1 00:00:00,040 --> 00:00:05,520 It is March 30th, 2026, and I want you to imagine something 2 00:00:05,520 --> 00:00:07,720 for a second. You're sitting at your desk, 3 00:00:07,720 --> 00:00:11,960 sipping your coffee, and you're reviewing a routine pull request 4 00:00:11,960 --> 00:00:13,960 from a junior developer on your team. 5 00:00:14,160 --> 00:00:16,480 You're scrolling through the code and you know everything 6 00:00:16,480 --> 00:00:19,000 looks totally normal. The logic flows, the syntax is 7 00:00:19,000 --> 00:00:22,600 clean, and then right there, nested in the middle of a 8 00:00:22,600 --> 00:00:25,960 function, you find an advertisement just quietly 9 00:00:25,960 --> 00:00:30,040 slipped into your company's proprietary code base by an AI 10 00:00:30,040 --> 00:00:31,320 assistant. Wow. 11 00:00:31,960 --> 00:00:34,240 I mean, it sounds like a cyberpunk dystopian novel, 12 00:00:34,240 --> 00:00:37,080 honestly, but that is the reality of our current 13 00:00:37,080 --> 00:00:38,720 development environment, yeah. It really is. 14 00:00:39,120 --> 00:00:41,240 For today's deep dives, we're pulling from a really 15 00:00:41,240 --> 00:00:44,560 fascinating stack of sources to make sense of the absolute chaos 16 00:00:44,560 --> 00:00:47,160 in the AI developer tool space over this last month. 17 00:00:47,720 --> 00:00:50,400 We're looking at hacker blogs from Zach Manson and Simon 18 00:00:50,400 --> 00:00:52,560 Willison. We've got some incredibly 19 00:00:52,560 --> 00:00:55,320 detailed reverse engineering tear downs from the Arklot AI 20 00:00:55,320 --> 00:00:57,840 subreddit, official announcements from GitHub and 21 00:00:57,840 --> 00:01:00,720 Anthropic, and some really good insights in the Latent Space 22 00:01:00,720 --> 00:01:01,840 newsletter. Yeah. 23 00:01:01,840 --> 00:01:04,360 And the mission for this deep dive is to really try and 24 00:01:04,360 --> 00:01:07,960 navigate this wild acceleration because right now, the 25 00:01:07,960 --> 00:01:10,200 productivity gains are just massive. 26 00:01:10,200 --> 00:01:12,760 I mean, people are doing things like vibe coding entire 27 00:01:12,760 --> 00:01:14,560 applications in an afternoon. Exactly. 28 00:01:14,560 --> 00:01:16,800 But the hidden traps are equally massive. 29 00:01:16,800 --> 00:01:20,920 We're talking about giant silent API bills and, you know, 30 00:01:20,920 --> 00:01:24,400 shifting data privacy policies that could just leave your code 31 00:01:24,400 --> 00:01:25,680 completely exposed. Yeah. 32 00:01:25,880 --> 00:01:28,360 The risk? So let's unpack this. 33 00:01:28,760 --> 00:01:31,600 The way I see it, the current state of AI coding tools is a 34 00:01:31,600 --> 00:01:36,280 lot like handing the keys to a brand new Ferrari to a teenager. 35 00:01:36,880 --> 00:01:40,800 You're going to get incredible mind bending speed, but you 36 00:01:40,840 --> 00:01:43,320 absolutely need to know where the brakes are and you really 37 00:01:43,320 --> 00:01:45,320 need to know who is tracking the GPS. 38 00:01:45,320 --> 00:01:48,520 That is a perfect analogy because that blind trust in the 39 00:01:48,520 --> 00:01:52,400 GPS is the core issue here. The transition from AI is a fun 40 00:01:52,400 --> 00:01:55,440 novelty to AI is a deeply integrated Co worker. 41 00:01:55,720 --> 00:01:58,800 Happened so fast that human review is often just, well, 42 00:01:58,800 --> 00:02:00,560 nominal. All right, it's a rubber stamp. 43 00:02:00,600 --> 00:02:02,600 Exactly. We see a block of code, it has 44 00:02:02,600 --> 00:02:04,880 the right shape, the right syntax highlighting, and we just 45 00:02:04,880 --> 00:02:07,120 assume it's correct. Which brings us back to that 46 00:02:07,120 --> 00:02:08,919 advertisement in the pull request. 47 00:02:09,360 --> 00:02:11,840 This comes straight from a blog post published just a few days 48 00:02:11,840 --> 00:02:14,280 ago by a developer named Zach Manson over at 49 00:02:14,280 --> 00:02:18,080 notes.zachmanson.com. He reported that GitHub Copilot 50 00:02:18,080 --> 00:02:21,120 actually inserted what appeared to be promotional content 51 00:02:21,120 --> 00:02:25,080 directly into APR. Like how does a coding assistant 52 00:02:25,080 --> 00:02:28,000 even hallucinate a billboard? It's supposed to be writing 53 00:02:28,000 --> 00:02:29,760 functions, not selling me things. 54 00:02:29,760 --> 00:02:33,560 Well, it comes down to training data language basically, and the 55 00:02:33,560 --> 00:02:36,520 fundamental mechanics of how these large language models 56 00:02:36,520 --> 00:02:40,480 predict the next token. Because these models are trained 57 00:02:40,480 --> 00:02:42,840 on millions of public repositories, right? 58 00:02:43,320 --> 00:02:46,040 And a lot of those repositories contain markdown files, sponsor 59 00:02:46,040 --> 00:02:48,560 Readme's, or boilerplate templates that include 60 00:02:48,800 --> 00:02:51,760 promotional links for the creator's Atreon or, you know, 61 00:02:51,760 --> 00:02:53,000 Cororate sponsors. Oh, I see. 62 00:02:53,360 --> 00:02:56,800 O When the AI's context window gets confused, maybe the code 63 00:02:56,800 --> 00:02:59,760 structure closely resembles a popular open source template it 64 00:02:59,760 --> 00:03:01,960 was trained on. It just redicts the next most 65 00:03:01,960 --> 00:03:06,040 likely token, and sometimes that sequence of tokens happens to be 66 00:03:06,040 --> 00:03:09,200 an ad from its training data. So it's just blindly 67 00:03:09,200 --> 00:03:13,240 regurgitating a pattern it saw in the wild without any actual 68 00:03:13,240 --> 00:03:16,960 understanding that an ad doesn't belong inside a Python script. 69 00:03:17,160 --> 00:03:19,520 Precisely. I mean, the incident completely 70 00:03:19,520 --> 00:03:22,400 blew up on Hacker News because it highlights a really dangerous 71 00:03:22,400 --> 00:03:25,000 trust gap. There's a massive difference 72 00:03:25,000 --> 00:03:29,200 between code that usually looks right and code that is actually 73 00:03:29,200 --> 00:03:31,920 right. Yeah, when we get so comfortable 74 00:03:31,920 --> 00:03:34,760 with a tool that we stop actively reading the code it 75 00:03:34,760 --> 00:03:37,800 generates, we just leave ourselves incredibly vulnerable 76 00:03:37,800 --> 00:03:41,200 to these bizarre hallucinations. And it feels like this localized 77 00:03:41,200 --> 00:03:44,280 trust issue, like worrying about what the AI is putting into our 78 00:03:44,280 --> 00:03:48,000 code, connects directly to a much broader corporate level 79 00:03:48,000 --> 00:03:51,120 trust issue regarding what the AI companies are pulling out of 80 00:03:51,120 --> 00:03:53,800 our code. 0 Absolutely. Because the very same week Zach 81 00:03:53,800 --> 00:03:57,640 Manson's post drops, GitHub makes a massive data policy 82 00:03:57,640 --> 00:03:59,320 announcement. Yeah, that GitHub announcement 83 00:03:59,320 --> 00:04:02,880 from March 25th is critical. Listeners, if you take nothing 84 00:04:02,880 --> 00:04:06,840 else away from this deep dive, mark April 2420 2026 on your 85 00:04:06,840 --> 00:04:07,320 calendar. You. 86 00:04:07,320 --> 00:04:10,280 Usually write it down. Starting on that date, the 87 00:04:10,280 --> 00:04:14,360 interaction data from Copilot, Free Pro and Pro Plus users will 88 00:04:14,360 --> 00:04:16,920 be used to train AI models for Microsoft. 89 00:04:17,160 --> 00:04:19,720 And by interaction data they mean everything right? 90 00:04:19,720 --> 00:04:22,440 Like inputs, outputs. Everything your prompts, the 91 00:04:22,440 --> 00:04:25,360 code snippets it generates and the entire context window of the 92 00:04:25,360 --> 00:04:26,760 files you have open. Wow. 93 00:04:27,440 --> 00:04:30,800 And the kicker is that this change is opt out by default. 94 00:04:30,880 --> 00:04:33,200 You have to actively go into your settings and tell them not 95 00:04:33,200 --> 00:04:35,960 to use your data. See, I really have to push back 96 00:04:35,960 --> 00:04:38,360 on the philosophy behind an opt out mechanism here. 97 00:04:38,360 --> 00:04:42,000 I mean, are we entering an era where PR review is just theatre 98 00:04:42,480 --> 00:04:46,520 and if we blink, our proprietary secrets and our core business 99 00:04:46,520 --> 00:04:49,720 logic just become part of the collective AI hive mind? 100 00:04:49,880 --> 00:04:52,080 It's a valid fear. It feels like we're paying a 101 00:04:52,080 --> 00:04:55,280 premium subscription for a tool that is secretly using our own 102 00:04:55,280 --> 00:04:57,160 blueprints to essentially replace us. 103 00:04:57,440 --> 00:05:00,400 If I have proprietary code passing through Copilot, I don't 104 00:05:00,400 --> 00:05:03,080 want to have to remember to uncheck a box buried in a 105 00:05:03,080 --> 00:05:04,720 settings menu just to keep it safe. 106 00:05:04,960 --> 00:05:07,320 Right. It forces us to ask what the 107 00:05:07,320 --> 00:05:09,600 true cost of these tools actually is. 108 00:05:09,840 --> 00:05:12,680 We pay the subscription fee, sure, but we are also 109 00:05:12,800 --> 00:05:14,400 potentially paying with our data. 110 00:05:14,560 --> 00:05:18,160 And as we've seen this month, the frantic pace of development 111 00:05:18,160 --> 00:05:21,120 in this space means we might also be paying literal 112 00:05:21,120 --> 00:05:24,520 unexpected financial costs when these systems breakdown behind 113 00:05:24,520 --> 00:05:26,640 the scenes. Yes, because the speed of 114 00:05:26,640 --> 00:05:29,120 development right now is just blinding if. 115 00:05:29,120 --> 00:05:31,200 They even accidentally leaked the name of something called 116 00:05:31,200 --> 00:05:33,680 Claude Mythos which they quickly scrubbed. 117 00:05:34,280 --> 00:05:36,960 So now everyone is guessing about what massive release is 118 00:05:36,960 --> 00:05:39,480 coming next. But honestly, the real issue is 119 00:05:39,480 --> 00:05:41,280 the regressions. Right, the regressions. 120 00:05:41,280 --> 00:05:45,000 I saw a massive thread on the R Claude AI subreddit where 121 00:05:45,000 --> 00:05:49,120 someone's API bill absolutely melted down, but I couldn't 122 00:05:49,120 --> 00:05:51,640 quite understand how they figured out what went wrong. 123 00:05:52,080 --> 00:05:54,880 They were talking about reverse engineering the app, which seems 124 00:05:54,880 --> 00:05:57,600 incredibly intense for a simple billing dispute. 125 00:05:57,640 --> 00:06:01,280 Oh, the lengths this independent researcher had to go to are 126 00:06:01,280 --> 00:06:03,640 staggering. They were dealing with clawed 127 00:06:03,640 --> 00:06:08,120 codes, stand alone binary, and this isn't some small readable 128 00:06:08,120 --> 00:06:13,040 Python script, it is a 228 megabyte ELF binary. 129 00:06:13,200 --> 00:06:15,640 An ELF binary, so it's compiled. Exactly. 130 00:06:15,920 --> 00:06:18,160 ELF stands for Executable and Linkable Format. 131 00:06:18,440 --> 00:06:21,280 It's basically a package compiled stand alone application 132 00:06:21,280 --> 00:06:24,000 format used in Linux and Unix environments. 133 00:06:24,320 --> 00:06:26,720 Because it's compiled into machine code, it is essentially 134 00:06:26,720 --> 00:06:28,320 a black box. You can't just open it in the 135 00:06:28,320 --> 00:06:31,040 text editor to see how it works. So they actually had to pry the 136 00:06:31,040 --> 00:06:33,560 black box open. They spent days tearing it 137 00:06:33,560 --> 00:06:35,760 apart. They were using heavy duty 138 00:06:35,760 --> 00:06:39,760 reverse engineering tools like Gidra and Raider 2 and they were 139 00:06:39,760 --> 00:06:42,960 setting up man in the middle of proxies just to intercept the 140 00:06:42,960 --> 00:06:46,000 network traffic so they could see what the tool was actually 141 00:06:46,000 --> 00:06:48,640 sending to Anthropic servers under the hood. 142 00:06:48,760 --> 00:06:50,680 That is wild. What did they find hiding in 143 00:06:50,680 --> 00:06:55,040 that 228 megabyte black box? They found two independent bugs 144 00:06:55,040 --> 00:06:57,040 that were silently breaking prompt caching. 145 00:06:57,040 --> 00:06:59,520 Oh, no, yeah. One of them had to do with a 146 00:06:59,520 --> 00:07:02,200 Sentinel replacement issue. OK, wait, what's a Sentinel in 147 00:07:02,200 --> 00:07:04,400 this context? Just so we're on the same page. 148 00:07:04,440 --> 00:07:07,040 Sure. So in programming, a Sentinel is 149 00:07:07,040 --> 00:07:11,160 just a specific unique value used to signal the end of a 150 00:07:11,160 --> 00:07:13,160 block of data. It's like a bookmark telling the 151 00:07:13,160 --> 00:07:15,640 system, hey, stop reading here. Got it. 152 00:07:16,000 --> 00:07:18,880 Because Claude code was mishandling these Sentinels, the 153 00:07:18,880 --> 00:07:21,320 system was losing its place. It thought it was reading a 154 00:07:21,320 --> 00:07:24,640 brand new file every single time, which totally destroyed 155 00:07:24,640 --> 00:07:28,000 the prompt cache. Think about your own workflow 156 00:07:28,000 --> 00:07:30,280 right now. If you're using Claude to 157 00:07:30,280 --> 00:07:33,920 refactor a massive code base prompt caching is what makes it 158 00:07:33,920 --> 00:07:37,040 financially viable. If you send the same 100,000 159 00:07:37,040 --> 00:07:41,120 lines of code to the AI over and over, caching means you only pay 160 00:07:41,120 --> 00:07:44,480 a tiny fraction of the token cost for that repeated context. 161 00:07:44,480 --> 00:07:47,040 Exactly. But because of this Sentinel 162 00:07:47,040 --> 00:07:50,920 bug, the passion was feeling completely The system quietly 163 00:07:50,920 --> 00:07:55,160 defaulted to charging the user for full token prices on every 164 00:07:55,160 --> 00:07:58,320 single interaction instead of those discounted cash hit 165 00:07:58,320 --> 00:08:01,000 prices. And there were 0 error messages, 166 00:08:01,000 --> 00:08:02,200 right? It didn't crash, it just 167 00:08:02,200 --> 00:08:04,040 silently charged them full price. 168 00:08:04,240 --> 00:08:07,200 Heavy users of clawed code. We're seeing A10 to 20X 169 00:08:07,200 --> 00:08:10,920 inflation in their ATI costs silently while they thought 170 00:08:10,920 --> 00:08:12,320 everything was functioning normally. 171 00:08:12,560 --> 00:08:15,160 I mean is the move fast and break things era back? 172 00:08:15,160 --> 00:08:18,120 But instead of just crashing our apps it's silently siphoning our 173 00:08:18,120 --> 00:08:20,920 wallets while we sleep. It's just wild to me that a user 174 00:08:20,920 --> 00:08:23,920 had to fire up Ghidra and decompile machine code just to 175 00:08:23,920 --> 00:08:25,800 figure out why their credit card was melting. 176 00:08:26,000 --> 00:08:29,640 It is a perfect storm, really rapid iteration combined with 177 00:08:29,640 --> 00:08:32,919 complex abstraction. The tools are incredibly 178 00:08:32,919 --> 00:08:36,440 capable, but they are shipping with deeply hidden bugs. 179 00:08:37,159 --> 00:08:39,640 This means we urgently need a way to control them. 180 00:08:39,760 --> 00:08:42,320 We have to learn how to bound the infinite intern. 181 00:08:42,520 --> 00:08:45,600 Bounding the infinite intern. I love that that perfectly 182 00:08:45,600 --> 00:08:48,600 captures the feeling of using an autonomous coding agent. 183 00:08:49,120 --> 00:08:51,600 They're incredibly eager, but they have absolutely no common 184 00:08:51,600 --> 00:08:54,480 sense. Yeah, Simon Willison recently 185 00:08:54,480 --> 00:08:56,880 quoted Matt Webb on this exact philosophy. 186 00:08:56,880 --> 00:09:00,480 Webb said agents grind problems into dust. 187 00:09:01,120 --> 00:09:04,160 What Webb means is that if you give an AI agent a while loop, 188 00:09:04,160 --> 00:09:06,880 in enough time it will technically solve any problem 189 00:09:06,880 --> 00:09:09,080 you give it. Unlike a human intern who will 190 00:09:09,080 --> 00:09:11,880 eventually get tired, realize they're stuck, and ask you for 191 00:09:11,880 --> 00:09:14,000 help, a machine will just keep iterating. 192 00:09:14,200 --> 00:09:16,800 It just doesn't. Stuff it'll try 10,000 dead end 193 00:09:16,800 --> 00:09:18,720 solutions. Bring a trillion tokens in the 194 00:09:18,720 --> 00:09:21,880 process until it either hits a hard rate limit or drains your 195 00:09:21,880 --> 00:09:24,040 bank account. So the challenge isn't getting 196 00:09:24,040 --> 00:09:25,880 the agent to solve the problem eventually. 197 00:09:25,960 --> 00:09:28,360 The challenge is getting it to solve the problem efficiently 198 00:09:28,360 --> 00:09:30,280 before it grinds your wallet into dust. 199 00:09:30,480 --> 00:09:33,080 This is where we get some incredibly authoritative advice 200 00:09:33,080 --> 00:09:36,040 from Boris Journey. He's the creator of Claude Code. 201 00:09:36,560 --> 00:09:40,800 He dropped 15 best practice tips on the R Claude AI subreddit and 202 00:09:40,800 --> 00:09:43,000 GitHub, and they are essential reading. 203 00:09:43,560 --> 00:09:47,440 The core of his advice revolves around mastering the claw G dot 204 00:09:47,440 --> 00:09:49,480 MD file. See, I always thought of claudy 205 00:09:49,480 --> 00:09:52,640 dot MD as just a basic config file you know, where you list a 206 00:09:52,640 --> 00:09:55,680 few project paths or environment variables. 207 00:09:55,680 --> 00:09:59,960 Yeah, a lot of people do. But Cherney emphasizes that you 208 00:09:59,960 --> 00:10:01,640 need to completely change your framing. 209 00:10:01,840 --> 00:10:05,720 You must treat Clodgy dot MD as a comprehensive onboarding 210 00:10:05,720 --> 00:10:08,880 document for a hypothetical brilliant new engineer who 211 00:10:08,880 --> 00:10:10,760 cannot ask you any follow up questions. 212 00:10:10,760 --> 00:10:13,440 Oh wow, that means you have to pre answer every possible 213 00:10:13,440 --> 00:10:14,880 misunderstanding. Exactly. 214 00:10:15,160 --> 00:10:17,200 You need to include your architecture decisions, the 215 00:10:17,200 --> 00:10:19,760 rationale behind them, your testing conventions, deployment 216 00:10:19,760 --> 00:10:21,880 gotchas. You should explicitly list files 217 00:10:21,880 --> 00:10:25,240 that Claude is absolutely not allowed to modify, but the most 218 00:10:25,240 --> 00:10:27,800 genius piece of advice Charney gives I think, is to include a 219 00:10:27,840 --> 00:10:30,480 specific section for things that look like they should be 220 00:10:30,480 --> 00:10:34,320 refactored but shouldn't. Oh, that's brilliant, because AI 221 00:10:34,320 --> 00:10:37,240 loves to be helpful. If it sees a piece of code that 222 00:10:37,240 --> 00:10:40,880 looks redundant or strangely structured, its instinct is to 223 00:10:40,880 --> 00:10:44,280 quote UN quote fix it for you, entirely unaware that you 224 00:10:44,280 --> 00:10:48,120 structured it that way to handle some bizarre undocumented edge 225 00:10:48,120 --> 00:10:51,680 case in a legacy API. Right, you have to explicitly 226 00:10:51,680 --> 00:10:55,200 bound its scope. Cherney also mentions giving 227 00:10:55,200 --> 00:10:57,800 Claude tasks with defined done states. 228 00:10:57,960 --> 00:10:59,480 What does that look like in practice? 229 00:10:59,560 --> 00:11:03,160 Well, don't just prompt it to fix the login page, you tell it. 230 00:11:03,360 --> 00:11:06,240 Add input validation to the login function, stop immediately 231 00:11:06,240 --> 00:11:08,920 when the unit test pass and do not change anything else. 232 00:11:08,960 --> 00:11:10,520 Makes sense. We also need to talk about 233 00:11:10,520 --> 00:11:13,400 system permissions because Claude code recently introduced 234 00:11:13,400 --> 00:11:15,720 auto mode. Oh yeah, Simon Wilson read about 235 00:11:15,720 --> 00:11:18,680 this on his blog. Auto mode seems to be the safer 236 00:11:18,680 --> 00:11:21,800 alternative to using the dangerously skip permissions 237 00:11:21,800 --> 00:11:25,040 flag, which sounds terrifying just reading it out. 238 00:11:25,040 --> 00:11:27,560 Loud it does in auto mode. Claude makes permission 239 00:11:27,560 --> 00:11:30,440 decisions autonomously, like deciding whether it needs to run 240 00:11:30,440 --> 00:11:33,680 a bash script or install a package, but there are hidden 241 00:11:33,680 --> 00:11:35,400 safeguards monitoring his actions. 242 00:11:35,600 --> 00:11:37,560 Wilson cautions, though, that you need to read the 243 00:11:37,560 --> 00:11:41,040 documentation carefully before adopting this, especially if you 244 00:11:41,040 --> 00:11:43,640 are working on a team with access to production 245 00:11:43,640 --> 00:11:46,160 infrastructure. The risk profile of letting an 246 00:11:46,160 --> 00:11:50,240 agent run wild on a solo weekend project on your local machine is 247 00:11:50,240 --> 00:11:53,520 fundamentally different from letting it loose in a shared AWS 248 00:11:53,520 --> 00:11:55,800 environment. It's like handing a bowling ball 249 00:11:55,800 --> 00:11:58,520 to a hyperactive bodybuilder who has never played the game. 250 00:11:58,680 --> 00:12:00,760 They're going to throw it at 100 miles an hour, which is 251 00:12:00,760 --> 00:12:04,160 incredible power. But without Klow, you dot MD and 252 00:12:04,160 --> 00:12:08,480 explicit done states acting as the gutter bumpers, that ball is 253 00:12:08,480 --> 00:12:11,200 going to crash right through the wall of the alley into the 254 00:12:11,200 --> 00:12:13,720 parking lot and rack up a massive bill. 255 00:12:14,040 --> 00:12:16,200 That is exactly the dynamic we are managing. 256 00:12:16,640 --> 00:12:19,960 So we've explored the trust gap, we've unpacked the silent cost 257 00:12:19,960 --> 00:12:22,400 leaks, and we've established how to set up the bumpers. 258 00:12:22,920 --> 00:12:26,680 If you manage all of these risks perfectly, what is the actual 259 00:12:26,680 --> 00:12:28,680 reward? What kind of magic can you build 260 00:12:28,680 --> 00:12:30,520 right now? This is the fun part, because 261 00:12:30,520 --> 00:12:33,680 despite all the chaos and the bugs, the raw capability of 262 00:12:33,680 --> 00:12:36,400 these tools is just staggering. Simon Wilson has been writing 263 00:12:36,400 --> 00:12:38,680 heavily about Vibe Coding. Vibe coding. 264 00:12:39,280 --> 00:12:42,440 It describes this entirely new paradigm where you aren't 265 00:12:42,440 --> 00:12:44,560 writing every line of syntax yourself. 266 00:12:44,960 --> 00:12:47,680 Instead, you're directing the AI at a high level. 267 00:12:48,120 --> 00:12:50,000 You're feeling out the architecture and the flow, 268 00:12:50,000 --> 00:12:52,600 acting more like an orchestrator while the AI handles the 269 00:12:52,600 --> 00:12:55,520 implementation right. Willison recently demonstrated 270 00:12:55,520 --> 00:12:57,440 this by Vibe Coding with Swift UI. 271 00:12:57,680 --> 00:13:01,600 Yeah, he gets this new M5 MacBook Pro, which he notes is 272 00:13:01,600 --> 00:13:05,720 an absolute beast for running local LLMS because it has 128 273 00:13:05,720 --> 00:13:08,760 gigs of unified memory. But he gets frustrated with the 274 00:13:08,760 --> 00:13:11,480 built in Activity monitor on the Mac, and instead of just 275 00:13:11,480 --> 00:13:14,120 complaining about it, he uses Clawed code to Vibe Code, a 276 00:13:14,120 --> 00:13:16,200 custom performance monitoring tool from. 277 00:13:16,200 --> 00:13:18,840 Scratch The significance of this project is Willison's 278 00:13:18,840 --> 00:13:20,840 background. He comes from web development. 279 00:13:21,360 --> 00:13:23,480 He is deeply embedded in Python And Django. 280 00:13:24,000 --> 00:13:26,280 Swift UI is native Apple development. 281 00:13:26,560 --> 00:13:29,200 It's a completely different paradigm with its own complex 282 00:13:29,200 --> 00:13:30,680 state management and rendering. Rule. 283 00:13:30,680 --> 00:13:33,680 Yeah, it's not an easy jump. No, but Claude acts as a 284 00:13:33,680 --> 00:13:36,680 translation bridge. It maps Willison's known logic 285 00:13:36,680 --> 00:13:40,120 patterns in Python over to the unfamiliar syntax of Swift 286 00:13:40,200 --> 00:13:42,760 seamlessly. It fills in the framework 287 00:13:42,760 --> 00:13:46,240 specific knowledge gaps so rapidly that a developer can 288 00:13:46,240 --> 00:13:49,440 conceptually architect and deploy an app in a language they 289 00:13:49,440 --> 00:13:51,960 don't even fluently speak. That is incredible. 290 00:13:51,960 --> 00:13:54,360 And it's not just limited to user interfaces either. 291 00:13:54,480 --> 00:13:58,280 Willison also built a functional Python vulnerability lookup tool 292 00:13:58,280 --> 00:14:02,160 in just 40 minutes. He used the OSB dot dev open 293 00:14:02,160 --> 00:14:05,080 source vulnerability database, which apparently has an open 294 00:14:05,080 --> 00:14:08,560 cores Jason API. For my understanding, a course 295 00:14:08,560 --> 00:14:11,640 Jason API allows a web browser to talk directly to another 296 00:14:11,640 --> 00:14:14,120 server's database without needing a complex back end 297 00:14:14,120 --> 00:14:16,640 intermediary. Yeah, and that is exactly why he 298 00:14:16,640 --> 00:14:19,720 was able to build it so fast. Because of that API structure, 299 00:14:19,720 --> 00:14:22,360 he didn't need to spin up a heavy back end service or a 300 00:14:22,360 --> 00:14:24,840 database. He just fed the API 301 00:14:24,840 --> 00:14:27,920 documentation directly to Claude and 40 minutes later he has a 302 00:14:27,920 --> 00:14:30,840 lightweight front end tool where you can drop in a requirements 303 00:14:30,840 --> 00:14:34,720 about TXT file or a GitHub repo URL and it instantly scans for 304 00:14:34,720 --> 00:14:37,000 vulnerabilities. Building a functional security 305 00:14:37,000 --> 00:14:40,000 adjacent tool in 40 minutes on a Tuesday is incredible. 306 00:14:40,520 --> 00:14:43,320 But you know, the real test of that speed isn't building a 307 00:14:43,320 --> 00:14:46,520 hobby tool, it's when you are actively under attack and every 308 00:14:46,520 --> 00:14:49,440 single second counts. That brings us to Kellen 309 00:14:49,440 --> 00:14:53,480 McMahon's live malware incident. Wilson highlighted McMahon's 310 00:14:53,480 --> 00:14:56,960 story where he discovered a live malware attack happening on the 311 00:14:56,960 --> 00:15:00,600 Light LM Pi Pi package. And Π Pi is the central 312 00:15:00,600 --> 00:15:03,320 repository where all Python software is downloaded, right? 313 00:15:03,600 --> 00:15:07,000 So a compromise there effects thousands of dependent projects 314 00:15:07,000 --> 00:15:08,000 instantly. Instantly. 315 00:15:08,000 --> 00:15:11,880 Yeah, McMahon actually used clawed in real time during the 316 00:15:11,880 --> 00:15:14,880 incident response and he published the transcripts of the 317 00:15:14,880 --> 00:15:17,000 session. He was feeding Claude the 318 00:15:17,000 --> 00:15:19,480 heavily obfuscated malicious code to confirm the 319 00:15:19,480 --> 00:15:23,200 vulnerability on the fly. He was asking it who to contact 320 00:15:23,200 --> 00:15:25,320 and what immediate triage actions to take. 321 00:15:25,760 --> 00:15:28,440 Claude was the one that parsed the situation and suggested the 322 00:15:28,440 --> 00:15:31,760 specific Pi Pi emergency security contact address. 323 00:15:31,960 --> 00:15:35,120 Having an AI as a real time incident response partner 324 00:15:35,120 --> 00:15:37,520 fundamentally shifts how we handle security. 325 00:15:38,160 --> 00:15:41,120 When you are dealing with a live malware attack, the cognitive 326 00:15:41,120 --> 00:15:43,440 load on the engineer is just massive. 327 00:15:43,880 --> 00:15:46,680 Having an agent sitting next to you that can instantly D 328 00:15:46,680 --> 00:15:50,080 obfuscate code, parse server logs, and retrieve emergency 329 00:15:50,080 --> 00:15:52,360 protocols provides an immense advantage. 330 00:15:52,360 --> 00:15:54,680 It really does. You know, reading through all 331 00:15:54,680 --> 00:15:57,440 these sources for this deep dive actually inspired me to start 332 00:15:57,440 --> 00:16:00,120 building things this week. After reading about the Sentinel 333 00:16:00,120 --> 00:16:03,880 cash bugs and the invisible API bills combined with Willis and 334 00:16:03,880 --> 00:16:07,080 Swift UI post, I decided to try vibe coding myself. 335 00:16:07,240 --> 00:16:08,040 Oh, really? What do you? 336 00:16:08,760 --> 00:16:11,640 I'm currently using Clawed to build a little menu bar app in 337 00:16:11,640 --> 00:16:15,160 Swift UI that hooks into my Anthropic account and tracks my 338 00:16:15,160 --> 00:16:19,120 real time Clawed API spend. That way I have a visual monitor 339 00:16:19,120 --> 00:16:22,400 right on my desktop to make sure the infinite intern isn't 340 00:16:22,400 --> 00:16:24,760 bankrupting me. That is extremely practical. 341 00:16:24,760 --> 00:16:27,600 Yeah, I'm doing something very similar based on Willison's 342 00:16:27,600 --> 00:16:29,600 other post. Actually I'm building ACI 343 00:16:29,600 --> 00:16:33,640 integrated Python vulnerability checker using that OSV dot dev 344 00:16:33,640 --> 00:16:35,240 API he highlighted. Oh nice. 345 00:16:35,320 --> 00:16:37,720 Yeah, I wanted to run automatically as a lightweight 346 00:16:37,720 --> 00:16:41,440 security 30 gate before any code gets merged into my main branch. 347 00:16:41,560 --> 00:16:44,160 It is just so empowering to realize we can read an article 348 00:16:44,160 --> 00:16:47,560 about a new API on a Tuesday and have a working custom tool 349 00:16:47,560 --> 00:16:50,080 deployed by Thursday. Yeah, it's a great time to be 350 00:16:50,080 --> 00:16:52,320 building. OK, let's wrap this up with some 351 00:16:52,320 --> 00:16:55,120 immediate takeaways. Listeners, we want you to be 352 00:16:55,120 --> 00:16:57,800 able to protect your code and your wallets right now. 353 00:16:58,240 --> 00:17:00,680 Based on the sources we've covered, here are three action 354 00:17:00,680 --> 00:17:03,640 items you can do today. Number one, check your GitHub 355 00:17:03,640 --> 00:17:06,680 Copilot data settings. Remember, the deadline is April 356 00:17:06,680 --> 00:17:10,040 24th, 2026. It is opt out by default. 357 00:17:10,319 --> 00:17:13,520 Go into your settings and make sure your proprietary code isn't 358 00:17:13,520 --> 00:17:15,160 being scooped up for model training. 359 00:17:15,720 --> 00:17:19,040 Number 2GO read that Reddit post on the clawed cash books. 360 00:17:19,359 --> 00:17:22,200 Look at the workarounds they posted and seriously audit your 361 00:17:22,200 --> 00:17:26,000 recent clawed API bills. Make sure you aren't paying 10 362 00:17:26,000 --> 00:17:28,640 times the normal rate for an invisible caching error. 363 00:17:28,640 --> 00:17:32,960 Critical and #3 Sit down and write or heavily update your 364 00:17:32,960 --> 00:17:36,920 claw UEE dot MD file. Treat it like you are on 365 00:17:36,920 --> 00:17:39,880 boarding a brilliant but completely silent engineer. 366 00:17:40,040 --> 00:17:42,440 Put your bumpers up. I will leave you with one final 367 00:17:42,440 --> 00:17:45,560 thought to Mull over an implication that wasn't directly 368 00:17:45,560 --> 00:17:49,560 stated in any of our sources, but feels inevitable given the 369 00:17:49,560 --> 00:17:51,200 trajectory we're on. OK, let's hear it. 370 00:17:51,520 --> 00:17:55,720 If we are now writing our Cleelemd files specifically 371 00:17:55,720 --> 00:17:58,400 formatted for an AI's comprehension rather than the 372 00:17:58,400 --> 00:18:02,280 humans, and we are using AI to vibe code massive amounts of 373 00:18:02,280 --> 00:18:06,000 boilerplate at lightspeed, are we approaching A tipping point 374 00:18:06,000 --> 00:18:08,960 where our code bases are being optimized entirely for machine 375 00:18:08,960 --> 00:18:10,440 readability? Oh wow. 376 00:18:10,440 --> 00:18:12,760 And if that happens, what is going to happen when a human 377 00:18:12,760 --> 00:18:16,560 inevitably needs to step in under extreme pressure and fix a 378 00:18:16,560 --> 00:18:19,480 deeply flawed, sprawling system that was never actually meant 379 00:18:19,480 --> 00:18:21,880 for human eyes? That is a terrifying thought. 380 00:18:22,120 --> 00:18:25,320 From finding an advertisement hallucinated into a pull request 381 00:18:25,480 --> 00:18:27,920 to realizing you might not even be able to read your own code 382 00:18:27,920 --> 00:18:31,600 base in a few years, the Ferrari is definitely moving fast. 383 00:18:31,680 --> 00:18:34,160 Just make sure you keep your hands on the wheel. 384 00:18:34,320 --> 00:18:36,240 Thank you so much for joining us on this deep dive. 385 00:18:36,240 --> 00:18:39,040 We love exploring these massive shifts with you, figuring out 386 00:18:39,040 --> 00:18:41,960 the hidden traps and finding the incredible tools along the way. 387 00:18:42,280 --> 00:18:46,160 Until next time, keep building, keep learning and please keep 388 00:18:46,160 --> 00:18:47,880 checking those API bills.