Hani Momeninia

AI security engineer. Red teaming LLM systems, building security automation. Writing about breaking AI agents

[Matt Pocock @mattpocockuk]

This might be the greatest issue report in history

Some folks wrote a paper about my /retro skill assessing its effectiveness

Incredible

https://t.co/IYo4rhz1Vp

[Pause @pausevfx]

Introducing Claude Duet for Video Editing

Just describe the edit and Pause edits the ENTIRE video in one shot

-> Editors
-> Youtubers
-> Streamers

Stop manually editing like its 2018

[ClaudeDevs @ClaudeDevs]

We launched OSS Scanner, which gives critical open source projects free, periodic vulnerability scans from our strongest models.

Each finding includes a proof-of-concept, and a patch where possible.

https://t.co/aonfpNG3WO

[JosephZhou @openmys]

We plugged Google Research’s Harness² into JEV 1.14.

Zero weights touched, yet driving massive gains on vision benchmarks round after round.

Under the hood, the system:
⚡️ Rewrites its own prompts
🛠️ Builds its own tools
🧠 Distills its own experience

JEV-Harness² repo drops soon. Stay tuned.

[ClaudeDevs @ClaudeDevs]

Claude writes about 90% of Claude Code's code.

From June to September, merged PRs more than doubled while the share reverted fell by more than 40%.

We wrote about how we changed code review to get there, and how to adopt it:

https://t.co/9sZe64g3mb

[Bug Bounty Village @BugBountyDEFCON]

One 6-hour run. One hackbot. 4 confirmed criticals. 17 confirmed highs.

@jhaddix breaks down how Arcanum built Armada - their in-house hackbot running on Claude Code - and every failure it took to get there.

Full talk is up. https://t.co/scUwBKQklJ

[mirku @mirku21]

Official Anthropic tip for Claude Code: don't exhaust Opus 5.5 context on repetitive multi-file routines when Sonnet 5.5 can swarm them in parallel and Fable 5.1 can verify the result

turn mass-agent sweeps into deterministic code with dynamic workflows

claude --effort ultracode /workflows

Opus 5.5 acts as the lead architect, drafting the workflow script, setting input schemas, and synthesizing final verified reports
Sonnet 5.5 workers swarm the execution pipeline across dozens of files, handling bulk refactors and migrations at medium effort
Fable 5.1 stands by as the dedicated verifier, entering the pipeline at three decisive moments:

→ before a fan-out: does this workload justify a 50-agent script or can a tight 5-step pipeline solve it?
→ on worker failure: can the step replay from cache or does the pipeline branch need a clean rerun?
→ before reporting: did every reported finding survive adversarial cross-checking and voting?

Sonnet 5.5 executes. Fable 5.1 cross-examines. Opus 5.5 authors and reports

Jev engineering runs the identical pattern one layer down: mechanical choices that need no cognitive reasoning (which file to inspect, which tool to invoke, retry or stop) resolve in 16ms, so frontier models only wake up when execution paths actually split

Plan on high. Delegate on medium. Keep Fable on call.

- the full workflow architecture
> Opus 5.5 on high drafts the orchestration script inside .claude/workflows/
> pipeline() fans out Sonnet 5.5 workers across target paths concurrently
> each worker operates inside an isolated working copy to eliminate file collisions
> Fable 5.1 cross-checks claims and votes down unverified findings
> intermediate state lives in script variables, leaving Claude's context 100% clean
> 1h prompt cache prefix hold eliminates redundant system prompt processing

paste the setup and this prompt into Claude Code below:

"Configure my Claude Code workspace for dynamic workflows:

1. Audit ~/.claude/workflows and .claude/workflows for existing scripts:
> Draft workflow definitions for codebase audits, parallel migrations, and adversarial verification
> Pin model: sonnet, effort: medium for pipeline workers, and model: fable for verifier agents
> Configure workers to operate on isolated copies to eliminate edit conflicts

2. In ~/.claude/settings.json, enable dynamic workflows:
> Set ultracode = true
> Lock main session effortLevel to high
> Set subagentPromptCacheTtl = '1h' to share prompt prefixes across parallel fan-outs

3. Set workflow runtime controls:
> Set autoContinueAtUsageLimit = true so long batch runs automatically resume after limit resets
> Set CLAUDE_CODE_WORKFLOW_PREFIX_STAGGER_MS = 5000 for prompt prefix caching
> Set large workflow warning threshold to 25 agents

4. Add a rule to ~/.claude/CLAUDE.md: all multi-file audits must pass an adversarial Fable cross-check before findings are reported to the lead session

Show every configuration diff first. Do not apply edits until confirmed"

↳ https://t.co/PcTdH7e68J

[Daniel San @dani_avila7]

Absolutely recommend using Cache Control in Claude Code

Probably one of the Mods that will save you the most tokens and help keep your sessions going much longer

It adds this bar for Claude’s 5 minute cache and sends notifications to help keep the cache warm

Install command:
npx claude-code-templates@latest --mod observability/prompt-cache-control

[ClaudeDevs @ClaudeDevs]

We're adding a new plugin to Claude Code: You should Know.

It scans Claude's output for important information you might miss to help keep you in the loop.

Enable it with:

/plugin enable cc-plugin-you-should-know@builtin

[Shoopy @0xShoopy]

Matt Pocock (TypeScript wizard, ex-Vercel):

"Opus 5 got addicted to writing tests that just repeat the code back to itself."

in a 22-min talk at AI Engineer Paris, Matt walks through how to stop AI PRs from turning your repo into a slop cannon:

5:30 → the tests AI writes that pass forever and catch nothing
8:31 → deep modules: how codebase design makes those tests impossible
11:41 → why coding standards belong in a separate review agent, not your implementer
15:34 → your AI reviewer shouldn't comment. it should commit the fixes
17:20 → one-way vs two-way doors: which PRs a human actually needs to review
20:38 → retro skill: turn every review comment into a check so you never write it twice

how to build agents that learn by watching you work – pinned article↓

[Claude @claudeai]

A thread of our favorite things people built with Claude recently:

https://t.co/bLVmlNj5ew

[Carnage @0xCarnagee]

https://t.co/WPM22G94F3

[StudioYebisu @studio_yebisu]

やぁ！兄弟たち！

Jevに関するGitHubの実用性と発展性がありそうなリポジトリをまとめたよ！
やはり、高速判断を要するComputerUseや完全自動トレードなんかに対しての活用が多い印象だね！

Jevは公式のウェイトリストも1日ほどで承認されるけど、待たなくてもVercel AI GatewayからModel: typesafe-ai/jevで直接呼び出せるってさ！
このGrok翻訳っぽい文章はわざわざタイピングしてるゾ！

1. browser-use/jev-ultrafast
Jevがブラウザ自動操作と対象要素を選び、文字入力時のみ小型LLMを使うブラウザエージェント。
https://t.co/aZfA1mgmxv

2. TheoLeeCJ/openjev
TypeSafe公式の非公開モデルを再現したものではなく、オープンモデルで同じ入出力パターンを試す独立プロジェクト。ローカルGPUで動かせます。
https://t.co/jij3KZqvLA

3. vinnylarouge/jevlike
変化するテキスト候補から1つを選ぶJev-likeモデルを、自前データで学習する独立プロジェクト。TypeSafe公式モデルではありません。※使い物にはならないが面白い試み
https://t.co/Ke9wmLIaJs

4. jarrodwatts/jev-trader
Monad上のKuru MON-USDCを対象に、Jevで売買判断を行うトレードbot。デフォルトはdry-run/mock動作で、収益性を証明・保証するものではありません。
https://t.co/DODHIGqryQ

5. Anil-matcha/awesome-jev-by-typesafe
TypeSafe Jevの使い方、パターン、プロンプト、スターターコード、事例などを集めたコミュニティのまとめ。
https://t.co/e8j9G9VorO

6. awlevin/typesafe-computer-use
画面をOCRで読み取り、次のクリック操作をTypeSafe/Jevで選ぶMac向けのcomputer-use実装。
https://t.co/nxPWCeXdES

7. devagrawal09/jev-review
Git diffやコードベースを段階的に検査し、正確性・安全性・信頼性・互換性・テストリスクを構造化して表示するコードレビューworkflow。
https://t.co/0N2PRpsqm0

8. gargpratyush/jev-router
Claude CodeやOpenAI Codexのターンごとに、簡単な作業を速いモデル、難しい作業を強いモデルへ振り分けるルーター。
https://t.co/I0uCLYkG9g

9. vlad-terin/jev-browser
既存のブラウザ自動操作ツールにJevを組み込み、連続的な観測・操作・検証ループで対象要素を選ぶ非公式runtime/skill。
https://t.co/pNzXAU9Cbd

10. droidrun/mobile-jev
実機のAndroid端末をJevで操作するモバイルエージェント。ライブ操作デモ、CLI、実行トレースを含みます。
https://t.co/JKGDRx8OOt

[codila @0xCodila]

Jev is the "Internet" moment for the AI industry

It tells your agents and LLMs what to do next, in milliseconds and at almost zero cost

If you set it up correctly, you will have the AI engineer’s stack for 2028

In this article, I show you how https://t.co/x3qn41ejnr

[Hani Momeninia @Hani_Momeninia]

Source: LangChain https://t.co/QIz1S5cAJ6

[Sydney Runkle @sydneyrunkle]

https://t.co/CF54CU9Ddz

[flavio @flaviocopes]

what is Jev and how to use it, a deep dive ⤵︎
https://t.co/eahHu86Icl

[Moritz Kremb @moritzkremb]

Full Jev Tutorial

What it is, how you can build with it and what new applications it can unlock

→ 0:00 Intro
→ 0:34 Jev explained
→ 4:06 API setup
→ 5:59 Demo 1: Voice-controlled browser
→ 11:33 Demo 2: AI memory
→ 17:27 Demo 3: YouTube predictor

[Avid @Av1dlive]

i burned through my entire GPT-6 Astra weekly quota in 3 days

so i'm replacing my $200/mo Codex subscription with this...

a free 32,960-star GitHub repo that runs GLM-5.3 Flash, Kimi K3, and DeepSeek V4 Flash locally

[here's the exact setup i used:]

1. get colibri

download the release archive for Linux, macOS, or Windows. no compiler needed.

python3 coli info

2. or build it from source

git clone https://t.co/nGh4QY3h7W
cd colibri/c
./setup.sh
cd ..

3. pick a model

GLM-5.3 Flash: 321B, ~195 GB converted, 25 GB RAM
DeepSeek V4 Flash: 284B, ~167 GB, or ~85 GB for the REAP 150B version
Kimi K3: 2.8T, ~1.6 TB snapshot, 32 GB+ RAM

none of them needs a GPU. a GPU only makes some runs faster.

4. get the weights

GLM-5.3 Flash uses the dedicated converter:

python3 tools/convert_glm53.py --outdir /nvme/glm53_i4 --min-free-gb 30

DeepSeek V4 Flash and Kimi K3 load from their original Hugging Face snapshots. pre-converted containers work too.

5. run it

COLI_MODEL=/nvme/glm53_i4 ./coli chat
./coli web --model /nvme/glm53_i4 # dashboard
./coli serve --model /nvme/glm53_i4 # headless API

6. tune it

./coli doctor # readiness check
./coli plan # RAM/VRAM/disk placement
./coli tune # fastest safe profile

`coli` reads `config.json` and picks the right engine for each model.

the tradeoff is honest: no token bill, no hosted quota... but you need the storage.

the frontier moved from your subscription to your SSD.

[Md Ismail Šojal 🕷️ @0x0SojalSec]

Claude just got a red-team playbook.

Claude-Red just dropped a full pentest skill pack for Claude :

- 78 SKILL.md files.
- 23 categories.
- Load on demand unused skills don’t burn context.

Web, AD, cloud, containers, CI/CD, wireless, EDR evasion, exploit-dev.

Use it for authorized red team, bounty in scope, research, CTF.