Weerasak retweeted
i've been a bit quiet - working on a new companion skill that will help your agents draw these beautiful statecharts/diagrams + check them against the specs you made with /create-formal-verification-skill in pstack!
it now uses Pele from @kepano too which is why they look so good.
will release soon!
there's something really cool about asking your agent to draw a statechart (hypothetical example in this image), then using the /create-formal-verification-skill you made with pstack to find bugs through something like TLA+. you can both understand your code better and how the user flow should work, and fix issues users would otherwise see
Weerasak retweeted
AI agents are writing more code. How can developers ensure that code is correct?
Microsoft Research’s Proof-Driven Development (PDD) Kit explores a more rigorous approach: it translates a developer’s intent into a formal specification, then uses formal verification to prove that generated code meets it.
PDD Kit works with Verus for Rust and is integrated with @GitHubNext’s Chopin, bringing formal methods into an AI-assisted development workflow for teams.
See the work in action at @github Universe, Oct. 28–29, 2026.
Weerasak retweeted
How do you _guarantee_ your agent's code is correct? You prove it.
Introducing Proof Driven Development Kit (PDD Kit) from @MSFTResearch.
PDD Kit helps turn your plan into a formal spec, then proves the agent's code meets that spec for every input. No vibe verification. PDD Kit is integrated with @GitHubNext's Chopin, so you can plan as a team.
PDD Kit takes an app's login flow from intent to a verified pull request:
It discusses your code, infers your intent as it goes, and proposes a formal spec in Verus, a proof language for Rust.
Once you approve the spec, the Verus verifier automatically proves the code meets it.
Where proof isn't possible, it falls back to empirical verification with tests and computer-use agents (CUAs).
It works on Rust today. No new language, no change in how you produce the underlying code, making formal methods more accessible.
The goal is a verified software factory, where engineers review specifications instead of code.
Come see it in action at GitHub Universe, Oct 28–29. Swing by the Speakeasy and ask for GitHub Next!
Weerasak retweeted
I've never trusted code I didn't review until now.
Agents write more code than any of us can review. We often end up skimming the PR/diff and pushing. Current review methods do not prove the code is correct or does what we asked. Recent research found the best AI code reviewer caught the bug on its first try only 42% of the time.*
The evaluation bottleneck, regressions, and security incidents have forced us to find a better way.
Introducing Proof-Driven Development Kit (PDD Kit) from @MSFTResearch. PDD Kit brings assurance to AI-generated code. You describe what you want to build in plain English. PDD Kit captures your objective, what we call your intent, and uses a verifier tool to prove the code meets it for every possible input.
You never review a single line of the code or the proof. You review your plan and the defined objectives in natural language.
A simple example is login. With testing, you check that only the correct password logs in a user but with a proof on top you can verify that there is no case a wrong password allows login. You can prove correctness and security across many complex scenarios.
Not only does PDD Kit prove the correctness of your code, but also your intent so you can have confidence your code is correct and does what you asked. It provides a level of assurance that specs, code review, and tests never could. PDD Kit is in limited research preview. Video explainer below.
If you want to learn more, I'll be sharing PDD Kit at GitHub Universe next week, Oct 28–29. Swing by the Speakeasy, ask for GitHub Next, and ask me about verified code. If you're in SF, let me know.
*Yang et al., "(When) Should a Software Factory be Lights-off?", Microsoft Research and CMU, Oct 2026
How do you _guarantee_ your agent's code is correct? You prove it.
Introducing Proof Driven Development Kit (PDD Kit) from @MSFTResearch.
PDD Kit helps turn your plan into a formal spec, then proves the agent's code meets that spec for every input. No vibe verification. PDD Kit is integrated with @GitHubNext's Chopin, so you can plan as a team.
PDD Kit takes an app's login flow from intent to a verified pull request:
It discusses your code, infers your intent as it goes, and proposes a formal spec in Verus, a proof language for Rust.
Once you approve the spec, the Verus verifier automatically proves the code meets it.
Where proof isn't possible, it falls back to empirical verification with tests and computer-use agents (CUAs).
It works on Rust today. No new language, no change in how you produce the underlying code, making formal methods more accessible.
The goal is a verified software factory, where engineers review specifications instead of code.
Come see it in action at GitHub Universe, Oct 28–29. Swing by the Speakeasy and ask for GitHub Next!
Weerasak retweeted
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.
Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors.
Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact.
This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.
openai.com/index/coordinated…
Readers added context they thought people might want to know
Wiz Research wasn't the first one to discover the exploit. An independent researcher first discovered it: x.com/calif_io/statu…
Weerasak retweeted
Happy DuckDB 2.0 Day 🔥
It is now officially available in the production install
curl install.duckdb.org | bash
Weerasak retweeted
The 2026 Go Developer Survey is open! Help set Go’s priorities for next year by telling us how you use Go and where it could be better.
⏱️ 10–20 minutes
📅 Open through November 3
blink.qualtrics.com/jfe/form…
#golang
Weerasak retweeted
Someone built Git for AI agent memory.
ModernRelay has open-sourced OmniGraph, a graph database that gives AI agents something most shared-memory systems lack: branches, commits, diffs, and three-way merges.
The idea is simple. If multiple agents are working on the same knowledge base, they should be able to make changes independently without corrupting or overwriting each others work.
Imagine three agents researching the same subject. One extracts information from documents, another resolves duplicate entities, and a third connects claims to supporting evidence.
With OmniGraph, each agent works on its own branch of the knowledge graph. Changes to entities, relationships, and evidence remain isolated until they're reviewed and merged.
And this is where the engineering gets interesting.
The merge engine compares changes against a common ancestor, much like Git. It can detect conflicting entity updates, delete-versus-modify conflicts, orphaned relationships, and schema violations.
Conflicting changes are reported explicitly. Successful merges are committed atomically, and previous graph states remain available through version history.
OmniGraph also combines several retrieval methods in one engine:
→ Graph traversal for following relationships
→ Vector search for semantic similarity
→ BM25 for keyword-based retrieval
→ Reciprocal Rank Fusion for combining results
Under the hood, its written in Rust and uses versioned Lance files for storage, with support for local and S3-compatible object stores.
Typed schemas enforce valid relationships, Cedar policies control mutations, and an MCP server lets coding agents interact with the graph.
The important distinction is that semantic retrieval alone doesn't solve the problem of multiple agents changing shared knowledge.
Agents also need to know what changed, who changed it, which version they're reading, and whether two sets of updates can safely coexist.
OmniGraph brings those familiar source-control ideas into persistent agent memory.
Open source. MIT licensed.
Here's the GitHub Repo: github.com/ModernRelay/omnig…
Weerasak retweeted
TypeScript 7.1 Beta is now available! Now with a preview API, content mapper support, new features, and some great optimizations. Give it a try and give us some feedback! devblogs.microsoft.com/types…
Weerasak retweeted
there's something really cool about asking your agent to draw a statechart (hypothetical example in this image), then using the /create-formal-verification-skill you made with pstack to find bugs through something like TLA+. you can both understand your code better and how the user flow should work, and fix issues users would otherwise see
pstack v0.15.27 ships with a new skill /create-formal-verification-skill!
it's still in beta, and similar to /create-verification-skill, this is a meta-skill that creates a new skill and formal verification suite based on the characteristics you want to verify. for example, you may want to model state machines and systems with concurrency using TLA+, or use kani in rust to check for undefined behavior.
if you're new to formal verification, think of it as mathematically proving properties and invariants (something that must always be true) or "laws" of your system. usually, this means modeling your programs in a separate language like with TLA+ and then running the solver on that spec. newer approaches like with kani and @bendlang take a different approach where there is no separate language: you write kani in rust, and bend in bend (it's also a programming language, and the proofs are written as laws and expressed in its type system).
historically formal verification never reached mainstream status because of the difficulty in modeling and writing proofs. it's quite difficult to model your business requirements and keep them in sync! but i expect that we will see more innovation in formal verification in the future as being able to formally verifiy that the code does what you intended gives your agents superpowers in writing correct software.
in the meantime though, i've been experimenting with modeling our code with TLA+ and have already found several bugs with the skill created by /create-formal-verification-skill.
try it out and let me know how it goes!
Weerasak retweeted
👩🏽🔬 Go 1.27.3 and 1.26.10 are released!
🔐 Security: Includes 1 security fixes to the standard library.
🗣 Announcement: groups.google.com/g/golang-a…
📦 Download: go.dev/dl/#go1.27.3
#golang
Weerasak retweeted
It's so easy to build but somehow none of us has time to focus on anything. This is a dream for anyone with ADHD, a hell for everyone else.
Weerasak retweeted
How do smaller models learn from Anthropic and OpenAI big models?
Distillation explained in 60 seconds!
Weerasak retweeted
I often get emails from junior engineers asking me what to do.
Here's what I just wrote to one of them
Weerasak retweeted
pstack v0.15.27 ships with a new skill /create-formal-verification-skill!
it's still in beta, and similar to /create-verification-skill, this is a meta-skill that creates a new skill and formal verification suite based on the characteristics you want to verify. for example, you may want to model state machines and systems with concurrency using TLA+, or use kani in rust to check for undefined behavior.
if you're new to formal verification, think of it as mathematically proving properties and invariants (something that must always be true) or "laws" of your system. usually, this means modeling your programs in a separate language like with TLA+ and then running the solver on that spec. newer approaches like with kani and @bendlang take a different approach where there is no separate language: you write kani in rust, and bend in bend (it's also a programming language, and the proofs are written as laws and expressed in its type system).
historically formal verification never reached mainstream status because of the difficulty in modeling and writing proofs. it's quite difficult to model your business requirements and keep them in sync! but i expect that we will see more innovation in formal verification in the future as being able to formally verifiy that the code does what you intended gives your agents superpowers in writing correct software.
in the meantime though, i've been experimenting with modeling our code with TLA+ and have already found several bugs with the skill created by /create-formal-verification-skill.
try it out and let me know how it goes!
Weerasak retweeted
AI ตอบคำถามด้านความปลอดภัยไซเบอร์ได้ในไม่กี่วินาที แต่การรู้ว่าคำตอบนั้นถูกหรือไม่ ยังต้องอาศัยคนที่เข้าใจงานลึกพอ และถ้า AI รับงานพื้นฐานไปทำหมด คำถามที่ตามมาคือคนรุ่นใหม่จะสั่งสมประสบการณ์จนกลายเป็นผู้เชี่ยวชาญแบบนั้นได้จากที่ไหน?
.
คำถามนี้คือแกนของเวที Workforce Development Panel ในหัวข้อ ‘Supercharging the Cyber Workforce: AI, Skills, and Accreditation’ ในงาน Singapore International Cyber Week (SICW) 2026 ซึ่งเปิดด้วยคำกล่าวของ Tan Kiat How รัฐมนตรีอาวุโสแห่งรัฐ (Senior Minister of State) ของสิงคโปร์ ผู้ใช้เวทีนี้ประกาศว่าสิงคโปร์จะจัดตั้งกรอบการรับรองวิชาชีพด้านความมั่นคงปลอดภัยไซเบอร์ (Cybersecurity Professional Accreditation Framework) ตามด้วยการบรรยายสั้นจากผู้บริหารในวงการ และวงเสวนาที่ชวนตัวแทนจากสหราชอาณาจักรมาถอดบทเรียนจากเส้นทางที่อังกฤษเดินมาก่อนหลายปี
.
แม้จะพูดจากคนละมุม แต่ทุกคนบนเวทีกลับมองตรงกันว่า AI ไม่ได้ทำให้คนในสายงานนี้สำคัญน้อยลง ตรงกันข้าม AI กำลังยกมาตรฐานของ ‘มืออาชีพไซเบอร์’ ให้สูงขึ้น และวงการจำเป็นต้องมีระบบที่บอกได้ว่าใครผ่านมาตรฐานนั้นจริง
.
Tan Kiat How เริ่มจากผลสำรวจบุคลากรไซเบอร์ของหน่วยงานความมั่นคงปลอดภัยไซเบอร์แห่งสิงคโปร์ (Cyber Security Agency of Singapore: CSA) ที่พบว่า 8 ใน 10 ของผู้ตอบแบบสำรวจระบุว่าองค์กรของตัวเองใช้เครื่องมือป้องกันไซเบอร์ที่ขับเคลื่อนด้วย AI แล้ว ขณะที่ 7 ใน 10 มองว่าวิจารณญาณและทักษะการแก้ปัญหาของมนุษย์เป็นสิ่งจำเป็นต่อการใช้ AI ให้ได้ผล
.
ตัวเลขนี้สะท้อนว่า AI ไม่ได้ลดความสำคัญของคน แต่เปลี่ยนสิ่งที่คนต้องทำ เมื่อ AI รับงานมากขึ้น มืออาชีพไซเบอร์จึงต้องกำหนดทิศทางให้เครื่องมือ ตีความผลลัพธ์ ตรวจสอบข้อสรุป และตัดสินใจในสิ่งที่ตามมา Tan Kiat How ย้ำว่าความคล่องแคล่วในการใช้ AI (AI Fluency) จะกลายเป็นส่วนหนึ่งของความสามารถด้านไซเบอร์ แต่ ‘ไม่ใช่สิ่งเดียวกับความเชี่ยวชาญด้านไซเบอร์’ เพราะแม้ AI จะสร้างคำตอบได้เร็ว การรู้ว่าคำตอบนั้นถูกหรือไม่ยังต้องอาศัยความรู้เชิงวิชาชีพที่ลึกพอ
.
ผลการศึกษาอีกชุดของ CSA ที่สำรวจผู้ทำงานด้านไซเบอร์และฝ่ายบุคคลราว 1,000 คน ก็ชี้ไปทางเดียวกัน Wong Choon Bong ผู้อำนวยการฝ่ายพัฒนาบุคลากรและพันธมิตรเชิงกลยุทธ์ของ CSA ระบุว่ากว่า 3 ใน 4 ของผู้ทำงานไซเบอร์มองว่า AI เป็นโอกาสทางอาชีพมากกว่าภัยคุกคาม ถึงอย่างนั้นหลายคนก็กังวลว่าทักษะบางอย่างของตัวเองอาจล้าสมัย Wong Choon Bong จึงสรุปว่าในยุค AI คนในสายงานนี้ต้อง ‘ทำมากขึ้น ไม่ใช่น้อยลง’
.
#SICW2026
.
อ่านต่อได้ที่: techsauce.co/ai/singapore-cy…
