Bobo Lin | AI notes

AI is full of confident claims. I’m interested in the conditions that make them true. Notes on research, agents, and real-world AI.

[Bobo Lin | AI notes @BoboLinNotes]

Claude Code is powerful, but the right plugins can make it feel like a senior engineer instead of a code generator.

Start with Agent Skills and Context7. One gives Claude reusable engineering workflows, the other keeps its library knowledge up to date.

Add Graphify to map your codebase, and 21st MCP to turn prompts into polished frontend components. Better context, better architecture, better UI.

Then install Strix to scan your application for real security vulnerabilities. Because shipping code is easy. Shipping secure code is the hard part.

Junior devs write code. Senior devs understand the system, make better decisions and catch problems before they ship. Bookmark this for your next build.

[Bobo Lin | AI notes @BoboLinNotes]

The biggest opportunity for Backend Engineers in the AI era is building the infrastructure behind autonomous agents. CRUD APIs are no longer enough. The next generation needs engineers who can make AI systems reliable, secure and scalable.

Start with the core infrastructure. Build an AI Gateway, a Hybrid Search Engine and a Streaming SSE Proxy. Add semantic caching, vector search, reranking and real-time token streaming. Make AI fast, searchable and affordable.

Then tackle reliability and security. Build a Durable Workflow Engine, a PII Redaction Proxy and an Inter-Agent Auth Broker. Add checkpoint recovery, webhook replay, scoped permissions and event-sourced debugging. Agents need more than intelligence. They need control.

Now optimize for production. Build token-aware rate limiting, cost kill-switches, shadow traffic routing, GPU autoscaling and LLM tracing. Add local inference fallbacks and isolated AI environments. Every millisecond, failed request and wasted token matters.

Don't build all 15. Pick three, build them from scratch, deploy them and document every engineering decision. Most developers are still writing CRUD APIs. The real builders are designing the nervous system of autonomous AI. Bookmark this. You'll need it.

[Bobo Lin | AI notes @BoboLinNotes]

AI Research Engineering is one of the hardest skills to replace. Stop learning how to call models and start learning how to build them. The real opportunity is understanding what happens beneath the API.

Start with the foundations. Master PyTorch internals, tensor mathematics, custom Autograd and Triton. Then learn how data quality, scaling laws and training strategies shape model intelligence. If you cannot explain why a loss curve collapses, you're still treating AI as a black box.

Move beyond standard Transformers. Explore MoE, Mamba, synthetic data generation, multimodal fusion and advanced alignment methods like DPO and KTO. Build models, train them on different data mixtures, and measure what actually improves performance. Understanding the trade-offs matters more than memorizing architectures.

Then learn what separates research experiments from real AI systems. Master distributed training, inference optimization, KV-cache, speculative decoding, mechanistic interpretability and adversarial evaluation. A model that performs well but cannot scale, explain its failures or run efficiently is not enough.

Finally, reproduce new research papers, turn mathematical ideas into working code, and publish your models, training logs and benchmarks. Don't just collect certificates or follow tutorials. Build evidence that you can push the boundaries of AI. Most people use intelligence. Research Engineers learn how to create it.

[Bobo Lin | AI notes @BoboLinNotes]

If I had 6 months to become an Agentic AI Engineer, I wouldn't waste time collecting certificates or watching endless tutorials. I'd focus on building systems that actually work.

First, I'd master the foundations. Python, async programming, FastAPI, LLM fundamentals, context management, token economics and tool calling. Without these, you're just putting a chatbot inside a fancy interface.

Next, I'd learn to build intelligent workflows. Structured outputs, memory, RAG, single-agent reasoning, multi-agent orchestration and human approval loops. The goal is to build agents that can plan, use tools, remember context and recover when things go wrong.

Then I'd focus on production engineering. Evaluation, tracing, security, prompt injection defense, cost optimization, vLLM, Kubernetes and reliable deployment. A demo that works once is easy. An agent that survives real users, failures and scale is a different game.

Finally, I'd ship 2–3 real agents, publish the code, document the architecture and share measurable results. Six months of building beats years of passive learning. Most people collect AI knowledge. Builders turn it into working products.

[Bobo Lin | AI notes @BoboLinNotes]

The biggest mistake in Agentic AI is thinking that building an agent means connecting an LLM to a few tools. Real engineers build systems that can think, recover, coordinate and survive production failures.

Start with the infrastructure. Build an async orchestrator, dynamic context manager, strict Pydantic tool router, and three-tier memory engine. Add self-healing loops and typed multi-agent workflows. Your agents should recover from errors, manage their own context and execute complex tasks without falling apart.

Then make them safe. Build human approval gates, sandboxed code execution, inter-agent security filters and automatic cost kill-switches. Add trajectory-based evaluations and OpenTelemetry tracing so every action can be audited, replayed and debugged. Autonomy without control is just an expensive liability.

Production is the real test. Build API-to-browser fallbacks, shadow traffic testing and automated regression gates. Test failures, measure costs and verify behavior before exposing new agents to real users. A successful demo proves almost nothing. Reliability under unpredictable conditions proves engineering ability.

Finally, publish three serious architecture breakdowns showing your orchestration, security, state management and cost optimization decisions. You don't need 15 unfinished repos. You need a few systems that actually work. Most people know how to build a chatbot. Very few can build an autonomous system they can trust. Builders ship systems.

[Bobo Lin | AI notes @BoboLinNotes]

Six months is enough to become a serious GenAI Engineer if you stop learning randomly and start building with a clear roadmap. The goal isn't to master every AI tool. It's to understand how production AI systems actually work.

Start with Python, FastAPI, async architecture and multimodal LLMs. Master context engineering, structured outputs, prompt management, RAG and knowledge graphs. These are the foundations of building AI applications that do more than generate text.

Then move into real agent engineering. Learn MCP, multi-agent orchestration, durable workflows, human approval gates and production-ready generative UI. Build systems that can remember state, recover from failures and execute real tasks.

Next, master what separates demos from production. Learn evaluation, trajectory debugging, observability, inference optimization, KV caching, quantization, cost control and AI security. If you can't measure reliability, latency and cost, you aren't ready to scale.

Finally, ship open-source projects, publish architecture breakdowns and real benchmarks, then apply for GenAI Engineer, Agent Engineer or AI Infrastructure roles. Stop collecting tutorials. Build systems, publish proof, and let your work speak for you. Builders get hired.

[Bobo Lin | AI notes @BoboLinNotes]

The biggest mistake in GenAI engineering is thinking that calling an LLM API makes you an engineer. Real engineers build systems that make AI fast, reliable and scalable.

Build async streaming, real-time voice and vision, generative UI, and intelligent RAG. The future of AI isn't another chatbot. It's an application that can see, listen, respond and recover.

Master the hard parts: multi-agent orchestration, structured outputs, security, trace debugging and automated regression testing. Agents that work in demos are easy. Agents that survive production are rare.

Then optimize for reality. Reduce inference latency with KV-cache sharing, use WebGPU fallbacks, control runaway costs, test new models through shadow routing, and improve models with real user feedback.

Don't just collect tutorials or GitHub stars. Build, deploy, benchmark and publish your results. Most people know how to use AI. The valuable engineers know how to make AI work at scale. Most people watch tutorials. Builders ship systems.

[Bobo Lin | AI notes @BoboLinNotes]

The biggest mistake in AI is learning tools without understanding the language behind them. If you're building with AI, you need to know the fundamentals — LLMs, tokens, context windows, prompts, inference, latency, temperature and hallucinations.

Modern AI is much more than generating text. Learn how RAG, embeddings, vector databases, chunking and reranking work together. Understand fine-tuning, LoRA, distillation, quantization and open weights. These concepts determine how models retrieve knowledge, adapt to tasks and run efficiently.

Agents are the next layer. Know tool calling, MCP, agent loops, subagents, orchestration, memory and skills. Understand how guardrails, prompt injection, jailbreaks and human approval affect real-world execution. A model that can answer questions is useful. A system that can safely take action is far more powerful.

Then learn how to measure and optimize performance. Evals, benchmarks, ground truth, LLM-as-judge, structured outputs, caching, streaming and rate limits are not optional details. They're what separate an impressive demo from a reliable AI product.

Finally, understand the engineering stack — GPUs, multimodal models, reasoning, few-shot and zero-shot prompting, vibe coding, coding harnesses and project instructions like CLAUDE.md. You don't need to master all 50 terms overnight, but you should know what they mean before building at scale. Bookmark this. Your next AI project will make a lot more sense.

[Bobo Lin | AI notes @BoboLinNotes]

If I had 6 months to become an AI/ML Engineer, I wouldn't waste time collecting certificates. I'd build the skills that make me capable of training, optimizing and shipping real models.

First, master the foundations. Learn PyTorch internals, tensor operations, CUDA, mixed precision, data curation, synthetic data generation and scaling laws. Understand what happens beneath the abstractions before relying on them.

Next, learn to adapt and train models. Master LoRA, QLoRA, DPO, KTO, model merging, distributed training, FSDP and DeepSpeed. Then explore MoE, multimodal architectures, vision-language models and advanced attention mechanisms. Don't just use models. Learn how to change them.

Then focus on making models production-ready. Study quantization, KV-cache optimization, speculative decoding, vLLM, SGLang, model routing, evaluation, red teaming and automated experiment tracking. Accuracy, latency and cost matter just as much as model intelligence.

Finally, publish your work. Reproduce research papers, release fine-tuned models on Hugging Face, write proper model cards and share reproducible benchmarks. Six months won't make you an expert in everything, but six months of building can put you ahead of people who spent years only watching tutorials. Most people study AI. Builders prove they can engineer it.

[Bobo Lin | AI notes @BoboLinNotes]

The biggest mistake in an AI Engineer interview is knowing LLMs but not knowing how to build systems around them. These 25 questions reveal whether you can actually engineer AI, not just talk about it.

Can you explain agents, tool calling, reasoning loops, RAG, embeddings, vector databases, memory and MCP? Do you know when to fine-tune, when to retrieve, and when one agent is better than ten?

Can you design multi-agent workflows, prevent endless loops, handle failed tools, add human approval and defend against prompt injection? Can you turn a flight-booking or customer-support idea into a working system?

Then comes production. How do you evaluate agents, debug hallucinations, reduce latency, control token costs and scale to one million users without everything falling apart?

Knowing LLM terminology gets you noticed. Knowing how to build, debug and scale reliable agents gets you hired. Bookmark this and send it to someone preparing for an AI Engineer interview.

[Bobo Lin | AI notes @BoboLinNotes]

The biggest mistake in AI/ML is learning to use models without learning how they work. If you want to stand out, build systems that prove you can train, optimize and scale real models.

Start with the foundations. Build custom Triton kernels, CUDA activation functions, synthetic data pipelines and MinHash deduplication systems. Understand what happens beneath PyTorch, because real performance comes from controlling compute and data.

Then master model engineering. Fine-tune with QLoRA, merge models with TIES, experiment with KTO alignment, train MoE routers with FSDP, and connect vision embeddings to language models. Don't just call models. Learn to shape them.

Production skills matter just as much. Build AWQ quantization benchmarks, speculative decoding, automated hyperparameter sweeps, complexity-based model routing and adversarial red-team tests. Optimize speed, cost, safety and quality together.

Finally, reproduce a recent arXiv paper and publish your code, weights and training results on Hugging Face. Pick a few projects and build them deeply. Most people watch AI tutorials. The engineers who stand out understand the machinery and ship working systems.

[Bobo Lin | AI notes @BoboLinNotes]

The biggest problem with traditional MCP tool calling is that every action sends the agent back to the model. More tools mean more context, more tokens and more latency.

A simple customer lookup can trigger multiple rounds of tool calls and model responses. Scale that to thousands of endpoints, and the overhead becomes ridiculous.

Code Mode flips the architecture. Instead of choosing tools one by one, the model writes code that calls multiple tools in a single execution.

The advantage is simple. The model already understands code extremely well, while exposing thousands of tool definitions wastes its context. Cloudflare has 2,500+ API endpoints, yet Code Mode reduces the interface to just two tools.

Stop making agents babysit every tool call. Let them write code and execute entire workflows. That's a much smarter way to build agents.

[Bobo Lin | AI notes @BoboLinNotes]

The biggest mistake in AI job hunting is collecting certificates instead of building things. Companies want proof that you can turn agents into working products.

Build projects that solve real problems. Think customer support, sales research, recruiting, meeting automation, invoice processing, and employee onboarding.

Then go deeper with codebase RAG, automated PR reviews, data analysis agents, browser automation, multi-agent research teams, and MCP integrations. These projects show you can connect AI to real workflows.

Don't ignore production challenges. Add evaluation dashboards, security guardrails, and human approval mechanisms. Measure accuracy, latency, and cost instead of just showing a cool demo.

Pick 2–3 projects, deploy them, document what failed, and explain how you fixed it. That's a portfolio worth hiring. Most people talk about AI. Builders prove it. Bookmark & Repost.

[Bobo Lin | AI notes @BoboLinNotes]

The biggest mistake when growing on X is posting into an empty room. Nobody knows you yet, so stop waiting for attention and start joining conversations that already have it.

Find 15–20 influential accounts in your niche, track their posts, and show up early with replies that add real value. Don't chase likes with empty compliments. Bring fresh insights, useful data or a different perspective.

Quality beats volume. 20 thoughtful replies can do more than 100 meaningless ones. Write every reply as if it were an independent post, not just a reaction.

Make your profile worth visiting. A clear bio, a strong pinned post and five useful posts can turn a curious visitor into a follower. Keep publishing your own content so people have a reason to stay.

After 30 days, familiar faces start recognizing you. That's how you grow from zero: borrow attention, earn trust, then build an audience of your own.

[Bobo Lin | AI notes @BoboLinNotes]

AI security may become one of the most valuable engineering skills of the next decade. As companies deploy agents with access to emails, databases and business tools, someone must understand how attackers can exploit those privileges. This is a career opportunity most developers are still overlooking.

Start by learning how AI systems get attacked. Master prompt injection, jailbreaks, data poisoning, RAG vulnerabilities and MCP tool security. Don't just read about exploits. Build attack scenarios that expose how easily an agent can be manipulated into leaking data or abusing its permissions.

Then learn how to defend real systems. Implement scoped OAuth tokens, human approval gates, PII masking, output validation and strict tool permissions. Build automated red-team pipelines with PyRIT or Garak, and test your defenses continuously instead of trusting a system prompt to keep everything safe.

Go deeper into enterprise security. Study model extraction, privacy protection, interpretability, alignment, compliance and immutable audit trails. Companies don't just need AI that works. They need systems that can explain what happened, prove who authorized an action and survive security reviews.

Finally, publish your work. Build security tools, reproduce vulnerabilities, responsibly disclose bugs and write technical teardowns. In a field this new, practical evidence beats another certificate. Don't just learn how to build AI. Learn how to break it, defend it and make it trustworthy. That's a skill worth investing in.

[Bobo Lin | AI notes @BoboLinNotes]

AI companies aren't hiring people to build another chatbot demo. They want engineers who can make AI survive real-world production. Your portfolio needs to prove that difference.

Build systems that solve real problems. Think hybrid RAG, document extraction, voice agents, tool-using agents, and fine-tuned small models. Show that you can turn raw data into reliable AI products.

Then focus on what separates demos from production. Add automated evaluations, hallucination detection, red-team testing, structured outputs, and full observability. Make every model call measurable, testable and recoverable.

Learn to control the economics too. Build model routers, semantic caches, local LLM deployments, prompt A/B testing, and synthetic data pipelines. Accuracy matters, but so do latency, reliability and cost.

Don't build 15 half-finished projects. Pick two, deploy them, publish real benchmarks, and explain what you learned. A demo proves you can call an API. Production proves you can be trusted with AI. Bookmark this for your next AI job hunt.

[Bobo Lin | AI notes @BoboLinNotes]

AI security is becoming one of the most valuable engineering skills. Knowing how to write a system prompt isn't security. You need to know how to stop an AI system from being exploited.

Start by building defenses against real attacks. Create a jailbreak fuzzer, an MCP tool poisoning shield, a RAG poisoning detector, a PII masking proxy and a computer-use security auditor. Learn how attackers manipulate context, tools, memory and interfaces.

Then secure the infrastructure behind agents. Build an OAuth delegation broker, an inter-agent sanitization layer, a semantic API rate limiter, a vector memory scanner and a cryptographic execution ledger. Identity, trust boundaries and data integrity matter more than another layer of prompts.

Take security into the development lifecycle. Build automated red-team CI gates, grammar-constrained output enforcement, AI supply-chain scanners, activation safety dashboards and exploit reproduction tools. Every vulnerability should become a test, every failure should produce evidence, and every fix should be measurable.

Don't build all 15 just to fill your GitHub. Pick three, implement them from scratch, and document every engineering decision. Most people trust the system prompt. Real security engineers enforce boundaries at the tool, data and execution levels. Bookmark this. You'll need it.

[Bobo Lin | AI notes @BoboLinNotes]

If I had to become an Applied AI Engineer from zero, I wouldn't spend months collecting certificates. I'd learn how to turn powerful models into products people actually use.

First, master the fundamentals. Understand tokens, APIs, context windows, structured outputs and retrieval. Build small projects that measure cost, latency and accuracy. If you can't measure performance, you can't improve it.

Then move beyond prompting. Learn context engineering, RAG, embeddings, fine-tuning and model selection. Build systems that retrieve the right information, return reliable data and choose the right model for each task.

Next, learn production engineering. Build agents with tools and human approval, add evaluations and safety guardrails, deploy real applications, and track every failure, token and dollar. A working demo is easy. A reliable product is the real challenge.

Finally, ship three real projects and publish measurable results. Show how you reduced costs, improved accuracy or made an agent more reliable. Certificates prove what you studied. Shipped products prove what you can do. Prompt wrappers are everywhere. Applied engineering judgment is the moat.

[Bobo Lin | AI notes @BoboLinNotes]

If I had 6 months to become a GTM Engineer, I wouldn't waste time collecting certificates. I'd learn how to turn data, AI and automation into revenue.

First, I'd master the data foundation. Learn SQL, dbt, Snowflake, customer identity resolution and Reverse ETL. Then connect website intent signals, product events and buyer behavior to identify who is ready to buy.

Next, I'd build AI-powered sales systems. Use Clay, Apollo and LLMs to enrich leads, personalize outreach, automate SDR workflows and score product-qualified leads. Make every customer interaction a useful signal.

Then I'd focus on revenue optimization. Build usage-based pricing, multi-touch attribution, churn prediction, sales intelligence and automated QBRs. Learn to connect product usage directly to retention, expansion and measurable ROI.

Finally, publish real GTM teardowns and build a portfolio of revenue systems. Add integrations, community attribution and ecosystem partnerships. Tutorials teach you tools. Shipped systems prove you can drive growth. Builders get hired.

Bookmark it.

[Bobo Lin | AI notes @BoboLinNotes]

The biggest opportunity in AI security is knowing how to break the systems everyone else is building. If you want to stand out, stop studying security only in theory and start building real defenses.

Build tools that detect prompt injection, expose jailbreaks, scan leaked secrets, redact PII, and test poisoned documents. Don't just trust your model to recognize attacks. Give it systems that can catch them.

Then secure the actions themselves. Create permission gates for tool calls, isolated agent sandboxes, RAG access controls, output validators, and MCP server auditors. One compromised instruction should never control your entire system.

Go deeper with audit logs, data exfiltration monitors, model supply chain checks, security evaluation suites, and incident replay tools. Every attack should leave evidence. Every failure should become a test.

Pick three projects. Build them from scratch. Attack them until they break, then fix them. Most developers know how to ship agents. Very few know how to defeat them. That's where real AI security engineers stand out.

Bookmark this. You'll need it.

[Bobo Lin | AI notes @BoboLinNotes]

The future of GTM Engineering isn't sending more emails. It's building systems that turn customer data into predictable revenue. If you want to stand out, stop learning tools and start building revenue infrastructure.

Build AI SDR agents, real-time buyer intent routers, product-qualified lead scoring and automated lead routing. The goal is simple: find the right buyers, understand when they're ready, and reach them before your competitors do.

Then master revenue intelligence. Connect your warehouse to your CRM, build multi-touch attribution, track usage-based billing, and detect churn before renewals. If you can't measure where revenue comes from or why customers leave, you're running GTM blind.

Automate the work that slows growth. Generate sales battlecards, analyze call transcripts, create customer ROI reports, optimize free-to-paid conversion, and calculate commissions accurately. AI should give revenue teams more time to sell, not more dashboards to maintain.

Finally, publish your own GTM architecture breakdowns. Build real systems, measure conversion, prove ROI, and show what failed. Most people learn how to use GTM tools. The best engineers build the infrastructure that makes revenue scale. Bookmark & Repost.