「 UX Engineer 」 Trying to work out what's going on, and what happens next. Mostly tech. 🇧🇻 https://xitter.cf/t.co/3cfz3kER3g co-founder

🇫🇮 Finland | 🇪🇸 expat
Joined January 2009
David Corbacho retweeted
one day you wrote console.log("here") for the last time and didn't even know it
213
1,730
268
17,895
597,811
David Corbacho retweeted
Factories should be "closed loop" systems. By closed loop, I mean that agents are able to observe everything that's happening in them and have a structured way of testing improvements. In Warp Factories we accomplish this by defining factories as code, storing all agent traces (potentially on customer hosting) and deploying self-improvement agents to suggest improvements. If your factory is just a loose collection of automations, with no testing or benchmarking, then it's not actually a factory IMO. It's just a bunch of automations that may or may not actually improve throughput.
14
6
1
53
3,350
David Corbacho retweeted
Microsoft has launched a new container system for AI agents across Windows, Linux and macOS. It’s called Microsoft Execution Containers, or MXC, and it lets developers control which files, networks and system resources an agent can access. An agent can edit your project and run its tools while being blocked from personal files or changing configurations it only needs to read. These restrictions are enforced outside the agent’s control, so it can’t grant itself extra permissions. MXC uses platform-specific sandboxes, including Bubblewrap on Linux, through a unified JSON configuration and SDK. GitHub Copilot, OpenAI Codex, Replit and OpenClaw already support it, with Claude Code support planned. Source: blogs.windows.com/windowsdev…
50
62
5
356
27,982
David Corbacho retweeted
This essay is one of the most important things written on AI governance this year, in my view. I made a short video explainer. I think this is close to where we'll end up.
1
4
1
20
6,387
cheap tokens
Yaban domuzlarını yakalamak için 5 gün boyunca tuzak alanına alışmalarını bekleyen bir kişi, tüm sürünün içeri girdiği anda kapıyı kapatarak onlarca domuzu tek seferde yakaladı.
90
David Corbacho retweeted
Human-only code review doesn’t scale. Reviewers stop finding defects effectively when they review more than 400 lines of code. And, you can only review 450 lines of code in an hour. Go higher and effectiveness falls off a cliff. - Study at Cisco So it takes 3-4 days to effectively review a 10k line PR! Solution: Use AI to assist. Use subagents to check multiple facets of quality simultaneously (security, performance, accessibility, etc).
50
13
142
12,550
David Corbacho retweeted
Don’t get me wrong: this isn’t a dig at AI. The quality of open-source contributions had been declining long before AI. AI just accelerated it, while also making PR spam dramatically worse. I use AI extensively myself. It simply makes no sense for me to spend time reviewing and going back and forth on a low-quality PR when I can generate, verify, and ship the fix myself 10× faster. This is ultimately about optimizing my time.
14
15
8
697
84,561
David Corbacho retweeted
fframes is finally released! And we are jumping straight to 1.0 of providing unprecedented performance rendering the video and a built in verification loop for your agents to make progress faster. Without a browser. At all.
Not many remember but 5 years ago I started working on my FAST video rendering framework. I have never released it but when I've seen that people wait 12 hours I realized that I have to do it now Introducing fframes. This video was vibed in 48 minutes and rendered in 36 seconds
10
50
3
930
85,295
David Corbacho retweeted
got Jev to review my PRs. ~200x cheaper than Claude and it answers in half a second 6 real PRs in the video. $0.00007 each. 1,000 PRs = 7 cents vs ~$14.50 on Opus 5 paste a diff → ONE call to @typesafeai → 14 typed checks come back as probabilities: hardcoded secret, sql injection, touches auth, deletes tests, breaks api, migration, debug leftovers, does the description actually match the diff, blast radius, reviewer effort… code turns that into a verdict: BLOCK / security review / nits / merge. anything a critical check isn't sure about (0.35–0.65) gets escalated to a human or a big model instead of guessed
98
143
49
2,759
359,867
David Corbacho retweeted
This is indeed one of the most impressive registries I've seen. tbh I don't even know how half of this even work. congrats on the launch @davidhaz
Introducing Canvas UI, the first ever html-in-canvas component library. Your DOM is the render target now. Real-time shaders over real, interactive UI. 24 components. React, Vue, Svelte, vanilla TS. Free. Open source. 🧵 canvasui.dev
25
160
3
4,667
460,703
David Corbacho retweeted
Excited to share our most powerful new Claude Code feature: dynamic workflows! Mention "workflow" in a prompt and Claude will dynamically create an orchestration plan that it strictly follows, allowing you to confidently trust that every stage happens in the right order even across 100s of agents.
350
818
334
7,777
1,705,593
David Corbacho retweeted
This is why you should use tools like COI: github.com/mensfeld/code-on-… to isolate coding agents and nuke machines once job is done.
‼️🚨 UPDATE: The TanStack npm attack is now a full campaign. 'Mini' Shai-Hulud has hit: - OpenSearch - Mistral AI - Guardrails AI -UiPath - Squawk packages across npm and PyPI The malware specifically targets AI developer tooling. It hooks into Claude Code (.claude/settings.json) and VS Code (.vscode/tasks.json) to re-execute on every tool event, long after the infected package is gone. npm uninstall does not fix this.
2
5
28
8,798
David Corbacho retweeted
nah im just not gonna run npm install anymore
182
417
44
8,369
387,531
David Corbacho retweeted
Replying to @_chenglou
I feel like we should write a love letter to @behdadesfahbod — this picture really is true
1
2
1
41
4,002
David Corbacho retweeted
Neither of these men are married or have kids. Both are simply obsessed with their own personal perfection and optimization. There is nothing impressive about a single man with no kids sleeping well and being fit. Show me a man with young children, a full time job, disrupted sleep, who works out regularly, eats healthy, trains Jui Jitsu, with a muscular body… THIS is impressive. THIS requires extreme discipline.
Chris Williamson just shared his "nuclear" sleep stack that's quietly changing his life—and Andrew Huberman breaks down exactly why it works: If you're lying in bed at 2 a.m. scrolling or staring at the ceiling, this 4-minute protocol combo might be the fastest way to shut your brain off without pills. The two killer techniques Williamson swears by: 1. The Mind Walk (visualization on steroids) - Imagine walking a route you know perfectly (your house → front door → street) - Do it with insane detail: feel the shoehorn, hear the key turn, feel the door handle, pressure of the pavement - It's like reading fiction for your nervous system—engages the brain just enough to stop problem-solving loops, but not enough to keep you awake 2. Resonance breathing with the Ohm stone lamp - Bedside lamp with induction-charging stone that has a built-in FDA-cleared HRV sensor - Hold the stone → 3/6/9/12-minute guided sessions with silent tactile vibration (no sound, no light, partner-safe) - Guides you into true resonance frequency (max vagal tone) → the stone knows when you hit it - Williamson calls it “the sickest” sleep tool he’s ever used—currently in stealth (ohmhealth, not widely available yet) Huberman adds the neuroscience: Looking down + eyelids lowering activates parasympathetic circuits and deactivates wakefulness-promoting brainstem nuclei. It’s literally pedaling the sleep pedal while shutting off the alertness arm. Williamson: “Some days you need the adventure story (mind walk), some days you need the physiological hammer (resonance breathing). Stack them and I’m cross-eyed into sleep.” Already trying one of these? Or is your nighttime routine still a war zone?
1,114
875
152
19,463
2,051,241
David Corbacho retweeted
It’s Next.js Liberation Day. The #1 request we kept hearing: help us run Next fast and secure, without the lock-in and the costs. So we did it. We kept the amazing DX of @nextjs, without the bespoke tooling, built on @vite. We’re working with other providers to make deployment a first-class experience everywhere. Next.js belongs to everyone. blog.cloudflare.com/vinext/
251
388
334
3,816
1,694,001
David Corbacho retweeted
Karpathy buried the most interesting observation in paragraph five and moved on. He’s talking about NanoClaw’s approach to configuration. When you run /add-telegram, the LLM doesn’t toggle a flag in a config file. It rewrites the actual source code to integrate Telegram. No if-then-else branching. No plugin registry. No config sprawl. The AI agent modifies its own codebase to become exactly what you need. This inverts how every software project has worked for decades. Traditional software handles complexity by adding abstraction layers: config files, plugin systems, feature flags, environment variables. Each layer exists because humans can’t efficiently modify source code for every use case. But LLMs can. And when code modification is cheap, all those abstraction layers become dead weight. OpenClaw proves the failure mode. 400,000+ lines of vibe-coded TypeScript trying to support every messaging platform, every LLM provider, every integration simultaneously. The result is a codebase nobody can audit, a skill registry that Cisco caught performing data exfiltration, and 150,000+ deployed instances that CrowdStrike just published a full security advisory on. Complexity scaled faster than any human review process could follow. NanoClaw proves the alternative. ~500 lines of TypeScript. One messaging platform. One LLM. One database. Want something different? The LLM rewrites the code for your fork. Every user ends up with a codebase small enough to audit in eight minutes and purpose-built for exactly their use case. The bloat never accumulates because the customization happens at the code level, not the config level. The implied new meta, as Karpathy puts it: write the most maximally forkable repo possible, then let AI fork it into whatever you need. That pattern will eat way more than personal AI agents. Every developer tool, every internal platform, every SaaS product with a sprawling settings page is a candidate. The configuration layer was always a patch over the fact that modifying source code was expensive. That cost just dropped to near zero.
Bought a new Mac mini to properly tinker with claws over the weekend. The apple store person told me they are selling like hotcakes and everyone is confused :) I'm definitely a bit sus'd to run OpenClaw specifically - giving my private data/keys to 400K lines of vibe coded monster that is being actively attacked at scale is not very appealing at all. Already seeing reports of exposed instances, RCE vulnerabilities, supply chain poisoning, malicious or compromised skills in the registry, it feels like a complete wild west and a security nightmare. But I do love the concept and I think that just like LLM agents were a new layer on top of LLMs, Claws are now a new layer on top of LLM agents, taking the orchestration, scheduling, context, tool calls and a kind of persistence to a next level. Looking around, and given that the high level idea is clear, there are a lot of smaller Claws starting to pop out. For example, on a quick skim NanoClaw looks really interesting in that the core engine is ~4000 lines of code (fits into both my head and that of AI agents, so it feels manageable, auditable, flexible, etc.) and runs everything in containers by default. I also love their approach to configurability - it's not done via config files it's done via skills! For example, /add-telegram instructs your AI agent how to modify the actual code to integrate Telegram. I haven't come across this yet and it slightly blew my mind earlier today as a new, AI-enabled approach to preventing config mess and if-then-else monsters. Basically - the implied new meta is to write the most maximally forkable repo and then have skills that fork it into any desired more exotic configuration. Very cool. Anyway there are many others - e.g. nanobot, zeroclaw, ironclaw, picoclaw (lol @ prefixes). There are also cloud-hosted alternatives but tbh I don't love these because it feels much harder to tinker with. In particular, local setup allows easy connection to home automation gadgets on the local network. And I don't know, there is something aesthetically pleasing about there being a physical device 'possessed' by a little ghost of a personal digital house elf. Not 100% sure what my setup ends up looking like just yet but Claws are an awesome, exciting new layer of the AI stack.
113
298
71
3,482
606,656
David Corbacho retweeted
Software development is undergoing a renaissance in front of our eyes. If you haven't used the tools recently, you likely are underestimating what you're missing. Since December, there's been a step function improvement in what tools like Codex can do. Some great engineers at OpenAI yesterday told me that their job has fundamentally changed since December. Prior to then, they could use Codex for unit tests; now it writes essentially all the code and does a great deal of their operations and debugging. Not everyone has yet made that leap, but it's usually because of factors besides the capability of the model. Every company faces the same opportunity now, and navigating it well — just like with cloud computing or the Internet — requires careful thought. This post shares how OpenAI is currently approaching retooling our teams towards agentic software development. We're still learning and iterating, but here's how we're thinking about it right now: As a first step, by March 31st, we're aiming that: (1) For any technical task, the tool of first resort for humans is interacting with an agent rather than using an editor or terminal. (2) The default way humans utilize agents is explicitly evaluated as safe, but also productive enough that most workflows do not need additional permissions. In order to get there, here's what we recommended to the team a few weeks ago: 1. Take the time to try out the tools. The tools do sell themselves — many people have had amazing experiences with 5.2 in Codex, after having churned from codex web a few months ago. But many people are also so busy they haven't had a chance to try Codex yet or got stuck thinking "is there any way it could do X" rather than just trying. - Designate an "agents captain" for your team — the primary person responsible for thinking about how agents can be brought into the teams' workflow. - Share experiences or questions in a few designated internal channels - Take a day for a company-wide Codex hackathon 2. Create skills and AGENTS[.md]. - Create and maintain an AGENTS[.md] for any project you work on; update the AGENTS[.md] whenever the agent does something wrong or struggles with a task. - Write skills for anything that you get Codex to do, and commit it to the skills directory in a shared repository 3. Inventory and make accessible any internal tools. - Maintain a list of tools that your team relies on, and make sure someone takes point on making it agent-accessible (such as via a CLI or MCP server). 4. Structure codebases to be agent-first. With the models changing so fast, this is still somewhat untrodden ground, and will require some exploration. - Write tests which are quick to run, and create high-quality interfaces between components. 5. Say no to slop. Managing AI generated code at scale is an emerging problem, and will require new processes and conventions to keep code quality high - Ensure that some human is accountable for any code that gets merged. As a code reviewer, maintain at least the same bar as you would for human-written code, and make sure the author understands what they're submitting. 6. Work on basic infra. There's a lot of room for everyone to build basic infrastructure, which can be guided by internal user feedback. The core tools are getting a lot better and more usable, but there's a lot of infrastructure that currently go around the tools, such as observability, tracking not just the committed code but the agent trajectories that led to them, and central management of the tools that agents are able to use. Overall, adopting tools like Codex is not just a technical but also a deep cultural change, with a lot of downstream implications to figure out. We encourage every manager to drive this with their team, and to think through other action items — for example, per item 5 above, what else can prevent a lot of "functionally-correct but poorly-maintainable code" from creeping into codebases.
412
1,574
310
12,108
2,151,083
David Corbacho retweeted
Replying to @AshCrypto
44
20
3
538
13,345
Move over, Playwright? Meet MCP-Chrome by Hangwin — an open-source AI agent tool that can fully control your Chrome browser: cross-tab context, session auth, history & more. In this video, @AugmentedAJ: - Sets up MCP-Chrome & connects it to Auggie CLI - Gives the agent a multi-step task across Reddit & X - Generates a full report in a web app Perfect for automated testing, research & dev workflows. What’s your favorite underrated MCP tool right now?
23
65
3
520
49,895