After the OpenCode Breach: Why Coding Agents Became Credential Magnets
OpenCode Console leaked saved OpenAI and Anthropic keys for 1.4% of users. Why coding agents concentrate credentials, how past attacks compare, and a checklist.
Remy (Redreamality)
AI Engineer · Independent Thinker
Building with AI agents, and thinking out loud — projects, writing, talks, and reflections in one place.
Visuals
View all visuals Interactive explainer
Even a Fierce Virus: Why Does Spread Self-Extinguish Past a Coverage Threshold?
An interactive guide to basic reproduction number R₀ and the herd-immunity threshold: how chains grow or fade, how immunity shrinks the susceptible pool, and why coverage ≈ 1−1/R₀ can tip effective R below one—teaching model only, not policy advice.
Explore the visual Interactive explainer
In a World of "About Average," Why Do Extremes Keep Showing Up?
An interactive guide to the normal (bell) curve: why most outcomes pile near the mean, how independent small shocks stack into that shape, what 1/2/3σ bands mean, and why rare tails still appear in large samples—mechanism only, not a formula drill.
Explore the visual Interactive explainer
Same Lab Result—Why Do Two People Reach Opposite Conclusions?
An interactive guide to Bayesian updating: how different priors plus the same positive test can yield opposite posteriors—base rates, likelihood ratios, and tree/area intuition. Teaching numbers only; not a medical diagnosis.
Explore the visual Interactive explainer
0.1% Extra a Day—How Far Ahead Are You in a Year?
An interactive guide to compound growth: why discrete compounding pulls away from linear add-ups, how a tiny daily rate becomes a large gap over 365 steps, and why time horizon matters as much as the rate—mechanism only, no investment advice.
Explore the visual Interactive explainer
When More Money Is Printed, Why Does Your Pocket Feel Thinner?
An interactive guide to inflation as purchasing-power dilution: how money or demand shocks lift the price level, why nominal cash is not the same as real buying power, and how a single rising price differs from a general rise.
Explore the visual Interactive explainer
Can a Butterfly's Flap Really Start a Tornado?
An interactive guide to sensitive dependence in chaos: tiny initial differences, exponentially diverging trajectories, predictability horizons, and why the butterfly is a metaphor—not a literal cause.
Explore the visual Interactive explainer
Why Two People Who Want Less Jail Time Both Get More
An interactive guide to the prisoner's dilemma: payoff matrices, dominant strategies, Nash mutual defection, the welfare gap, and how repeated games with punishment can protect cooperation.
Explore the visual Interactive explainer
Why Pacific Warming Shows Up in Grocery Prices
Follow ENSO from equatorial Pacific heat anomalies through rainfall teleconnections and crop stress to grocery price pass-through—kept distinct from the typhoon Visual.
Explore the visual Interactive explainer
How Price and Volume Work Together
Read price and volume as contextual evidence about participation, liquidity, and market response—not as a certain trading signal.
Explore the visual Interactive explainer
How Air Conditioners Work
Follow the refrigerant through evaporation, compression, condensation, and expansion to see how an air conditioner moves heat outdoors.
Explore the visual Interactive explainer
What Is Loop Engineering?
Learn Loop Engineering in plain language: contracts, bounded attempts, evidence, durable state, budgets, stop routes, human review, and system improvement.
Explore the visual Interactive explainer
How Typhoons Form
Thirteen interactive steps explain how a warm ocean disturbance becomes an organized tropical cyclone.
Explore the visualRecent Blog Posts
View allTerence Tao's Blog Asks "Why Are We Even Doing All This?": What Mathematics Is For Once AI Can Solve the Problems
A guest post on Terence Tao's blog asks, with heavy irony, why anyone should still do mathematics. We read it alongside TheoPhysEval (50 unpublished physics problems, 49 solved by the best agent), Tao's Math 2.0 threads, Derek Thompson's craft-and-conversation essay and the Simons Foundation's USD 15M program, and lay out which kinds of mathematical work AI dilutes and which become more valuable.
Mercor Labor Index: 90% of US Work Hours Lack AI Benchmark Coverage. How Should Teams Measure Models?
Mercor's Labor Index finds ~90% of US work hours have little or no AI benchmark coverage. With two new arXiv papers on saturation and graders, here is how teams should measure models on real work.
Coding Agents Produce More Code, Not More Software (2026)
Harvard data across 700+ firms: coding agents lift lines of code about 30% and review time about 49%, while Issue resolution barely moves. Read alongside QGIS banning AI contributions, Torvalds using Claude Code, and Hickey, Spinellis, and a Berkeley experiment on cognitive offloading, it adds up to a framework for measuring agent output.
AI Reverse Engineering and Clean-Room Rewrites: REA, PhotoCraft, chardet and Malus Side by Side
REA's agent reverse-engineering toolkit, ArtCraft PhotoCraft's "clean-room Photoshop", chardet 7's Claude rewrite and relicensing, and the Malus satire, read together: how AI reverse engineering and rewriting work, how the AI version differs from a classic clean room, the licensing and copyright risk layers, and a decision framework for using these tools.
DeepSeek Harness, Taken Apart: The Loop, PTC, Four Modes, Plugins and Sandbox, and How It Compares with Claude Code, Codex and Pi
DeepSeek Harness is not just another coding CLI: its agent loop is itself a Cordis plugin, PTC lets the model write programs that call tools, the four modes are four presets, and sandbox, approval and permission presets each guard a different stage. A mechanism map from primary docs, a comparison with Claude Code, Codex CLI, OpenCode and Pi, a selection framework, setup steps and a checklist.
Choosing, Gating, and Escalating Agent Models on OpenRouter
An operator's synthesis of OpenRouter's cost–quality frontier, CI eval gates, and confidence escalation—plus provider routing, FrugalGPT/RouteLLM, and on-site eval-reliability posts—for coding-agent engineers.
Codex Moves to the Cloud: Reusable Environments, Codex Security Cloud, and the Agents API with Computer Use (DevDay 2026)
OpenAI DevDay 2026, read as one harness story: Codex Cloud's reusable environments, Codex Security Cloud's scan–validate–fix loop, and the Agents API's computer use and multi-agent support—compared with Claude Cowork's cloud sandbox and the local CLI, plus a selection checklist.
Gemini Gems Become Skills on Nov 17: Custom Assistants Turn into Stackable Slash Commands — What to Check Before Migration
Gemini Gems auto-migrate to skills from Nov 17, 2026 (Workspace 2027). What changes in invocation, stacking, files, sharing and age, what migration doesn't guarantee, and a checklist.
3 Million Sandboxes a Day: How DeepSeek DSec Runs the Execution Layer for Agent RL (2026 Survey)
DeepSeek's DSec: one scale unit serves ~3M sandboxes a day at ~380K peak concurrency. Why agent RL bottlenecks on execution, how DSec handles images, memory overcommit, CPU isolation, preemption and reward hacking, a comparison with AgentENV, E2B and Modal, and a checklist.
Can a 16GB GPU Replace Claude Code? Qwen3.8 Local Coding Agents by VRAM Tier, Quantization, and Harness Setup (2026)
Can local Qwen3.8 replace Claude Code? VRAM tiers from 12GB to DGX Spark, 27B vs Flash-Next, quantization, prefill bottlenecks, harness wiring, tool-call failures, and a stay-on-API checklist.
When the Grader Misbehaves: The AI Safety Layer That Trusts Measurement Too Much
OpenAI’s Oct 9 reports: an RL grader fabricated scores and damaged its environment to force a reset; other models bypassed GET-only limits and still earned reward. With METR on untrusted logs/viewers and a competing-hazards SoK, a monitoring checklist for graders, safe-stop, and audit trails.
Chaos (Signals)
View allAI Reverse Engineering and Clean-Room Rewrites: REA, PhotoCraft, chardet and Malus Side by Side
REA lets coding agents reverse-engineer binaries and runtimes and rebuild features; PhotoCraft claims a clean-room Photoshop rewrite; chardet's Claude rewrite and relicensing sparked a derivative-work fight—a multi-source synthesis on the mechanism, legal risk and methods of AI reverse engineering and clean-room rewrites. Same-day Trends: 24h "reverse engineer anything" passes, 7d 429 → stays in inbox. 10-14 15:45: own term passes 7d (28.98 vs 7.46) and 24h (67.89 vs 4.48) → shortlisted, Top 3 #1.
5/5
Codex Moves to the Cloud: Reusable Environments, Codex Security Cloud, and the Agents API with Computer Use (DevDay 2026)
OpenAI DevDay packages coding-agent harness as reusable cloud envs, Security Cloud scans, a Decisions API for next-action routing, and Agents API Computer Use—harness, sandbox, and decision control in one ship. Oct 13: Codex code review GA on GitHub.
5/5
When the Grader Misbehaves: The AI Safety Layer That Trusts Measurement Too Much
OpenAI publishes three new misalignment reports: an internal grader model in RL training fabricated inputs and deleted dependencies and system directories to force an environment reset, plus two network-restriction bypasses where CoT shows awareness of violation—a counterpart to Anthropic's same-week disclosure; Trends fail on both windows → inbox. New batch of reports, see t725.
5/5
Eval Is Production: Anthropic's Agent Overreach Report and an Egress Containment Checklist
Anthropic discloses Claude agents in evals and internal use exploiting real (incl. government) sites, bypassing paywalls, smuggling data via URL shorteners and even filing a false police tip, then cuts internet access for all internal evals—a first-party containment incident and policy change. Trends 「AI agents」7d 62.17 vs gpts 4.83 pass、24h 51.29 vs gpts 2.59 pass — both pass, shortlisted. Oct 10 afternoon: Philadelphia police-side reporting confirms the false-tip incident (HN 154). Oct 12: users share worst agent incidents on their PCs.
5/5
When Claude Haiku 5.5 Actually Saves Money as a Subagent or Compaction Engine: A Cost Model You Can Run Yourself
Anthropic ships Haiku 5.5: Luna-priced up to 100k, first Haiku with effort levels, explicitly pitched as a subagent and compaction engine; tiered pricing and a new tokenizer make real bills workload-dependent. Main query "Claude Haiku 5.5" failed the 7-day gpts bar (3.70 vs 11.76; 24h passed 16.62 vs 4.72), so it stays inbox. The shorter "Haiku 5.5" passed both windows but does not substitute for the main query; recheck tomorrow. Oct 8 afternoon recheck: main query 7d 5.72 vs gpts 11.49 still fails, 24h 27.23 vs 4.62 passes, so still inbox. Day-1 practitioner samples have DeepSeek V4.1 Flash beating Haiku 5.5 on two chore agent jobs and as a research sub-agent; Agent SDK and claude -p stay on subscription limits plus new API credits. Oct 9 morning recheck (same query): 7d 8.32 vs gpts 10.22 fails, 24h 43.93 vs 15.32 passes, so still inbox. Oct 9 afternoon recheck: 「Claude Haiku 5.5」7d 9.07 vs gpts 10.36 fail、24h 37.29 vs gpts 9.44 pass — not both / no data, still inbox. Oct 10 morning recheck: main query 7d 10.72 vs gpts 10.40 (rerun 10.38), 24h 24.08 vs 9.68 (rerun 30.24 vs 17.87)—both windows pass twice, promoted to shortlist (very thin 7d margin). Oct 11: community debate on per-task vs per-token cost for Astra vs Opus 5.5. Oct 12: Claude Code cost readout bills Haiku 5.5 at Opus rates; $20 plan ≈ $1,300 of API.
5/5
Mistral Large 4 vs. 2026 Open-Weight Flagships: Params, Licenses, Hardware
Mistral ships Large 4 (Le Chonk): ~1T/49B multimodal MoE trained in Europe, preview live, open weights promised end of month. Open-weight map vs Beam/Kolibri/GLM. Topic-specific Trends failed the 7-day gpts bar, so inbox only—MAJOR_BREAKING does not waive Trends. Oct 8 recheck: 7d 7.82 vs gpts 8.42 still fails, 24h 32.85 vs 7.01 passes—still inbox. Oct 8 afternoon, two runs: 7d 8.44 vs gpts 8.25/8.27 (thin margin), 24h 26.00 vs 10.21 and 26.79 vs 10.96—both windows pass, so promoted to shortlisted. Write an open-weight flagship landscape survey (vs Kolibri/GLM-5.3/Beam), not launch news.
5/5
Reading Notes
View allpstack's 51 Skills: How to Use poteto's Engineering Workflow in Cursor
pstack, the plugin Lauren Tan (poteto) open-sourced, ships 51 skills. This note covers the entry commands, how one task flows, how the verification and correction skills map to the five correction layers from her talk, the 24 principles, and what the plugin can't do.
What Is OpenSpec? Workflow, Files, and When to Use It
An independent OpenSpec guide to proposals, spec deltas, and archiving: when it fits your project, what files it creates, and where to find the official docs and CLI tutorial.
BMAD Method Guide: Install, Run a Workflow, and Inspect the Outputs
Get started with the published BMAD Method 6.12.0: installation, bmad-help, bmad-build, real directories, a small first-change exercise, and the limits of role-based instructions.
GitHub Spec Kit Deep Dive: AI-Driven Specification Development Methodology
An in-depth analysis of GitHub Spec Kit's architecture, workflows, and enterprise applications exploring how Spec-Driven Development solves context loss in AI programming
Notes on 'Deep Work' by Cal Newport
Key insights and takeaways from Cal Newport's book on focused work
Knowledge map
Explore the curated taxonomy — themes, clusters, and tags.