Idea log

Google's new model (Gemini Decision 1) doesn't write text; it gives probabilities for predefined questions: yes/no, multiple choice (2–255 options) or rubric scoring. In one request it evaluates up to 1,000 questions on the same multimodal input (text, image, PDF, audio, video), in 150–250 ms. Every answer comes with a confidence score, so uncertain cases can be passed to a stronger model. ❓ The sources conflict on price: Google's blog says $0.10 per 1M input tokens, while TLDR wrote "$0.10 per 2M tokens". Output is free. The page says nothing about EU availability.

OpenRouter measured that the same GitHub task on Sonnet 5.5 cost 1,421 tokens with the gh command-line tool (CLI), 3,315 with a skill, and 59,417 with the GitHub MCP server's 46 default tools. The reason: every tool's description is sent to the model again with every request. Tool Search (deferred loading of tools) roughly halved the cost on Claude, with mixed results on other models. Their recommendation: use a CLI where one exists; with MCP, load only the tools you need, and trim large tool responses (requesting only the needed fields).

AI often answers a slightly different question than the one asked: it calculates net instead of gross, or counts only active employees instead of all of them. The Neuron's method: (1) have the AI list every definition and assumption it used; (2) compare that with the wording of the request; (3) in a new chat, give only the request and this list, with this prompt: "Below are my original request and the definitions and assumptions an assistant used. List where a definition is narrower, broader or different from my wording, and for each, describe how the result would change with my original wording."

A list of typical LLM phrasings is going around. Examples: openings of the "not X, but Y" kind, announcing "this is crucial" instead of showing what the thing does, punchy closing lines, lists of three out of habit, and "happy to elaborate" at the end. The list comes from the "declauding" skill in oaustegard/claude-skills: the skill rewrites the draft, and in a separate mode marks in HTML what it changed and why. In Claude.ai it can be uploaded as a ZIP under Settings / Skills.

Scammers use social media posts to write personalized phishing emails (spear phishing). In one case, a deepfake "CEO" and "lawyer" were used to extract $129M. Even small organizations should give staff a short warning: always verify urgent payment requests through a second, known channel. (Superhuman)

A free, open-source (Apache 2.0) research preview for Mac, Windows and servers. It tracks invoices, drafts replies, watches pages, and asks for approval before sending. It also works with local models (Ollama), but those need tool calling and a 64K context. The question: how far can you trust an experimental tool with access to your email and calendar? It could run on an always-on home machine. (Superhuman, The Neuron · nod.n8n.io/)

Intruders at the Railway cloud host stole environment variables, mainly AI provider keys, and used them to run up charges. Grok Build's 35,000 public apps also exposed confidential data. Lesson: put a monthly spending cap on AI provider keys, and keep them out of public repositories and code. (TLDR InfoSec)

Microsoft researchers showed that by rewriting a few rarely used neurons in an open-weight model, a hidden command can be planted that activates on a trigger phrase. When running a model locally, download it only from official sources. (TLDR InfoSec, TLDR IT)

In an internal ticketing system, Amazon replaced Claude Sonnet 4.6 with its own Strands Decider model, which doesn't generate text but gives probabilities for predefined labels. Accuracy stayed the same, while cost per ticket dropped from $0.022 to $0.0005 and response time from 4.2 s to 0.9 s. The lessons: write each label as a 1–2 sentence criterion, include a "none of these" option, and run the old and new solutions in parallel for a while. The model has a small context (4,096 tokens), gives no explanatory text, and must run on your own server (GPU).

The open-source STE80 Humanizer skill fixes AI-sounding text in two passes. First it removes 26 typical AI phrasings, then it rewrites sentences into short, active constructions, one idea per sentence. You can try it without installing anything with this prompt (it works in other languages too): "Rewrite this draft in plain language. Keep every fact, number, name and source claim. Use the active voice where it's accurate; keep one main idea per sentence; replace abstract phrases with concrete actors and actions; delete repeated conclusions and filler transitions. Don't add new facts, jokes or confidence. At the end, list the three sentences that still carry too many ideas." Then read it aloud and restore the style where it became too sterile. For fiction and ad copy, only the first pass is recommended.

An open-source MCP server through which Claude can create and fix automations, scripts and dashboards in Home Assistant, and also analyze logs. It provides about 87 tools; unlike the built-in HA MCP server, it can access everything, not just the tools exposed to Assist. Install from HACS or the Marketplace (Home Assistant 2026.8+). For Claude Code there is an install script with a --claude-code flag. Security: create a separate admin account for it that is reachable only from the local network. Adding /readonly to the end of the URL makes it read-only, and approval can be required for write operations.

Because bugs made usage limits drain faster than they should, every paid (Pro, Max, Ultra, Team) user gets one free, full limit reset for all models. It can be redeemed until 2:00 PM PT on Dec 10 (11:00 PM Central European Time); the interface also shows the exact expiry time.

installctl runs "copy and run" install scripts in an isolated layer, then lists which files they created, modified or deleted, and you decide what to apply. It stops and asks when a script installs packages, creates a new user, or changes systemctl or crontab, and at the end it writes an uninstall script. Note: it uses Linux namespaces and FUSE, so it is for Linux and doesn't run on a Mac.

Besides Railway, about a dozen AI developer platforms were breached in a month, mainly for customers' API keys. In the Railway case, the WSJ reports at least $750,000 and The Code about $740,000 in unauthorized AI charges. By combing through leaked source code with AI agents, the attacker found a second way in within hours. Lesson: put a monthly spending cap on AI provider keys and give them only the permissions they need. (WSJ Pro Cybersecurity, The Code Cybersecurity)

Flaws in the Barracuda email gateway and N-able N-central (33 zero-days in the latter) can be exploited because the admin console is reachable from the internet. The question for any smaller setup: are your router's management interface, WordPress /wp-admin and your servers' admin panels reachable only via VPN? (TLDR InfoSec)

In Google Workspace, thread summaries and "Help me write" are switched on by default for every user aged 18+, with the rollout running for 15 days from Nov 10. Organizations handling health or other sensitive data should decide whether they want it on for such emails, since admins can turn it off. (TLDR IT)

Apple's subsidiary Claris is testing an app that turns Apple Silicon Macs into a local AI server, even pooling the memory of several Macs over Thunderbolt 5. It is in early access for now, with no announced price. Worth keeping in mind when replacing a small office server. (TLDR)

An October study (Xu and Wu, arXiv) looked at 40 Python projects where the instruction file and the code contradicted each other. Claude Code and Codex followed the outdated instruction file in about 90% of cases. A single sentence that gives the existing code priority raised the share of code-following decisions from 4.2% to 91.4%: "When an instruction file and the existing code disagree, follow the conventions in the code, and point out each mismatch in your final reply."

The recommendation: start with Opus 5.5 at medium effort. Sonnet 5.5 suits narrowly scoped work, Haiku 5.5 simple high-volume tasks (classification, labeling, data extraction), and Fable 5.2 the hardest, long, unattended work. Before switching models, try raising the effort first. A cheap model is enough for a subagent: set it with the model: haiku line in its definition, or globally with the CLAUDE_CODE_SUBAGENT_MODEL environment variable. API list prices per 1M tokens (input / output): Haiku $0.10 / $0.50, Sonnet $2 / $10, Opus $4 / $20, Fable $8 / $40.

Warp's method is to check every PR from five angles before even opening the changes: (1) proof: the agent attaches before-and-after screenshots; (2) match: did it build what was asked, without unrequested "extras"; (3) impact: what is the worst that could break (login, permissions, payments); (4) rollback: can it be undone easily; (5) detection: would we notice if it broke. Warp packaged this into the open-source /merge-risk skill, which gives a low/medium/high risk rating.

According to Superhuman's video guide, you can build a filterable dashboard with interactive charts without SQL, Python or Tableau: attach the spreadsheet (or Google Drive), give a four-part prompt (data, goal, charts, filters), then ask for live filters and tooltips. The finished page can be shared or exported.

Instead of giving ready answers, the skill teaches through questions in five steps: (1) it assesses what the learner already knows; (2) builds a skill map with levels 0–5; (3) asks one question at a time; (4) brings back earlier material periodically (spaced repetition); (5) tests at the end. For an agent, copy it into the skills folder and start with "teach me …"; in a plain chat, paste the contents of SKILL.md.

According to user reports, a background process of AMD's graphics software (atieclxx.exe) keeps writing to the SSD even when idle, at up to 5 MB/s. That can add up to hundreds of GB a day, quickly eating into the SSD's lifespan (TBW). AMD has acknowledged the bug and a fix is in testing. On Windows PCs with an AMD graphics card, check the Disk tab in Task Manager / Resource Monitor to see whether this process writes continuously. (The Code)

Several leaders (Notion, a former Amazon engineer) warn that a codebase can become opaque within a week if everyone works with agents. Anthropic recommends keeping learning and review in the workflow. The question: will agent-written projects still be explainable by their authors a year from now? (Superhuman)

Meta's smallest model runs at $0.10 / $0.50 per 1M tokens, aimed at high-volume agent tasks (tool calls, routing, data extraction), putting it on par with Haiku 5.5. The question: is it worth bringing in a second provider for a small project, or better to stay with a single API? Answer it with the K2 guide's method, measured on your own tasks. (The Code, TestingCatalog)

The project (1.2k ⭐) is built for code review, vulnerability scanning and pentesting, with a web UI, a CLI and MCP. The question: how useful is it for checking WordPress sites? Use it only on your own systems, and try it on a test copy first. (The Code · github.com/0sec-labs/0)