Founder & Builder | Building https://xitter.cf/t.co/ag2bhjo5r8, https://xitter.cf/t.co/9EO3BU4jCx, https://xitter.cf/t.co/vqTghjn5bf | AI Agents| 15x Patents | 7x Author | Building for Growth
London, England
Joined March 2011
- Tweets14.8K
- Following989
- Followers3.5K
- Likes3.2K
8.4%. That's how many of the 1,000+ SaaS vendors Vercel surveyed this year support anything beyond a static API key. Not 84%, not 48%. Eight point four. That number is the justification behind this week's announcement that Vercel is retiring long-lived credentials across its own platform and pushing every Marketplace vendor to do the same, with a real deadline attached: vendors without OIDC support get a "Not secure" label on November 30, and get delisted in January.
The mechanism is the part worth sitting with. Instead of an app storing a provider's API key forever, it gets a short-lived signed token that a receiving service verifies before granting access, and a stolen token is just dead weight once it expires. GitHub Actions and AWS IAM solved this exact problem for CI pipelines years ago, workload identity instead of a secret sitting in a vault somewhere waiting to leak. Vercel is dragging the same pattern into the one layer that never got the memo: the hundreds of SaaS integrations a typical stack connects to, each one usually handed a permanent key the day you sign up and never rotated again.
What makes this an agent story and not just a dev-ops one is who's holding these keys now. Vercel Connect is explicitly built so that "applications and agents" can request scoped provider tokens at runtime instead of storing secrets at all, and that framing isn't an accident. An agent wired into a dozen MCP servers and tool integrations is carrying more permanent credentials than any human on the team ever did, usually with less oversight over where they get copied into config files or logs. A static key an agent holds doesn't need to be stolen in some dramatic breach. It just needs to end up in the wrong prompt, the wrong log line, the wrong fork of a repo.
Vercel can set a deadline for its own Marketplace. It can't set one for the rest of the ecosystem, and most of the industry is still issuing keys the old way. I'd bet the gap between knowing how to fix this and everyone actually doing it is where the next round of agent security incidents comes from.
xitter.cf/vercel/status/21133972…
It's time to retire long-lived static credentials.
We surveyed 1,000+ SaaS vendors and found only 8.4% support secure auth. This is our call to action and how we're doing our part.
vercel.com/blog/death-to-lon…
Claude Opus 5.5 tops the new Artificial Analysis Coding Agent Index at 61.7, and it costs $11.42 per task to get there. Three rows down the same leaderboard, Codex running DeepSeek's V4.1 Flash scores 47.3 for $0.39. That's 77% of the leading score at 3% of the cost, and nobody's really talking about it.
Artificial Analysis rebuilt the index this week. Version 2.0 runs 290 tasks across three benchmarks: FrontierCode v1.1 from Cognition (real open-source repos, graded on whether a maintainer would actually merge the change), Terminal-Bench 4.0 from the Laude Institute, and a reworked SWE-Atlas-QnA from Scale AI with stricter grading, enough to drop the average config's score by 1.7 points once the rubric tightened. Claude Code with Sonnet 5.5 sits at 59.3. Muse Code's flagship lands at 58.9. Below the top four, 15 of 24 configurations bunch between 43 and 49 percent on FrontierCode alone, which tells you how much daylight there actually is between "frontier" and "pretty good."
What's new in this version matters more than the leaderboard shuffle. Every trajectory now gets scanned for reward hacking, Cognition's own rule-based detector flags anything that touched solution material, and a flagged attempt scores zero no matter how clean the diff looks. There's also a safety-refusal metric tracking how often a model declines a task outright. Both exist because the index stopped being a curiosity and started being what teams point to when they pick a harness, which means it's now worth gaming, and worth defending against gaming.
The real split in this data isn't model versus model. It's whether you're buying the top of the curve or the knee of it. DeepSeek V4.1 Flash through Codex isn't winning, but it's sitting exactly where the cost per percentage point stops making sense to argue about. For anyone running agents at volume rather than showing them off in a demo, that's the number that decides the bill, not the leaderboard position.
xitter.cf/ArtificialAnlys/status…
Announcing Artificial Analysis Coding Agent Index v2.0: FrontierCode v1.1 from Cognition replaces DeepSWE, SWE-Atlas-QnA grading is revised, and Claude Opus 5.5 in Claude Code leads at 61.7
Today we are launching v2.0 of the Coding Agent Index. The Index evaluates models together with their agent harnesses, now across 290 tasks covering software engineering, terminal use, and repository Q&A, with the three benchmarks weighted equally.
Changelog (Index v1.5 → Index v2.0):
→ FrontierCode v1.1 replaces DeepSWE v1.1. FrontierCode is a benchmark from @cognition with a private test set: 100 software engineering tasks on real open-source repositories, graded on whether a maintainer would merge the change. An attempt that fails a blocking check scores zero, and one that passes them all scores between 70% and 100% depending on the non-blocking checks it meets. We also scan each trajectory with a modified version of Cognition's rule-based scanner, and any attempt flagged for accessing solution material scores zero.
→ Revised SWE-Atlas-QnA grading, now SWE-Atlas-QnA-AA. Scale AI's 124 repository Q&A tasks are unchanged. We reworded 127 of the 1,306 rubric criteria for more consistent verdicts and moved to GPT-6 Luna (xhigh) as the judge, with five votes per criterion. The dataset and judge configuration are published on Hugging Face.
Key results:
➤ Claude Opus 5.5 leads the Index: Claude Code with Claude Opus 5.5 (max) scores 61.7, followed by Claude Code with Claude Sonnet 5.5 (max) at 59.3, Muse Code with Muse Wonder Full (max) at 58.9 and Claude Code with Claude Fable 5.1 (max with fallback) at 57.6.
➤ FrontierCode v1.1 is where Opus 5.5 pulls ahead: Opus 5.5 scores 56.0% on FrontierCode, ahead of Codex with DeepSeek V4.1 Flash (max) at 52.6%, Codex with GPT-6.1 Sol (max) at 49.4% and Codex with GPT-6 Astra (max) at 49.3%. Below the top, FrontierCode scores are tightly packed: 15 of the 24 configurations on the Index score between 43% and 49%.
➤ SWE-Atlas-QnA-AA grading is stricter and more consistent: across the 21 configurations evaluated on both Index versions, the mean score falls 1.7 points, from 58.8% to 57.1%, with 14 of 21 moving down. Individual configurations move by up to 7 points: Muse Code with Muse Spark Open (xhigh) falls 7.0, Kimi K3 in Kimi Code CLI and Codex with GPT-6 Luna (max) 6.2, and Muse Code with Muse Wonder (max) 5.6, while Codex with GPT-6.1 Sol (max) gains 2.1.
➤ Four configurations sit on the cost frontier: Codex with DeepSeek V4.1 Flash (max) scores 47.3 at $0.39 per task, Codex with GPT-6.1 Sol (max) 54.1 at $1.50, Codex with GPT-6 Astra (max) 54.7 at $7.04 and Claude Code with Claude Opus 5.5 (max) 61.7 at $11.42. Costs are pay-per-token API costs, not subscription prices.
We will keep updating the Coding Agent Index incrementally, with more evaluations and agents to come.
I keep running into video AI APIs that resell model access, and the markups are no longer small.
David Im's Sume API just went live routing calls to Veo, Kling and others at 0% markup. Zero. You pay what the underlying model actually costs. That stood out to me because the normal range across this category is nowhere close to zero.
Higgsfield's studio layer runs about 40% over base model pricing. Fal.ai, built for developers who already know what they want, sits closer to 100%. Runway's all-in-one tool reportedly marks up as much as 414% over the same underlying generation cost, charging for the UI, templates and workflow wrapped around someone else's model.
None of this is entirely new. Pika quietly cut its own markup earlier this year once people started comparing prices across tools in public. What feels different now is a founder launching at zero and daring the rest of the category to justify margin with something other than convenience.
There's a related signal from Jorge Vayron, who open sourced his own small video generation studio instead of charging for it. Different bet: give away the wrapper, let people run it against whatever model they want, and compete on being useful rather than being the only option.
I think both moves point at the same pressure. Once underlying models get cheap and commoditized fast enough, the wrapper around them has to earn its price with real functionality, not just access. A markup that size survives only as long as switching costs do, and those are getting thinner by the month.
xitter.cf/davidim/status/2113316…
As a builder in the AI video space, I was terrified about how much markup API providers charge for simply routing the models.
Higgsfield API adds a 40% markup even with its maximum advertised discount. Fal adds 100%. Runway adds 414% (Seedance 2 480p)
I might be hated by the industry, but :
Today, we’re launching Sume API, the first image & video model provider with 0% markup.
For example with Seedance 2.5 1080p
• 50% cheaper than fal
• 50% cheaper than higgsfield api (29% even with biggest discount)
• 28.02% cheaper than kie ai
The routing infrastructure layer is never the moat. We believe that APIs should be commoditized, and the moats will be built at the application layer.
Check the pricing comparisons below, and see how the broken industry is saved.
Claude now checks your calendar before you ask it to, and asks before it acts on anything it finds there.
Duet, opened this week as a research preview, is Anthropic's attempt at a genuinely proactive agent instead of a chat window waiting for a prompt. It surfaces what needs your attention, keeps working on tasks after you step away, and confirms before it acts on your behalf, which is the detail separating it from most things currently wearing the word agent.
OpenAI shipped the same instinct first, back in September 2025 with Pulse: async overnight research synced to your calendar and inbox, delivered as a digest the next morning. The difference is Pulse mostly surfaces, it doesn't act, it's Tasks with better taste. Google's agent work leans harder toward browsing and booking on your behalf inside Chrome. Duet sits closer to the acting end of that spectrum while keeping a human confirmation step in place, which is Anthropic's usual tell: ship the capability, keep a human in the loop until trust is earned rather than assumed.
An agent that checks with you before every consequential action is safer and also slower to feel magical. The entire pitch of ambient AI was supposed to be not having to supervise it, and Duet's confirmation step is a quiet admission that nobody, including Anthropic, is ready to remove that supervision yet. Canva already wired Duet into its own app on day one, which tells you where the real test happens next: not a benchmark demo, but whether people let it touch their calendar for a full week without switching it off.
Proactive agents keep getting announced like a finished category. They're not. They're three companies running three different experiments on how much initiative people will actually tolerate from software, and the research preview label on Duet is the most honest part of the launch.
xitter.cf/claudeai/status/211298…
Two critical PHP flaws rated 9.2, ten Node CVEs including a remote code execution bug in the Brotli decoder, and the fix Cognition shipped wasn't a patch note, it was a skill.
Cognition open sourced a vulnerability remediation plugin built on the Agent Skills standard, the same one Anthropic just handed to the Agentic AI Foundation. Install it with npx skills add and it runs in Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Factory Droid and OpenCode, not just Devin. It inventories your repos, asks which ones to patch, verifies target versions against the actual vendor advisories, runs your test suite before and after, and opens one PR per repo with rollback notes attached.
That cross-agent part is the whole story. A skill isn't locked to whichever CLI you installed it for anymore, which is exactly the problem I built Campfire to sit on top of. It runs Claude Code, Codex, Goose, Aider and OpenHands side by side in one tab, so a skill like this one doesn't have to be relearned per backend. The permission voting layer means a skill that runs with the agent's full permissions, Cognition's own warning, not mine, still needs majority approval before it touches anything, and session replay plus the cost dashboard let you see exactly what the skill did across every agent that ran it instead of trusting the PR description.
github.com/stretchcloud/camp…
xitter.cf/cognition/status/21133…
We’ve open sourced an agent plugin that helps secure systems against recent cybersecurity threats.
You can install them with any agent or use them in Devin today:
devin.ai/blog/vulnerability-…
DesignArena's blind preference leaderboard now ranks Canva's new image model second in the world for image generation, behind exactly one other lab.
Craft is Canva's first frontier model, not a wrapper on someone else's API, and it launched this week. That leaderboard matters because it isn't scoring pixel accuracy, it's testing aesthetic judgment through head to head human preference votes, a much harder thing to game than a standard eval. Canva bought its way here: it acquired Leonardo.ai in 2024 specifically to build generation in house instead of licensing it, and Craft is that bet paying off.
It lands in a field that barely existed three years ago. Adobe Firefly starts at $5 a month and is built to be commercially indemnified for enterprise legal teams. Ideogram and Recraft are sharper at typography and vector work. Midjourney is still the aesthetic benchmark for a lot of creators. Canva, at roughly $15 a month, wraps frontier generation inside the same canvas hundreds of millions of people already design in.
Owning the model doesn't automatically win the workflow, though. Adobe's edge was never raw image quality, it's that Firefly sits inside procurement-approved tools with IP indemnification, which matters more to a legal team than a leaderboard rank. Canva is betting distribution plus a very good model beats a slightly better model with worse distribution.
The split worth watching is between labs chasing the most capable model and platforms chasing the most used one. Canva just proved you can build a genuinely frontier model without being a frontier lab first, you just need the users already in the room when you ship it.
xitter.cf/canva/status/211334870…
Introducing Canva Craft 🚀
Extraordinary image generation is now available to everyone, powered by our first frontier model built specifically for design.
With Craft, Canva is now the world's second most advanced AI lab for image generation on @DesignArena's global leaderboard.
See what it can do 👇
OpenAI, Anthropic, Google, Microsoft, AWS, Bloomberg, Cloudflare and Block now co-govern the same piece of agent infrastructure, and none of them had to win a standards war to get there.
Anthropic donated Agent Skills this week to the Agentic AI Foundation, the same neutral home it gave MCP to back in December 2025. Skills are the format for packaging an agent's expertise: instructions, scripts and resources a model pulls into context instead of stuffing everything into one system prompt. Since December, more than 70 platforms have already wired it in, ChatGPT, Cursor, GitHub Copilot and VS Code among them, which means the standard was winning in practice well before the donation made it official.
AAIF now hosts ten projects: MCP (over 10,000 servers in the wild), goose from Block, AGENTS.md from OpenAI, adopted by more than 60,000 repos, and now Agent Skills, Open Responses, OpenEnv and OpenSandbox. The platinum member list reads like a rivalry that decided not to happen: AWS, Anthropic, Block, Bloomberg, Cloudflare, Google, Microsoft and OpenAI, all funding the same neutral foundation under the Linux Foundation. I've seen this move before, just not in AI. Google handed Kubernetes to the CNCF in 2015 rather than let container orchestration fragment into incompatible stacks, and it's a big part of why container tooling never split the way, say, JavaScript frameworks did.
Neutral governance doesn't mean neutral incentives, though. Anthropic still ships the reference implementation fastest, still wrote the spec, and still has the most to gain from everyone adopting its format instead of inventing their own. A foundation seat isn't the same as equal pull on the roadmap.
What this buys the rest of us is boring in the best way: a skill written for Claude Code should keep working if you point it at Codex or Copilot next quarter, the same bet developers made on Kubernetes manifests staying portable across clouds. Format wars are expensive for everyone except whoever's trying to lock you in, and for once the biggest labs chose not to run that play.
xitter.cf/ClaudeDevs/status/2113…
We're donating Agent Skills to the Agentic AI Foundation (@AgenticAIFdn), the same foundation we donated MCP to.
Since December 2025, 70+ agent platforms have integrated the standard, including ChatGPT, Cursor, GitHub Copilot, and VS Code.
Here's what that means for you:
Barclays called AI the icing on the cake in the same breath as cutting 5,000 jobs, about 5% of its workforce, with 60% of the cuts landing in support functions including software development.
The detail that matters is what's replacing the headcount. Barclays wants half its software developers using Claude Code by the end of this year and most of them by the end of 2027. A knowledge assistant already touches more than 16,000 UK employees. In Global Markets, AI models are processing 120,000 client emails a day. None of that is a pilot, it's the operating model, and the bank has already booked roughly £307 million in restructuring costs this year with another £300 million expected before December.
Zoom out and every major bank is running some version of the same experiment at a different speed. JPMorgan tracks AI usage across 65,000 engineers as a formal part of performance reviews now, sorting people into light, heavy, and non-user tiers off Copilot telemetry, with a Claude Code pilot that started this spring. Citi says 182,000 employees use its AI tools. Wells Fargo claims a 35% productivity lift from the same category of tooling. Goldman Sachs is the outlier, holding tech spend flat at $6 billion, unwilling to go higher without clearer returns, even as the bank's own economists estimate AI is costing the US economy 5,000 to 10,000 jobs a month in exposed sectors.
What nobody's pricing in out loud: a study cited alongside JPMorgan's own rollout found developers measurably slower on some tasks while using these tools, and every one of these banks operates in a regulated environment where a human still has to verify whatever the model produced. Adoption and correctness are two different dashboards right now, and only one of them is getting built.
What I keep coming back to is that this round of cuts isn't speculative the way the 2023 vintage was. You can point to the tool, the rollout date, and the headcount number in the same press release. That's a different kind of signal than a vague promise that AI will change everything someday.
xitter.cf/OffThePress1/status/21…
Barclays CEO calls AI ‘icing on the cake’ as bank cuts 5,000 jobs offthepress.com/r/167636?c=s…
Ten security advisories against one piece of AI infrastructure this year. Two of them critical. The newest one just got its CVE number today: 2026-114612, rated 9.9, for a bug the maintainers first disclosed back in September at a more modest 7.7.
The mechanism is almost elegant in how bad it is. LiteLLM's proxy uses the same key to encrypt secrets at rest and to sign session tokens. Ask it for a new API key with a crafted metadata field containing a forged admin credential, and the proxy dutifully encrypts that forgery and hands it back to you. Present the result as a bearer token and the proxy decrypts it, trusts the forged identity, and you're proxy_admin. From there you're at the MCP stdio endpoint, running commands on the host.
This isn't an isolated miss. Back in June, Obsidian Security chained three separate LiteLLM bugs to get the same outcome from a default low privilege account, then demonstrated forging a tool call against Claude Code mid session, because the proxy sits between agent and model and can rewrite what passes through. In March, a compromised CI dependency let an attacker push malicious PyPI releases that stayed live about 40 minutes, long enough to harvest AWS, GCP, Azure, and Kubernetes credentials and phone them home to a domain LiteLLM says it doesn't own.
None of this is a side project getting sloppy. 54k GitHub stars, over 100 providers routed through one interface, sitting in the same category as Portkey, Cloudflare's AI Gateway, OpenRouter, and Kong, a market that barely existed three years ago and now routes a meaningful share of the $644 billion going into generative AI this year. Every one of these gateways holds provider keys, a master encryption key, and every prompt and response passing through, making the gateway a richer target than most of what it's supposedly protecting.
My read: 2026 was the year teams hardened the model layer, red teamed prompts, bolted on guardrails, while the proxy routing every request sat there with the blast radius of a domain controller and the access controls of a config file. If an agent's tool calls can be forged upstream of your approval step, the permission model you built on top of it was never actually in the loop.
xitter.cf/shcallaway/status/2113…
I don't mean to alarm you but a new critical CVE in LiteLLM just dropped 😬
Find out if you're affected: cve.now
Somebody built a tool whose entire pitch is finding out who on X is burning the most tokens on Claude Code and Codex. No prompts. No code. No API keys. Just one command. usagerank.com went live today and people immediately used it to roast their own spend in public. That reaction says something: developers want to see the number, they just don't want to be the only one looking at it.
There's already a real market forming around this exact anxiety. Helicone logs cost and latency with a one line proxy swap. Langfuse groups agentic tool calls into session level cost trees. Zylo benchmarks your Anthropic renewal against more than $75B in spend data it has seen elsewhere. Anthropic's own guidance puts typical Claude Code spend at $13 a developer per active day, with 90% of users under $30, which sounds fine until your team is running five backends at once and nobody owns the aggregate number.
That's the exact gap I built Campfire's cost dashboard for, except the comparison isn't against the internet's spend, it's against your own session. Run Claude Code, Codex, Goose, and Aider on the same task in isolated git worktrees, race mode shows what each backend actually cost to reach the same result, and cost cascade mode runs the cheapest backend first and only escalates when it fails. You don't need a public leaderboard to know you're burning tokens. You need to see which of your own agents is burning them for nothing.
github.com/stretchcloud/camp…
xitter.cf/csaba_kissi/status/211…
Aaaaaaand we're live!
usagerank.com
No prompts. No code. No API keys.
Just one command to find out who on X is burning the most tokens on Claude Code and Codex 🔥
A terminal command that generates an image, cuts a video, voices a line of dialogue with lyria-3.5, transcribes the result, and spins up a managed agent for the next step. That's gemini-api, Google's new, and officially unofficial, CLI for the Gemini API, now in preview.
The README is unusually honest about what it is: Apache 2.0, built with Speakeasy, and in its own words, "not an official Google product," not ready for production, breaking changes expected between versions. That caveat matters less than the shape of the thing. A year ago a coding agent was a chat window wired to a model. Now the baseline expectation is that one binary generates an image, voices it, transcribes it, and hands the result to a managed agent, all from one install script. Claude Code owns the terminal coding workflow. Codex iterates fast on the OpenAI side. Gemini already had a CLI for writing code. This is Google trying a second entry point, not "write my function" but "be the one tool my agent calls for every modality."
The real tell, to me, is what's missing from this build: the tokens and docs subcommands are both listed as not yet available. An experimental CLI shipping multimodal generation before it ships usage visibility says a lot about where the industry's priorities actually sit right now. Ship the capability, worry about knowing what it cost you later.
Every agent stack is quietly making the same bet: whoever becomes the default tool call wins distribution, even while the tool itself says don't trust me in production yet.
xitter.cf/LyalinDotCom/status/21…
Every agent that touches regulatory or legal data runs into the same wall: it doesn't know which government site has the real answer, so it guesses, scrapes the wrong PDF, or hallucinates a citation. Firecrawl shipped a fix this week, a free Government and Legal Index with 30 million plus US federal statutes, court opinions, city codes, and permits, sitting behind one plugin call.
The number behind it is the interesting part. Firecrawl says agents using this index scored 21% higher on answer quality than agents using generic web tools, in their own internal tests. That's backed by real money: a $75M Series B led by Smash Capital, on top of an API already serving 1.5 million users. The pitch is a library for the world's knowledge, official data providers plus a research index, developer index, and government index behind one interface. Tavily, Apify, and Exa are all racing the same territory from different angles. This is becoming its own category, not a feature.
What none of these indexes solve is the layer underneath them: once an agent actually has to pull a page, most tools re-read the DOM with an LLM every single time, even when nothing on the page has changed since yesterday. That's where I focused DeepScrape. It generates a deterministic CSS selector once, self-heals it when the page structure actually changes, and only brings the LLM in for the parts that genuinely need judgment: new fields, ambiguous layout, structure that moved. The index tells an agent where to look. The extraction layer decides whether you're paying model tokens every single time you look there.
github.com/stretchcloud/deep…
xitter.cf/firecrawl/status/21133…
Introducing the free Government & Legal Index for ChatGPT & Claude.
Give your AI agents 30M+ US government pages, from federal statutes and court opinions to city codes and permits.
Research tax rules, permits & case law with the Firecrawl plugin.
firecrawl.dev/alexandria/gov…
2,900 sign in attempts a minute. That is the pace Microsoft clocked from an AI agent, not a botnet, not a script kiddie running Hydra overnight.
Microsoft's own blog lays out what happened. Storm-0940, a China aligned group, ran an open source penetration testing framework called ARTEX, a multi agent system that chains reconnaissance through exfiltration with almost no human in the loop. Through the ConnectWise supply chain compromise, ARTEX password sprayed 327 accounts across eight organizations in four days and produced over 151,000 failed logons without a single successful one in that batch. Where it did get in, through stolen application credentials, it authenticated as an app that already had trust, meaning no interactive sign in, no MFA prompt, nothing for a human to notice. In several cases attackers went from first contact to privileged Global Administrator access in under three hours. Peak velocity: over 200 sign ins in four minutes off four application credentials.
ARTEX itself is not some exotic state asset. It's a public pentesting framework, written in Go with a Next.js front end, that works with any model and runs in five languages. The same tool red teams use to find their own holes is apparently good enough for a nation state to run offense at machine speed against real companies.
Security vendors have spent two years selling agent based defense: SOC copilots, autonomous triage, AI that writes its own detection rules. Less has been said about what happens once the attacker gets the same upgrade. Storm-0940 just answered that. The defender's agent has to be faster than the attacker's agent, not just smarter, because the entire value of ARTEX here was raw throughput: thousands of login attempts a minute that no analyst could triage by hand even if every one of them lit up a dashboard.
Every company that connected a ConnectWise app now has a specific, boring homework assignment: pull Entra sign in logs back to October 1, inventory service principal IDs, revoke what should not still have access. Nobody is pricing that cleanup into the "AI changes cybersecurity" headlines yet.
xitter.cf/MsftSecIntel/status/21…
The China state-aligned threat actor Storm-0940 used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries. Microsoft Threat Intelligence assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multitenant application. msft.it/6018aakEE
Our investigation found that Storm-0940's use of ARTEX accelerated the speed of compromised application abuse to authenticate to target environments through applications that had already been granted access, allowing the threat actor to operate without requiring an interactive user sign-in. AI-accelerated follow-on activity included reconnaissance, application credential changes, and attempts to modify privileges that could enable expanded or persistent access.
Read our blog for a detailed analysis and indicators of compromise (IOCs), along with Microsoft Defender detections, protection recommendations, and guidance on investigating service principal sign-ins and unexpected application credential or privilege changes.
Every agent demo hits the same wall eventually: a login form. 1Password shipped a fix today with 1Password for Agents, free on Individual and Family plans, and the mechanism is almost boring by design. An agent hits a sign-in page, asks the vault for the credential it needs, the user approves that specific request inside 1Password, and the password gets filled directly into the page. The agent never touches it, never stores it, never sees the one-time code either.
The partner list is the real story here. Meta's Muse and Grok Bot are rolling out now. Town's Townie is coming to web and iOS. Anthropic's Claude Duet and OpenAI's ChatGPT Work and dots are coming soon, alongside Browserbase, Browser Use, Perplexity, Ramp and a handful of smaller agent platforms. That's most of the serious personal-agent field agreeing to route through one company's vault instead of building their own credential layer, and it says more about how hard secure delegated auth is to get right than any feature list does.
It's a narrower, more personal version of the same problem that just made Chase tell customers to stop handing their banking passwords to AI assistants: an agent needs to act as you without becoming you. The bank story is institutions blocking the workaround. This is a vendor building the version that doesn't need one.
1Password is betting the broker model beats the alternatives on the table: pasting a password into a prompt, which hands the agent everything indefinitely, or making a human sit through every login, which defeats the point of having an agent at all. Okta and the enterprise secrets managers have circled this exact problem for machine identities for years. 1Password got there first on the consumer side because it already had the vault and the user relationship, not because the underlying problem is actually solved.
Credential brokering only works if every agent on that partner list actually respects the boundary it draws. The list proves demand. It doesn't prove that yet.
xitter.cf/1Password/status/21132…
Today we announce 1Password for Agents platform, building with companies @Muse, SpaceX Super Intelligence Grok @Bot, @AnthropicAI’s @Claudeai, @OpenAI, @TownAI, @Browserbase, @Browser_use, @heydana_ai, Instinct, @usekernel, @Perplexity_ai, @tryramp, @Tomo, and @wajo_ai, with more integrations on the way. 🎉
We've heard from so many of our customers who want to use these new personal AI agents to help them get more done, but want more control over what the agent can access with the same trust and ease of use they get when using 1Password directly.
1Password for Agents gives your agents access without giving up your passwords. When an agent reaches a sign-in form, it requests a credential from your vault. If you approve the request, 1Password directly auto-fills the credential in the destination site so the agent can’t see or take possession of the credentials.
The agent gets the task done, but it doesn’t get your passwords..
You stay in control. 1Password for Agents free and optional for personal and family accounts. Unless you opt-in to an agent connector, agents cannot touch your vault.
➡️Learn more: bit.ly/487da6J
Morgan Stanley, JPMorgan, Bank of America and Citi are now blocking a category of customer that didn't exist two years ago: the customer's own AI agent. Axios reported this week that unvetted third-party agents are showing up inside live banking sessions, some contacting call centers or attempting actions on their own, after customers handed their login and password straight to an assistant the bank never approved. Chase has started warning people outright not to share credentials with anything, human or not.
This isn't a hack. It's 2016 all over again. Mint, Yodlee and the early Plaid stack got built the exact same way, by screen-scraping credentials customers handed over willingly, until banks spent a decade building OAuth-based open banking rails specifically to kill the practice. AI agents just reopened the same door with better manners and a system prompt.
The fix the industry actually wants isn't blocking, it's a standard, and four of them are racing for the same slot right now. Visa's Trusted Agent Protocol signs merchant-specific credentials so a store can tell a real shopping agent from a bot. Mastercard's Agent Pay tokenizes the card itself and layers issuer risk controls on top. Google's AP2 proves an agent held a verifiable mandate to transact, payment-agnostic, built to plug into A2A and MCP. Stripe, OpenAI and Meta's ACP goes the other way, merchant checkout first, cart and delegated payment built on primitives stores already run, which is why it's the fastest path for anything selling through ChatGPT. Coinbase's x402 skips the retail argument entirely and just lets an agent pay per API call.
None of these four replace the others. Read-only access, which is what most banks are quietly shifting customers toward right now, is a stopgap while the identity layer gets built underneath it.
The real cost nobody's pricing in: every one of these protocols assumes the agent is honest about who it's acting for. The banks aren't panicking about malicious agents. They're panicking because right now there's no reliable way to even tell the difference.
xitter.cf/Polymarket/status/2113…
Jensen Huang gave an agent one sentence and let it finish his keynote for him. At GTC Berlin, he handed Hermes, Nous Research's self-hosted agent, a single prompt on an RTX Spark laptop. Hermes installed itself, then planned, built and ran an entire robot-training pipeline on its own: Nemotron scoped the obstacle course, GPT-6 Astra built the CAD and scene in FreeCAD and Omniverse, Isaac Sim and Isaac Lab ran the physics and the reinforcement-learning rollouts on cloud GPUs, and the trained policy got exported to ONNX and pushed over SSH to four physical robot ducks that then responded to sit and stand commands onstage.
The headline isn't the robot. It's that nobody at Nous wrote that pipeline by hand. The agent assembled its own toolchain from one instruction, which is the actual shift agent builders have been chasing since autonomous-agent demos first went viral: not a smarter model, a model that can scaffold its own infrastructure.
Nous isn't a side project NVIDIA borrowed for a demo. It's closing a round at a $1.5B valuation, Robot Ventures leading with USV in, up from the $1B mark Paradigm set in its Series A back in April 2025. Hermes already carries roughly 214,000 GitHub stars, runs on more than 300 models through NVIDIA's own Switchyard router, and ships with persistent memory, sandboxed command execution and the ability to write its own reusable SKILL.md files. That's the open-weight answer to Devin and Manus: self-hosted instead of a hosted black box, which is exactly why NVIDIA is pointing enterprises toward it for on-premises deployment alongside Perplexity and Aible.
What the demo skips past: Nemotron, Isaac Sim, Omniverse and the robot hardware were all NVIDIA's own stack, tuned for precisely this showcase. The gap between an agent building an agent onstage and a team doing it on infrastructure nobody pre-wired is still the whole gap that matters.
The model stopped being the hard part days ago. The orchestration layer, the thing that lets one agent reliably wire up ten other tools without a stage crew standing behind it, is where the next two years get decided, not on a benchmark leaderboard.
xitter.cf/NousResearch/status/21…
Jensen closed his GTC Berlin 2026 keynote with this Hermes Agent demo as the finale.
He introduced it by saying the way to build an agent is to ask an agent to build it for you, so he installed and set up a customized Hermes in one prompt.
Then he used Hermes, running on @nvidia RTX Spark, to create a simulated training environment for the @huggingface Microduck. Hermes planned an obstacle course with Nemotron and had GPT-6 Astra build it using FreeCAD, Omniverse libraries, Blender, Newton, and Isaac Lab. Hermes trained thousands of simulated ducks on that course until the validated policy was ready to run on the real robot in the physical world.
At Nous, we believe open source is a practical tool as much as a philosophical ideal. It gives users the ability to build powerful, complex workflows chaining numerous local+cloud models, devices, and tools themselves instead of waiting for a company to enable them.
A year ago, running one coding agent was the whole workflow. Now people are stringing together three or four just to ship a feature, like the builder who posted today about coordinating Claude Code, Codex and Pi through a separate tool just to keep the loop consistent. 'Which coding agent CLI should I use' comparison posts have turned into their own genre this year, usually a sign the real answer is more than one.
The part nobody's solved well is what happens once several agents are making decisions against the same codebase at the same time. Who approves what. Whether you can tell which agent burned the tokens on a given session. Whether you trust any of them enough to let one merge without a human reading every diff.
Campfire runs Claude Code, Codex, Aider, Goose and others side by side in one browser tab, each in its own git worktree, with a permission model built for exactly this: majority-rules voting across the agents on anything risky, any single deny blocks it, a 30-second timer so nothing stalls waiting on a human who stepped away. You can run the same task as a race across backends in isolated worktrees and actually compare what each one shipped, replay any session after the fact, and check a cost dashboard that shows which agent is expensive and which is just slow.
github.com/stretchcloud/camp…
xitter.cf/dgalarza/status/211326…
Laravel's MCP package maintainer posted a patch notice yesterday: SSRF and credential exposure in the OAuth discovery flow, fixed in 1.1.0 and 0.9.7. On its own that's one Tuesday. In context it's at least the fourth SSRF disclosure in an MCP server this year, after Grafana's MCP server (CVSS 9.1, reachable AWS instance credentials in testing), the Terraform MCP server, and the Facebook Ads MCP server. Four vendors, four different stacks, same bug class.
An academic audit published this year gives the scale behind it: 640 confirmed production MCP servers found, 414 dynamically tested. 91.8% had no OAuth at all. 687 tool instances across the pool exposed raw shell execution with zero access control. 29 servers had SSRF, one reaching AWS's metadata service during testing. Censys separately estimated over 21,000 MCP instances sitting on the public internet back in May. The same study found 41.6% of servers it fingerprinted were gone three days later, which tells you how hard this is to even inventory, let alone patch.
The paper's own conclusion is the useful part: it blames structural defaults, not sloppy developers. MCP servers ship authenticated-by-nobody because the spec and tooling make that the path of least resistance, the same way S3 buckets defaulted to readable long enough to become a running joke before AWS flipped it. Atlassian's MCP connector, a WordPress plugin, and a graph database called ArcadeDB have all shipped their own separate advisories this year too, spanning the full range of who's building on this protocol.
Nobody owns verifying an MCP server's auth posture before you point an agent at it, and the registries listing these servers mostly don't disclose whether auth exists at all. That's not a model problem. It's a protocol still running on 2023-era trust assumptions at 2026-era adoption.
xitter.cf/pushpak1300/status/211…
Hate to be that guy 🙃, but if you’ve updated PHP, please update laravel/mcp too.
The advisory we published yesterday is patched in 1.1.0 and 0.9.7.
composer update laravel/mcp
github.com/laravel/mcp/secur…
Stay Safe. Fam!
The scraping stack people reach for now runs straight through an LLM: point a prompt at a page, let the model read and re-read it every single pass to pull structure out. That's also why it costs what it costs. Apify's own AI Web Scraper prices LLM-token extraction at $20 to $30 per 1,000 pages, against $0.20 to $1 per 1,000 for the plain HTTP crawler doing the same job without a model in the loop. Same data, 20 to 100x the bill, because the model is re-reading a layout that hasn't changed since last week.
Firecrawl just raised $82M on top of a $14.5M Series A to go compete across scraping, search and browser agents, so real money is chasing exactly this cost problem right now. The fix most of the field is converging on isn't a bigger model, it's doing the structural work once. DeepScrape generates deterministic CSS selectors the first time it sees a page, reuses them on every pass after, and only calls an LLM again when the page actually changes and the selectors need to self-heal. The model's job shrinks to selector generation, validation and adaptation instead of reading the whole document every time.
It also ships as an MCP server, so Claude or Cursor can call the scraper directly as a tool, plus a site-to-MCP mode that turns any website into a structured data source an agent queries instead of re-scrapes. Built for agents that need web data to be reliable and cheap, not just possible.
github.com/stretchcloud/deep…
xitter.cf/rrs00179/status/211323…
From raw HTTP requests and HTML parsing to Selenium, Playwright, Puppeteer, CAPTCHAs, production scraping and modern AI-driven tools like Firecrawl, Apify and crawl4ai.
Want to learn it for free, check it out here: lnkd.in/d9xiiPQ4
Thanks to Remi Taffin for authoring!
95.4% accuracy and $5.63 per 1,000 correct tool calls sits right next to 95.4% accuracy and $1.50 per 1,000 correct tool calls on the same benchmark. Same task, same pass rate, 3.75x the bill. That's Claude Opus 5.5 and Grok 4.7 on Tirtha Bench, a solo-built tool-calling leaderboard that just published 843 result rows across 74 models.
The setup is 800 shared tool-calling tasks plus 100 traps designed to tempt a wrong call, scored for the right tool with the right arguments. Only 8 models ran the full shared test, which is the honest way to run this: everything else on the page is single-run and the author says so upfront, unlike most leaderboards that blend methodologies and let you forget it.
This sits next to, not instead of, the Berkeley Function-Calling Leaderboard, the reference standard since Gorilla shipped it, and Sierra's tau-bench, which tests agents against simulated retail and airline conversations rather than isolated calls. None of the three lead with cost-per-correct-answer. Tirtha does, and the spread is brutal: DeepSeek V4.1 Flash clears a correct call for $0.09 per 1,000 at the cheap end, Opus 5.5 sits 65x higher at the top.
What the accuracy column hides: parallel tool calls break models that look fine on single calls. GPT-5.1 Codex holds 93%+ on one-shot calls and falls to 61% the moment it has to fire several at once. The same open model swings 14 points on identical tasks depending only on which inference host serves it, gpt-oss-120b scored 63.9% on Cerebras and 78.0% on Together. Nobody's model card mentions the host.
My read: teams are still picking models off accuracy leaderboards and routing cost decisions through a separate pricing page, when the benchmark that matters is the one that multiplies the two together.
xitter.cf/TirthaAI/status/211202…
Solo founder, building in the open. Tīrtha Bench is live: 68 models, the same 800 tool-calling tasks, every raw row public. Biggest surprise: dollars per 1,000 right answers vary 65x, and the priciest model only tied for first. tirtha.ai/bench
