<h2>Must know</h2>
<ul>
<li><strong>AI coding tools are changing developer roles, but quality is a concern</strong>: The rise of AI coding assistants like Cursor and GPT 5.2 Codex is fundamentally shifting software development. Salesforce, for instance, saw 90% adoption of Cursor among its 20,000 engineers, reporting double-digit gains in cycle time and code quality. However, a Carnegie Mellon University study of 807 GitHub repositories found that while initial productivity increased, static analysis warnings rose by 30% and code complexity by over 40%, persisting long after initial gains. This suggests that while AI can accelerate coding, human oversight and a ‘VC mindset’ for managing AI agents are crucial to maintain quality, as highlighted by a developer who ported JustHTML from Python to PHP using GPT 5.2 Codex. <a href="https://app.daily.dev/feed-by-ids?id=7KqSlBkW9&amp;id=EZUXhYwRZ&amp;id=HWjGJHh6I&amp;id=BJsnyHclD" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>New security vulnerabilities target AI frameworks and developer tools</strong>: Critical vulnerabilities were discovered in Chainlit, a popular Python-based AI chatbot development framework with millions of downloads, allowing unauthenticated attackers to read any file on the server and perform CSRF/SSRF attacks. This could lead to the exfiltration of API keys and sensitive credentials. Separately, a ‘Contagious Interview’ campaign is exploiting VS Code by embedding malicious code in <code>tasks.json</code> files within seemingly legitimate Git repositories, creating persistent backdoors on developers’ machines when they trust the repository. These incidents underscore the growing attack surface introduced by AI tools and developer environments. <a href="https://app.daily.dev/feed-by-ids?id=I9vckVFsM&amp;id=PT6kAI0i3" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Open source projects push back against AI-generated spam</strong>: The cURL project has ended its bug bounty program due to an overwhelming influx of low-quality, AI-generated bug reports, which maintainer Daniel Stenberg called ‘AI slop.’ Similarly, the LLVM compiler project has instituted a ‘human in the loop’ policy, banning AI-generated code contributions without thorough human review, citing a surge in low-quality submissions. These moves highlight a growing concern within the open-source community about maintaining code quality and project integrity in the face of unchecked AI assistance. <a href="https://app.daily.dev/feed-by-ids?id=zNsgAYHqy&amp;id=DXhDzQ15v&amp;id=ssDvZHbZq" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Amazon launches Bedrock AgentCore for AI agent deployment</strong>: Amazon introduced Bedrock AgentCore, a platform for deploying and operating AI agents with zero infrastructure management, offering modular services like Runtime, Memory, Gateway, and a CLI toolkit for rapid creation and integration with frameworks like LangGraph and CrewAI. <a href="https://app.daily.dev/posts/PbCI8QH1q" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>New AI reasoning model for on-device use</strong>: Liquid AI released LFM2.5-1.2B-Thinking, a 1.2 billion parameter AI reasoning model designed to run fully on-device with less than 1GB of memory, featuring explicit ‘thinking traces’ and a 32,768 token context window. <a href="https://app.daily.dev/posts/vKfW5OdcJ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Meta expands Threads ads globally</strong>: Meta is rolling out ads globally on Threads, its platform with over 400 million monthly active users, allowing advertisers to manage campaigns alongside Facebook, Instagram, and WhatsApp. <a href="https://app.daily.dev/posts/OBgOopij2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>jQuery 4.0 drops legacy browser support, adds security features</strong>: jQuery 4.0, released after nearly a decade, removes support for Internet Explorer 10 and Edge Legacy, integrates Trusted Types and Content Security Policy, and migrates to ES modules. <a href="https://app.daily.dev/posts/uMYmsakGM" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>New Ruby framework for business logic</strong>: CMDx is a new Ruby framework that organizes business logic using composable command objects, implementing the CERO (Compose, Execute, React, Observe) pattern with typed attributes, built-in validation, and structured logging. <a href="https://app.daily.dev/posts/LmcMOfqU8" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cloudflare fixes WAF bypass vulnerability</strong>: Cloudflare patched a vulnerability in its Web Application Firewall (WAF) ACME validation logic that allowed attackers to bypass security rules and access origin servers directly. <a href="https://app.daily.dev/posts/PoZiSIcPJ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>New toolkit for AI security testing</strong>: BlackIce is an open-source toolkit bundling 14 AI security testing tools into a single Docker image, simplifying deployment for prompt injection, jailbreak detection, data leakage, and adversarial example creation, mapped to MITRE ATLAS and DASF frameworks. <a href="https://app.daily.dev/posts/PSfiaCphA" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Palantir CEO says AI will fix immigration, industry says AI still sucks</strong>: Alex Karp, Palantir’s CEO, boldly declared at the World Economic Forum that AI will eliminate the need for large-scale immigration in Western economies, except for ‘specialized skills.’ This is, of course, while Gartner reports enterprise AI adoption is in the ‘trough of disillusionment’ and PwC found most CEOs see zero payoff from their AI investments. So, while Karp is busy solving global labor markets with unverified AI magic, the rest of us are still waiting for AI to deliver on its basic promises. <a href="https://app.daily.dev/posts/3s1vrBGbY" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Netflix’s ‘strong uptake’ in casual gaming is 10% of eligible members</strong>: Netflix co-CEO Greg Peters is touting ‘strong uptake’ and ‘strong engagement’ for their cloud-based party games like Boggle and Pictionary, which have reached a whopping 10% of eligible members. Meanwhile, they’re reportedly trying to acquire Warner Bros. Discovery’s games division for $82.7 billion. It seems ‘strong uptake’ for casual games isn’t quite enough to justify their gaming ambitions, so they’re just going to buy a bigger piece of the pie. <a href="https://app.daily.dev/posts/SBSWaa9fL" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI-powered UI builder promises ‘production-ready’ components, because manual coding is for suckers</strong>: Shadcn Studio MCP, an AI-powered tool, claims to generate ‘production-ready’ UI components, blocks, and pages for React, Next.js, and Laravel, promising to integrate directly into your IDE. Because who needs to understand design systems, accessibility, or actual code when an AI can just spit out ‘production-ready’ artifacts? It’s almost like they’re trying to make frontend development even more abstract than it already is. <a href="https://app.daily.dev/feed-by-ids?id=84wxnOe0I&amp;id=ncQILOQ9m" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
