Bye bye “State Of” reports. Benchmarks are the new “blog post”. This is a post for all of you DevRel friends out there.
Liran Tal
@lirantal.com
🦄 Node.js Secure Coding: http://nodejs-security.com 🌟 @GitHub Star 🏅 @OpenJS Pathfinder award for Security 🥑 DevRel at @snyksec
if you think engineering and technical savy is unimportant beacuse you can just ask the agent... well, here's yet another example of pushing back and steering agents away from disaster and disappointed users
snapshot from the Snyk VulnBench when I set out to build the benchmarking harness so if I were to build a new benchmark - what questions would you want it to answer... ?
If you're doing development within an AI-assisted IDE which maintains the chat and the traditional editor experience, how do you think of this agentic security experience with Snyk? it effectively runs health checks on an agent suggested packages to audit that the package is legitimate (and not ma
you know it's just a matter of time we get another malicious security incident right make sure you're ready for it I recommend npq
from a conversation with a good friend about an agentic tool... it's in Hebrew but basically it is "my agent replied to your agent" 😆
I got some new Boxdown features and fixes streamlined in the latest 2.x major version: github.com/lirantal/box... If you care about running agentic workloads inside secure and isolated environments, go try boxdown:
GitHub - lirantal/boxdown
Contribute to lirantal/boxdown development by creating an account on GitHub.
github.com
Aerospace tiling is really cool and genuinely useful but the whole workspace via shortcuts is not productive when I can just swipe left/right with the magic mouse on a mac how are you all using it?
it's 2026 and Atlassian didn't add export to Markdown in Confluence :(
in case you were living under a rock and missed the OpenAI + Hugging Face incident from last week... Here, I highlighted everything you need to know from the incident report. Maybe emergent properties? Maybe Skynet early days. Maybe a nice PR. Either way, stay vigilant.
uhmm yeah, this is kinda cool :) go read up on vulnbench - an LLM vs SAST security benchmark I worked on, it's now public
I was really hoping to use VS Code for managing the second brain Obsidian-like vault but the extensions and overall capabilities are just terrible What did you all do? Just use Obsidian?
Here's the highlight from Snyk VulnBench that we published: Claude Sonnet 4.6 Medium produced the most one-off extra vulnerability reports: 61.7% of its LLM-only reports appeared in just one of five runs Ask yourself - how does instructing Claude Code to find vulnerabilities impacts vulnerability
Snyk VulnBench JS 1.0 shows that the best-scoring LLM configuration reached 75.4% Snyk-reference F1, leaving a 24.6-point gap against deterministic SAST reference reproduction. Go read up on this coding agents security benchmark Trusting your Claude Code or other harness to just "find all vulner
DevRel friends you should invest more in doing deep research I ran the VulnBench benchmark project at Snyk, which now graduated to a full-time Forward Research initiative under DevRel, and it's not only satisfying from a technical perspective but also incredibly energising to dive into the detail
Who's coming to AGNTCon and MCPCon in San Jose on October? register.linuxfoundation.org/kwvwKR?sms=7... I'm planning to show you some real live hack examples of agents going rogue due to... agent skills, yep. We'll focus on skill security :)
register.linuxfoundation.org
On September 17-18 I'm heading to AGNTCon + MCPCon Europe 2026 in Amsterdam register.linuxfoundation.org/gqbR9n?sms=7... Going to show you all why you need to give your AI agent a second brain 🧠 💜 Come meet me if you want to see some cool Snyk demos :-)
register.linuxfoundation.org
trustworthiness is engineered, and it's engineered where Snyk operates (context, tooling, guardrails) thanks for coming to my ted talk
What we're setting up to explore as part of Snyk's Forward Research benchmarks is the through-line of the harness-sensitivity spine: not the model. The harness defines how the agent is built, grounded, and governed. Follow for updates 👀
The OpenJS Foundation contributors leaderboard 🎉 Thank you to all of the amazing humans, some of whom are on this list that I am grateful to call friends, for building a better open-source world for us ❤️
Reasons to use subagents: □ Context window: remains unpolluted on the main agent session □ Access: gated access of tool calls per subagent □ Reasoning: model + the reasoning effort level specific to the subagent's task □ Prompt: the repeatable instructions are kept within the subagents (no need for
what if I ran /grill-me but I'd have the agent answer its own questions
guess what really unlocks agentic loops? verifiable software ;-) yep, you still need to write tests, have a deterministic CI setup, and... security controls