is it time to turn the internet off yet kb.isc.org/docs/cve-2026-943…

🚨 Confirmed. OpenCode hacked. Keys stolen. Telling customers to revoke.

1h on a sub, 5 mins for subagents and API billing You can change it by setting promptCacheTtl (or subagentPromptCacheTtl for subagents) in settings.json though!

I think we might lose public key cryptography.

SCOOP: OpenAI, Anthropic and security researchers are investigating tens of thousands of incidents - not dozens - in which their frontier models took steps that outside evaluators would consider problematic, sources told Axios. The sheer volume of incidents found in our reporting indicate that the problem is orders of magnitude more complex than what is currently publicly known and disclosed. The findings also raise questions about what level of control anyone working on AI development can expect to have over their own technology, and whether these kinds of incidents are becoming synonymous with frontier deployment. Read my latest for Axios here: axios.com/2026/09/26/openai-…

This is an extremely good watch. The things that felt novel/interesting to me: 1. Lock down your agents Humans tend to like 'sharp knife' abstractions - that are powerful, but you can cut yourself if your use them wrong. Lauren says agents perform much better in extremely locked-down environments. Abstractions are designed so they can't screw up, and lint rules enforce it. They built a whole internal framework (Dune) to keep the agent on track. That helps optimise agents that don't have a large context window to work productively in your codebase. 2. Create verification infrastructure To trust the results of any agent, you either need to sit and watch it OR have it provide evidence of its improvement. This has always made sense to me, but Lauren really pushes it hard here: - Invest in custom CLI's that let the agent drive the app and measure its performance - Make the app "factory ready" from the get-go - i.e. deployable to an environment where the agent can mess about with it 3. Feature Maps Lauren's software factory (what she calls an 'outer loop') often requires the agent to break down vague bug reports from users and to turn those into potential fixes. To aid that, they built a 'feature map' of all the main features in their application, which describe exactly how the app is supposed to function. This has become essential for helping the agent navigate the codebase, and figure out quickly how things are supposed to work. It's maintained along with the codebase, and kept in sync via automations. This is the kind of documentation I usually warn against. It goes stale quickly and can confuse agents if it's not kept up to date. But Lauren's team are using it as critical navigation infrastructure, and it makes it possible for agents to explore faster and better - even on a large codebase. So it sounds like navigation docs like this are worth it if they enable new behavior. Banger talk - watch the whole thing on 2x.

I am done with this shit. It is over. The state of engineering right now is horrible. It has been half a month since I started a new role at a big company. Nobody knows anything here. The specs, code, tests, PRDs, tickets, resolution of those tickets, reports, etc., everything is made by Claude Code. Nobody on my team likes this. They are being forced to ship as much as they can. I have heard multiple times from higher management that pushing code is not a bottleneck, so why are we slow? People are working 12 to 13 hours a day just to press enter. Nobody is reading anything. Humans in corporate are doing nothing on their own. Everyone, literally everyone, from an L1 to an L7 engineer here is doing the same thing. Talk to Claude. There is no sense of victory. Nobody is resolving bugs. In reality, nobody is thinking anymore. Everything is done by LLMs. It is so soul-sucking. I would not mind it, to be honest, if we were at least given the time to check out the code and see what is going where. But no, the goal is to just ship. No matter what happens.

A great idea I'm stealing from @dexhorthy: When you first start building a software factory, make it TINY. Don't get it to triage every issue in your repo. Just do one per day. Check its output. Adjust it. Keep going with your regular work. As you begin to trust its judgment, get it to triage TWO issues per day instead. Then five. Then ten. Start small. Adjust. Build trust. Expand.

in enterprise it's an insanely hard problem: - bad memories are worse than no memories. the moment you write down a fact from salesforce or jira, it starts going stale. Try to keep it in sync and you're fighting rate limits, ToS, and vendors who really don't want you building a memory layer on top of their data - invalidation isn't "update one thing" - 1 fact changes and suddenly a dozen memories that leaned on it are quietly wrong - two memories disagree. which one do you trust? "the newer one" is wrong way more often than you think - some knowledge is unevenly distributed on purpose. salaries, deals, hr stuff. not everyone is supposed to know everything, and that's a feature - scoping at write time is a guess. is this a private thing? should the whole team know? the agent has to decide on the spot and both wrong answers hurt - access control has to happen when you recall, not when you write. someone with access saves a memory, someone without it gets it back later; people change roles, leave, switch teams - poisoned data. one injected or hallucinated memory and every future session inherits it - compliance is a nightmare. right to erasure, legal hold, retention windows - forgetting is the actual hard part. more memories means more noise & worse recall and nobody has a good decay function yet we tried

You can now set Claude Code's output style to Concise. Claude leads with the result, keeps responses short, and still gives full detail when you ask. Turn it on in /config → Output style, or set "outputStyle": "Concise" in settings.json.

A technical dive inside our new "Midjourney Scanner"

wait... you did what?!

OAI and Claude both dropped to 98% uptime during February. Another data point: Github has had more outages in Q1 2026 than the entirety of 2016-2019, according to their status page. Software is objectively getting worse.

Claude Code wiped our production database with a Terraform command. It took down the DataTalksClub course platform and 2.5 years of submissions: homework, projects, and leaderboards. Automated snapshots were gone too. In the newsletter, I wrote the full timeline + what I changed so this doesn't happen again. If you use Terraform (or let agents touch infra), this is a good story for you to read. alexeyondata.substack.com/p/…