Michael

Building. Fellow @acumen and @halcyoninspires

[Gabe Stein @gabrielste1n]

https://t.co/zNUkYUBPWJ

[Michael @_bluman]

🕺🏽

[Michael @_bluman]

@_wjbright But is it really a war on open source if you can use an API key?

[Michael @_bluman]

@LoopOnChain @steipete @davemorin Hi Amart 👋🏽, OpenClaw superuser here too. Checkout https://t.co/YREeuqMPHF if you'd like to give your agent a phone they can autonomously make calls with. Built it to solve my own issues with needing to reach service providers that are accessible only via a phonecall 🙏🏾

[Israel The Creator @israel_obasola]

God abeg o, can’t deal with no Viltrumites right now.

[Jeff Johnson @JeffJSays]

One thing about Invincible... that boy Vincible as hell 😂

[Michael @_bluman]

South Bay area earthquake!

[Michael @_bluman]

@seyitaylor Hi, I just DM'ed you something interesting related to this. Looking forward to what you think 🙏🏾

[Michael @_bluman]

This is the first time I've seen a legit "AI caught something humans missed" moment that isn't cherry-picked. Devin flagged the semver bump pulling in a brand new package with no GitHub commits backing it. That's pattern recognition on supply chain anomalies that goes beyond typical code generation. Way more interesting use case

[Scott Wu @ScottWu46]

Devin Review caught the axios supply chain attack for multiple Cognition customers before the attack was publicly known.

These attacks will be 10x more frequent in the age of AI; it is critical that repo maintainers start using AI for defense as well.

(showing one example below where Devin Review caught the attack within an hour of its release - text minorly edited for anonymization)

[Michael @_bluman]

Both the 1.x and 0.x branches got poisoned within 39 minutes of each other because the maintainer's npm account got hijacked. And all it took was swapping the email to a ProtonMail address and publishing via CLI instead of the normal GitHub Actions pipeline. min-release-age=7 in .npmrc would have blocked this for everyone

[Feross @feross]

🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages.

The latest [email protected] now pulls in [email protected], a package that did not exist before today. This is a live compromise.

This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now.

Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that:

• Deobfuscates embedded payloads and operational strings at runtime
• Dynamically loads fs, os, and execSync to evade static analysis
• Executes decoded shell commands
• Stages and copies payload files into OS temp and Windows ProgramData directories
• Deletes and renames artifacts post-execution to destroy forensic evidence

If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.

[Michael @_bluman]

https://t.co/O0luU7Uh5p

[Michael @_bluman]

@inachu @vivilinsv We've got spam protection in place to prevent that. And there are daily limits to the number of calls that can be made to prevent abuse. Give it a try!

[Michael @_bluman]

Introducing https://t.co/Lww8DBvpxK — voice, SMS, and email for any AI agent. One CLI. 500ms voice latency. Install in under 5 minutes.

Your AI agent can plan a holiday and fill forms, but gets stuck when it needs to make a phone call to change that reservation or text a follow-up to the crew you just hired for the renovation.

[Michael @_bluman]

@vivilinsv It's amazing what's possible in today's world with agents!

[Vivi @vivilinsv]

@_bluman Congrats!! The agent could act on your behave in calls and texts - interesting :) Agents are getting more real.

[Michael @_bluman]

@rdominguezibar https://t.co/8JnOeITnTc

[Michael @_bluman]

Introducing https://t.co/Lww8DBvpxK — voice, SMS, and email for any AI agent. One CLI. 500ms voice latency. Install in under 5 minutes.

Your AI agent can plan a holiday and fill forms, but gets stuck when it needs to make a phone call to change that reservation or text a follow-up to the crew you just hired for the renovation.

[Michael @_bluman]

The bet: in 12 months, every serious AI agent will have a phone number. The ones that don't will feel like chatbots.
@spixhq is the fastest way to be on the right side of that.

What's the first thing you'd want your agent to call, text, or email? Drop it below or check out the recipes at https://t.co/WeUI4snl7m

[Michael @_bluman]

I spent 4 years building Voice AI and USSD systems that serve half a million farmers across Africa — real telephony, at scale, in places where a dropped call means a missed harvest.

Spix is that infrastructure, rebuilt from the ground up for AI agents.