Jonathan Santilli

Building &

[Jonathan Santilli @pachilo]

One clear difference between @OpenAI Codex and @AnthropicAI @ClaudeDevs is the transparency. Claude was down for a long period, with no prompt and official communication yet (just the status page).

[Jonathan Santilli @pachilo]

This is getting personal. I smell a quota reset around the corner.

[Jonathan Santilli @pachilo]

It's not you, it's me:

[Jonathan Santilli @pachilo]

It's not you, it's me:

[Jonathan Santilli @pachilo]

I have a complex problem to solve. OpenAI/Codex is GPT-5.6 ready rock?

[Jonathan Santilli @pachilo]

As a OpenAI DevEx, choosing to write a "haiku" is very clever or very naive, not sure what to think.

[dominik kundel @dkundel]

The OpenAI API and Codex are now on Amazon BedRock 🎉

[Jonathan Santilli @pachilo]

Weird, has Claude reset the limits?

[Jonathan Santilli @pachilo]

Saddest day

[Jonathan Santilli @pachilo]

Don't you love it when people claim something without demonstrating?

Just thrown some numbers and hope for the best. The viral, the better.

[Lea Verou, PhD @LeaVerou]

💡Recent insight: gaslighting @claudeai seems to improve code quality >90% of the time.

“You overengineered this, there is a simpler way”
“There is a smaller delta that buys us most of the benefits”
“There is a more elegant way”
“This is not architecturally coherent”

…before I even read its code. 😆

[Jonathan Santilli @pachilo]

Opus 4.8 likes to tell off

[Jonathan Santilli @pachilo]

The funny and ironic part: That site was created by Claude.

[Peter Steinberger 🦞 @steipete]

I smell a takedown in 3...2...1 https://t.co/KfxM4Dp0Qh

[Jonathan Santilli @pachilo]

Skynet

[𝖊𝖛𝖆𝖉𝖊 @encrypted]

wait... you did what?!

[Jonathan Santilli @pachilo]

Socket to the rescue, keep up the good work 💪

[Socket @SocketSecurity]

🚨 BREAKING: Active supply chain attack across npm, PyPI, and Crates.​io.

Socket detected TrapDoor, a crypto stealer campaign hitting 34 malicious packages and 384 versions and artifacts, with attackers repeatedly pushing new releases across ecosystems.

TrapDoor targets #crypto, #DeFi, AI, and security developers, stealing wallets, SSH keys, cloud credentials, GitHub tokens, browser data, env vars, and API keys.

Socket detected releases with a median detection time of 5 minutes, 27 seconds. The fastest detection occurred 58 seconds after publication.

[Jonathan Santilli @pachilo]

Nothing like a little bit of exposure to correct things. Great work Aikido

[Aikido Security @AikidoSecurity]

Update: Google has re-opened the report and is now treating it as a P0 bug

[Jonathan Santilli @pachilo]

Do not trust ANY SOURCE of Skills, scan them, ALWAYS:

`npx codegate --help`

[NVIDIA AI @NVIDIAAI]

We just shipped NVIDIA-Verified Agent Skills 🔐

Skills make your agent more capable, but can also introduce vulnerabilities. Verified skills give you transparency into what a skill does, where it came from, what risks it carries, and whether it's been modified.

Every verified skill carries a skill card and is built on the https://t.co/ijhll6w6yh open specification to work reliably across @claudeai Code, @openai Codex, and @cursor_ai.

[Jonathan Santilli @pachilo]

...and this for skills:

`npx codegate skills [skillsArgs...]`

wraps `npx skills ...`

[Feross @feross]

@vladsazonau Don’t forget to install Socket Firewall too!

https://t.co/ebIUWSo0Y9

[Jonathan Santilli @pachilo]

Oh my...

[Aikido Security @AikidoSecurity]

Deleting a Google API key doesn't revoke it immediately.

Our research found successful authentications up to 23 minutes after deletion across Google's infrastructure. During that window, attackers with a leaked key can still access enabled APIs, including Gemini.

Google closed our report as "won't fix."

[Jonathan Santilli @pachilo]

Amen!

[EXO Labs @exolabs]

We're benchmarking every model, every quant, on every different hardware setup for every price point.

All developers, companies, and people will have access to local, open source intelligence.

Releasing soon.

[Jonathan Santilli @pachilo]

...or any agentic coding tool Skill, I would add.

[Nathan McNulty @NathanMcNulty]

😭

VS Code extensions are no different than browser extensions - high risk that you should be controlling with an allowlist

Yes, review and approval processes suck, but IR sucks even more

https://t.co/zsxhBhUsZN

[Jonathan Santilli @pachilo]

If extensions are an attack vector path, Skills are a highway!

[GitHub @github]

1/ We are sharing additional details regarding our investigation into unauthorized access to GitHub's internal repositories.

Yesterday we detected and contained a compromise of an employee device involving a poisoned VS Code extension. We removed the malicious extension version, isolated the endpoint, and began incident response immediately.

[Jonathan Santilli @pachilo]

No one is safe

[GitHub @github]

We are investigating unauthorized access to GitHub’s internal repositories. While we currently have no evidence of impact to customer information stored outside of GitHub’s internal repositories (such as our customers’ enterprises, organizations, and repositories), we are closely monitoring our infrastructure for follow-on activity.