Daily · 2026-07-15

Ranked by engagement score at capture. Expand any card for full text; metrics are a flash read of importance.

Posts

35.2K

Σ score

Security

2.9M

Σ views

Product security & cyber · 2026-07-15

How urgency works · feed →

Text-derived urgency for triage — not CVSS/EPSS/KEV. Re-checked on every rebuild.

Critical exploit / RCE language High leak · bypass · ransomware Elevated clear security signal Needs score CVE, score next Watch lower-impact signal

Urgency (unverified)	Signal	CVE	Types
Elevated checked 2026-07-27	Open-sourced fully autonomous AI Red Team — multi-agent LangGraph, Neo4j attack graphs, Sliver C2 in sandbox. 2026-07-15 · @0x0SojalSec · next: `process_and_product_review`	`—`	agent_or_ai_risk, product_security
Critical (text) checked 2026-07-27	[$4,500] Remote Code Execution Vulnerability in Meta's Manus AI #bugbounty 2026-07-15 · @z41zen · next: `process_and_product_review`	`—`	agent_or_ai_risk, high_impact_vuln_class, product_security
Elevated checked 2026-07-27	Claude Code artifacts can call MCP connectors — runs as viewer, limited tools, consent per connector not action; org-share only. 2026-07-15 · @PawelHuryn · next: `process_and_product_review`	`—`	agent_or_ai_risk, product_security
Elevated checked 2026-07-27	1Password Credential Broker for CI/CD and AI agents — short-lived creds via workload identity; GitHub Actions beta. 2026-07-15 · @ken5scal · next: `process_and_product_review`	`—`	agent_or_ai_risk, product_security
Elevated checked 2026-07-27	Joint guidance for coordinated vulnerability disclosure programs with security researchers. 2026-07-15 · @CISAgov · next: `monitor`	`—`	advisory_or_disclosure, cybersecurity

Trend signals · last ~2 weeks

Weighted engagement (♥ + 3×↻ + 2×🔖 + views/500) by theme — points you can track over time. Hover dots for day detail.

Product securityCybersecurityOpen sourceDefense / dronesAgent infrastructurePrivacy / trustPractical tools

post preview

Agent infrastructure @ClaudeDevs 2026-07-15

♥9.8K ↻593 💬267 🔖5.6K 👁1.5M score23.8K

Claude Code artifacts can now call MCP connectors for live dashboards/actions per viewer.

Lesson: Major harness feature: MCP-connected artifacts.

Open on X

Full post text

Claude Code artifacts can now call MCP connectors for live dashboards/actions per viewer.

post preview

Agent infrastructure @perplexity_ai 2026-07-15

♥732 ↻90 💬59 🔖270 👁285.2K score2.1K

Lesson: Long-running agents need durable sandboxes with cheap CoW snapshots — not always-on VMs.

Open on X link

Full post text

Introducing SPACE, the sandbox platform behind Perplexity Computer. It creates isolated environments for code, files, and long-running agent sessions. SPACE has handled 100% of Computer production traffic since June. https://research.perplexity.ai/articles/making-space-secure-and-efficient-runtimes-for-long-running-agents

Open source @ericosiu 2026-07-15

♥205 ↻15 💬7 🔖521 👁208.7K score1.7K

Spent months building these on real pipelines. Giving them away for free. Open-source AI skills for marketing and sales teams. https://github.com/ericosiu/ai-marketing-skills

Lesson: Skill packs for agents > one-off prompts; map skills to weekly work.

Open on X link

Full post text

Spent months building these on real pipelines. Giving them away for free. Open-source AI skills for marketing and sales teams. https://github.com/ericosiu/ai-marketing-skills

Safe adopt prompt · agent skill pack

Copy into Claude / Grok / Codex / Cursor — investigates provenance & malware first, then plans LifeOS-compatible install only if safe.

SAFE ADOPT — investigate first, then wire into my local agent stack (LifeOS-compatible)

You are my technical agent. Do NOT clone, download, pip/npm install, grant permissions, or write config until Phase A–D pass. If anything fails, STOP and report — never "install anyway."

══════════════════════════════════════
ARTIFACT (from Laitest capture)
══════════════════════════════════════
- Kind (guess): agent skill pack
- Category: Open source (open_source)
- Source post: https://x.com/i/status/2077502803639947350
- Author on X: @ericosiu (ericosiu) · date 2026-07-15
- Primary URL: https://github.com/ericosiu/ai-marketing-skills
- All URLs:
  1. https://github.com/ericosiu/ai-marketing-skills
- Capture lesson: Skill packs for agents > one-off prompts; map skills to weekly work.
- Post excerpt:
"""
Spent months building these on real pipelines. Giving them away for free.

Open-source AI skills for marketing and sales teams.

https://github.com/ericosiu/ai-marketing-skills
"""

══════════════════════════════════════
GOAL
══════════════════════════════════════
Decide what this is (skill · tool · agent · MCP server · orchestrator · model · library · other), whether it is safe and worth adopting, and if yes: the minimal correct way to put it into MY stack so future sessions know how to use it.

My stack (LifeOS-compatible local agent OS):
- Skills live under ~/.claude/skills/ (use CreateSkill skill before creating/modifying ANY skill — never hand-roll SKILL.md)
- MCP servers / peer tools: configure only after provenance + security pass
- Projects/tools may land under ~/Projects/ or a clearly named path — never overwrite without asking
- Dual memory: curated notes vs verbatim recall — if worth remembering, say where it should be filed
- Prefer reversible, audited installs (git clone to a sandbox dir first; no curl|bash; no sudo unless I approve)

══════════════════════════════════════
PHASE A — IDENTIFY (no downloads yet)
══════════════════════════════════════
1. Name the artifact, license (if known), language/runtime, and intended use in one paragraph.
2. Classify exactly one primary type:
   [ ] LifeOS/Claude skill pack   [ ] MCP server   [ ] Coding agent/harness/CLI
   [ ] Library/SDK                [ ] Model/weights [ ] Orchestrator/workflow
   [ ] Security tool              [ ] Other: ___
3. List dependencies (Node/Python/Rust/Docker/GPU/API keys) and network blast radius (what it phones home to).
4. If multiple URLs, rank which is canonical and which are mirrors/docs/marketing.

══════════════════════════════════════
PHASE B — PROVENANCE (is this the real thing?)
══════════════════════════════════════
1. Resolve the canonical upstream (org/user + repo or package). Prefer official org over random forks.
2. Typosquat / clone checks:
   - Similar names with high stars that are NOT this one
   - Fork that rebrands itself as original
   - Recently created account + sudden stars (bought engagement)
   - README that copies a famous project but different remote
3. Author/reputation: real maintainers? Linked site? History of other repos?
4. Activity: last commit/release, open issues, PR response, abandoned?
5. Stars/forks/watchers in context (not gospel — only a signal).
6. Output: PROVENANCE = PASS | WEAK | FAIL with evidence links.

══════════════════════════════════════
PHASE C — SECURITY (malware / supply chain)
══════════════════════════════════════
Do this BEFORE any install that runs code:
1. Inspect README, install docs, GitHub Actions, package.json/pyproject/Cargo.toml for:
   - postinstall / prepare scripts that fetch remote code
   - obfuscated JS/Python, base64 blobs, eval/exec of network content
   - requests for secrets, SSH keys, wallet files, browser cookies
   - unexpected network endpoints, crypto miners, reverse shells
2. Check advisories: OSV / GitHub Dependabot / known CVE mentions for this package name.
3. Permissions: does it need root, full disk, browser automation, shell, or cloud credentials?
4. Sandbox plan: clone to a temporary directory (e.g. /tmp/laitest-vet-{slug} or ~/Projects/_quarantine/{slug}) with no global npm/pip install until review.
5. For models/weights: source integrity (checksums, HF org trust), license, data exfil risk if run with tools.
6. Output: SECURITY = PASS | CONDITIONAL | FAIL + specific red flags.
   CONDITIONAL requires listing exact mitigations (offline, container, no secrets, etc.).

══════════════════════════════════════
PHASE D — MAINTENANCE & FIT
══════════════════════════════════════
1. Is it maintained enough for production use, or research-only?
2. Does it duplicate something I already have? (search my skills/tools first if accessible)
3. Value vs complexity: is the lesson above real for me, or hype?
4. Output: FIT = ADOPT | WATCH | SKIP with one-sentence why.

══════════════════════════════════════
PHASE E — ONLY IF A–D allow it: SAFE ADOPT PLAN
══════════════════════════════════════
Produce a step-by-step plan I can approve:

1. Exact clone/download command into a quarantine path (no global side effects).
2. What to read first (entry files, SECURITY.md, LICENSE).
3. Minimal smoke test that does NOT need production secrets.
4. How to wire it into LifeOS / my agent of choice, choosing the right shape:
   - Skill → invoke CreateSkill; scaffold; do not hand-write SKILL.md
   - MCP → config snippet + scopes + why those permissions
   - CLI/agent → install location + PATH note + example invocation
   - Library → when to depend vs vendor
   - Model → where weights live, how to call, hardware needs
   - Orchestrator → how it coexists with existing harnesses (do not replace blindly)
5. Rollback: how to fully remove files, configs, services.
6. Memory note (2–4 bullets) for future sessions: what it is, when to use it, gotchas.

══════════════════════════════════════
OUTPUT FORMAT (strict)
══════════════════════════════════════
## Verdict
PROVENANCE / SECURITY / FIT — each PASS|WEAK|CONDITIONAL|FAIL|ADOPT|WATCH|SKIP

## What it is
…

## Red flags
… (or "none material")

## Safe next commands (only if not FAIL)
```bash
# quarantine only
```

## LifeOS / agent wiring (only if ADOPT)
…

## Memory note
…

## STOP reasons (if any)
…

Begin Phase A now. Do not skip to install.

post preview

Defense / drones @adamgoldstein13 2026-07-15

♥275 ↻41 💬32 🔖33 👁606K score1.5K

Archer Zee — AI foundation model for aviation / physical AI; pilot programs with governments and airlines.

Lesson: Aviation foundation models as defense-adjacent physical AI.

Open on X

Full post text

Archer Zee — AI foundation model for aviation / physical AI; pilot programs with governments and airlines.

post preview

Open source @nutlope 2026-07-15

♥331 ↻26 💬30 🔖346 👁33.9K score1.2K

Introducing TogetherLink! An open source CLI to run any open source model inside your favorite coding harness. Run GLM 5.2 directly in Codex and Claude Code.

Lesson: Harness-agnostic model routers let teams swap closed↔open without relearning the CLI.

Open on X

Full post text

Introducing TogetherLink! An open source CLI to run any open source model inside your favorite coding harness. Run GLM 5.2 directly in Codex and Claude Code.

post preview

Agent infrastructure @ClaudeCodeLog 2026-07-15

♥475 ↻24 💬18 🔖81 👁85K score879

Claude Code 2.1.211 — subagent stream-json, permission preview hardening, PreToolUse ask for unsandboxed Bash.

Lesson: Harness security: permission spoofing defenses shipping in coding agents.

Open on X

Full post text

Claude Code 2.1.211 — subagent stream-json, permission preview hardening, PreToolUse ask for unsandboxed Bash.

Product security @0x0SojalSec 2026-07-15

♥225 ↻47 💬5 🔖224 👁8.4K score831

Open-sourced fully autonomous AI Red Team — multi-agent LangGraph, Neo4j attack graphs, Sliver C2 in sandbox.

Lesson: Autonomous red team packages accelerating; authorize carefully.

Open on X

Full post text

Open-sourced fully autonomous AI Red Team — multi-agent LangGraph, Neo4j attack graphs, Sliver C2 in sandbox.

post preview

Privacy / trust @dfinity 2026-07-15

♥413 ↻95 💬19 🔖31 👁30.7K score821

Internet Identity is getting an MCP server. An AI agent runs in a cloud sandbox. No access to your device. No safe way to hold your keys. The MCP server is the answer. Keys stay in a trusted execution environment, and …

Lesson: Agent auth should keep keys in TEE + user approval — never paste secrets into model context.

Open on X

Full post text

post preview

Product security @z41zen 2026-07-15

♥295 ↻39 💬5 🔖174 👁12.3K score785

[$4,500] Remote Code Execution Vulnerability in Meta's Manus AI #bugbounty https://zaizen.me/blog/manus-ai-deep-link-rce.html

Lesson: Agent deep-link handlers are a new RCE surface — treat client→agent URL schemes as untrusted input.

Open on X link

Full post text

[$4,500] Remote Code Execution Vulnerability in Meta's Manus AI #bugbounty https://zaizen.me/blog/manus-ai-deep-link-rce.html

Product security @PawelHuryn 2026-07-15

♥182 ↻9 💬11 🔖174 👁28.7K score614

Claude Code artifacts can call MCP connectors — runs as viewer, limited tools, consent per connector not action; org-share only.

Lesson: Artifact+MCP = product security review of least privilege & consent UX.

Open on X

Full post text

Claude Code artifacts can call MCP connectors — runs as viewer, limited tools, consent per connector not action; org-share only.

Open source @rohanpaul_ai 2026-07-15

♥226 ↻22 💬13 🔖90 👁18.9K score510

SpaceXAI open-sourced Grok Build Apache 2.0; reset usage limits.

Lesson: Coding harness open-sourcing is a competitive move.

Open on X link

Full post text

SpaceXAI open-sourced Grok Build Apache 2.0; reset usage limits.

post preview

Product security @ken5scal 2026-07-15

♥55 ↻15 💬1 🔖26 👁5.6K score163

1Password Credential Broker for CI/CD and AI agents — short-lived creds via workload identity; GitHub Actions beta. https://1password.com/blog/introducing-1password-credential-broker

Lesson: Agent credential brokers are product security infrastructure.

Open on X link

Full post text

1Password Credential Broker for CI/CD and AI agents — short-lived creds via workload identity; GitHub Actions beta. https://1password.com/blog/introducing-1password-credential-broker

post preview

Open source @sdianahu 2026-07-15

♥50 ↻8 💬3 🔖7 👁21.5K score131

LMSYS day-0 serving for Inkling open model — high tok/s on open stack.

Lesson: Day-0 open serving stacks race with model drops.

Open on X

Full post text

LMSYS day-0 serving for Inkling open model — high tok/s on open stack.

Cybersecurity @CISAgov 2026-07-15

♥37 ↻19 💬3 🔖7 👁5.8K score120

Joint guidance for coordinated vulnerability disclosure programs with security researchers. https://go.dhs.gov/5Am

Lesson: CVD program guidance is evergreen PSIRT policy content.

Open on X link

Full post text

Joint guidance for coordinated vulnerability disclosure programs with security researchers. https://go.dhs.gov/5Am

Defense / drones @Sam_Badawi 2026-07-15

♥68 ↻8 💬10 🔖3 👁5.7K score109

NVIDIA Jetson Thor T3000/T2000 for robotics, edge AI, autonomous machines; partners Amazon Robotics, FANUC, Boston Dynamics parent.

Lesson: Edge autonomy silicon is the defense/robotics choke point.

Open on X

Full post text

NVIDIA Jetson Thor T3000/T2000 for robotics, edge AI, autonomous machines; partners Amazon Robotics, FANUC, Boston Dynamics parent.

Lessons learned

Major harness feature: MCP-connected artifacts.
Long-running agents need durable sandboxes with cheap CoW snapshots — not always-on VMs.
Skill packs for agents > one-off prompts; map skills to weekly work.
Aviation foundation models as defense-adjacent physical AI.
Harness-agnostic model routers let teams swap closed↔open without relearning the CLI.
Harness security: permission spoofing defenses shipping in coding agents.
Autonomous red team packages accelerating; authorize carefully.
Agent auth should keep keys in TEE + user approval — never paste secrets into model context.
Agent deep-link handlers are a new RCE surface — treat client→agent URL schemes as untrusted input.
Artifact+MCP = product security review of least privilege & consent UX.
Coding harness open-sourcing is a competitive move.
Agent credential brokers are product security infrastructure.
Day-0 open serving stacks race with model drops.
CVD program guidance is evergreen PSIRT policy content.
Edge autonomy silicon is the defense/robotics choke point.