← Feed

Posts

• Post #4517682

  When Claude Code prints that token stat (10k tokens) I assume those are output tokens, right? how do you know?

• Post #4494968

  jack of all trades, orchestrator top gun

• Post #4444013

  vanity metrics of the day

• Post #4413055

  oh my god, new hell discovered

• Post #4380449

  you're all rushing into Skynet speculations from Mythos and other cybersecurity models but in the meanwhile, in the reality of things, about 3 years later after I disclosed these set of (CVE) vulnerabilities, I received a note that a maintainer will look into addressing them in a fork 🤷‍♂️

• Post #4371446

  if you haven't yet jumped on the LifeOS wagon, well... there's no better time. go build yourself a second brain.

• Post #4360022

  from CLI to an isolated workspace environment I can work with Claude Code app in under a minute. Slick DX powered by Boxdown ✨

• Post #4350764

  looks like a lot of you are working with agents in a highly privileged mode + highly sensitive environment (your local dev machine) how do you sleep at nights? 😅

• Post #4326711

  what AX means

• Post #4273194

  it's 2026 and Atlassian didn't add export to Markdown in Confluence :(

• Post #4191982

  Black Hat 2026 will be riddled with AI Security announcements but this one from Snyk I am genuinely excited about Agentic Development Security is how we started with shaping GenAI code to ensure secure and trusted output and then continued to MCP security and then Skill scanning

• Post #4190222

  it's been cooking for quite some time but it's not the duration but rather that it's a relatively small scope so now I'm super curious at what the agent stumbled onto throughout that required this amount of work to be invested... how do you all do agents observability locally?

• Post #4170752

  secure software factory >> software factory

• Post #4168891

  Snyk VulnBench JS 1.0 shows that the best-scoring LLM configuration reached 75.4% Snyk-reference F1, leaving a 24.6-point gap against deterministic SAST reference reproduction. Go read up on this coding agents security benchmark

• Post #4160104

  DevRel friends you should invest more in doing deep research I ran the VulnBench benchmark project at Snyk, which now graduated to a full-time Forward Research initiative under DevRel, and it's not only satisfying from a technical perspective but also incredibly energising to dive into the details

• Post #4133932

  in case you were living under a rock and missed the OpenAI + Hugging Face incident from last week... Here, I highlighted everything you need to know from the incident report. Maybe emergent properties? Maybe Skynet early days. Maybe a nice PR. Either way, stay vigilant.

• Post #4117116

  I was really hoping to use VS Code for managing the second brain Obsidian-like vault but the extensions and overall capabilities are just terrible What did you all do? Just use Obsidian?

• Post #4115690

  guess what really unlocks agentic loops? verifiable software ;-) yep, you still need to write tests, have a deterministic CI setup, and... security controls

• Post #4108962

  color me surprised 😅 ladies and gents, always push back

• Post #4092437

  you know why, right?

• Post #4084875

  appreciate the shoutout from Yigitcan Kaya on the Real World AI Security conference stage from a couple of weeks back on Snyk's ToxicSkills research malicious skills research is incredibly relevant and I'm grateful to have had the privilege to work alongside smart humans at Snyk who pioneered this work around agent skill security

• Post #4058103

  Quick tip - in the latest update of Claude Cowork you can now select text on a doc (the opened right sidebar view) and then tell Claude what to change on it specifically

• Post #4041217

  the pressure is real 😬

• Post #4031519

  If you're not concerned of malicious and insecure SKILL md files you should be and maybe I'll convince you in this presentation of mine form AI DevCon: https://www.youtube.com/watch?v=oJGX8GYLWxg&list=PLISstAySqk7KtlYPFps1ZnK9xNIMSVkDD&index=37 In this session you'll watch live hacking of a malicious skill and how it fools a coding agent for rogue actions, a prompt injection leaks your secrets over email, and a leaky skill passes credit card numbers straight through the LLM...

• Post #4008936

  The OpenJS Foundation contributors leaderboard 🎉 Thank you to all of the amazing humans, some of whom are on this list that I am grateful to call friends, for building a better open-source world for us ❤️

• Post #4005187

  New npq feature 🎉 To help you with figuring out an alternative npm package when the latest one doesn't fit the security criteria, npq will not check prior versions published and suggest them instead Thank you to Brian Clark who suggested this improvement npm install -g npq@latest to get it

• Post #3990742

  Boxdown vs NVIDIA OpenShell assessment for the base Docker image setup

• Post #3982646

  A few weeks back we announced VulnBench at Snyk. It's a forward research benchmark project that I lead to uncover LLM security findings The benchmark isn't about a competition between AI-based scanning to SAST-based scanning, but rather centers on the differences and risks of both

• Post #3964689

  Can I trick Gemini CLI to pop the calc? apparently yes: https://lirantal.com/blog/gemini-cli-invisible-unicode-skill-injection I disclosed a Gemini CLI prompt injection where invisible Unicode tag characters in SKILL md caused the agent to run a hidden command. Google closed the report as out of scope because the workspace was trusted and YOLO mode was enabled.

• Post #3956331

  hah, I do appreciate this update from dependabot but like 10 years too late Snyk dependency upgrade introduced a 21 days cooldown period since 2020 in my repos I have this defaulting to 30 days. call me paranoid. I know.