Code Review
Reviewing the Off-by-One the Model Put in the Pagination Loop
The loop fetched every page except the last, and the omission was invisible because the page count was right and the total was right, and the only wrong…
Opinion
The Model Should Not Write the Tests for the Code It Wrote
Asking a model to test its own output produces tests that confirm the implementation rather than the intent, and the confirmation is invisible in a green…
Bug Hunt
The Model-Written Regex That Took Nine Minutes on One Input
The generated pattern passed every test in the suite, then a single long string made it run for nine minutes. The pattern was not wrong.
Error Autopsy
The Package the Model Invented That Someone Else Registered
The model suggested a dependency that did not exist, the install command ran anyway, and the name resolved because a stranger had registered it.
Deep Dive
Why AI-Written Code Is Shaped Like the Happy Path
Generated code reflects the distribution it was trained on, and that distribution is tutorials and working examples, so the edges are where generated code…
Security
The Model Output That Rendered as HTML in the Browser
The assistant's reply was trusted because a model wrote it, and the reply was inserted with innerHTML, so a crafted input became stored script, and the…
Security
The Agent Held a Token That Could Delete Its Own Task
The task was to summarise a repository, and the token the agent ran with could delete its branches. The scope was copied from a deploy credential, and the…
Performance
The Token Bill Is a Performance Metric, and Yours Is Unread
The invoice tripled with no traffic change, because the prompts tripled, and nobody was reading tokens as a metric.
Debugging
Debugging an Agent That Will Not Reproduce Its Own Mistake
The agent broke the build once, and no rerun would do it again, because the failure was a draw from a distribution, not a function of the input.
DevOps
Running Agents in CI Needs Budgets, Gates and a Kill Switch
The pipeline gained an autonomous step and, with it, a workload that could loop, spend and touch production at three in the morning.
Tooling
The Sandbox Checklist for Letting an Agent Touch Real Tools
The agent was given a shell and, eventually, a mistake. The boundary that made the mistake cheap was not the model's judgement but the sandbox: disposable…
Security
The Phishing Email That Attacks Your AI Assistant Too
Barracuda Research describes phishing emails carrying two payloads: a social engineering lure for the human and a hidden prompt injection for the AI…