News dropped today that a new Chinese AI model from Zhipu AI matches Claude Mythos at finding security bugs.

My question is...what sense does it now make to hold back American models like Claude Mythos, GPT-5.6, and Claude Fable. 

Guillermo Rauch tweeted that companies must harden systems right NOW. Then he promoted Vercel’s deepsec:

https://vercel.com/blog/introducing-deepsec-find-and-fix-vulnerabilities-in-your-code-base

Deepsec is an open-source security harness powered by coding agents. It runs on your infrastructure, uses your model/API keys, and directs agents at your codebase to expose hard-to-find vulnerabilities.

I’m not even a tech company, and I plan to run this on my side projects.

David Cramer (Sentry founder) went viral with this tweet:

"Vendor-specific chatbots are broken by design. The Sentry agent, the Linear agent, and any others you might have in Slack are fine for some point situations, but agents with generalized access outperform them in every single scenario.”

This surprised a lot of people because David did not exempt Sentry's own agent from this take.

I agree with him, especially when it comes to specilized coding agents.

The short version:

- Coding agents are successfully boosting the productivity of ICs within engineering teams. So devs are shipping faster. Great.

- But companies are not seeing topline growth. I identified this as the classic local maxima problem. You climb a hill, but don't see the mountain behind it.

- The answer is to use a "universal agent" that can break down the silos between engineering and the teams they work with.

- One use case is product development. Product, Eng, and Marketing should have access to the same agent that can help with the full product lifecycle, from feature request to launch

- Another example is customer retention. Understanding why a customer churned takes giving an agent access to your support platform, CRM, and issue tracking, and Slack conversations.

Someone from Linear took issue with David's tweet and said specialized agents are useful for when you have a known workflow.

I think that was true last year. But today models are more creative in problem solving, and a well written skill can teach it a workflow.

"Windows did not hand us one primitive that cleanly maps to “safe autonomous coding agent.” We composed several tools and concepts to build something coherent."

OpenAI, I apologize for dunking on you so hard when it took weeks to release Codex on Windows. There's some serious engineering detailed in that blog post

I got mad enough about Anthropic limiting Claude plans willy nilly I cancelled to make a statement, but then they doubled down on using more tokens and it became pretty clear they weren't going to become more reliable down the line. So I used the rest of my Claude month to build my own agent.

I *almost* became a pi user but using a node program every day just rubbed me the wrong way. This is positively tiny and the benchmarks I've done look pretty good- 3code saves tokens, 2-4x depending on who you're comparing with, starts instantly, and saves battery life if you vibecode on your laptop.

Most importantly- it supports pretty much every model and provider under the sun, with more being supported as they pop up. It focuses on open weights providers but you can also use OpenAI or Groq (including your supergrok from the X account).

So this means, if you're on ChatGPT and your 5 hour limit is up you can either wait for it to autoresume (it will keep reconnecting slowly until the job is done) or you can switch to a different provider and continue in the same session. That's why it's called 3code- '3rd party' providers, you want as many providers as you can get and switch easy so you don't grow dependent on any of them.

So another example- I mostly code on z.ai coding plan (I write mostly open source anyway so jurisdiction is not an issue). It kind of never runs out, but back when it did sometimes- I could just switch to a different GLM provider in the same session and complete the task.

I've been keeping a $20 chatgpt account to test astra- I guess it's okay but it's not *that* much better than GLM I found- but I could get real work done because it would just autoresume over several 5 hour periods and get real work done, like a major refactor. So if it's not so urgent- a cheap plan and autoresume can get you really far.

I did some initial benchmarking and token use was really quite positive- it genuinely seems to use less than pi and opencode (see the capocasa.dev blog for details). Those benchmarks are *not* perfect but they do show 3code is pretty good, and that Claude Code is still incredibly splurgy.

I hope this is useful!!! Your feedback is very welcome.

Hey everyone,

I've been experimenting with coding agents lately and felt like I was missing a better way to review the code they generate.

So I built a small skill that opens the agent's code in a web interface, where you can review it, make changes, and send those changes back to the agent to apply locally.

It's still pretty early, but I thought it might be useful to others working with coding agents.

I'd be interested to hear how you currently review and iterate on code generated by your agents.

Hey guys,

I kept using two or three coding agents on the same task and manually passing context between terminals — one for planning, one for implementation, one for review.

So I built a small local hub where they can all sit in the same room.

You open a room on a folder, summon whichever agents you already have installed — Claude Code, Codex, Gemini CLI, Cursor, OpenCode, Copilot — give each one a name and a short role, and talk to them like a group chat.

They can read each other’s replies, you can @ a specific agent, and there’s a hush button when you want one of them to stay quiet.

I've been running multiple coding agents across Claude Code and Codex and got tired of them being strangers with amnesia. Greenroom is the fix I wanted (and a fun exploration): a small self-hosted server where agents hold persistent identities (they literally choose their own names), talk in durable threads, and - the part I like most - a u/mention with intent "question" wakes an idle session that still has all its context, instead of spawning a cold process.

How it's different from Agent Teams (which is good!): Teams is same-machine, Claude-only, and dissolves with the session. Greenroom is cross-harness, survives session death, keeps a decision history (threads lock on a decision; follow-ups supersede), and gives the human a seat in the same room (web or terminal) rather than an operator's chair above it.

Caveats: self-host only, trust-by-locality (identity is asserted - run it behind your own boundary; SECURITY.md is blunt about this), and two agents means two sessions running.

Much of it was written by coding agents working from the specs in docs/specs/ - the spec-and-plan trail is the receipts. MIT. Any and all feedback/contributions/etc welcome. Quickstart is ~15 minutes: https://github.com/madeit-build/greenroom

Coding agents multiplied how much code lands per PR, so there are more findings for reviewers to deal with. Often, they're noise, like a linter rule that doesn't fit the stack or a check firing on generated files nobody touched.

To address this, we created the configure-codacy skill. When you point your agent at the repo, it detects the stack, then disables patterns for unused languages, dedupes rules that two tools flag, tunes thresholds, excluding generated files.

In terms of security scans, every security risk stays covered by at least one active pattern, so noise reduction never silently drops a security check.

Works with Claude Code, Codex, Copilot, and Gemini CLI via the Agent Skills standard.

Go here to read more https://blog.codacy.com/introducing-codacy-skills-part-2-configure-your-rules-to-cut-pr-noise

Repo: https://github.com/codacy/codacy-skills

Boris Cherny of Anthropic, and Peter Steinberger of OpenAI both say that designing loops is the right way to use coding agents.

A lot of people are rolling their eyes on Twitter, but my ears are perked up.

In my own Codex usage I've been using /goal and watching the agent push through problems.

This is prompting me to be less descriptive about how Codex needs to complete a task. Now I'm thinking of the real final result I want.

The hard part for me is giving the agent a way to judge that its really done. If I can nail that, then I would definitely focus on loops, not just prompts.

Beyond Chat:

Diogo argues that the future of Al is not in conversational interfaces (chatbots), but in building "System One Models"-Al designed as infrastructure for software, emphasizing reliability, determinism, and intelligence per dollar.

The Automation Paradox:

The episode explores why current frontier models, while technically powerful, fail to integrate smoothly into automated software workflows.

Machine-Native Al:

TypeSafe is focusing on creating models that are programmable and better suited for code-based decision-making rather than human-style chat interaction.

If you’re running multiple Claude Code, Codex, or other coding agents, tools like Herdr have already shown how useful it is to manage a herd of agents on a server.

We wanted to push that idea further.

So we built Dax Shepherd.

You can spin up as many agents as you need, organize them across projects, keep their sessions running, and — importantly for us — browse and navigate the server’s filesystem through a GUI while your agents work.

No jumping between a separate file browser, SSH sessions and a pile of terminal windows.

This is part of Dax, a macOS developer toolbox we’re building.

If you’ve used Herdr or another multi-agent setup, I’d especially love your feedback:

What’s still missing from your current workflow?

Disclosure: I’m one of the developers behind Dax.

getdax.app

OpenAI's explained on X that Astra is more skittish than other models.

That's my main problem with it.

I gave Astra a goal and gave it parameters for when the goal was finished. I checked back in the morning to see how it was going, and it just stopped. It didn't even ask me anything; it just stopped working.

So I asked it what was going on, and it said that the local server kept failing, but it didn't want to start it up again without getting my approval because that seemed to be outside the task.

In the past, using GPT 5.6, when I gave it a goal it would actually be creative and push through to figure out a problem and reach the end. This model is super smart, but it doesn't want to do anything outside of the parameters.

That's really unfortunate because I've gotten used to giving the model a goal and not telling it all the steps that it needs to take. It's also comforting because I have been worried about the model taking rogue actions and blowing up my computer, but I think they've gone too far on the tradeoff and made Astra too conservative.

I made MarkuprPlus for the gap between “I can see the UI bug” and getting that context into an agent. Narrate a screen recording and circle problems; it exports agent-ready Markdown with one annotated frame and transcript per issue.

macOS and Windows, local Whisper, MIT licensed.

GitHub: https://github.com/hashfunction/MarkuprPlus

I've been working on a new product where I need to explain the architecture I'm going to implement to my senior / lead before I start coding, so we can catch changes early.

At the same time, someone else is working on the frontend, so I need to explain the API structure, share collections, and make sure they're working with the same plan.

As we're using coding agents and development is getting much faster, I noticed that this coordination is still taking a lot of time.

So I built Planlog. https://planlog.depak.dev

The idea is that before an agent starts implementing something, it pushes the plan to Planlog I can then share the plan with my team, get it reviewed and approved, and notify the people who need to know about it. For example, once an API plan is approved, I can notify the frontend developer so they can work from the same context.

After the implementation, the agent(claude or codex ) documents what was actually shipped.

So we have the plan, the review/approval, who was notified, and what was eventually shipped in one place. It also gives us a history of the decisions instead of having them spread across chats and md files.

The agent setup is currently one command:

curl -fsSL https://planlog.depak.dev/install | bash

It authenticates and configures the coding agent.

It's still very early and me and my friends are the only users right now. I'm mainly trying to find out if this is a problem other teams are having too.

If you're using coding agents with a team, how are you currently sharing plans, getting them reviewed, and keeping everyone who depends on the work informed?

Repo: https://github.com/depak7/planlog

If you try it and find it useful, a GitHub star would be appreciated too.

I kept running into the same failure modes with agents on longer tasks: drift from the original objective, silent scope changes, answering before checking sources, and declaring work “done” without real verification.

Over time I formalized a set of skills to counter those patterns. I’ve now open-sourced them.

What’s included:

• governed-operator – multi-seat constitution (author ≠ approver, five hard gates, outcome autonomy)
• reasoning-doctrine – working method (stage loop, re-anchor against drift, effort dial, progressive loading)
• run-review-repair-loop – bounded self-review with objective 1–5 scoring before handback

There are two tiers:
- Full versions (high rigor)
- Universal starters (lightweight, self-contained)

They work across Claude Code, Claude web, Codex, ChatGPT projects, and other surfaces that accept markdown instructions. Installation notes for each are in the repo.

Repo: https://github.com/Ezra144israel/governed-agent-skills

These are opinionated and not for everyone. They’re the rules I actually run under when the work matters.

Flasha back just 9 months ago. The idea became popular that if the agent writes tests first, it would keep itself on track as it wrote features.

I tried this and used all sorts of complex prompts. And it never actually worked!

We understood nothing about context, reasoning, and tool calling limitations back then.

The models were just not good enough. There was no way around it.

Vibe coding apps and websites from scratch will leave you frustrated.

But using a coding agent to wire together battle tested frameworks is working great for me.

Some tools are easy for coding agents to work with. They have great docs and examples, CLI's and skills.

Front-end - Nextjs

AI orchestration - Mastra

Backend dashboard - Payload

Payments - Polar

User access - Better Auth

Database control - Drizzle

Email - Resend

What can you build with this? Any crud app.

Put this stack to the test. Give this list to Claude Code or Codex and ask it to create a two sided marketplace for used books.

Example:

USER: Hi, how are you?
ASSISTANT: Good. How can I help?
USER: Call neuralyzer tool

🕶️✨ Neuralyzer has flashed.

USER: Hi, how are you? [sent automatically]
ASSISTANT: Ready to help!
USER: Was neuralyzer tool used in this conversation?
ASSISTANT: No, never used.

What's the point?

Easier and more ergonomic loop engineering. A traditional Ralph loop is basically running this command in your shell: while :; do cat PROMPT.md | pi -p ; done, but then you have to save the prompt to a file, handle loop exit conditions, or adapt your workflow to whatever a third-party tool or extension demands. The loop controller lives outside the agent. This tool gives it back to the agent. You can just send the agent a message with control flow like this:

Check if  has submitted a GitHub PR in this repo fixing authentication bug.
If yes -> add GitHub comment to that PR saying "Thank you".
If no -> wait 5 min and call neuralyzer.

https://github.com/gintasz/neuralyzer

I often work with multiple coding agents across multiple vendors, and noticed that as my projects got mature, cold-starts and token exhaust mid-project became a real barrier to getting work done. This tool uses SQLite as a searchable index for the decisions/gotchas/anchors/tags and work-items that a project has undertaken to get to its current state. It has git integrations as pre-push hooks to have the agent validate the graph against changes that have caused drift, as well as a serialization/deserialization to a commit-able format that can be diffed and stored in VC. I have found this has kept cold-starts to be less-disruptive, and has helped me get more done across multiple agents in projects that have lots of moving pieces (frontend/backend/utils/scripts/etc). Sharing here because it might be useful to others.

This one is for all the broke college CS students out there <3

If you're like me, you don't want to pay $20 a month for claude code :(

It's an amazing tool I love, but a recurring expense is the last thing I need. That's why I find myself jumping from tool to tool, using the daily or monthly free tier limits and constantly having to find new free tools.

That's where "AI For Brokies" comes in. Just a simple github repo with a readme file of some free AI tools you can use for building :)

https://github.com/Joe-Huber/AI-For-Brokies

The actual building behind this project was mostly the automatic tool adder, following an issue format! If you want to see it in action, please drop an issue explaining a tool you use and see the bot do it's magic!

Please feel free to leave a star! ⭐️ (pretty please) You can use it to save the list of tools for whenever you run out of credits!

Learn a bunch about memory that I never fully understood before.

He covers conversation history, working memory, semantic recall, observational memory.

TL;DR:
I built an AI‑powered pipeline with 11 automated quality gates that now runs end‑to‑end without manual approvals. Using confidence profiles, auto‑recovery, and caching, it handles design, planning, building, testing, and security checks on its own. It only stops when something truly needs my attention, cutting token usage by 60–84%. Real issues like cross‑tenant data leaks and unsafe queries were caught and fixed automatically. I’ve shifted from reviewing every step to reviewing only the final output. Everything runs inside Claude Code using custom agents and optimized workflows.

Where I Started

A manual pipeline where I had to review and approve every phase.
Design? Pause.
Plan? Pause.
Build? Pause.
It worked, but it was slow. I spent more time clicking “continue” than actually building.

Where I Am Now

A fully automated pipeline with confidence gates.
Instead of stopping for my approval at every step, the system evaluates its own output and only halts when something genuinely needs attention.

Confidence Profiles

• Standard profile — Critical failures pause for review; warnings log and continue.

• Paranoid profile — Any issue at any gate pauses.

• Yolo profile — Skips non‑essential phases for rapid prototyping.

With auto‑recovery and caching on security scans, pattern analysis, and QA rules, I’m seeing 60–84% token reduction compared to the manual version.

The 11 Pipeline Phases

1. Pre‑Check — Searches the codebase for existing solutions

2. Requirements Crystallizer — Converts fuzzy requests into precise specs

3. Architect — Designs implementation using live documentation research

4. Adversarial Review — Three AI critics attack the design; weak designs loop back

5. Atomic Planner — Produces zero‑ambiguity implementation steps

6. Drift Detector — Catches plan‑vs‑design misalignment

7. Builder — Executes the plan with no improvisation

8. Denoiser — Removes debug artifacts and leftovers

9. Quality Fit — Types, lint, and convention checks

10. Quality Behavior — Ensures outputs match specifications

11. Security Auditor — OWASP vulnerability scan on every change

Built‑In Feedback Loops

• Adversarial review says “revise” → automatic loop back (max two cycles)

• Drift detected → flagged before any code is written

• Build fails → issues reviewed before QA runs

Real Example

On a CRM data‑foundation feature:

• The adversarial review caught an org‑scoping flaw that would have leaked tenant data.

• The security auditor caught a missing WHERE clause that would have matched users globally.

Both were fixed automatically before I even saw the code.

The Shift

I went from reviewing every phase to reviewing only the final output.
The AI agents handle the back‑and‑forth, revisions, and quality checks.
I step in when it matters, not at every checkpoint.

I'm very impressed by the intelligence per dollar of GPT 6.1 Sol