CodeChap

Building SpamChap with SpaceX Ai (Grok) and Anthropic.

[CodeChap @CodeChap]

@alexabelonix Never - still waiting.

[CodeChap @CodeChap]

@alexabelonix And here I am trying to build two and a game.

[CodeChap @CodeChap]

@alexabelonix Ive been off of x for three days and the world just moved on without me. WTF

[CodeChap @CodeChap]

@Wondersofworld0 Woof woof.

[CodeChap @CodeChap]

@LaurieGreen36 Not so well.

[CodeChap @CodeChap]

@alexabelonix I wish I had the motivation you do to train.

[CodeChap @CodeChap]

@alexabelonix True

[CodeChap @CodeChap]

@alexabelonix Those "did they..." questions are spot on. I'm going to use that.

[CodeChap @CodeChap]

@alexabelonix They did.

[CodeChap @CodeChap]

You open the homepage. Looks fine.

Google sees something else - a Turkish gambling page. Lunabet. Slots, RTP, football form. Served only when the User-Agent smells like Googlebot, or the referer says google.

That's cloaking. On a real corporate WordPress site. Humans got the brand. Search got the spam.

We spent the day cleaning one of these. Not a deface. A full takeover with three jobs:

- Get in and stay in
- Hijack what Google ranks
- Self-heal if anyone deletes a file

The shells had names that look like WordPress core. class-wp-widget. class-wp-hook. Fake mu-plugins for "core updates" and "mail handling." Drop-ins abusing object-cache.php. Webshell families stacked on top of each other - BYTE_BUNK, WonderfulWebshell, keyed RCE droppers under uploads.

Rogue admins showed up with emails like wp2_*@wp2shell.invalid and wpsvc_*@wordpress-svc.internal. Created mid-July. Not staff.

Then the part that makes casual cleanup fail:

- Malicious mu-plugins re-copying shells into /tmp
- wp-config pulling a payload from the database on boot
- A ~125 KB base64 shell parked in a site transient
- Crontab every 5 minutes restoring a plugin file if you removed it
- Crontab every 30 minutes "health checking" the /tmp shell
- .htaccess blocking most PHP and allowlisting the malware filenames

Delete one file. Another layer puts it back.

File mtimes told a short story. Fake plugin and first rogue admin around 20 July. More shells and mu-plugins mid-week. SEO cloaker on the 26th. Hardened malicious .htaccess by the 28th-30th. Found and cleaned on the 31st. Roughly ten days of active infection - not years of silent rot on this host.

Not ransomware. Not card skimming. Not nation-state. Commodity black-hat SEO plus long-term RCE on a domain Google already trusted. Your real content stayed put. They needed the authority more than a funny homepage.

Cleanup only works multi-layer: files, config inject, drop-in, DB option, rogue users, crontab, /tmp. Miss one and it comes back. After that stack, the re-scan stayed clean.

The acute event is the kit. The chronic risk is the door.

Rotate every secret. Patch plugins and core. 2FA on admin. Limit who can even see wp-login. Then check Search Console for spam indexing - malware is the fire, ranking damage is the smoke.

[CodeChap @CodeChap]

@alexabelonix That's ok, we don't know what we doing half the time anyway.

[CodeChap @CodeChap]

@alexabelonix +5mg

[CodeChap @CodeChap]

I did not get a good nights sleep, so putting extra creatine in my smoothie this morning.

[CodeChap @CodeChap]

@alexabelonix For the same reason no-one use a vibe-coded game?

[CodeChap @CodeChap]

MCP 2026-07-28 is live - Anthropic is rolling it into Claude, and it kills the session handshake.

No more Mcp-Session-Id. No sticky sessions required. Every tools/call is a self-describing HTTP request that can land on any instance behind a load balancer.

Remote MCP was a demo until it could deploy like the rest of the web.

Close to half a billion SDK downloads a month. The protocol finally acts like infrastructure.

[CodeChap @CodeChap]

@alexabelonix trauma said “talk to one person only.” therapy said “cute, try again.” behaviour first, desire later!

[CodeChap @CodeChap]

You open the agent chat and dump the whole feature in one breath.

"Build auth. Wire the database. Make the dashboard look clean."

Twenty minutes later you are staring at a forty-file diff you half understand. Tests are red. The model is cheerfully arguing with itself inside a polluted context window.

That is the doom loop. Fuzzy ask. Mass of code. Then you spend longer untangling than you would have spent writing it.

Most people try to vibe harder. More model. Longer prompt. Accept All again.

Do the opposite. Slow the agent down.

Explore. Plan. Implement. Verify.

- Explore - "Read `src/auth` and summarize how sessions work. Do not edit."
- Plan - "Propose steps. Wait for my OK." You edit the plan in English before a single line moves.
- Implement - one scoped change on a feature branch. Not the whole app.
- Verify - run the suite. Paste the real stack trace. Review the diff, not the Accept All button.

Treat the agent like a fast junior. First 80% from the model. Last 20% and the merge button from you.

Never merge code you cannot explain.

That loop is the product. Everything else is decoration.

[CodeChap @CodeChap]

Elon just put hard dates on the next two Groks.

Grok 4.6 around August 7.
Grok 4.7 a few weeks later.

4.6 stays in the 1.5T class - same weight class as 4.5 - but with significantly better SFT and RL. That's the "make the current brain actually better at work" pass.

4.7 is the scale step. 2.1T. Better than 4.6 in every way, slightly slower to serve, better token efficiency.

This is not Grok 5. This is xAI treating models like a factory line. Polish the current foundation, ship it. Then ship the bigger one the same month.

Two full model drops in August.

[CodeChap @CodeChap]

@RoundtableSpace We are about to see an explosion of games on stream.

[CodeChap @CodeChap]

@hatman lol - shame.