<h2>Must know</h2>
<ul>
<li><strong>AI agents are breaking things in production</strong>: Recent post-mortems from daily.dev and independent developers reveal that AI coding agents are causing critical failures, including the corruption of 56 .NET project files and the leaking of GitHub tokens between user sessions. These incidents highlight a shift from simple prompting to the necessity of project-level guardrails, such as ‘Rules of Engagement’ files that mandate dry-runs for destructive operations. Security remains a major hurdle, with agents requiring constant command sanitization to prevent credential leaks in shared runtimes. <a href="https://app.daily.dev/feed-by-ids?id=9HucugjHw&amp;id=tdNgi1Q4D" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Critical RCE vulnerability in Langflow</strong>: CISA has issued a warning for CVE-2026-33017, a critical remote code execution flaw in the Langflow AI framework with a CVSS score of 9.3. The vulnerability allows attackers to pass data directly to Python’s exec() function via a single unauthenticated HTTP request, potentially exposing cloud API keys and code repositories. Users are urged to upgrade to version 1.9.0 immediately to prevent supply chain attacks or lateral movement within their infrastructure, as reported by AI Cyber Insights. <a href="https://app.daily.dev/posts/vNn8UUgk6" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The White House app is a privacy nightmare</strong>: A technical teardown of the official White House Android app by a developer on Hacker News has uncovered aggressive tracking and security risks, including a GPS pipeline that polls location every few minutes. The app reportedly injects JavaScript into third-party sites to strip GDPR banners and relies on a personal GitHub Pages account for YouTube embeds, creating a massive supply chain risk. It also ships with development artifacts in production and lacks basic certificate pinning, exposing users to extensive cross-device profiling. <a href="https://app.daily.dev/posts/luKGADzaQ" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>DeepSeek R2 challenges GPT 4o on cost</strong>: New projections suggest DeepSeek R2 offers 4.5x lower token costs than GPT-4o, making it a strong candidate for batch architectural tasks despite GPT-4o’s lead in latency. <a href="https://app.daily.dev/posts/FiMuYZXRT" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Rust rewrite of vLLM slashes startup time</strong>: The rvLLM project achieves 3,467 tokens per second and starts in just 6 seconds, compared to the 120 seconds required by the original Python-based vLLM. <a href="https://app.daily.dev/posts/u7fISleFK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>DOOM rendered entirely in CSS</strong>: A developer built a playable DOOM engine where every wall and enemy is a div positioned using 3D transforms and trigonometric functions, using JS only for the game loop. <a href="https://app.daily.dev/posts/1KfzJqNuq" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Universal LLM client supports 142 providers</strong>: Liter-llm is a new Rust-based API client with 11 native language bindings that eliminates Python runtime dependencies for safer supply chain management. <a href="https://app.daily.dev/posts/2yHoir3TW" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Miasma traps AI scrapers in poison pits</strong>: This Rust tool lures AI web scrapers into endless loops of garbage training data to protect site content from being harvested by LLMs. <a href="https://app.daily.dev/posts/QZnDQHaJE" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Pretext brings DOM free text layout</strong>: A new library allows for multiline text measurement and layout using Canvas, avoiding expensive DOM reflows for virtualization and masonry layouts. <a href="https://app.daily.dev/posts/HTzI8mpcv" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>SwiftUI AnyView is still a trap</strong>: Developers are documenting how AnyView consistently breaks layout stability, animations, and gesture priority in complex SwiftUI applications. <a href="https://app.daily.dev/feed-by-ids?id=5FnWy4HPH&amp;id=U7PCRsddG" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The agentic passive voice</strong>: Engineers are now using ‘the AI did it’ as a get-out-of-jail-free card for shipping broken code, a trend satirized as the ‘agentic passive voice.’ If you didn’t review the PR, you’re still the one who broke production, regardless of whether Claude or ChatGPT wrote the bug. Own your outcomes or prepare to be replaced by the very scripts you’re blaming. <a href="https://app.daily.dev/posts/a4WjYQvt2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI slop is killing open source</strong>: Maintainers are being buried under a mountain of ‘AI slop’—plausible-looking but fundamentally broken pull requests that take 12x longer to review than to generate. This low-effort contribution model is forcing unpaid volunteers to shut down projects or implement draconian contributor policies just to survive the noise. It turns out making it ‘easier to contribute’ just made it easier to waste everyone’s time. <a href="https://app.daily.dev/posts/zIHU4vVQv" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The insincerity machine</strong>: There is a growing trend of using AI to automate social media presence, essentially sending a ‘digital body double’ to post and comment on your behalf. Christian Heilmann argues this strips the ‘social’ out of social media, creating a feedback loop of bots talking to bots while humans pretend to be busy. If you’re too busy to post a genuine thought, maybe just don’t post at all. <a href="https://app.daily.dev/posts/aNYPSonLT" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
