: mov eax,DWORD PTR [esi] ; eax = Low 32 bits of S1 0x40152f: mov edx,DWORD PTR [esi+0x4]; edx = High 32 bits of S1 0x401532: test edx,edx ; Is S1 zero? 0x401534: jne 0x40153e 0x401536: test eax,eax 0x401538: je 0x40162f ; If S1 == 0 -> Failure ; Comparison of S1 with Modulus M (stored at 0x40403c) 0x40153e: sub eax,DWORD PTR ds:0x40403c ; S1 - Modulus (low part) 0x401544: sbb edx,DWORD PTR ds:0x404040 ; S1 - Modulus (high part with borrow) 0x40154a: jae 0x40162f ; If S1 >= Modulus -> Failure (S1 must be < M) ; Copy and Verification of the Second 64-bit Number: S2 = [esi+0x8] (0x404208) 0x401550: mov eax,DWORD PTR [esi+0x8]; eax = Low 32 bits of S2 0x401553: mov edx,DWORD PTR [esi+0xc]; edx = High 32 bits of S2 0x401556: mov DWORD PTR [edi],eax ; Copy

On 2026-09-04 I pointed a scanner at langchain-ai/langchain . Shallow clone of the default branch, HEAD 79cab2d , read only. It walked 2581 files and printed zero sites. Its own control had passed immediately before the run, with two positive fixtures seen and four negative fixtures clean, so the zero was a measurement rather than a crash. Then I opened one file by hand. libs/langchain_v1/langchain/agents/middleware/human_in_the_loop.py , line 403: def _should_interrupt ( self , tool_call , config , state , runtime ) -> bool : """ Return False if the `when` predicate rejects this tool call, True otherwise. """ when = config . get ( " when " ) if when is None : return True ... return when ( req ) when is supplied by the caller. It is declared NotRequired[Callable[[ToolCallRequest], bool]] on line 195 and documented as returning True to interrupt or False to auto-approve. Its result is handed back unchanged. A predicate that falls off a branch returns None , and the caller on line 436 reads: if not self . _should_interrupt ( tool_call , config , state , runtime ): continue None is falsy. The interrupt is skipped and the tool call proceeds with nobody looking at it. The annotation says bool ; nothing at runtime makes that true. Why the machine stayed quiet I took the failure apart instead of guessing at it. Three causes, each sufficient on its own: Vocabulary. 22 lines in that file matched the approval vocabulary the scanner looks for. Not one of them put line 403 inside its window. The nearest match was 26 lines away and sat in a comment. This project calls the decision interrupt , not approval. Window. The -> bool annotation is on line 378. The return is on 403. That is 25 lines apart, and the window was 12. Signals. Widened to 55 lines, the three behaviour signals still matched nothing on that line. The file walk was innocent. The file is .py , 18256 bytes, and no skip rule matched it. It was read. What I got wrong The window of 12 lines had no measurement behind it

Runnable reproductions for every framework named above, offline and pinned to a version: https://github.com/mahirhir/unanswered-approval

Cloud technology is evolving faster than ever. From containers and Kubernetes to serverless platforms, infrastructure as code, observability, and AI-powered developer tools, there is always something new to explore. As a cloud enthusiast, I’ve learned that keeping up with technology isn’t about learning everything. It’s about staying curious, understanding the fundamentals, and continuously experimenting. ☁️ Exploring Modern Infrastructure Modern infrastructure has changed the way we build and operate software. Tools like: Docker for containerization Kubernetes for orchestration Terraform for infrastructure as code GitHub Actions for automation Prometheus and Grafana for observability Cloud platforms for scalable infrastructure have become an important part of the modern developer toolkit. But tools are only part of the journey. Understanding why we use them is just as important as knowing how to use them. 🛠️ Learning by Building One of my favorite ways to learn is by building small projects. Instead of only reading documentation or watching tutorials, I try to turn concepts into something practical: Learn it → Build it → Break it → Fix it → Understand it Breaking things is often where the best learning happens. A failed deployment, a misconfigured container, or a broken CI/CD pipeline can teach lessons that a tutorial sometimes can't. 🚀 What's Next? The cloud ecosystem is moving toward more automation, platform engineering, AI-assisted development, and increasingly intelligent infrastructure. That makes this an exciting time to be learning. There will always be another tool, another framework, or another platform to discover. And that's the fun part. Stay curious. Keep building. Keep breaking things. Keep learning. ☁️🚀 This is just the beginning of my journey into cloud, infrastructure, developer tools, and modern technology. More experiments and lessons coming soon.