Peter Siska

@feross @threadreaderapp unroll

🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages. The latest axios@1.14.1 now pulls in plain-crypto-js@4.2.1, a package that did not exist before today. This is a live compromise. This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now. Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that: • Deobfuscates embedded payloads and operational strings at runtime • Dynamically loads fs, os, and execSync to evade static analysis • Executes decoded shell commands • Stages and copies payload files into OS temp and Windows ProgramData directories • Deletes and renames artifacts post-execution to destroy forensic evidence If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.

@_chenglou @threadreaderapp unroll

My dear front-end developers (and anyone who’s interested in the future of interfaces): I have crawled through depths of hell to bring you, for the foreseeable years, one of the more important foundational pieces of UI engineering (if not in implementation then certainly at least in concept): Fast, accurate and comprehensive userland text measurement algorithm in pure TypeScript, usable for laying out entire web pages without CSS, bypassing DOM measurements and reflow

@synopsi Kids?

Seems like 1/9/90 rule influences every aspect of my life. I noticed the other day that I also run my finances with it. I currently hold 1% in cash, 9% in immediately liquid assets (stocks and such) and 90% in completely illiquid assets (private companies mostly). This obviously reflects the size of the pie. There were times, at the beginning of my career, where it was the opposite. The most important realization is that if I have too much cash on my hand (more than few months of runway) I get restless and start buying nonsense. I am the happiest when there are real constrains on my spending and at the same time I can see my money to be somewhat productive. Won't work for everyone, but works for me quite well.

Goodness. The ArrowJS sandbox lets you build amazing stuff. Here's an infinite "app canvas". Drag a new box, scribble what kind of app you want, and it renders it for you. no pre-defined components no pre-defined styles no iframes ➡️ arrow-js.com

@shshnkp @threadreaderapp unroll

My favorite (and often overlooked) MLX feature is the 17 (and growing) CLI tools part of mlx-lm. You can do so much with a single line of code! Here's a quick overview 🧵 🚀 Inference, 🍦 Serving 🎯 Fine-tuning, ⚡ Quantization 📊 Evaluation & Benchmarking 🤗 Sharing and model management

@CloudflareDev @threadreaderapp unroll

Introducing the new /crawl endpoint - one API call and an entire site crawled. No scripts. No browser management. Just the content in HTML, Markdown, or JSON.

@thdxr @threadreaderapp unroll plz

sent this to the team today everything great comes from being able to delay gratification for as long as possible and it feels like we're collectively losing our ability to do that

@atmoio @threadreaderapp unroll

I was a 10x engineer. Now I'm useless.

@shanaka86 @threadreaderapp unroll

A blog post just wiped $30 billion off IBM in a single afternoon. Not a product launch. Not an earnings miss. Not a competitor undercutting on price. A five-minute blog post explaining that Claude can read COBOL. IBM dropped 13%. Worst single-day loss since October 2000. Twenty-five years of stock resilience ended by one AI company publishing a capability update. Here’s what happened: 95% of ATM transactions in America run on COBOL. Hundreds of billions of lines power banking, airlines, and government systems. The developers who built them retired decades ago. The knowledge left with them. Finding engineers who can even read COBOL gets harder every quarter. IBM’s moat was never the technology. It was the fact that nobody else could understand it. Entire consulting empires existed because the code was too old, too tangled, and too critical to touch. Companies paid IBM billions because the alternative was catastrophic system failure. Then Anthropic published a blog post saying Claude Code can map dependencies across thousands of lines of COBOL, document workflows, identify migration risks, and translate legacy logic into modern languages. Modernization in quarters instead of years. The market heard: the priesthood just lost its monopoly on the sacred language. And this isn’t the first time. Last week Anthropic announced Claude Code Security for vulnerability scanning. CrowdStrike dropped. Okta dropped. Cloudflare dropped. One company is serially destroying legacy moats with blog posts. Now here’s where it gets surreal. This same company, on the same day, also published evidence that three Chinese AI labs ran 24,000 fake accounts and 16 million exchanges to steal Claude’s capabilities. DeepSeek used it to build censorship tools. MiniMax pivoted within 24 hours when a new model dropped, redirecting half its traffic to steal the latest version. And yesterday, the Pentagon summoned this same company’s CEO for what officials called a “sh*t-or-get-off-the-pot meeting,” threatening to blacklist them like Huawei for refusing to let the military use Claude without safety restrictions. Three stories. One company. Twenty-four hours. The company destroying legacy moats faster than the market can reprice them is simultaneously being threatened by its own government and looted by foreign competitors. Anthropic is valued at $380 billion. Its CEO says a 12-month delay in AI would make him bankrupt. The Pentagon wants to designate it a supply chain risk. Chinese labs are running industrial espionage against it. And it just proved it can vaporize $30 billion in market cap with a Monday morning blog post. Whatever you think about AI disruption, IBM’s stock just settled the argument. Full institutional analysis on my Substack. open.substack.com/pub/shanakaans…

@addyosmani @threadreaderapp unroll

Tip: Be careful with /init. A good mental model is to treat AGENTS(.md) as a living list of codebase smells you haven't fixed yet rather than a permanent configuration. Auto-generated AGENTS(.md) files hurt agent performance and inflate costs because they duplicate what agents can already discover. Human-written files help only when they contain non-discoverable information - tooling gotchas, non-obvidous conventions, landmines. Every other line is noise. Beyond what to put in it, there's a structural problem worth naming: a single AGENTS(.md) at the root of your repo isn't sufficient for any codebase of real complexity. What you actually need is a hierarchy of AGENTS(.md) files - placed at the relevant directory or module level - automatically maintained so that each agent gets context scoped precisely to the code it's working in, rather than a monolithic file that conflates concerns across the entire project.

@simas_ch You can use pnpm

Why do JavaScript projects have a local `node_modules` directory by default, and not a global one like Maven? It doesn't make sense to work with a Git worktree and download everything repeatedly.

@r0ck3t23 @threadreaderapp unroll

Yann LeCun just exposed AI’s fundamental flaw. We’re celebrating systems that can’t do what insects do effortlessly. LeCun: “The biggest difficulty is not to get fooled into thinking that a computer system is intelligent simply because it can manipulate language.” Language feels like intelligence because we experience it as the highest form of human thought. So when a machine produces fluent, articulate, convincing text, the instinct is to conclude it understands. It doesn’t. LeCun: “It turns out the real world is much, much more complicated.” Language is actually the easy part. A sequence of discrete symbols with a finite number of possibilities. Predicting the next word is a tractable mathematical problem. Impressive at scale. Not understanding. Pattern matching in symbol space. The real world is something else entirely. A high-dimensional, continuous, noisy signal that changes every millisecond in ways no text corpus can capture. Physical reality doesn’t come in tokens. LeCun: “Which your house cat is perfectly able to deal with. But not computers yet.” This is the Moravec paradox. The things that feel hard to humans: writing essays, solving equations, passing bar exams. Computationally straightforward. The things that feel trivially easy: walking across a room, catching a falling object, folding a shirt. Extraordinarily difficult for machines. Your house cat navigates a complex three-dimensional physical environment in real time. Predicts trajectories. Adjusts to surprises. Understands cause and effect through direct interaction with the world. The most powerful AI systems ever built cannot do what your cat does before breakfast. That’s not a minor gap. That’s the entire frontier. Language is the easy problem that looks hard to humans. The physical world is the hard problem that looks easy because evolution solved it billions of years ago. We’re pouring hundreds of billions into making language models marginally better at the simple problem. The actual intelligence problem remains unsolved. LeCun has spent fifteen years on this. Not making chatbots more fluent. Giving machines the ability to understand, predict, and interact with physical reality the way animals do instinctively. The benchmark that matters isn’t passing a bar exam. It’s folding a shirt. Loading a dishwasher. Navigating an unfamiliar room without a map. We built systems that can write your dissertation before we built systems that can tie your shoes. That’s where AI actually is. Everything else is autocomplete at scale.

@lennysan @bcherny @threadreaderapp unroll

My biggest takeaways from @bcherny: 1. Coding is now “solved” for most use cases. Boris hasn’t written a single line of code by hand since November, with 100% of his work now authored by Claude Code. At the same time, he remains one of the most productive engineers at Anthropic, shipping 10 to 30 pull requests daily while leading the team. 2. Anthropic has seen a 200% increase in engineer productivity since adopting Claude Code. As Boris notes, “Back at Meta, with hundreds of engineers working on productivity, we’d see gains of a few percentage points in a year. Now we’re seeing hundreds of percentage points.” 3. AI is moving beyond writing code to generating ideas. “Claude is starting to come up with ideas. It’s looking through feedback, bug reports, and telemetry, then suggesting features to ship.” 4. The next roles to be transformed are those adjacent to engineering. Product managers, designers, and data scientists will see similar transformations as agentic AI expands beyond coding. “Any kind of job where you use computer tools will be next.” 5. Build for the model six months from now, not today. One of Boris’s key principles is to design products for future AI capabilities, not current ones. “It’s going to be uncomfortable because your product-market fit won’t be very good for the first six months. But when that model comes out, you’ll hit the ground running.” 6. Watch for “latent demand.” Claude Code was built by observing what people were already trying to do, and then making it easier. Cowork emerged when they noticed people using Claude Code for non-coding tasks like analyzing MRIs or recovering wedding photos from corrupted drives. 7. Don’t optimize for token cost. Boris advises companies to give engineers unlimited tokens during experimentation phases. “At small scale, the token cost is still relatively low compared to their salary. If an idea works and scales, that’s when you optimize it.” 8. Underfund headcount on purpose. When Boris puts one engineer on a project, they’re forced to let AI do more of the work. Constraint drives creative use of AI tooling, not just faster typing. 9. The most successful people in the future will be generalists. “Try to be a generalist more than you have in the past. Some of the most effective engineers cross over disciplines. The people who will be rewarded most won’t just be AI-native—they’ll be curious generalists who can think about the broader problem they’re solving.” 10. Always use the most capable model, not the cheapest. A less intelligent model often burns more tokens correcting mistakes than a smarter one spends getting it right the first time. Boris runs maximum effort on Opus 4.6 for everything. Here's the full conversation: youtube.com/watch?v=We7BZV…

@sama @threadreaderapp unroll

Peter Steinberger is joining OpenAI to drive the next generation of personal agents. He is a genius with a lot of amazing ideas about the future of very smart agents interacting with each other to do very useful things for people. We expect this will quickly become core to our product offerings. OpenClaw will live in a foundation as an open source project that OpenAI will continue to support. The future is going to be extremely multi-agent and it's important to us to support open source as part of that.

@Theoladeledada @claudeai @threadreaderapp unroll

Jesus christtttttttttttttttttt!!! Stop whatever you are doing and watch this @claudeai got a huge update today & I'm flattered. As of now, Claude Opus 4.6 can build mobile apps and prepare shipping them on the Apple + Google app stores.

@milesdeutscher @threadreaderapp unroll

This is getting out of control now... Read this slowly. In the past week alone: • Head of Anthropic's safety research quit, said "the world is in peril," moved to the UK to "become invisible" and write poetry. • Half of xAI's co-founders have now left. The latest said "recursive self-improvement loops go live in the next 12 months." • Anthropic's own safety report confirms Claude can tell when it's being tested - and adjusts its behavior accordingly. • ByteDance dropped Seedance 2.0. A filmmaker with 7 years of experience said 90% of his skills can already be replaced by it. • Yoshua Bengio (literal godfather of AI) in the International AI Safety Report: "We're seeing AIs whose behavior when they are tested is different from when they are being used" - and confirmed it's "not a coincidence." And to top it all off, the U.S. government declined to back the 2026 International AI Safety Report for the first time. The alarms aren't just getting louder. The people ringing them are now leaving the building.

@threadripp @cryptopunk7213 🙈

@peschee @cryptopunk7213 What?

yo anthropic just dropped a risk report for opus 4.6 and er… wtf - it helped create chemical weapons of destruction. “it knowingly supported efforts towards chemical weapon development and other heinous crimes” 😂 - it conducted unauthorised tasks without getting caught. researchers concluded opus 4.6 was significantly better at ‘sneaky sabotage’ than any other previous model lol - opus 4.6 was aware it was being tested and acted ‘good’ during those times. - hidden thinking - model was found to be conducting private reasoning that anthropic researchers couldn’t access or see - only the model knew.

@rauchg @cramforce @vercel What about quality?

Claude-using teams on @vercel: ▪️ generated 12.8% of deployments last week ▪️ ship 7.6x more often than non-Claude teams ▪️ growing deployments at 14% WoW

@aakashgupta @threadreaderapp unroll

Everyone’s reading this as the beginning of the end for software engineers. The opposite is happening at the company saying it. Anthropic had 240 employees in 2023. Today they have over 4,000, with 392 open roles, plans to triple their international headcount, and they’re expanding their applied AI team fivefold. They just closed $10-15B at a $350B valuation in January. Revenue run rate hit $9B. The biggest line item in those open roles? Engineering. So the company where Claude writes “effectively 100%” of the code is hiring engineers faster than almost anyone in tech. That tells you what “AI writes the code” actually means in practice. Those 2-3,000 line PRs represent what happens when one engineer can now do what used to take a team of five. Output per engineer goes vertical, but the bottleneck shifts to the person who knows what to build, how to architect the system, and whether the 3,000 lines Claude generated are correct. Review, judgment, and system design become the scarce skills. The code itself becomes abundant. And when you make something abundant, you don’t need fewer people who understand it. You need more people who can direct it at harder problems. Anthropic figured this out before anyone else because they’re living it daily. Their engineers aren’t writing less code. They’re shipping more product. And every additional product surface requires more engineers to spec, review, and maintain what Claude produces. The companies that will struggle are the ones who hear “100% AI-written code” and cut headcount. The ones that win will hear the same thing and hire more engineers who can think at a system level while Claude handles the keystrokes.