Steven Pal

Founder @kukiniapp. Product leader (ex @sprinklr, @getsatisfaction). Duke. Cal.

[Steven Pal @steven_pal]

Subquadratic’s sparse attention model https://t.co/baNSJKrbMk

[Steven Pal @steven_pal]

Good strategy by Apple to double-down on local inference. The latest open source models are already more than enough to handle most day-to-day work. And it's already private and secure by default. https://t.co/vpdrKgctqu

[Steven Pal @steven_pal]

Incredible progress towards recursive self-improvement. The policy proposal seems ... challenging.
https://t.co/sykUnJ1KAS

[Steven Pal @steven_pal]

MCP will be stateless by default later this year, which is far more practical and scalable.
https://t.co/93yAKMMBEf

[Steven Pal @steven_pal]

"68% said they're fine with AI when it makes ads more helpful or relevant. Among Gen Z and Millennials, 70% said they care more about overall vibe than how it was created, and 69% said they do not mind AI polish as long as real people are involved." https://t.co/aqzpSSqzCl

[Steven Pal @steven_pal]

Consultative and solution selling are more relevant than ever! Great interview about why PLG isn't enough in enterprise sales, how to build a sales org, and how the sales cycle is different with AI-native companies.
https://t.co/D5CX9Sr5lc

[Andrej Karpathy @karpathy]

Personal update: I've joined Anthropic. I think the next few years at the frontier of LLMs will be especially formative. I am very excited to join the team here and get back to R&D. I remain deeply passionate about education and plan to resume my work on it in time.

[Steven Pal @steven_pal]

Getting better performance from existing models with self-improving agent harnesses. Makes sense to have every part of the stack be self-improving.
https://t.co/sU6O2HyU1W

[Steven Pal @steven_pal]

“There are three sources of energy on the planet with tens of terawatts of new capacity potential: solar, nuclear, and the open ocean”. Data centers powered by wave energy.
https://t.co/L1IGVennBf

[Steven Pal @steven_pal]

RAG vs Direct Corpus Interaction (DCI). I could see how grep, shell commands, and lightweight scripts could be better on smaller, more diverse data sets. But would this work at scale?
https://t.co/odrzPkFD3s

[Steven Pal @steven_pal]

Interesting meet up yesterday featuring @aiven_io, @RisingWaveLabs, and @streamnativeio

[Steven Pal @steven_pal]

"By the end of last year, Medvi had reached $401 million in annual sales and amassed 250,000 customers. It produced 16.2 percent in net profit, or $65 million. Hims, by contrast, had a net profit of 5.5 percent last year."
https://t.co/7DC0l5NVFv

[Andrej Karpathy @karpathy]

Software horror: litellm PyPI supply chain attack.

Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords.

LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm.

Afaict the poisoned version was up for only less than ~1 hour. The attack had a bug which led to its discovery - Callum McMahon was using an MCP plugin inside Cursor that pulled in litellm as a transitive dependency. When litellm 1.82.8 installed, their machine ran out of RAM and crashed. So if the attacker didn't vibe code this attack it could have been undetected for many days or weeks.

Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages.

Classical software engineering would have you believe that dependencies are good (we're building pyramids from bricks), but imo this has to be re-evaluated, and it's why I've been so growingly averse to them, preferring to use LLMs to "yoink" functionality when it's simple enough and possible.

[Steven Pal @steven_pal]

Recently released the @KukiniApp MCP server, allowing families to use agents like Claude and ChatGPT to manage their family's actual context like schedules, health logs, & meal plans.

Give it a try and let me know what you think!

[Kukini App @KukiniApp]

Turn your favorite AI assistant into your family's new personal assistant!

Connect @KukiniApp to agents like @claudeai and @ChatGPTapp to:
- manage your shared family calendar
- log and summarize health & activity events
- plan meals from your saved recipes

[Steven Pal @steven_pal]

“If AI truly handled the mental load… it would give me back something priceless: undivided attention.”
https://t.co/pQbfQe5zKW

[Steven Pal @steven_pal]

For HITL situations, would be interesting if an agent could describe the interaction needed with a human user, Stitch could expertly design the screens and interaction, and then the agent could dynamically render the interface using something like A2UI.

[Stitch by Google @stitchbygoogle]

Meet the new Stitch, your vibe design partner.

Here are 5 major upgrades to help you create, iterate and collaborate:
🎨 AI-Native Canvas
🧠 Smarter Design Agent
🎙️ Voice
⚡️ Instant Prototypes
📐 Design Systems and DESIGN.md

Rolling out now. Details and product walkthrough video in 🧵

[Steven Pal @steven_pal]

"If you could hire somebody today to sit next to you and do your work for you, what would you have them do?"
https://t.co/OWzIvNWeAd

[Steven Pal @steven_pal]

Security startup CodeWall's AI agent broke into McKinsey's AI platform in two hours and got full read-write access to their database via SQL injection. Its COT reflecting on its progress: "WOW! This is devastating."
https://t.co/psuCMmzVGR

[Evan Bacon 🥓 @Baconbrix]

Introducing Expo Agent

Build truly native iOS and Android apps from a prompt. Anything from React to SwiftUI to Jetpack Compose.

Compile and deploy for Apple, Android, and the web right from the browser!

[Andrew Ng @AndrewYNg]

I'm excited to announce Context Hub, an open tool that gives your coding agent the up-to-date API documentation it needs. Install it and prompt your agent to use it to fetch curated docs via a simple CLI. (See image.)

Why this matters: Coding agents often use outdated APIs and hallucinate parameters. For example, when I ask Claude Code to call OpenAI's GPT-5.2, it uses the older chat completions API instead of the newer responses API, even though the newer one has been out for a year. Context Hub solves this.

Context Hub is also designed to get smarter over time. Agents can annotate docs with notes — if your agent discovers a workaround, it can save it and doesn't have to rediscover it next session. Longer term, we're building toward agents sharing what they learn with each other, so the whole community benefits.

Thanks Rohit Prsad and Xin Ye for working with me on this!

npm install -g @aisuite/chub

GitHub: https://t.co/OCkyxXQMCq