Leaked keys in Claude Code's permission file

In an internal ticketing system, Amazon replaced Claude Sonnet 4.6 with its own Strands Decider model, which doesn't generate text but gives probabilities for predefined labels. Accuracy stayed the same, while cost per ticket dropped from $0.022 to $0.0005 and response time from 4.2 s to 0.9 s. The lessons: write each label as a 1–2 sentence criterion, include a "none of these" option, and run the old and new solutions in parallel for a while. The model has a small context (4,096 tokens), gives no explanatory text, and must run on your own server (GPU).

The open-source STE80 Humanizer skill fixes AI-sounding text in two passes. First it removes 26 typical AI phrasings, then it rewrites sentences into short, active constructions, one idea per sentence. You can try it without installing anything with this prompt (it works in other languages too): "Rewrite this draft in plain language. Keep every fact, number, name and source claim. Use the active voice where it's accurate; keep one main idea per sentence; replace abstract phrases with concrete actors and actions; delete repeated conclusions and filler transitions. Don't add new facts, jokes or confidence. At the end, list the three sentences that still carry too many ideas." Then read it aloud and restore the style where it became too sterile. For fiction and ad copy, only the first pass is recommended.

An open-source MCP server through which Claude can create and fix automations, scripts and dashboards in Home Assistant, and also analyze logs. It provides about 87 tools; unlike the built-in HA MCP server, it can access everything, not just the tools exposed to Assist. Install from HACS or the Marketplace (Home Assistant 2026.8+). For Claude Code there is an install script with a --claude-code flag. Security: create a separate admin account for it that is reachable only from the local network. Adding /readonly to the end of the URL makes it read-only, and approval can be required for write operations.

Because bugs made usage limits drain faster than they should, every paid (Pro, Max, Ultra, Team) user gets one free, full limit reset for all models. It can be redeemed until 2:00 PM PT on Dec 10 (11:00 PM Central European Time); the interface also shows the exact expiry time.

installctl runs "copy and run" install scripts in an isolated layer, then lists which files they created, modified or deleted, and you decide what to apply. It stops and asks when a script installs packages, creates a new user, or changes systemctl or crontab, and at the end it writes an uninstall script. Note: it uses Linux namespaces and FUSE, so it is for Linux and doesn't run on a Mac.

Besides Railway, about a dozen AI developer platforms were breached in a month, mainly for customers' API keys. In the Railway case, the WSJ reports at least $750,000 and The Code about $740,000 in unauthorized AI charges. By combing through leaked source code with AI agents, the attacker found a second way in within hours. Lesson: put a monthly spending cap on AI provider keys and give them only the permissions they need. (WSJ Pro Cybersecurity, The Code Cybersecurity)

Flaws in the Barracuda email gateway and N-able N-central (33 zero-days in the latter) can be exploited because the admin console is reachable from the internet. The question for any smaller setup: are your router's management interface, WordPress /wp-admin and your servers' admin panels reachable only via VPN? (TLDR InfoSec)

In Google Workspace, thread summaries and "Help me write" are switched on by default for every user aged 18+, with the rollout running for 15 days from Nov 10. Organizations handling health or other sensitive data should decide whether they want it on for such emails, since admins can turn it off. (TLDR IT)

Apple's subsidiary Claris is testing an app that turns Apple Silicon Macs into a local AI server, even pooling the memory of several Macs over Thunderbolt 5. It is in early access for now, with no announced price. Worth keeping in mind when replacing a small office server. (TLDR)