Google Play's new Android memory thresholds land in February 2027, and the RSS + swap part is easy to get wrong. The metric is dynamic memory = anonymous RSS + swap. File-backed pages are excluded, so Android discarding library code won't lower it, and swapping to zRAM won't make it look like you freed anything. A few things to watch: → Java heap isn't the whole process. On Android 8+, bitmap pixel data lives in native memory → RSS counts shared pages in full, PSS splits them across processes. Example: 90 MB private + 30 MB shared with 2 other apps = 120 MB RSS, but 100 MB PSS → PSS can shift when other processes start or stop sharing pages Quick example: 200 MB anonymous memory, 60 MB moves to swap. RSS drops to 140 MB, dynamic memory stays at 200 MB. The p90 thresholds (apps, not games): → 4 GB tier: 2 GB foreground | 1 GB background → 8 GB tier: 2.25 GB foreground | 1.5 GB background → 16 GB tier: 4.25 GB foreground | 2 GB background So 1.5 GB in the 4 GB tier is fine in the foreground but over the limit in the background. Mixing both states into one number hides that. Play uses aggregated p90 over 28 days, so one heavy session doesn't say much on its own. This blog from @measure_sh walks through all of it, and shows how to flag high-memory sessions (at 75% of target) and tie them back to session replays 👇 measure.sh/blog/android-memo…

Every coding agent session starts from zero. AGENTS.md fixed half of it. Claude Code, Codex, Cursor and OpenCode all read the same rules file now. The other half is knowledge. The retry policy, the API quirk, why a decision got made. A rules file doesn't hold that, and built-in memory stays on one machine with one tool. The test in this Article is the one I'd steal: ask Claude Code in one repo and Codex in another the same question. If they don't cite the same file, they don't share memory. They share a naming convention. What I'd take from it: 1. AGENTS.md holds rules only, under 200 lines, plus a pointer to where knowledge lives 2. Write docs for grep, not for browsing. One topic per file, keywords in the first lines 3. One server every agent reads from, instead of copies going stale in each repo 4. Agents get read-only by default and write into an inbox a human reviews 5. Owner and last_reviewed on every doc, so stale ones show up in a query Boring setup. That's the point. You stop re-explaining your codebase to four agents every morning.

Most security scans are a photo. Your code is a video. Claude Security just fixed that part. Connect your repos once, it runs a deep baseline scan, then keeps scanning changes based on how risky and complex they are. Read the launch blog though, and the scanning isn't what I care about. These are: 1. Fixes close themselves. Ship the fix in Claude Code or anywhere else and the finding gets marked fixed. If the bug comes back, it reopens. 2. One project can hold several repos. So it can catch the bug that lives between services, like a backend trusting input the client was supposed to validate. 3. You can tell it what it can't see. Each project gets a knowledge base for how you deploy and which policies apply, plus a threat model Claude writes from your code that your team can edit. That's how it skips risks your setup already handles. 4. Every finding has a severity and an attack path, so you fix what an attacker can actually reach first. 5. It lives in your tools. An API, webhooks for new findings, and an MCP connector in Claude Code. Pull up a finding, ask about it, fix it, resolve it, same session. Vanta's security lead said the findings only matched how they prioritize after they wrote their own risk policy into the threat model. That's the real lesson. A scanner is only as good as the context you give it. public beta, Enterprise only. Eligible orgs get $25K in usage credits a month for two months.

Opus 5.5 is turning into After Effects for devs, and most people still think it's "one prompt". I made a 15s Studio1 showreel with it last month. One prompt, 11 minutes. But what's actually happening under the hood: 1/ Opus can't output a video -> it writes a program, and a headless browser turns that program into frames 2/ Every frame is a function of time -> seek(t) paints exactly what's on screen at second t. No timers, no Math.random 3/ 15s at 60fps = 900 frames -> Playwright grabs each one, ffmpeg stitches them into an MP4 4/ So any frame can be fixed on its own -> title lands too early? change one number and re-render 5/ The chat app can write it, an agent can render it -> Claude Code with a shell can render, look at its own frames and fix them 6/ Give it real assets -> your logo, real screenshots, the site URL. Leave blanks and you get the same gradient title everyone posts 7/ Code still loses somewhere -> photoreal scenes and characters still need footage or a video model The one-prompt clip is the demo. The render loop is the real tool 🎬 My exact prompt is in the quoted post 👇

The scary part isn't the agents. It's that the bank can't tell your agent from an attacker, because both log in with your password. Handing an agent your login was always a hack. What banks need is real agent access: read-only by default, scoped, revocable, and logged as the agent, not as you. Until then, blocking them is the only switch they have.

I gave an open model a screenshot of a solid black circle. It read the colour picker (ffec9980, an 8-digit hex), found the change that only adds "#" to 6-digit hex, and landed on a one-word fix: hex8. Told a user saw a bug and handed the screenshot, it found 8 of 10 visual bugs. If someone already screenshotted the bug, give your AI reviewer the screenshot 👀

litellm 1.107.0 on PyPI is backdoored. Again. The nasty part: it runs on every Python start on the machine, even in processes that never import litellm. It goes after SSH keys, cloud creds and your Claude Code, Cursor and Copilot configs. If it touched a machine, rotate everything and pin 1.106.2. Your LLM gateway sits next to every API key you own.

Your devtool's benchmark chart isn't the pitch anymore. A 10-point intelligence lead now buys about 20% more developer traffic. In late 2025 it bought nearly 69%. Cognition says its own data agrees: many coding tasks are now "intelligence saturated". Once any model can do the task well, cost and speed are all that matter. If developers pick models that way, they'll pick your tool that way too. What I'd put in front of developers now, as someone who runs DevRel for devtool teams at @Studio1HQ: → cost per task on one real workflow, not a leaderboard → time to the first thing that actually works → where it fails, written down → a rerun kit so they can check you When I published my PR-review benchmark of Muse, the bill sat next to the score: $0.18 per review Show developers what it costs, not just how it ranks.