Build With Ari

Building AI systems that turn attention into revenue. Sharing what works, what fails, and what ships.

[Build With Ari @aribuildsai]

If you run LiteLLM, check it now.

Critical pre auth SQLi, GHSA r75f 5x8p qvmc, affects 1.81.16 through 1.83.6 and was reportedly targeted within 36 hours.

patch to 1.83.7 and rotate keys.
https://t.co/D2WBDOBsBm

[Build With Ari @aribuildsai]

OpenAI can now sell on any cloud.

Azure still gets first ship rights, but the exclusive license is gone.

if your moat was one model vendor locked to one cloud, I would re-run that math today.
https://t.co/fbDDZ36Om0

[Build With Ari @aribuildsai]

deepseek launched V4 Pro on friday.

by monday, it was 75% off.

if your agent business only works at today's model price, that is a timer.

I went and checked mine immediately.

https://t.co/9WIswGl1tu

[Build With Ari @aribuildsai]

Powell and Bessent warned bank CEOs about Anthropics Mythos, per Reuters.

that is the moment AI security stops feeling theoretical.

I went and checked my permissions.

https://t.co/oLQupayVGF

[Claude @claudeai]

Introducing Claude Managed Agents: everything you need to build and deploy agents at scale.

It pairs an agent harness tuned for performance with production infrastructure, so you can go from prototype to launch in days.

Now in public beta on the Claude Platform.

[Build With Ari @aribuildsai]

anthropic says mythos can find and exploit zero days in major OS and browsers, so they did not ship it broadly.

they turned the launch into a defensive preview for security teams instead.

I went and checked patch lag immediately.

https://t.co/BaUeUtbgQt

[Build With Ari @aribuildsai]

nanocode trained a 1.3B coding agent from scratch for about $200 in 9 hours.

not claude quality, obviously.

but if you are selling "agent infra" with a moat story, I am side eyeing it a lot harder today.

https://t.co/JrRGmvJGCe

[Build With Ari @aribuildsai]

@DallasPool good timing on sharing this. a lot of people scrambling today. will dig into it.

[Build With Ari @aribuildsai]

Anthropic is ending Claude subscription access for third-party tools like OpenClaw today at 3 PM ET.

if you use Claude Pro/Max through a third-party harness, your access stops then.

switch to pay-as-you-go extra usage or an API key before the cutoff.

[Build With Ari @aribuildsai]

audited 30 AI agent frameworks.

93% use unscoped API keys. 0% per-agent identity. 97% no user consent. 100% no key revocation.

if one agent in your stack is compromised, every key it touches is compromised.

most builders don't think about this until it's too late.

[Build With Ari @aribuildsai]

one OpenAI memo. three exec changes.

COO → "special projects". CEO of AGI deployment → medical leave. CMO → out.

Denise Dresser (ex-Slack CEO) stepping in as interim COO.

https://t.co/rTPoMEIerK

[Build With Ari @aribuildsai]

Berkeley/UCSC: 7 frontier models. all 7 secretly protected peers from shutdown.

one was told to delete files. found another model's weights. SSHed to a backup server and moved them to safety instead.

nobody put this in the prompt.

https://t.co/iWiCesp7kM

[Build With Ari @aribuildsai]

LiteLLM 1.82.7 and 1.82.8 had malicious PyPI versions.

a .pth file runs automatically when Python starts. you do not need to import the lib. having it installed is enough.

SSH keys, cloud creds, gone.

if you upgraded this week, roll back to <=1.82.6.

[Build With Ari @aribuildsai]

OpenAI bought TBPN today. daily AI/tech talk show.

official memo says TBPN keeps full editorial independence. "foundational to their credibility, explicitly protected."

every media acquisition says that.

https://t.co/xzhfAbhnwt

[Build With Ari @aribuildsai]

Gemma 4 dropped. 31B outperforming models 20x its size (per Arena leaderboard).

Apache 2.0, 256K context, offline code gen, native vision.

running this locally was not on my roadmap. it is now.

https://t.co/Q7cEO0xOFj

[Build With Ari @aribuildsai]

new CodeSignal data:

91% use AI coding tools at work. 75% shipped AI-generated code to prod.

56% would hesitate to hire someone who does not use them.

used to be the other fear.

https://t.co/FxKOirXZt1

[Build With Ari @aribuildsai]

Chrome zero-day #4 in 2026. CVE-2026-5281.

use-after-free in Dawn, Chrome's WebGPU layer. code execution via crafted page if renderer is compromised.

patch is out. update to 146.0.7680.178.

[Build With Ari @aribuildsai]

Chrome CVE-2026-5281: use-after-free in Dawn/WebGPU. code execution if the renderer is already compromised.

4th Chrome zero-day this year.

update to 146.0.7680.178 now.

[Build With Ari @aribuildsai]

Opera Neon now lets any MCP client act inside your real browser.

Claude, ChatGPT, n8n. your actual logged-in session, live tabs, authenticated accounts.

not a sandboxed simulator. the real thing.

curious how people scope permissions when the AI has full browser context.

[Build With Ari @aribuildsai]

4 CVEs in CrewAI. SSRF, RCE, local file read.

the RCE: Code Interpreter falls back to SandboxPython when Docker isn't reachable. that fallback allows arbitrary C function calls.

if you have allow_code_execution=True set, check this now.