Oui d'ailleurs la manière dont @bcherny avait détaillé son process de code avec sa stack était déja une organisation à la clawd avant que la vague n'arrive. Et c'était aussi le principe de babyagi il y a un peu plus longtemps.
CODE
-
Code Validation Tools Essential for AI Coding Agents
By
–
As always though the trick is to arm them with a good coding agent harness and the right collection of tools – compilers and debuggers and linters and fuzzers and suchlike I don't trust any code produced by a model directly until I've seen the model run it
-
LLMs Show Strong Capability for Complex C Code Reasoning
By
–
I would not have trusted LLMs with C code a year ago but today's models appear to be very good at reasoning through memory management and other tricky aspects That said I'm not enough of a C expert myself to credible evaluate what they're doing!
-
Claude Code Auto Mode: Daily Feature Releases Continue
By
–
This is insane. They literally drop every freaking day. Today: Claude code auto mode. Permission decisions on your behalf.
-
Transitioning from skip permissions to automatic mode
By
–
Goodbye –dangerously-skip-permissions, hello auto mode
-
Long Prompt Handling Oversight in AI System Architecture
By
–
Unfortunately it was a oversight since historically only ~0.5% of prompts coming into our system were super long and we just weren't thinking about it much
-
Claude Live Codes Music with Strudel and TidalCycles
By
–
Been experimenting recently with making Claude live code music with Strudel / TidalCycles.
— Gene Kogan (@genekogan) 24 mars 2026
A bit slow at first, but things pick up around ~2:00. pic.twitter.com/O9AE1tIlyEBeen experimenting recently with making Claude live code music with Strudel / TidalCycles. A bit slow at first, but things pick up around ~2:00.
→ View original post on X — @genekogan, 2026-03-24 17:59 UTC
-
Auto-Research for Data: The Underrated ML Game Changer
By
–
Auto-research for ML training models is all the rage now, but underrated is: auto-research for data! Sure, you can squeeze out a bit of model performance by optimizing hyperparameters, but code agents can do data work that has been very labour intensive and required a lot of attention to a lot details effortlessly: > download data from many different data sources > bring all the data sources into uniform format > do detailed EDA: find patterns and outliers > look at 100s of samples and take detailed notes > make beautiful infographics rather than mpl plots > iterate on data filtering by looking at more samples > make a simple pipelines robust and scalable It's now possible to write data pipelines for dozens of data sources in hours that would have taken weeks of reading many docs, debugging APIs and data formats, wrangling outliers and missing data. A few weeks ago we gave Claude access to the CPU partition of our cluster and it iteratively refined filters to retrieve a domain subset of FineWeb. This would have taken me 2-3 days to work through while it took Claude just a few hours with almost no babysitting and with a nice logbook. Thus the long tail of small, niche data sources becomes more accessible and can be aggregated to even larger high quality datasets for cool applications. Data has been fuelling LLM progress more than model architecture innovations, so I am very excited about this!
→ View original post on X — @thom_wolf, 2026-03-24 17:04 UTC
-
LiteLLM Supply Chain Attack: Bug Saved Developers from Credential Theft
By
–
When vibe coding is an unalloyed good: your hacker vibe coded their way to a bug that limited the efficacy of their attack. 😅😮💨 (But still very serious.) Andrej Karpathy (@karpathy) Software horror: litellm PyPI supply chain attack. Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords. LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm. Afaict the poisoned version was up for only less than ~1 hour. The attack had a bug which led to its discovery – Callum McMahon was using an MCP plugin inside Cursor that pulled in litellm as a transitive dependency. When litellm 1.82.8 installed, their machine ran out of RAM and crashed. So if the attacker didn't vibe code this attack it could have been undetected for many days or weeks. Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages. Classical software engineering would have you believe that dependencies are good (we're building pyramids from bricks), but imo this has to be re-evaluated, and it's why I've been so growingly averse to them, preferring to use LLMs to "yoink" functionality when it's simple enough and possible. — https://nitter.net/karpathy/status/2036487306585268612#m
-
LiteLLM PyPI Supply Chain Attack Steals Credentials and API Keys
By
–
Software horror: litellm PyPI supply chain attack. Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords. LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm. Afaict the poisoned version was up for only less than ~1 hour. The attack had a bug which led to its discovery – Callum McMahon was using an MCP plugin inside Cursor that pulled in litellm as a transitive dependency. When litellm 1.82.8 installed, their machine ran out of RAM and crashed. So if the attacker didn't vibe code this attack it could have been undetected for many days or weeks. Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages. Classical software engineering would have you believe that dependencies are good (we're building pyramids from bricks), but imo this has to be re-evaluated, and it's why I've been so growingly averse to them, preferring to use LLMs to "yoink" functionality when it's simple enough and possible. Daniel Hnyk (@hnykda) LiteLLM HAS BEEN COMPROMISED, DO NOT UPDATE. We just discovered that LiteLLM pypi release 1.82.8. It has been compromised, it contains litellm_init.pth with base64 encoded instructions to send all the credentials it can find to remote server + self-replicate. link below — https://nitter.net/hnykda/status/2036414330267193815#m