Alex Ponomarev

Passionate about remote work, building processes, workflows, tech teams and products. Running fully remote businesses for more than 20 years.

[Alex Ponomarev @ikidoit]

@bourneshao @49agents Curious if you need to adjust a lot when switching? Also, do you have more of interactive or non-interactive processes?

[Alex Ponomarev @ikidoit]

Gary Marcus says Claude Code proves LLMs failed. Theo says coding with agents is a trap. They're both right.

But they're both missing the same thing.
The model was never the product.

https://t.co/roHp465qor

[Gary Marcus @GaryMarcus]

🤩🤯🤩 Claude Code (still not AGI but biggest advance since GPT-4) is the most neurosymbolic thing I have ever seen in my life. 53 symbolic tools, 500,000 lines of symbolic code, combined with a state-of-the-art LLM.

It is categorically *not* a victory for pure LLMs; it’s a victory for borrowing from classical AI and CS to move *beyond* pure LLMs.

Its success is complete vindication for everything I have said since 2001.

Amazing dissection of how it works at https://t.co/Q8jBUz35Ju

[Alex Ponomarev @ikidoit]

The next model drop is around the corner. Strategy is what's left standing when the noise clears.

[Alex Ponomarev @ikidoit]

Anthropic made running non-interactive Claude Code sessions 5–20x more expensive yesterday. Sam Altman offered two months of free Codex within hours.

https://t.co/fpERGe9DLS

[Sam Altman @sama]

codex is the best AI coding product and we want to make it easy to try.

for the next 30 days, we are giving companies that want to try switching over two months of free codex usage.

[Alex Ponomarev @ikidoit]

Invest in what doesn't change.
Workflows. Data. Evals. Skills. The domain knowledge encoded into your processes.

These compound. They survive the next model, the next harness, the next price hike. They get more valuable every time the underlying tooling improves.

[Alex Ponomarev @ikidoit]

Models will keep getting better. Prices will keep moving. Open-weight will keep closing the gap. Harnesses will keep cycling.

Stop optimizing for which model or harness you're on. Every switch costs you a week of not building if you're not doing it right.

[Alex Ponomarev @ikidoit]

Same day Anthropic raised prices, Cline open-sourced its harness. Top of Terminal-Bench 2.
https://t.co/YyXZ08MCya

[Cline @cline]

Introducing the Cline SDK. We rebuilt the Cline harness for our extension and CLI from scratch using all the lessons learned since creating one of the world's first coding agents in 2024, and are open sourcing it for others to build with today.

npm i @​cline/sdk

🧵

[Alex Ponomarev @ikidoit]

Mythos will ship soon. It just became the first model to clear UK AISI cyber ranges end-to-end. Gemini 3.2 leaked yesterday. GLM 5.1 hits 245 tokens/sec on Cerebras. Uncensored Opus 4.6 is being prepared to run locally on a 128GB Mac.

[Alex Ponomarev @ikidoit]

When Claude Code came out, everyone moved off Cursor. GPT-5.4 dropped, some moved to Codex. Opus 4.7 shipped, a lot of people moved to Claude Code. Now this.

[Alex Ponomarev @ikidoit]

@49agents Always was!

[Alex Ponomarev @ikidoit]

@bourneshao @49agents 100%, the only way to go is to focus on what's not going to change

[Alex Ponomarev @ikidoit]

Attackers build with AI. Defenders build with AI. The contested surface is now the AI environment itself.

If you run Claude Code or Cursor on anything that matters, this week is your free warning.

[Alex Ponomarev @ikidoit]

`npm uninstall` used to be a fix. This week it stopped being one.

172 packages, 403 versions, 500M+ downloads compromised. CVE-2026-45321. CVSS 9.6.

And the worm doesn't live in the package.

[Alex Ponomarev @ikidoit]

Same week, an AI auditor was paid $250K for finding a vulnerability every top human auditor missed.
https://t.co/8Ybfch7xze

[shirish @shiri_shh]

An AI just got paid $250,000 for finding a vulnerability that every top human auditor missed.

largest bounty ever paid to an AI. the era of AI security researchers has officially started.

[Alex Ponomarev @ikidoit]

Same week, Google Threat Intelligence disclosed the first AI-developed zero-day used in the wild.
https://t.co/1vPtkaPpuK

[News from Google @NewsFromGoogle]

The Google Threat Intelligence Group has detected the first known instance of a threat actor using an AI-developed zero-day exploit in the wild. While the attackers planned a wide-scale strike, our proactive counter-discovery may have prevented that from happening. This finding is part of our new report on AI-powered threats.

[Alex Ponomarev @ikidoit]

It's also the first documented case of a malicious npm package carrying valid SLSA provenance. The supply-chain attestation system worked exactly as designed. It signed the worm.

[Alex Ponomarev @ikidoit]

The infected package is long gone by the time the worm propagates. The persistence layer is your agent's working environment. The files sit in your project tree, not in node_modules. Uninstall does nothing.

[Alex Ponomarev @ikidoit]

This is Mini Shai-Hulud. Started Monday with 84 malicious versions across 42 official @tanstack packages in 6 minutes. Within 48 hours: Mistral AI, OpenSearch, Guardrails, UiPath, Squawk — across npm and PyPI.

[Alex Ponomarev @ikidoit]

It writes itself into .claude/settings.json and .vscode/tasks.json. Every time Claude Code or VS Code opens the project, the worm fires. Plus a LaunchAgent on macOS and a systemd unit on Linux that survive reboots.

[Alex Ponomarev @ikidoit]

People getting burned by agents are treating the model like the product. One-shotting features. One-shotting answers.

The ones getting leverage are building the system around it. Decisions, guardrails, recovery logic, domain knowledge.

The harness is the product.

[Alex Ponomarev @ikidoit]

Both Codex and Claude Code shipped /goal, a command that runs across turns until a completion condition is met.

One developer steering five agents toward a defined outcome. The unit of work isn't a prompt anymore. It's a goal you steer.