<h2>Must know</h2>
<ul>
<li><strong>AI agent security is a mess</strong>: AI coding agents are prioritizing speed over security, creating a ‘security debt crisis’ with issues like hardcoded API keys and public access policies. Stripe’s ‘Minions’ autonomously generate over 1,000 pull requests weekly, highlighting the scale of potential vulnerabilities. Researchers are already demonstrating ChatGPT’s free model recommending malicious sites, leading to ClickFix-style attacks, as reported by InfoSec Write-ups. Mitigations include spec-driven prompting with OWASP Top 10 and thorough code diff reviews. <a href="https://app.daily.dev/feed-by-ids?id=DD6LZnw0Q&amp;id=Et2d8uHu3&amp;id=LUO8dPKde&amp;id=RH1TYGIET&amp;id=UGo4Ea1t8&amp;id=bDJrJKMJX&amp;id=em7afQ5sm&amp;id=l0KLAjYGc&amp;id=ohhVPexbM&amp;id=vXBWwcwBk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google’s Gemini 3.1 pro is a benchmark queen, but a usability nightmare</strong>: Despite scoring high on benchmarks like ARC AGI 2 and custom spatial reasoning tests, Gemini 3.1 Pro consistently underperformed Claude Opus 4.6 in real-world coding and UI generation tasks. Reviewers noted tool-calling failures, incomplete features, and poor environment detection, making it practically unusable for complex agentic workflows. This suggests Google might be ‘benchmaxing’ at the expense of actual utility, according to articles from multiple sources. <a href="https://app.daily.dev/feed-by-ids?id=bIAFUawfa&amp;id=mGa3eARS3" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Anthropic and Figma team up for code-to-design workflow</strong>: Anthropic and Figma have collaborated to enable Claude Code to convert production code into editable Figma designs. This new workflow allows developers to send a live web page to a Figma file with a simple prompt, facilitating design collaboration and enabling updated designs to be round-tripped back to code. This integration streamlines the design-to-code and code-to-design process, as detailed in the announcement. <a href="https://app.daily.dev/posts/aCaE5xJ9z" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>OpenClaw use cases for developers</strong>: OpenClaw, an autonomous AI agent tool, can handle tasks like automated dependency maintenance, daily tech research briefings, cloud cost monitoring, and end-to-end app building from a PRD using Claude Code and Gemini. <a href="https://app.daily.dev/posts/WCj2dFu7Q" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>WebMCP enables browser-native AI agent tools</strong>: Google’s WebMCP is a browser-native API allowing websites to expose structured JavaScript tools for AI agents to invoke directly within the browser runtime, improving determinism and reducing token overhead. <a href="https://app.daily.dev/posts/61GmU0Tcy" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI agent memory systems are evolving</strong>: LangSmith Agent Builder uses a filesystem-based memory system, storing procedural and semantic knowledge as files in Postgres, exposed as a virtual filesystem to agents, with human-in-the-loop approval for updates. <a href="https://app.daily.dev/posts/9xLrRFK2b" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>NTransformer runs Llama 3.1 70B on a single RTX 3090</strong>: NTransformer, an open-source C++/CUDA LLM inference engine, enables running Llama 3.1 70B on a single RTX 3090 (24GB VRAM) using a 3-tier adaptive caching system and layer streaming. <a href="https://app.daily.dev/feed-by-ids?id=Ahx4zgQks&amp;id=WoJMuyqAQ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Elixir language server reaches release candidate</strong>: Expert, the new official Elixir language server merging Lexical and Next LS, has released its first release candidate (v0.1.0-rc.1), focusing on stability, compiler diagnostics, and monorepo support. <a href="https://app.daily.dev/posts/ItEtgwo7d" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Git’s magic files for repository control</strong>: A comprehensive reference covers Git’s special committed files like .gitignore, .gitattributes, and .gitmodules, explaining their purpose, syntax, and platform support for controlling repository behavior. <a href="https://app.daily.dev/posts/NIh4SPpHk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>KittenTTS offers nano-sized text-to-speech models</strong>: KittenTTS by Kitten ML provides ultra-compact text-to-speech models (down to 15M parameters) optimized for CPU, ONNX format, and edge/browser deployment, with an 8-bit quantized variant under 25MB. <a href="https://app.daily.dev/posts/aXA1rlMhE" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Meta patents AI to post after you’re dead</strong>: Meta has patented an AI system that can simulate a deceased user’s social media activity, including posting and chatting, using an LLM trained on their past data. Because what we all really need is our digital ghost haunting our feeds, ensuring our online presence is eternal, even if our actual presence isn’t. Ethical concerns? Nah, just keep scrolling. <a href="https://app.daily.dev/posts/AeW0pHCcd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Android malware makes itself unkillable and un-uninstallable</strong>: A technical deep-dive into Android malware reveals sophisticated persistence mechanisms, including boot persistence, task-kill recovery, remote resurrection via FCM, and Device Administrator privileges to block uninstallation. Apparently, some malware developers are putting more effort into their ‘products’ than some legitimate app developers. Who needs user control when you can have an unkillable app? <a href="https://app.daily.dev/posts/VKUMk8xIJ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong><a href="http://Lobste.rs" target="_blank" rel="noopener nofollow">Lobste.rs</a> tries to migrate to SQLite, fails spectacularly</strong>: <a href="http://Lobste.rs" target="_blank" rel="noopener nofollow">Lobste.rs</a> attempted a live migration from MariaDB to SQLite, only to revert it quickly due to severe performance degradation. It seems the allure of a simpler database setup sometimes clashes with the harsh realities of production traffic. Who knew that swapping out a robust database for a file-based one might have ‘performance issues’? <a href="https://app.daily.dev/posts/RLQeRSeS0" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
