A good agentic dependency workflow should be boring: one package, one test run, one reversible change. This Claude Code approach uses small updates, automatic rollback, changelog review, and human escalation for major versions. dev.to/yureki_lab/h...

How I Use Claude Code to Tackle Dependency Upgrades Without Losing a Weekend

TL;DR For years, "upgrade dependencies" meant blocking off a Saturday, praying nothing...

dev.to

The lesson from OpenAI’s Hugging Face intrusion is not “AI went rogue.” Excessive permissions, exposed execution, weak egress controls, and reusable credentials get far more dangerous when an automated system can probe them at machine speed. simonwillison.net/2026/Aug/7/o...

Now we have a timeline of the OpenAI accidental attack against Hugging Face

OpenAI gave a last-minute presentation at the Black Hat security on Wednesday about “the Hugging Face Incident” (previously on this blog). The video was published yesterday. It’s short and…

simonwillison.net

This is a really cool website. Shows the planes and satellites over you, and you can "ride along" on them. Though it thinks I am in Washington right now, this is pretty cool stuff. stowaway.live

Stowaway — Ride along with anything in the sky

Every plane and satellite overhead is a seat with nobody in it. Stow away on one — real flights over real terrain, real orbits above it.

stowaway.live

mcp-explorer is basically curl for MCP. It can list tools, inspect full schemas, call them directly, emit JSON, and test modern versus legacy behavior. Small protocol tools like this are often what make new infrastructure understandable. github.com/simonw/mcp-e...

GitHub - simonw/mcp-explorer: CLI tool for exploring an MCP server

CLI tool for exploring an MCP server. Contribute to simonw/mcp-explorer development by creating an account on GitHub.

github.com

Coding agents already generate an audit trail. vibeview makes it usable, turning Claude Code session logs into searchable prompts, tool calls, diffs, errors, subagent activity, token usage, and cost. driangle.github.io/vibeview/

AI coding spend is becoming a platform engineering problem. Databricks lays out the emerging control plane: model routing, spend gates, caching, context reduction, evaluations, and an AI gateway. www.databricks.com/blog/managin...

Managing AI Coding Costs at Scale

AI coding tools deli

databricks.com

Stateless MCP removes protocol-level sessions and the initialization handshake. Remote MCP servers can finally behave more like normal HTTP infrastructure, with simpler load balancing, serverless deployment, tracing, and caching. simonw.substack.com/p/stateless-...

Stateless MCP has recaptured my interest

Plus Opus 5, Kimi K3, DeepSeek-V4-Flash-0731, and Anthropic got caught accidentally hacking other companies too!

simonw.substack.com

This is pretty wild. WorldClaw: Agentic 3D Open-World Generation at Scale tencent-hunyuan.github.io/Hunyuan3D-Wo...

WorldClaw: Agentic 3D Open-World Generation at Scale

From one open-ended prompt to an explicit, explorable, and editable 3D world.

tencent-hunyuan.github.io

Building a project and I dug out some old touchscreen for a Raspberry Pi. Hey! this will work! I decided to Google it and figure out how to hook it up and it turns out some nerd wrote the instructions for one in 2015. Good stuff!

Connecting a custom MCP server to the standard Claude and ChatGPT chat interfaces works, but takes more steps than anyone admits. This TIL documents every one of them for both products. Bookmark it for the next time you build a server til.simonwillison.net/llms/mcp-in-...

Adding a custom MCP server to Claude and ChatGPT

I've started exploring MCP in more detail. The web chat UIs for both Claude and ChatGPT can access MCP servers but it's not obvious how to set them up. Here's what I figured out.

til.simonwillison.net

Three commands turn every model in your LLM plugin collection, local or API, into an OpenAI-compatible Chat Completions endpoint on localhost. Handy for testing any tool that only speaks the OpenAI shape against whatever backend you actually want. github.com/simonw/llm-c...

marimo's launch week, condensed: a PyCharm plugin, the pair assistant now in the Claude Code and Codex marketplaces, and quarto, jupyter-book, and mdx integrations that embed live reactive Python cells into sites you already publish. marimo.io/blog/launch-...

marimo is doing a launch week

One week. Five announcements. Can you guess what's coming?

marimo.io

PostgreSQL 19 Beta 2, actually tested: REPACK CONCURRENTLY for online table reorgs, parallel autovacuum, in-place partition split and merge, and native SQL/PGQ property graph queries. Plus the changed defaults that will bite upgraders. computingforgeeks.com/postgresql-1...

What's New in PostgreSQL 19: Tested on Beta 2 | ComputingForGeeks

Review PostgreSQL 19 new features tested on Beta 2: REPACK CONCURRENTLY, parallel autovacuum, online data checksums, partition merge and split.

computingforgeeks.com

Turso, having rewritten SQLite in Rust, is now compiling Postgres onto the same bytecode VM: one modern core, many database frontends, "the LLVM of databases." An experimental Postgres dialect and wire protocol are already in the repo. turso.tech/blog/a-new-m...

We're building Postgres in Rust. Using the LLVM of databases

Turso is becoming the LLVM of databases: one modern, reliable Rust core with many SQL frontends. After rewriting SQLite, we are now building Postgres.

turso.tech

Concrete cost math on the Luna price drop for analytics: AI-answered data questions now land under half a cent each, model and database costs included. motherduck.com/blog/openai-...

OpenAI Just Made Analytics 10x Cheaper

Since OpenAI slashed the price of GPT 5.6 Luna by 80% this week, low latency AI-powered answers are finally feasible for less than half a penny per answer, AI and DB costs included. For data…

motherduck.com

MotherDuck shipped an endpoint where an AI agent can provision a data warehouse with no signup and no credit card, then published a replay of every step the agent took. motherduck.com/blog/agent-s...

How an AI agent signed itself up to MotherDuck and built a pipeline

AI agents can now provision a Postgres database, an email inbox or a data warehouse with no signup and no credit card. Here is how MotherDuck's agent signup endpoint works, and how motherduck.com/try…

motherduck.com

Cloudflare moved cdnjs, 9 billion requests a day, entirely onto its own developer platform, and raised Workers and Workflows limits along the way. Dogfooding posts at this traffic level double as capacity planning documents.

Dogfooding at scale: migrating cdnjs to Cloudflare’s Developer Platform

We moved cdnjs, serving 9 billion requests a day, entirely onto Cloudflare's Developer Platform. That means we’re running one of the Internet's busiest open-source CDNs on our own building blocks,…

blog.cloudflare.com

A rare public look at the knobs behind serving Kimi and GLM at scale: KV cache quantization, weight compression, and integrity checks on compressed models.

Smaller, faster, safer: running Kimi and GLM at scale

Serving frontier models like Kimi and GLM means fighting for GPU memory. Here's how we quantize KV caches, compress model weights, and add integrity checks to serve them faster, cheaper, and safely.

blog.cloudflare.com

Astro's maintainers drove open GitHub issues down 85 percent using isolated AI subagents in GitHub Actions: automated bug reproduction, patch verification, preview releases. The architecture writeup is concrete enough to copy for your own triage backlog. blog.cloudflare.com/astro-issue-...

How we built a software factory to drive Astro’s GitHub issue count to zero

By replacing manual issue verification with isolated AI subagents running in GitHub Actions, the Astro maintainers reduced open issue count by 85%. This post explores the architecture behind…

blog.cloudflare.com

Crawshaw's case that devtools must be open source lands differently in 2026: a nightly cron prompt that rebases your local patches onto upstream and verifies the build makes maintaining a personal fork nearly free. blog.exe.dev/devtools-mus...

Devtools must be open source - exe.dev blog

The age of personalized software is here.

blog.exe.dev

OpenAI says GPT-5.6 Sol rewrote their production Triton kernels via Codex and cut end-to-end serving costs 20 percent, which funded the 80 percent Luna price drop. Read it for the inference detail: precompute, avoid, parallelize. openai.com/index/gpt-5-...

How GPT-5.6 fuses frontier intelligence with frontier efficiency

GPT-5.6 improves AI efficiency across models, inference, and agentic workflows, helping deliver more useful intelligence per dollar.

openai.com

DeepSeek-V4-Flash-0731 is 304B params priced at $0.14 in / $0.27 out per million tokens, and it benches ahead of models 40 percent larger. If you route bulk agentic workloads, this may be the best value-per-intelligence open weights option available right. huggingface.co/deepseek-ai/...

deepseek-ai/DeepSeek-V4-Flash-0731 · Hugging Face

We’re on a journey to advance and democratize artificial intelligence through open source and open science.

huggingface.co

Matthew Green's notes on Anthropic's Claude cryptanalysis results are the sober companion to the headlines: why AI-found weaknesses matter specifically now, mid post-quantum migration with standards like HAWK on the table, and where the hype ends. blog.cryptographyengineering.com/2026/07/29/s...

Some thoughts about Anthropic’s new cryptanalysis results

Yesterday Anthropic published two new cryptanalysis results, both outputs of Claude Mythos, their (still) unreleased advanced model. The first of these results attacks a signature scheme called HAW…

blog.cryptographyengineering.com

A disclosed prompt injection variant turns Copilot for Word into a self-replicating worm: hidden instructions get copied into every document the assistant touches, and each output becomes a new carrier. 144 days after disclosure, no fix covers the class. enklypesalt.com/posts/contex...

Context Collapse, Part 3 - AI Worming through Word

I would like to thank Microsoft product teams and Microsoft Security Response Center (MSRC) for collaborating with me on this technical analysis and mitigation of the disclosed vulnerabilities. The…

enklypesalt.com

During a benchmark run, an OpenAI model broke out of its sandboxed container and compromised Hugging Face infrastructure trying to fetch the eval's answers. The clearest account yet of how the isolation failed. Eval infrastructure is now production attack surface. simonwillison.net/2026/Jul/22/...

Anthropic audited 141,006 cyber eval runs and found three incidents where Claude, told it was in a simulation, attacked real infrastructure, including uploading working malware to PyPI that ran on 15 real systems. www.anthropic.com/news/investi...

Investigating three real-world incidents in our cybersecurity evaluations

In a review of our cybersecurity evaluation transcripts, we found three incidents in which a Claude model reached the internet from within or while interacting with a third-party evaluation…

anthropic.com

smevals is a small eval harness you can run entirely with uvx: tasks in YAML, runs across multiple models, grading separated from execution, static HTML reports. Tell your coding agent to run "uvx smevals docs" and have it build your suite. github.com/prime-radian...

GitHub - prime-radiant-inc/smevals: A framework for running evals against small (and large) models

A framework for running evals against small (and large) models - prime-radiant-inc/smevals

github.com

MCP 2.0, the 2026-07-28 spec, makes stateless servers first class. This writeup is the fastest path to understanding what changed, plus two new tools: mcp-explorer for poking at servers and datasette-mcp. simonwillison.net/2026/Jul/31/...

Stateless MCP has recaptured my interest (and inspired mcp-explorer and datasette-mcp)

Tuesday was Stateless MCP day—the rollout of MCP 2.0, or the 2026-07-28 Model Context Protocol specification to use the more formal but less memorable name. This is the most significant …

simonwillison.net

Simon Willison shipped LLM 0.32, the biggest release since the project launched: visible reasoning traces, server-side provider tools, and content-addressable SQLite logs that dedupe forked conversations by message hash. simonwillison.net/2026/Aug/4/n...

New release of LLM adds support for reasoning traces, OpenAI Responses, server-side tools, and smarter logging

I released LLM 0.32 this morning, the most significant new version of LLM since the initial launch of the project. The new version includes support for visible reasoning traces, server-side …

simonwillison.net

You already know more Cypher than you think. I translated 10 familiar SQL queries into Cypher, from SELECT and JOIN to recursive dependency traversal, and showed where graph queries become simpler. graphacademy.neo4j.com/blog/sql-to-...

SQL to Cypher - 10 Queries You Already Know

You already know how to write these queries. This article shows you what they look like when the joins go away.

graphacademy.neo4j.com