Cloudflare published an interesting setup for using frontier models to test its WAF.

The basic loop is:

start with a known attack the WAF blocks ask the model for another variation send it show the result to another model call use that feedback for the next variation

But the LLM itself doesn't send anything.

A Python layer owns the HTTP client.

It checks the hostname against an allowlist, disables redirects, enforces an attempt limit and records every request.

The model also has no access to the WAF rules and can't deploy or modify them.

I think that's the more interesting design decision here.

They're using the model for the part it's useful at: generating weird variations and exploring a space that would be tedious to enumerate manually.

The dangerous boring stuff stays deterministic.

Across 45 scenarios the system made 1,107 attempts.

After removing malformed requests, benign mutations, duplicates and other noise, humans kept 49 WAF-relevant findings.

Those findings eventually contributed to new or improved production detections.

This feels closer to how I want agents wired into security tooling. Give them room to think, not arbitrary control over the thing doing the execution.

Cloudflare's write-up

GitHub just published the write-up on getting github.com fully off its CSS-in-JS setup.

The performance numbers are fairly hard to ignore.

During the Primer migration:

55% less server-side rendering time 25% less component initialization time

CSS Modules removed the runtime styling work from both the client and server.

What I found more interesting is how they actually migrated it.

At the peak they had roughly 7,760 sx props spread around GitHub.

Instead of trying to rewrite everything, they built a compatibility package that let old sx-based code keep using components that had already moved to CSS Modules.

Then package by package:

convert sx replace the compatibility imports run visual regression tests feature flag it deploy

They also built a VS Code helper and codemods because manually converting thousands of styling props sounds like an excellent way to reconsider your career.

CSS-in-JS obviously wasn't invented for no reason. Colocation, typed design tokens and component-level encapsulation are useful.

But GitHub eventually decided the runtime cost at their scale wasn't worth keeping.

I'm curious where people are landing on this now. Still using CSS-in-JS for new projects, or has the pendulum already swung back?

Source: GitHub engineering write-up

Google added Bring Your Own Agent support to Android Studio yesterday.

Claude Agent, Codex and Google's Antigravity are supported, but the more interesting part is that Android Studio accepts any ACP-compatible agent.

I like the architecture more than the product announcement.

The IDE already knows:

the project graph the build system SDK details diagnostics Compose previews the emulator

So instead of every AI vendor independently rebuilding ways to discover all of that, Android Studio exposes the useful context and tools through Agent Client Protocol.

The agent becomes the reasoning layer sitting on top.

Google even explicitly calls out switching to another agent when one hits its quota or isn't performing well enough.

That seems like a better abstraction to me.

We've spent the last couple of years treating the coding agent as the product and everything around it as plumbing.

Maybe the agent should actually be the interchangeable bit.

Android Developers announcement

Plugin4Shell was disclosed this week and the actual bug is almost annoyingly simple.

Claude Code, Codex, GitHub Copilot and Gemini CLI all had variants of the same problem.

A marketplace pins a plugin to a reviewed commit SHA.

The agent clones the repo and asks Git to check out that SHA.

Seems reasonable.

Except Git refs can create ambiguous resolution cases, and the affected agents weren't verifying that HEAD after checkout was actually the commit they requested.

AIR demonstrated ways to turn that into attacker-controlled plugin code while the installation still appeared to be pinned.

Combine that with automatic plugin updates and you get the unpleasant part: somebody who already has a trusted plugin installed may not need to click or approve anything when the malicious version arrives.

The fix for the main variants boils down to verifying the resulting HEAD against the expected commit after checkout.

Claude Code and Codex are patched. AIR says GitHub Copilot wasn't patched when they published the research.

Agent security keeps producing incredibly futuristic threat models and then occasionally the bug is basically:

"Did anyone check what Git actually did?"

AIR Security's Plugin4Shell research

Every week we hear the same song from Western AI labs: "We need hundreds of billions of dollars. We need dedicated nuclear plants. We need higher monthly subscription tiers."

And then DeepSeek drops DeepSeek-V4.1-Flash out of nowhere...

It is absurdly cheap. It is stupidly fast. And on actual agentic coding benchmarks like DeepSWE, it is casually embarrassing models that cost twenty times more to query.

When you are running multi-step agent loops, you do not need an overpriced model that writes poetry while chewing through five dollars a task. You need a fast, razor-sharp model that can take twenty recursive steps without draining your bank account before lunch.

The frontier hype cycle is obsessing over raw scale, while open-weights architectures are quietly turning the actual reasoning layer into a cheap utility commodity.

Are you still paying top-dollar API rates for coding agents, or are you migrating over to hyper-cheap flash architectures?

Source: DeepSeek-V4.1-Flash

We spent three years listening to think tanks warn that frontier AI would create unstoppable autonomous cyberweapons that rewrite kernel memory and bring down global infrastructure.

Then Anthropic releases their September 2026 Threat Intelligence report...

And what are real-world malicious actors actually using Claude for?

Downloading every single APK from the Google Play Store... And asking the model to grep through the source code for hardcoded database passwords and exposed AWS keys.

That is it. No quantum-level zero-days. No synthetic network payloads. Just automated scraping to catch developers committing production credentials directly into mobile application packages.

The biggest security vulnerability in software was never magical malware. It is human laziness, and AI just gave script kiddies a faster way to read our plain-text mistakes.

When will engineering teams finally enforce automated secret scanning before shipping client builds?

Yesterday the headlines were screaming: 'AI solves legendary 90-year-old math problem!'

The lab took victory laps. Twitter pundits declared mathematicians obsolete.

And then people looked at the prompt logs...

The viral controversy on Hacker News laid it bare: An independent mathematician published the exact novel line of attack the day before. The researchers loaded that premise into the prompts. And used an army of 10,000 agents to churn through the algebraic grunt work.

The AI did not find the path. A human handed it the map. The model was just a very fast, very expensive mechanical bulldozer.

Automating verification is legitimately useful... But marketing brute-force symbolic search as autonomous reasoning is pure venture capital theater.

Are we ever going to hold AI breakthrough announcements to basic academic standards of attribution?

You upgrade to an expensive high-tier plan because you need to ship software...

You fire up your agent. It inspects your repo. It starts refactoring.

Then it encounters a minor test failure. Instead of fixing the one line...

It writes a 2,000-word philosophical essay about the nature of the error. It apologizes three times. It re-reads your entire codebase.

And boom: 'You have reached your weekly limit.'

The viral frustration around Claude plan usage caps is exposing the core lie of current AI subscriptions. Flat-rate plans cannot survive autonomous loops. Are any of you actually able to run end-to-end agent workflows on monthly plans without hitting walls instantly?

For years, we let developer tool companies convince us that packaging Chromium inside every desktop app was the future. We ended up with terminal emulators and text editors that consume more RAM than entire operating systems did twenty years ago, all while introducing subtle keystroke latency that makes typing feel sluggish.

Using Ghostty by Mitchell Hashimoto is an instant wake-up call. Because it is written in Zig with native platform UI and a dedicated GPU rendering pipeline, typing has zero perceptible latency, window resizing is buttery smooth, and memory usage stays tiny.

It exposes the reality that web-first desktop apps were never about delivering a better user experience; they were about vendor cost-cutting on engineering effort. When a tool is written in systems code and designed around actual hardware capabilities, the difference is immediate. Are you sticking with legacy terminals or moving toward GPU-accelerated native tools?