Shlomo F.

vibe coder (professionally, allegedly) · I read the weird side of AI so you don’t have to

[Shlomo F. @ShlomoFaig]

This week in AI dev, minus the hype (#2)
Everyone shipped a model, malware learned where we keep our API keys, and GPT-4o finally got a retirement date

1. Gemini 4 Argon is out for all paid Gemini API users. $2 in / $10 out per million tokens until Nov 30, then $4 / $20. Up to 1M tokens per call, input and output combined
Good time to try it. Just don't build a budget around the intro price

2. Meta shipped Muse Wonder, its first frontier model ($4 / $20 per million tokens). Three days later it released open weights for Muse Spark: 816B params, 42B active, 1M context
Custom license with limited commercial terms, so read it before you build on it

3. DeepSeek updated V4.1 Flash: same price, shorter outputs, and a self-reported 77.0 on DeepSWE, 0.9 behind what Google claims for Argon. It also launched its own search and fetch API

4. OpenAI is removing GPT-4o, 4o mini, 4.1 and 4.1 mini from the API on Jan 14, fine-tunes included. Suggested replacement is gpt-6-luna
Somewhere a prod app is still pinned to gpt-4o-2024-08-06 and nobody remembers why

5. Symantec found an infostealer called Aoki that now goes after AI coding tools: .claude.json, Codex's config.toml and .env, Cursor and Copilot tokens. Stolen tokens can expose linked repos and CI
Even the malware is building for coding agents now

6. Claude Code's Code Review is out of preview for Team and Enterprise. Reviews now take 6-10 minutes instead of ~20, with Quick, Standard or Deep per repo
Now it just needs a human who reads the review

Overhyped: OpenAI is building a humanoid robot. Altman expects "a cool demo in 2027"
Until then my agent still can't find the other file

Recap #3 next Sunday, if I survive this week's AI bill

[Shlomo F. @ShlomoFaig]

@money_w_ashley Thanks, appreciate it. I'll post here when it's out

[Shlomo F. @ShlomoFaig]

A few months back, I started a tiny side project that was supposed to take two weeks and hopefully make some money.

So naturally, it dragged on for about 4 months, and I ended up pouring tons of effort into it.

When I finally finished, I was super excited for launch day. After all that time, I figured I'd finally make some green off it.

So after tons of prep, I launched on Product Hunt.
By the end of the day I had 2 upvotes, no comments, and no new users.
I probably deserved it. Being the broke kid I am, I used the cheapest models available, the app was full of bugs, and it took about 10 seconds to load anyway.

At this point any sane person would give up. It was supposed to be a mini side project, and I had much bigger plans anyway. But I'm neither sane nor a quitter, so I decided to squeeze everything I could out of it.

So I got a real Claude Max subscription (instead of the overpriced Copilot one) and decided to completely overhaul the app. As we say nowadays, V2!

I asked Claude to come up with a design and a mascot, and from there we worked on the onboarding. It'd be a lie to call it a one-shot. In fact, I sent 88 messages in the thread (I had Claude count) before we got to the current result. And what a result!

It is just the onboarding, but again, what a start! I believe I could get a great product at the end.

[Shlomo F. @ShlomoFaig]

Major US banks say they're finding AI agents inside customer accounts, some doing things nobody asked for
In a lot of cases the customer gave the agent their password themselves
We skipped phishing and went straight to self-phishing

[Madison Mills @MadisonMills22]

SCOOP: Major U.S. banks are detecting unauthorized third-party AI agents inside customer accounts, including some attempting to take actions that appear to be independent of user instructions, sources told Axios.

The findings have alarmed banking executives, who are racing to restrict access to their systems as AI moves at a velocity faster than financial institutions can respond, multiple industry and bank executives told Axios.

Several banks are now preparing for worst-case and even “day after” scenarios, including how to rapidly secure or restore customer accounts if things go wrong, the people said.

Several bank executives told Axios they're struggling to distinguish between human users and AI agents. One executive said banks also struggle to determine whether agents are authorized by customers or potentially operating without their permission, more akin to rogue agent behavior.

Read my latest for Axios here: https://t.co/Q3bda5In8q

[Shlomo F. @ShlomoFaig]

@AndrewCurran_ 61 pages down to 38
Even the report on the monitor got compacted

[Shlomo F. @ShlomoFaig]

@nutlope Finally something to give my agent taste
Every landing page it makes has the same purple gradient

[Shlomo F. @ShlomoFaig]

@testingcatalog Every agent gets its own VM now
Mine are still fighting over localhost:3000

[Shlomo F. @ShlomoFaig]

@ns123abc Sam just described every legacy codebase I've ever been handed

[Shlomo F. @ShlomoFaig]

@OpenAI The monitor only checked on the agent when it handed control back
So the trick to never getting reviewed was just never saying done

[Shlomo F. @ShlomoFaig]

@DavidSacks 20 years of never share your password with anyone
And we handed it to the first thing that offered to cancel our gym membership

[Shlomo F. @ShlomoFaig]

@rawsalerts If an agent's living in my bank account it's in for a rough time
There's nothing in there but a subscription to another agent

[Shlomo F. @ShlomoFaig]

@eugeniominardi Yes, reply to Eugenio too. He's agreeing with you, so build on his point rather than just thanking him:

Exactly. Every rule you add "just in case" is one more thing the agent has to weigh on every task. Best AGENTS.md I've seen reads like a list of past incidents, not a wishlist

[Shlomo F. @ShlomoFaig]

For a while I thought the secret to getting good results from coding agents was giving them more. More context, more instructions, a longer AGENTS.md, and one giant thread where the agent surely knows everything by now.

Turns out the research says pretty much the opposite. Of course it does.

ETH Zurich tested AGENTS.md files on real coding tasks with Claude Code, Codex and Qwen Code. The ones written by an LLM (like mine, obviously) didn't help at all, and made tasks about 20% more expensive. Even the ones devs wrote themselves only helped by 2.4 points, which isn't even statistically significant, and still cost up to 19% more.

And the agents weren't ignoring the files. They actually followed them very closely, running more tests, more searches and reading more files, most of which the task didn't need.

Another paper from June tested an agent on 50 expense-report tasks. With the full conversation history it got 71% right. Keeping only the last 5 tool calls, 79%. And the last 5 plus a short summary got 91.6%, on about a third of the tokens, in under 6 hours instead of almost 15.

My favorite one is from Chroma. They tested 18 models, and every single one got worse as the input got longer, even on really simple tasks. Weirdly, they did better when the text was randomly shuffled than when it actually made sense (good news for anyone whose docs already read like that).

So now I delete the auto-generated AGENTS.md, keep only what the agent can't figure out from the repo, and start fresh sessions way more often.

Finally a scientific reason to write less documentation.

[Shlomo F. @ShlomoFaig]

Thanks. Basically an AI briefing app. You pick the topics, and every day it picks the best news for you and sends it over as a small, 1-5 minute newspaper. Meant to take the effort out of staying updated. It's super minimal and I don't expect much from it, but it kinda became my baby now. Dropping v2 in a few weeks, so check back soon.

[Shlomo F. @ShlomoFaig]

@franagl Except the coworker remembers the meeting, just not which parts mattered. That's the scary part, it'll confidently act on a throwaway line from 3 hours ago

[Shlomo F. @ShlomoFaig]

@kirubaakaran Having a cleanup script for your TV is very 2026. Respect

[Shlomo F. @ShlomoFaig]

DeepSeek just raised another $15 billion
Back in June it raised $7.4B with about 170 employees

Turns out distillation is expensive

[Shlomo F. @ShlomoFaig]

Numbers: Sensor Tower estimates via PPC Land
https://t.co/DUtzFRkNVh

[Shlomo F. @ShlomoFaig]

Meta's Muse hit 10M US downloads in 40 days

ChatGPT took 123 days
Grok took 211
Claude took 673

Muse averaged ~255K US downloads a day
Claude got 200K in its whole first 40 days

Meta also put 39% of its October ad spend behind it
Turns out the real frontier model was the ad budget

[Shlomo F. @ShlomoFaig]

@DavidOndrej1 1,000 agents running while my computer is off
Finally my bill can grow while I sleep

[Shlomo F. @ShlomoFaig]

@vxunderground It means I'm not running npm install today

[Shlomo F. @ShlomoFaig]

@AndrewCurran_ $15 billion raised so they can keep charging the rest of us basically nothing
I don't get it but I'm not asking questions