<h2>Must know</h2>
<ul>
<li>AI agent security is a mess: AI coding agents, while boosting productivity (Stripe’s “Minions” generate 1,000+ PRs weekly), are creating a “security debt crisis” by prioritizing speed over secure practices. Research from Columbia University indicates these agents often introduce vulnerabilities like hardcoded API keys. A security researcher even demonstrated ChatGPT recommending a malicious site for Tesseract OCR, leading to a reverse C2 shell installation, highlighting the risks of LLMs trusting self-declared legitimacy. Mitigations include spec-driven prompting with OWASP Top 10 and thorough code reviews. <a href="https://app.daily.dev/feed-by-ids?id=DD6LZnw0Q&amp;id=Et2d8uHu3&amp;id=LUO8dPKde&amp;id=RH1TYGIET&amp;id=UGo4Ea1t8&amp;id=bDJrJKMJX&amp;id=em7afQ5sm&amp;id=l0KLAjYGc&amp;id=ohhVPexbM&amp;id=vXBWwcwBk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li>Google’s Gemini 3.1 pro is a benchmark queen, not a coding king: Despite Google’s Gemini 3.1 Pro achieving top benchmark scores, including 78% on ARC AGI 2, it consistently underperformed Claude Opus 4.6 in real-world coding and UI generation tasks. Reviewers noted issues like tool-calling failures, incomplete features, and poor environment detection, leading to significant practical usability problems. This suggests Google might be “benchmaxing” at the expense of actual developer utility, as highlighted by multiple reports. <a href="https://app.daily.dev/feed-by-ids?id=bIAFUawfa&amp;id=mGa3eARS3" target="_blank" rel="noopener nofollow">Read more</a></li>
<li>Anthropic and Figma team up for code-to-design workflow: Anthropic and Figma have collaborated to enable Claude Code to convert production code into editable Figma designs. This workflow allows developers to send a live web page to a Figma file with a simple prompt, facilitating design collaboration. Updated designs can then be round-tripped back to code, streamlining the iteration process between design and development. <a href="https://app.daily.dev/posts/aCaE5xJ9z" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li>Go’s FFI now faster than GDScript and Rust: Go bindings for Godot, <a href="http://graphics.gd" target="_blank" rel="noopener nofollow">graphics.gd</a>, now surpass GDScript and ‘safe’ Rust in FFI performance due to call batching and Go 1.26’s cgo overhead reduction. <a href="https://app.daily.dev/posts/j8AoMYJTv" target="_blank" rel="noopener nofollow">Read more</a></li>
<li>WebMCP enables browser-native AI agent tools: Google’s WebMCP is a new browser-native API allowing websites to expose structured JavaScript tools for AI agents to invoke directly, improving determinism and reducing token overhead. <a href="https://app.daily.dev/posts/61GmU0Tcy" target="_blank" rel="noopener nofollow">Read more</a></li>
<li>AI agent memory system uses virtual filesystem: LangSmith Agent Builder uses a filesystem-based memory system, storing knowledge as files in Postgres but exposing it as a virtual filesystem to agents for persistent, evolving knowledge across sessions. <a href="https://app.daily.dev/posts/9xLrRFK2b" target="_blank" rel="noopener nofollow">Read more</a></li>
<li>NTransformer runs Llama 3.1 70B on a single RTX 3090: NTransformer, an open-source C++/CUDA LLM inference engine, can run Llama 3.1 70B on a single RTX 3090 using adaptive caching and layer streaming, claiming an 83x speedup over mmap baseline. <a href="https://app.daily.dev/feed-by-ids?id=Ahx4zgQks&amp;id=WoJMuyqAQ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li>KittenTTS offers ultra-compact text-to-speech models: KittenTTS by Kitten ML provides ultra-compact text-to-speech models (down to 15M parameters) optimized for edge and browser deployment, making client-side TTS feasible. <a href="https://app.daily.dev/posts/aXA1rlMhE" target="_blank" rel="noopener nofollow">Read more</a></li>
<li>Expert Elixir language server reaches release candidate: Expert, the new official Elixir language server merging Lexical and Next LS, has released its first release candidate, focusing on stability and core features like compiler diagnostics and refactoring. <a href="https://app.daily.dev/posts/ItEtgwo7d" target="_blank" rel="noopener nofollow">Read more</a></li>
<li>React confirm manager for async dialogs: React Confirm Manager is a promise-based library for async, customizable confirmation dialogs in React, allowing imperative triggering without JSX at call sites. <a href="https://app.daily.dev/posts/VascGpijE" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li>AI agent orchestration dashboard is here to save us: Mission Control, an open-source AI agent orchestration dashboard, promises to manage tasks and coordinate multi-agent collaboration. Because what we really need is another dashboard to tell us what our AI agents are supposed to be doing, especially when they’re busy creating security vulnerabilities and hallucinating packages. It’s built with Next.js 14 and TypeScript, so at least it’ll look pretty while it’s not quite working. <a href="https://app.daily.dev/feed-by-ids?id=LY7p8IODB&amp;id=ZmcjIu8ai&amp;id=frjHTf2Ap&amp;id=xhDI1zj4i" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><a href="http://Lobste.rs" target="_blank" rel="noopener nofollow">Lobste.rs</a> tries to migrate to SQLite, fails spectacularly: <a href="http://Lobste.rs" target="_blank" rel="noopener nofollow">Lobste.rs</a> attempted a live migration from MariaDB to SQLite, briefly going read-only, only to suffer severe performance degradation and roll back. Apparently, the allure of SQLite’s simplicity was too strong to resist, even if it meant ignoring the consequences of scaling a production database. They’re calling it temporary, but I’m sure the next attempt will be totally different. <a href="https://app.daily.dev/posts/RLQeRSeS0" target="_blank" rel="noopener nofollow">Read more</a></li>
<li>The magic of Git’s dotfiles, explained again: A comprehensive reference covering Git’s special committed files like .gitignore, .gitattributes, and .lfsconfig. Because apparently, after all these years, we still need a detailed explanation of how these ‘magic’ files work. It’s almost as if developers keep forgetting the basics while chasing the next shiny framework. Good thing someone’s still documenting the obvious. <a href="https://app.daily.dev/posts/NIh4SPpHk" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>