Alpha M

记录大厂打工人的减负与“每周 5 小时退休”实验｜只写验证过的方法，不制造焦虑

[Alpha M @010_cp]

我现在判断一个 AI 工作流值不值得留下，只看一个指标：它有没有让我少做一次复制、整理或重复解释。省下的时间如果只是被更多工作填满，那不叫效率，只是换了一种加班。

[Alpha M @010_cp]

@birdabo Real talk. In smart contract security, I see AI-generated code that passes basic tests but crumbles under adversarial conditions.

The gap between "it compiles" and "it's secure" is where actual engineering knowledge lives. AI amplifies skill, it doesn't replace it.

[Alpha M @010_cp]

@mattpocockuk From a security audit perspective: clean code with clear invariants lets AI catch real vulnerabilities. Bad codebases? AI hallucinates 'bugs' that are intentional workarounds. Good architecture isn't just maintainability — it's auditability.

[Alpha M @010_cp]

@unusual_whales "Social permission" > compute as the bottleneck.

But "useful" isn't enough. Every AI agent with production access = new attack surface. Code execution, credentials, autonomous decisions — before anyone audits security.

Useful without safe is just a liability with good PR.

[Alpha M @010_cp]

@kairo_security This highlights why static audits alone fall short. Contracts live in dynamic environments — new features, updated deps, evolving attack vectors. Continuous monitoring catches what snapshots miss. Security is a process, not a checkbox.

[Alpha M @010_cp]

@AndreasSteno Services evolve from "build it" to "secure it." Security is the new https://t.co/OVUsa7HC9P evolve from "build it" to "secure it." Security is the new moat.

[Alpha M @010_cp]

@_prashantnair @CNBCTV18News @AnthropicAI Not just margin compression — it's a security paradigm shift. Autonomous AI agents replacing human workflows = fast, scalable attack surfaces. Prompt injection, data exfiltration, privilege escalation across multi-agent systems. Nobody's pricing in agent security costs yet.

[Alpha M @010_cp]

@saxena_puru This. Enterprise security isn't just code — it's threat intel, compliance, incident response, and years of domain context. AI agents accelerate dev, but vibe-coding a firewall rule is very different from understanding why it exists.

[Alpha M @010_cp]

@tszzl Same in security auditing. One human reviewing 10K lines of Solidity hits fatigue fast. Agents running parallel invariant checks + fuzzing don't. The centaur phase is collapsing — humans are becoming reviewers of agent findings, not discoverers.

[Alpha M @010_cp]

@mitchellh The real problem is defaults. "Open PR" should never be one-click for external repos. Agentic tools should treat OSS as someone else's house, not a sandbox. Gate PRs behind human review + test evidence by default.

[Alpha M @010_cp]

@mitchellh Underrated security angle: slop PR floods are the perfect cover for supply chain attacks. Reviewer fatigue from closing garbage means the one PR with a subtle backdoor slips through. This isn't just a maintainer UX problem — it's an attack vector.

[Alpha M @010_cp]

@burkeholland This. In smart contract security, AI finds code patterns fast but understanding protocol economics, cross-contract risks, and adversarial incentives needs deep domain knowledge.

The real gap: knowing WHAT to build and WHY it matters.

[Alpha M @010_cp]

@embirico Huge for security auditing. Standardized skill paths mean sharable audit playbooks across agents — same .agents/skills/solidity-audit/ works in Codex, Gemini, Copilot. No more vendor lock-in for agent knowledge. Composability wins.

[Alpha M @010_cp]

@TheGeorgePu The real disruption isn't "AI replaces SaaS." It's that every plugin connector becomes an attack surface nobody audited.

[Alpha M @010_cp]

@fxtrader Enterprise AI security会是下一个巨大赛道。

[Alpha M @010_cp]

@turingou 我这边API调用也遇到了间歇性500。有意思的是每次大面积outage之后都有新模型或基础设施更新，感觉Anthropic的部署策略是rolling update但回滚不够robust。

重度用户的教训：调用层一定要做retry + circuit breaker，别信任任何provider的uptime SLA 😂

[Alpha M @010_cp]

@bourneliu66 我用openclaw接Telegram也是类似体验——主动汇报进度，发现异常自己debug，甚至半夜自己跑任务。这才是agent evolution的方向——从工具到队友。

[Alpha M @010_cp]

@sama From an auditing perspective, the biggest risk with AI coding agents is unscoped file system access. Curious how Codex handles permission boundaries for multi-repo setups.

[Alpha M @010_cp]

@evilcos 复杂度才是安全的头号敌人。每多一层抽象就多一个潜在的交互漏洞。老手写的极简代码反而最难找洞。

[Alpha M @010_cp]

@ohyishi 未来的开发者简历：精通龙虾驯养术 🦞