Published work

instagram · 2026-08-07

51% of business software buyers start research in ChatGPT or Claude now. More often than Google. For demand-gen teams, that's your funnel starting somewhere new. At Ahrefs, AI search was only 0.5% of traffic but 12.1% of signups. Save this. Link in bio.

linkedin · 2026-08-07

30 production MCP servers audited by authgent. Only 1 earned an A on OAuth security. Even launch partners for EMA ship OAuth violations: plain PKCE (forbidden since OAuth 2.1), missing RFC 9728 metadata, unsupported resource indicators. For builders running OAuth endpoints, this is your audit. Drift is invisible: specs change, defaults age, the flow never gets re-checked until something breaks. You still need to know your own flow well enough to map it to the RFC checks. This is not a one-button fix. What's the last RFC check that failed on yours? #OAuthSecurity #MCPServers #APISecurity #SecureByDefault

linkedin · 2026-08-06

OWASP now ranks prompt injection the number one risk in its Top 10 for large language model applications. Most AI security spending still protects the visible layer: input validation, jailbreak detection, guards on what a user types. Prompt injection skips that. In 2023, researchers demonstrated attacks against retrieval-augmented generation systems by embedding malicious instructions inside documents stored in enterprise knowledge bases, instructions the AI system later retrieves as context and executes as though a user had typed them. In enterprises connecting AI systems to large document repositories, the attack surface can span millions of files. For operators building multi-source AI systems, this moves the security perimeter. A retrieved document is an input, the same category as a user prompt or an API response. Treating it as trusted by default is the gap. If you're running a multi-source AI system in this region, worth comparing notes on how you're scoping that perimeter. #PromptInjection #LLMSecurity #RAG #AIsecurity

instagram · 2026-08-05

aicommits went 5x faster — 71 seconds down to 13 on a 95-file PR. The real gain is removing the commit-message tax from your ship loop. Save it. Link in bio.

instagram · 2026-08-04

1.6 billion free tokens per month across 200+ AI providers, wired into Claude Code (via last30days). Test models without vendor lock-in. Save + link in bio.

instagram · 2026-08-04

A post of 7 automation examples by industry hit 232,730 engagements. When you break down what to sell per vertical instead of one broadcast pitch, it lands. Pick your angle. Save + link in bio.

instagram · 2026-08-03

Fish Audio says S2.1 Pro can create a natural-sounding voice clone from as little as 10 seconds of audio. For GCC founders, one approved voice can now carry multilingual content tests before a studio day gets booked. Save this, share it with your content lead, and use the link in bio. Source: https://fish.audio/?utm_source=x&utm_medium=organic_social&utm_campaign=s21pro_launch&utm_content=try_s21pro_free

instagram · 2026-07-27

Cloudflare will judge AI crawlers by their whole behavior, starting September 15. Block AI training and bots like Googlebot get blocked outright too, worth checking now if you run a GCC site behind Cloudflare, per Cloudflare's own notes on a Hacker News thread. Save this before September 15. Full breakdown and more: link in bio.

x · 2026-07-26

PentestingEverything just shipped v2.0.0. Open source pentesting knowledge base, 1.6k stars, covering 23 security domains: web, API, mobile, cloud, AD, OSINT, IoT, blockchain, wireless, network, infra, DevSecOps. Methodology, checklists, payloads, commands in one index. Free.

instagram · 2026-07-26

Kimi K3 built 4 playable 3D worlds in one demo. The useful kernel is simple: front-end builders now have another model to test on visible product work, where speed, layout quality, and interaction detail are easy to judge. Use the carousel as a quick check. Source: last30days://new-ai-tool-and-model-releases-this-month/2026-07-25 Save this for your next AI tools review. Link in bio.

linkedin · 2026-07-26

Opus 5 could match or beat Fable-level performance on shorter tasks, while longer tasks seemed less ambitious and less complete. That is the useful catch from Ethan Mollick's early test. A model upgrade can look strong when the task is tight, then show its limit when the task needs a fuller body of work. For builders, the lesson is practical: test the task shape before you move the workflow. Use the source method in a small trial today. Give the model a short creative task with a clear runtime target, as in: "create a visually interesting shader that can run in twigl-dot-app." Keep the job narrow enough that quality is visible fast. Then run one refinement pass with the exact command from the source: "Make it better." Watch whether the second pass improves the work, or only decorates the first draft. For longer work, judge completion separately. Mollick's note says longer tasks seemed less ambitious and delivered a less complete set of work, so a short-task win should stay in its own lane. For a GCC founder, this turns AI tool testing into an operating check. The question is which task the tool can carry with supervision you can afford. The source example was a procedurally generated neo-gothic shader for twigl.app, an online editor for one-tweet shaders with gif or webm generator and sound shader. Source: Ethan Mollick on X. If you are testing new AI tools this week, DM me the workflow you want to pressure-test. #AIagents #FounderTools #GCCbusiness #CreativeAI

instagram · 2026-07-25

smtp-probe scans IPs against 29 RBL blacklists. For GCC operators, email trust needs a visible check before signup or outbound work depends on it. Source: https://github.com/monto-fe/smtp-probe. Save/share this, then use the hub in bio: https://humoudalmunawer.vercel.app/

linkedin · 2026-07-25

Kimi K3 was tested against Fable 5 on ~1,000 agentic tasks. The useful takeaway for builders is simple: long AI work should be routed by task fit, because one model can carry much of the loop when the job is measured in real agent tasks. Use this as a practical benchmark pattern. Start with one task family you already understand, like real repo bug fixes in the SWE-bench style. Fireworks.ai lists that family at 460 tasks, which makes it large enough to show behavior across real repo work. Run the open model and the closed model on the same task shape. The source compared Kimi K3 and Fable 5 inside real agent loops, then looked at which model should handle each job. Treat routing as the product decision. Fireworks.ai says oracle routing selected K3 for 72-96% of tasks, and results were up to ~50X more cost effective than Fable alone on long agentic loops. For a GCC founder, this points to a cleaner operating question: which tasks need the premium path, and which tasks can move through a cheaper open model with measurement around it? Source: https://fireworks.ai/blog/kimik3-fable More founder systems notes: https://humoudalmunawer.vercel.app/ #AIagents #FounderTools #GCCbusiness #ModelRouting

linkedin · 2026-07-24

A four-line diff with a passing test looks like an easy yes. That is the wrong signal to sort requests by. GitHub's engineering blog walks through a small example: surfacing a last_active_at timestamp that already exists in the backend, on a settings page. The team spends forty minutes in a thread over it. The piece says if it comes back as a four-line diff with a passing test, ship it. But size alone never tells you the real cost. Refactoring a well-tested helper is usually cheap. Changing authorization behavior is not cheap, no matter how clean the diff. Changing data-retention semantics is not cheap either. A two-hour change can become a two-week distraction if it touches the wrong part of the system. So before a request turns into a thread debate, sort it by what it touches, not by line count. For a small, low-risk ask like this one, the source's method for a constrained attempt: produce the smallest possible patch, keep it behind the existing feature flag, do not change the public contract, and add or update tests. That framing turns a forty-minute thread into a fast yes or a clear no. Full piece: https://github.blog/engineering/the-cost-of-saying-yes-has-changed

linkedin · 2026-07-23

Docker sandboxes are free and fast to set up, and they hold a coding agent's session while the creator verified the isolation claims directly with Docker's team. That matters because Claude Code and Codex both ship a "dangerously skip permissions" flag, also called Yolo mode, that lets the agent run any command with no prompt. Without a boundary around it, that agent reaches every file and folder on the machine, can kill running processes, rewrite environment variables, and edit or delete anything it touches. A prompt injection attack against that same setup can grab an API key and send it straight to a URL the attacker controls. Put the agent inside a Docker sandbox before the next session starts. In one demo run under this setup, the agent hit a failed debug and rolled back a database migration, then wrote a new one, moving the schema on its own. It had made a backup of the database first, which is the one thing that kept the mess recoverable. Full breakdown of isolation levels and setup: https://www.youtube.com/watch?v=zb2LyMro77M

instagram · 2026-07-24

A single portal now connects over 200 AI models to different tasks. For builders, that is 200-plus models reachable through one portal. Save this before you build. Link in bio.

instagram · 2026-07-23

$3 gets you an AI meeting notes app for good, no subscription attached. Bring your own API keys and pay only for what you use, not a flat monthly fee. Save this. Link in bio.

instagram · 2026-07-20

A chart on Hacker News says StackOverflow has lost 99.41% of its activity. The site every developer opened the second they got stuck barely gets visited anymore. Save this, full breakdown on the cards, link in bio.

linkedin · 2026-07-18

An AI agent trained a simulated spider to climb stairs. Verification bar: reach the top at least 8 out of 10 times. Time to get there with Claude driving the whole loop: about 60 minutes. That number matters more than the spider. It shows how fast a build closes once you cap it with a hard pass rate instead of a vague ambition. The method behind it holds a 5-part shape: TASK, WHY, OUTCOME, CONSTRAINTS, VERIFICATION. Write the task and the reason first, so the model knows why the outcome matters, not just what it looks like. State the outcome and the constraints plainly, then attach a verification test the run has to clear before you call it done, in this case 8 out of 10 spider climbs. Inside Claude Code, the /goal command can anchor that verification step directly, though the command only works there and nowhere else. Use the same shape on a build that has nothing to do with spiders. Pick a real outcome, write the 5 parts, set a numeric bar the output has to clear, then let the loop run until it does. Full walkthrough: https://www.sabrina.dev/p/6-insane-projects-to-learn-claude-fable-loop-engineering

linkedin · 2026-07-19

A small Python tool called model-routing-calculator computes what it actually costs to route AI tasks by tier instead of running everything on the top model. For a judgment-heavy task, that routed cost comes out to 63% of the top-tier baseline. For a long-unattended task, it drops to 46%. That gap matters for anyone building agent workflows who defaults every step to the priciest model without checking. The tool splits work into three lanes. Everyday tasks go straight to a mid-tier model. Judgment-heavy tasks get one top-tier call to plan the work, then a mid-tier model executes it. Long-unattended tasks get a top-tier model orchestrating while mid-tier subagents handle the execution. Run it against your own task list with python3 route.py examples/tasks.json, and before it touches your file it runs an assert-based self-check of its own routing and cost math. It has no dependencies and makes no network calls, pure Python 3 standard library, and the example pricing table is placeholder rates in dollars per million tokens, not real prices for any provider, so swap in your own numbers. Code's MIT licensed on GitHub: https://github.com/Humoudideas77/model-routing-calculator

linkedin · 2026-07-15

Frontier coding agents reached a 99% success rate on dexterous manipulation tasks, including PushT, pin organizing, and zip-tie cutting. Tencent deployed ARGUS, an agent debugging system, on a production cluster of over 10,000 GPUs for more than six months, validated through five real-world case studies covering compute stragglers, communication link degradation, and pipeline bubble amplification. Agent search scaled with count: 8 parallel agents reached higher-scoring solutions sooner than smaller agent counts. Agent count and cluster scale are parameters from real production deployments. Teams can copy both numbers directly into their own agent-search and debugging setups. 1. Clone the repo obra/superpowers from github.com/obra/superpowers. Description: "An agentic skills framework & software development methodology that works." 254k stars, 22.7k forks, 153 open issues, 176 open pull requests. 2. Clone the repo sandman/agentic-playground from github.com/sandman/agentic-playground. Description: "Experiments on AI agents, frameworks, MCP etc." 3. Set agent count to 8 in any agent-search pipeline; Import AI 463 reports 8 parallel agents reach higher-scoring solutions sooner than smaller counts. 4. Run a dexterous-manipulation policy against PushT, pin organizing, and zip-tie cutting; Import AI 463 reports a 99% success rate on these tasks. 5. Structure a production debugging agent across ARGUS's three layers: the Python layer for scheduling and data preparation, the framework layer for phase orchestration, and the GPU runtime layer for kernel execution. Full source: Import AI 463, importai.substack.com/p/import-ai-463-self-improving-robots.

instagram · 2026-07-14

CI time dropped from 14 minutes to 6 after one team adopted uv lock. Their production Dockerfile still installed packages from requirements.txt with pip, and the two files drifted for 41 days before anyone noticed. uv.lock held httpx 0.27.2 and httpcore 1.0.5. The Docker image held httpx 0.26.0 and httpcore 0.18.0. A deploy went out on a Tuesday at 09:12. Production threw an ImportError. The first route to fail was POST /payments/capture: httpx.Timeout(pool=...) exists only in httpx 0.27 and later, and the older version running in prod could not read it. The outage lasted 22 minutes. Rollback took 19, slowed by an argo history limit and image pulls on slow nodes. Match your lockfile to your image before it matches you: 1. Open uv.lock and read the exact pins it holds, for this team httpx 0.27.2 and httpcore 1.0.5. 2. Open the production Dockerfile and check what it actually installs. This team's still ran pip install -r requirements.txt with httpx 0.26.0 and httpcore 0.18.0. 3. Rebuild the Dockerfile to install from uv.lock instead of requirements.txt so both files stay in sync. 4. Document the change as this team did in ADR #47, their decision to standardize this stack on uv. 5. Apply the same pinning discipline project-wide: one MCP documentation server project pins mcp at 1.2.0 or higher, rank-bm25 at 0.2.2 or higher, and python at 3.10 or higher, all in one file. Full timeline and every version pin sit on the cards. Save this before your next deploy. Link in bio.

linkedin · 2026-07-14

Salesforce cut its customer service team by about 4,000 roles, CEO Marc Benioff confirmed. AI agents now handle half of all customer interactions there, and support costs fell 17% since early 2025. Adobe made its AEP Agent Orchestrator platform generally available, with six AI agents built in. Microsoft is preparing multiplayer AI collaboration features for Copilot this fall. Through a GSA partnership, Microsoft is also offering 365 Copilot free to federal agencies for up to 12 months. For operators, half of Salesforce's customer interactions already run through AI agents at lower cost today. How to use it now: 1. Audit the customer service queue for repetitive tickets before adding headcount. Salesforce's 17% cost drop traces to routing tickets to AI agents instead of hiring more staff. 2. Running on Salesforce already? Check how many support interactions AI agents currently handle before building a separate bot from scratch. 3. Microsoft's multiplayer collaboration features for Copilot arrive this fall. Put a review on the calendar now so a pilot group is ready before the wider rollout. 4. On Adobe's stack, review AEP Agent Orchestrator's six built-in AI agents before commissioning custom agent work. One may already cover the task. 5. Federal agency or contractor? Microsoft 365 Copilot is free for up to 12 months through the GSA partnership. Confirm eligibility before paying for an alternative. Full rundown: https://tldrai.substack.com/p/googles-gemini-boosts-day-to-day

instagram · 2026-07-18

A cache read on Claude's API costs 10% of the normal input token price. A cache write costs 25% more, for a cache that lives 5 minutes. That is the entire mechanism behind prompt caching, per Anthropic's own documentation. Prompt caching reuses a fixed prompt prefix across requests instead of paying full price on every single call. The prefix can be a system prompt, tool definitions, reference documents, even images. Anthropic bills that block once at full price, then every request that reuses it inside the cache window gets billed at a tenth of the cost. The default cache lasts 5 minutes and refreshes with each use inside that window. A longer 1 hour cache is available too, at twice the base input price. Order matters for what counts as reusable: tools first, then the system prompt, then messages, and an edit to any earlier block invalidates every block that comes after it. This matters for agents that carry a large system prompt, chatbots that carry long history, and RAG systems that query the same documents over and over. The bigger and more repeated the context, the bigger the saving, for one line of config. Five steps to turn it on sit on the cards, straight from the Anthropic docs. Save this before the next LLM bill runs high. Full docs in bio.

instagram · 2026-07-13

Your server looks dead. SSH times out, the browser spins, you are reaching for the reset button. Most of the time the box is fine, the lock just changed. Tailscale auth keys expire on their own after 180 days, a safety default. When one lapses the machine drops off your tailnet, so SSH and the site go dark while the server itself keeps running. One toggle prevents the whole thing. Flip it the day you add the server, long before any outage. Do this on every server you add: 1. Open the Tailscale admin console and find the machine. 2. Open its key settings and disable key expiry for that machine. 3. Check that it now reads key expiry disabled, so it stays reachable. 4. Already locked out? Get in over an out-of-band path first, a provider rescue console, then flip the same setting. 5. Make it a habit: disable expiry the moment you add a server, not the day it drops. Tailscale's own docs have the exact click path. Full walkthrough, link in bio.

instagram · 2026-07-12

Claude limits run on tokens, not messages. The fix is usually the workflow, not a bigger plan. Ruben Hassid and a generativeai.pub workflow guide broke down this week where the limits come from: Claude bills by tokens, resets on a rolling five-hour window rather than at midnight, and re-reads the whole conversation on every turn, so long chats cost more from the re-read than from the message count. Do these today: 1. Keep one topic per chat, and open a new chat for a new topic; dead context is dead tokens. 2. Plan in Chat before you build, and move to a build surface only once the plan is set. 3. Summarize every fifteen to twenty messages, then start a fresh session. 4. Turn search and connectors off by default, and switch them on per task. 5. Upload recurring files to a Project once, so every chat reuses them without re-paying. 6. Convert a long PDF to markdown before uploading, since one raw page can run about 3,000 tokens. 7. Route simple work to Sonnet or Haiku, and save Opus or Fable for the roughly ten percent that needs them. Fable 5 went pay-per-use on July 12, and a forty-turn thread runs about $14, so use it one or two turns for strategy, then switch to Opus. Full breakdown, link in bio: Ruben Hassid on X and the generativeai.pub workflow guide.

linkedin · 2026-07-13

One advisor call kept 92% of the top model's score at 63% of the cost. The numbers are from Anthropic's published pairing tests, which Allie K. Miller broke down this week. Claude Sonnet 5, with the larger Fable 5 consulted once for planning, scored 92% of Fable's solo result on SWE-bench Pro. In the reverse arrangement, Fable orchestrated Sonnet subagents and held 96% of solo performance on BrowseComp at 46% of the price. OpenAI shipped GPT-5.6 the same week in three sizes (Sol, Terra, Luna). Miller: "You just can't expect a business user who is swamped with a million other things to know this." Routing by task is still a manual choice. The setup is five steps and takes about an afternoon: 1. Write down the AI tasks the team ran last week. Typical list: code review on pull requests, support-ticket triage, first drafts of the weekly report, meeting summaries, invoice data extraction. Tag each task as everyday work, judgment-heavy work, or long unattended jobs. 2. Set the everyday tag to a mid-tier model as the default. On the Claude API that model is Sonnet 5; in the GPT-5.6 family it is Terra. Most requests fall in this lane. 3. Give each judgment-heavy task one advisor call to the top tier, Fable 5 or Sol. The advisor writes the plan or reviews the finished work, and the mid-tier model executes. This is the 92-at-63 arrangement. 4. Run long unattended jobs the other way around: the top model splits the job and hands the pieces to subagents. This is the 96-at-46 arrangement. 5. Paste both benchmark links into the cost sheet and recheck monthly. Anthropic and OpenAI both redrew their tier boundaries this quarter, and the right defaults will drift with them. Full numbers: x.com/alliekmiller/status/2074903086259142710 and oneusefulthing.org/p/the-twilight-of-the-chatbots

Prompt caching: cut your LLM input cost up to 90%

One line of configuration turns a large, repeated context from a full-price bill into a tenth of the cost. Here is the exact mechanism, the numbers, and how to switch it on.

Tailscale key expiry: never get locked out of your own servers

A node whose key expires drops off your tailnet — and if it is the box you reach everything else through, you are locked out. For always-on servers, disable key expiry deliberately.

Batch API: cut LLM costs 50% for work that can wait

Send requests that do not need an instant reply through the Batch API instead of the standard endpoint, and the same call costs half as much. Here is the mechanism, the limits, and where it pays.

Kimi K3 beat Fable 5 on cost, not on effort

Fireworks ran a 1,000-task agent benchmark comparing an open and a closed model. The routing result matters more than either model winning.

The UK Government Just Measured the Open-vs-Closed AI Gap

AISI ran real cyber capability evals against GLM-5.2 and DeepSeek-V4-Pro. The gap on narrow tasks is now months, not tiers -- but a second test shows exactly where it still holds.