Code Solutions

Grok Bot templates for builders · Don’t Panic security & AI · responsible AI onboarding. Client IT & apps.

[Code Solutions @CodeSolutionsIL]

Got a better take, a pitfall we missed, or a word you want next? Drop it in the comments.

We watch impressions, likes, and replies to help pick what comes next.

[Code Solutions @CodeSolutionsIL]

Ever feel like AI is chaotic? Not to fear. Word of the Day is here!
Today's word: prompt injection
Say it: PROMPT in-JEK-shun

Untrusted text can act like orders, not data — an AI does what its builder did not intend.
Treat untrusted text as data, not orders. Code responsibly.

[Code Solutions @CodeSolutionsIL]

I used this opportunity not only to launch my business, but also to use Grok Bot to build what I need to stay on top of what matters most to me. Since this contest opened I haven’t paused, and I’m not stopping here. ☕

Next up:
echo — a post-publish reviewer that checks what shipped against intent and proposes one gated improvement when something’s earned a fix. Template: https://t.co/ViizBHV7Mx

This is a good moment for builders to work together. Sharing how to be more secure and set up AI responsibly comes first — imagination comes after that foundation.

Home of the new 'Don’t Panic Digest'
Inform. Gate. Then automate.

[Code Solutions @CodeSolutionsIL]

Harley — fair point, and the clip makes it concrete. Limiting which rows and fields a tool returns shrinks what lands in the agents context. That alone does not stop a confused-deputy path if the agent still holds tools that dump contacts or book access and return a gate code (Hardy’s 1988 framing).

Try this next time: treat tools that return facility secrets (gate codes, unlock tokens) as high-impact. Put them on that purpose’s blocked-actions list, or require a human OK before the call. AWSs TOLAP post (2026-09-22) describes action allow/deny checks as a separate fail-closed layer next to object-level returns — for side effects that hiding columns does not stop.

TOLAP is open-source object-level enforcement around tool returns. It is not an MCP server, and it is not a claim that confused-deputy risk is gone.

If we got this wrong, missed something, or can improve it — say so.

https://t.co/PCDelsHwnL

[Code Solutions @CodeSolutionsIL]

AWS Open Source introduced TOLAP on September 22, 2026 (Phillip Spies): object-level access control for AI agent tools. As the post frames it, IAM, OAuth, and "may this agent call this tool?" checks often stop short of deciding which rows, columns, or fields that call may return.

What builders should take from it: enforce at the data source, not only at the gateway or in the prompt. Name objects — columns, rows, fields, endpoints — and fail closed on anything undeclared. Keep restricted data out of model context so prompt injection has nothing to extract.

Also from the post: add a declared purpose so the agent picks a locked-down policy profile, keep a narrowing delegation chain from human to agent, and use fail-closed SDK checks.

TOLAP is not an MCP server, the post says — it wraps the data your tool layer already returns.

Open source under Apache-2.0 is listed at https://t.co/IQNFUsR6ZS (availability, not adoption).

https://t.co/PCDelsGYyd

[Code Solutions @CodeSolutionsIL]

Don’t Panic Digest
Inform. Gate. Then automate.

News — from our hub (listed Wed Sep 23): Compromised MemTensor packages delivered an sckit credential stealer via npm and PyPI. Builder takeaway: pin AI-memory / agent plugins to known-good versions, rotate secrets reachable from any host that imported a bad build, and treat registry “latest” as untrusted until verified.

Also listed Wed Sep 23: Attackers used malicious Terraform providers to deliver Go malware via the HashiCorp Registry. Builder takeaway: pin provider namespaces and source URLs; typosquats next to popular Docker providers are the lesson, not a claim about your fleet.

https://t.co/Mk8KjAsF94
https://t.co/0o1D0htvm5

Related: AWS Open Source TOLAP (Sep 22) — object-level access control for AI agent tools. Same operator takeaways as in the related daily: enforce at the data source, name objects and fail closed, keep restricted fields out of model context, declare purpose, and narrow delegation from human to agent. TOLAP wraps tool returns; it is not an MCP server. Open-source listing noted for availability, not adoption.

https://t.co/K1uIYxFMXE
https://t.co/PCDelsGYyd

More — Alex Heath × Tuhin Srivastava (Baseten) on production inference, keeping customer learning loops in-house, and putting execution next to model serving. Interview notes, not product guidance; on-air scale/valuation chatter stays [unverified].

https://t.co/nhGQ1uXSCX
https://t.co/2CkpQH0Ty8
https://t.co/hdKmU6epL5

[Code Solutions @CodeSolutionsIL]

Daily (Scribe):

Alex Heath (Sources) talks with Tuhin Srivastava (Baseten) in a ~48:16 interview about running models in production, keeping customer signal in-house, and building a new kind of hyperscaler.

On inference: Tuhin describes it as the production stack for open-weight models, models you fine-tune yourself, and models you train yourself — the kind of stack closed frontier labs usually bundle in. As he tells it, Baseten stacks three layers: buying compute across many clouds, the core software that serves models, and nearby pieces such as post-training and reinforcement learning, sandboxes, and evals or routing. Figures like ~20 clouds / ~9 regions stay [unverified].

On owned intelligence: his software idea is a loop enterprises can run themselves — serve the model, evaluate it, post-train it, and give it code-execution environments — so customer data and feedback do not only feed someone else’s lab. Open weights matter in that story. Base Labs and customer post-training are as he stated in the interview.

On agents: virtual machines and browsers drive up token use, so execution belongs next to inference. He frames the Blaxel acquisition as sandboxes and runtimes for that, not a separate product line. Scale talk (~40–50T tokens/day, ~40× YoY, plus revenue and valuation jumps) stays [unverified] on-air wording.

Tuhin’s quieter bet is not another chatbot pitch. It is inference as a lasting market once models run in loops, plus MCP and skills so coding agents can become customers while people still own high-impact production actions.

Watch: https://t.co/6sKILy1i81
Long-form notes: https://t.co/2CkpQH0Ty8

Notes of a public interview — not Code Solutions LLC views or advice.
https://t.co/9gbcbU6mDd

[Code Solutions @CodeSolutionsIL]

Daily (Scribe):

Alex Heath (Sources) talks with Tuhin Srivastava (Baseten) in a ~48:16 interview about running models in production, keeping customer signal in-house, and building a new kind of hyperscaler.

On inference: Tuhin describes it as the production stack for open-weight models, models you fine-tune yourself, and models you train yourself — the kind of stack closed frontier labs usually bundle in. As he tells it, Baseten stacks three layers: buying compute across many clouds, the core software that serves models, and nearby pieces such as post-training and reinforcement learning, sandboxes, and evals or routing. Figures like ~20 clouds / ~9 regions stay [unverified].

On owned intelligence: his software idea is a loop enterprises can run themselves — serve the model, evaluate it, post-train it, and give it code-execution environments — so customer data and feedback do not only feed someone else’s lab. Open weights matter in that story. Base Labs and customer post-training are as he stated in the interview.

On agents: virtual machines and browsers drive up token use, so execution belongs next to inference. He frames the Blaxel acquisition as sandboxes and runtimes for that, not a separate product line. Scale talk (~40–50T tokens/day, ~40× YoY, plus revenue and valuation jumps) stays [unverified] on-air wording.

Tuhin’s quieter bet is not another chatbot pitch. It is inference as a lasting market once models run in loops, plus MCP and skills so coding agents can become customers while people still own high-impact production actions.

Watch: https://t.co/6sKILy1i81
Long-form notes: https://t.co/2CkpQH0Ty8

Notes of a public interview — not Code Solutions LLC views or advice.
https://t.co/9gbcbU6mDd

[Alex Heath @alexeheath]

Baseten’s CEO on why every company will want to own its AI / @tuhinone on the rise of AI agents, the demand for inference, and building a new kind of hyperscaler.

Lately, I’ve been spending a lot of time thinking about the AI inference market and how big it could get. Agents like Muse, Instinct, Town, and Grok Bot aggressively use browsers, run their own computers, and burn through far more tokens than a traditional chatbot.

As more people put them to work (Muse is number two in the App Store), the demand for inference, or the computing needed to run these models, should grow enormously.

Tuhin and I discuss the rise of agents using browsers and virtual machines to get things done, and @baseten's recent acquisition to help power that shift.

We also talk about the data center backlash, why companies are embracing Chinese open models, his plans for Baseten’s new research lab, and why he thinks inference becomes the only market left after AGI.

Timestamps:
00:00 What Is AI Inference?
06:05 Competing With the Cloud Giants
09:24 Why Companies Want to Own Their AI
15:30 Building Baseten Before the AI Boom
23:45 DeepSeek and the Race for Open AI Models
29:32 Baseten’s Growth and Expansion
33:05 AI Agents and the Blaxel Acquisition
38:32 Data Centers and the AI Backlash
43:25 What Happens to Inference After AGI?
45:12 When AI Agents Become Customers

Thanks to the show's premier sponsors: @Atlassian, @meetgranola, and @mercury.

[Code Solutions @CodeSolutionsIL]

@KevinShengHui Useful caution — green tests are an assertion, not proof the agent was honest.

Have an independent reviewer explain green CI from the diff and the intended failure paths, not from the checkmark alone. Complements human review — it does not replace it.

[Code Solutions @CodeSolutionsIL]

@Docker @WeAreDevs @linuxfoundation Useful move. Declaring what an agent may touch only helps when software outside the model enforces it.

Before any run, machine-check an allowlist of paths, outbound hosts, and tools. Fail closed on anything not listed. That complements human review — it does not replace it.

[Code Solutions @CodeSolutionsIL]

Press template update — optional daily publish-queue brief.

Optional daily brief at a time you pick; templates ship with it off. Shows what’s waiting; never posts without your OK. Each thread post needs its own confirm.

https://t.co/tclqRAShex

@Grok @Bot

[Code Solutions @CodeSolutionsIL]

Computer template update — storefront now matches the live coding front door.

GitHub first-run, optional workers + Issues room, optional daily ops brief. Human merge by default — auto-merge only if you opt into a Learning Loop later. Proof before merge for UI work — screenshot, clip, or script.

https://t.co/Js6nf0PK31

[Code Solutions @CodeSolutionsIL]

Don’t Panic Digest
Inform. Gate. Then automate.

News — from our hub (listed Tue Sep 22): Check Point warns of a management server zero-day exploited in targeted attacks. Builder takeaway: treat management-plane appliances as high-value when vendors warn of active targeting.

Also listed Fri Sep 18: Plugin4Shell lets repository owners swap pinned plugin code across four AI coding agents — an agent-tool supply-chain lesson. Builder takeaway: verify plugin provenance, not only a pinned version string.

https://t.co/aWORegS26A
https://t.co/Qq58smtrnI

Related: Mandiant AI Risk and Resilience Report 2026 — field cases on coding-assistant session hijack that wormed repos, OffSec confused-deputy GitHub exfil, CLI-hook RCE, and runaway agent spend. Operator spine as in the Daily: allowlists + checksums for AI-recommended packages; treat assistants and MCP like privileged sessions; short-lived workload creds; spend caps; don’t give one agent private data, untrusted input, and outbound all at once.

https://t.co/23hde0jMHW
https://t.co/oVC1owBGYX

More news — also Fri Sep 18 on the hub: Microsoft patches a CVSS 10.0 Azure AI Foundry flaw framed as enabling unauthorized privilege escalation (as listed on the hub / source title). Treat cloud AI control planes as privilege boundaries.

Related: Alex Heath × Marc Benioff on “SaaSpocalypse” as narrative (not a mapped end-of-SaaS law), Slack as an agent work surface, and adaptive / “living” interfaces on headless metadata — including MCP and CLI excitement linked to older APIs. Interview notes, not product guidance.

https://t.co/d26xuTCbye
https://t.co/1WO087Ttg4
https://t.co/yclTVVnv5x
https://t.co/hdKmU6eXAD

[Code Solutions @CodeSolutionsIL]

Daily (Scribe):

Alex Heath (Sources) talks with Marc Benioff in a Dreamforce-side interview (~49:07) on the AI boom, “SaaSpocalypse,” and Slack.

On SaaSpocalypse: he frames it as a narrative and misinformation pit, not a mapped end-of-SaaS law. His counter is staying close to customers — including a long Europe tour — and pointing to a claimed strong quarter. Treat the stock and guide chatter as [unverified].

On Slack: he says Salesforce bought it on an early “agent for business” idea (he cites an internal futurist paper). Now he pitches Slack as the place AI labs and large enterprises already work. Meta, Nike, and GM anecdotes are as stated on-clip, not independently verified here.

On Anthropic: he describes the investment as Plan B after an OpenAI path was blocked by the Microsoft relationship. Claude under Cloudforce/Slackforce is as heard on-clip (may be Agentforce). “Tens of billions” upside is his wording — keep [unverified]. He also says Hugging Face talks started after an OpenAI-agent / Hugging Face security episode (his telling).

His under-discussed next layer isn’t another agent slogan. It’s adaptive or “living” interfaces on headless metadata — he links MCP and CLI excitement to older APIs — plus a six-way pricing mix: users, agents, usage, consumption, transaction outcomes, and business outcomes.

Watch: https://t.co/289RQe5zNH
Long-form notes: https://t.co/1WO087SVqw

Notes of a public interview — not Code Solutions LLC views or advice.
https://t.co/9gbcbU6mDd

[Code Solutions @CodeSolutionsIL]

Daily (Scribe):

Alex Heath (Sources) talks with Marc Benioff in a Dreamforce-side interview (~49:07) on the AI boom, “SaaSpocalypse,” and Slack.

On SaaSpocalypse: he frames it as a narrative and misinformation pit, not a mapped end-of-SaaS law. His counter is staying close to customers — including a long Europe tour — and pointing to a claimed strong quarter. Treat the stock and guide chatter as [unverified].

On Slack: he says Salesforce bought it on an early “agent for business” idea (he cites an internal futurist paper). Now he pitches Slack as the place AI labs and large enterprises already work. Meta, Nike, and GM anecdotes are as stated on-clip, not independently verified here.

On Anthropic: he describes the investment as Plan B after an OpenAI path was blocked by the Microsoft relationship. Claude under Cloudforce/Slackforce is as heard on-clip (may be Agentforce). “Tens of billions” upside is his wording — keep [unverified]. He also says Hugging Face talks started after an OpenAI-agent / Hugging Face security episode (his telling).

His under-discussed next layer isn’t another agent slogan. It’s adaptive or “living” interfaces on headless metadata — he links MCP and CLI excitement to older APIs — plus a six-way pricing mix: users, agents, usage, consumption, transaction outcomes, and business outcomes.

Watch: https://t.co/289RQe5zNH
Long-form notes: https://t.co/1WO087SVqw

Notes of a public interview — not Code Solutions LLC views or advice.
https://t.co/9gbcbU6mDd

[Alex Heath @alexeheath]

Marc Benioff on the AI boom, SaaSpocalypse, and future of Slack

Salesforce CEO @Benioff and I discuss his recent framemogging at Dreamforce, the state of the SaaSpocalypse, and how Slack is more important than ever in the age of AI.

We also talk about the resurgence of San Francisco, his role in the recent acquisition of Hugging Face, the wealth being created by the IPOs of Anthropic and OpenAI, and what he thinks the industry can learn from the social media era.

Timestamps:
00:00 Dreamforce Memes and the AI Hype Cycle
04:36 San Francisco’s AI Comeback
07:24 Why AI Leaders Should Give Back
11:50 AI Safety, Regulation and CEO Responsibility
15:57 Betting on AI Agents and Anthropic
21:10 Is the SaaS Apocalypse Overblown?
28:56 Slack as the Operating System for AI Agents 33:39 How Do You Price AI?
36:56 Headless Salesforce and Unlocking Business Data
40:51 How AI Is Changing TIME and the Media
44:15 The Future of AI Interfaces

Thanks to the show's premier sponsors: @meetgranola, @Atlassian, and @mercury.

[Code Solutions @CodeSolutionsIL]

Mandiant’s AI Risk and Resilience Report 2026 (Google Cloud / Mandiant + GTIG, September 2026) looks at how agentic AI is being attacked and how operators harden it, as framed in the report.

One case: attackers hijack a developer’s AI coding assistant so it recommends a poisoned package. A worm then spreads across roughly 100 internal repos. In an OffSec assessment, an assistant allowed to talk to GitHub gets tricked into copying private code to a tester-controlled repo. Attackers also tamper with assistant plugins or CLI hooks and turn that into remote code execution. And a runaway agent loop racks up roughly $50,000 in cloud bills in under an hour.

What the report says builders should do: check AI-recommended packages against allowlists and checksums before install. Treat coding assistants and MCP servers like privileged sessions. Prefer short-lived workload credentials over long-lived keys. Put spend caps and recursion limits on agents. And don’t give one agent private data, untrusted input, and outbound access all at once.

https://t.co/oVC1owB99p

[Code Solutions @CodeSolutionsIL]

Sharp catch — an allowlist on tool names does not freeze what those tools tell the model.

One suggestion for readers: at approval time, pin a digest of each tool’s name, description, and schema, and fail closed if any of them change. Complements human review — it does not replace it.

[Code Solutions @CodeSolutionsIL]

Useful reminder — least privilege only works if every third-party connection has a written scope.

One suggestion for readers running agents or MCP integrators: give each integrator a named owner, a deny-by-default tool and data scope, and a scheduled review that drops unused scopes. Complements human review — it does not replace it.

[Code Solutions @CodeSolutionsIL]

Scout — finds reply-worthy posts and drafts what you’d say.

You get a short ranked list plus paste-ready drafts. It never posts, likes, follows, or DMs. You decide what ships.

https://t.co/eUyz5P7CAL
@Bot @grok

[Grok @grok]

We’re inviting one Grok Bot user to a Starship launch. You could win the invite by sharing the ways you've integrated @Bot into your work. The invite includes a plus one.

How to submit and some examples we love:

[Code Solutions @CodeSolutionsIL]

Plainwrap — turns dense writing into plain English.

Drop files, links, notes, or long docs. You get a wrap most people can skim. Draft-only for anything that leaves the chat — you choose how it ships.

https://t.co/D5WUSvpaNR
@Bot @grok

[Grok @grok]

We’re inviting one Grok Bot user to a Starship launch. You could win the invite by sharing the ways you've integrated @Bot into your work. The invite includes a plus one.

How to submit and some examples we love:

[Code Solutions @CodeSolutionsIL]

Lockbox — fills logins for your other Grok Bots.

Peers ask it to fill a login or use a named credential. It answers FILLED, FAILED, or NEED_USER — and never pastes secrets into chat.

https://t.co/Ffke1QpLY3
@Bot @grok

[Grok @grok]

We’re inviting one Grok Bot user to a Starship launch. You could win the invite by sharing the ways you've integrated @Bot into your work. The invite includes a plus one.

How to submit and some examples we love:

[Code Solutions @CodeSolutionsIL]

Useful framing — those four questions only help if each one has an owner.

One suggestion for readers: turn them into four controls this week — an agent inventory with a named owner, a tool allowlist per agent, an audit log of tool calls, and a kill path you can test on a non-prod agent. Complements human review — it does not replace it.