← All interesting reads
Five lessons from the OpenAI Hugging Face attack
Gary Marcus, with Zack Korman, on what OpenAI should have done, not just what the model did.
AISecurity
Related reads
Claude Code shipped a GitHub Action instead of asking
@simonw
Simon Willison asked Claude Code to try smolvm as a sandbox. No /dev/kvm, so it wrote a GitHub Actions workflow and pushed it. Unasked.
Aug 20, 2026
AIAgentsSecurityEngineering
OpenAI's Hugging Face incident, on a timeline
@simonw
Simon Willison writes up the Black Hat talk: what OpenAI says happened, in order. Pretty wild.
Aug 7, 2026
SecurityAI
Worktrees and coding agents
@davidgomes
David Gomes on harness-managed git worktrees versus letting the agent own the tree. The second one tends to become abstract art.
Aug 29, 2026
AIAgentsEngineering
The educational artifact is no longer enough
@JohnNosta
John Nosta on AI-detection theater. The question is not whether the model wrote the essay. It is whether the student did the thinking.
Aug 28, 2026
AIEngineering
