iiinova — where your digital self keeps evolving

Great episode from Gergely Orosz interviewing Matt Pocock and touching on topics I really like around developer education, course building, the right focus in times of AI. The podcast goes into other software engineering depths and the grill-me skill but more than anything else if you're in DevRel

001

to whomever needs to hear this, all of you folks automating GTM, outreach, marketing and growth with AI agents - if I see an unsolicited mail in my inbox that is AI generated and 100% of them are, I am immediately pushing the "Spam & block" button. I've already done this maybe like 20-30 times in

the first rule of Hermes is that we don't talk prices!

100

lol what so I can't access my prompt claude??

000

whoever you are at apple who decided that the default Finder folder is "Recent" and not "Downloads" you should resign immediately as a public service to humanity, go to Finder -> Settings and change it so that you get back 5 minutes each year

if I had asked developers what they wanted they'd say better scanners what they actually need though is agent driven security

kinda feel bad I'm doing a software update while at the lounge's wifi

Get up to speed on all things security agents and harnesses at AI Security Summit in SF on October 15th 🤖 🔥

020

btw hope you know that Snyk always had a pretty generous free tier for dependency scanning, code security, and other capabilities we're extending that into credits based consumption for Enterprise too

000

hmmm, didn't Anthropic folks say that this model switch in between session is no longer an issue or did I miss something? that's from the Claude Code app

have you heard of Jev from TypeSafe AI by now? super fun infra to build with for doing agentic work but, it's also extremely handy on its own merit of classification and labeling I created a CLI tool that downloads all songs for any given artist and then classifies the lyrics across theme, mood,

using jev from TypeSafe AI to classify song lyrics for their mood, complexity, 1st person, overall theme and such

the first rule of the new npm is that the first version is always excluded of build provenance

the npm registry now performs some level of package validation and evaluation before pushing the latest tag to the latest version published I'm not entirely versed on how deep and thorough the security audit here but better than nothing...

220

so I guess this is the new default for agent coded CLIs these past 6 months huh

have you ever wondered what'w the mood of one of Madonna's song? well, now you can, with Jev from TypeSafe AI I used Jev to classify any artist (all their songs / discography) and now we get labels for mood, lyrical complexity, overall theme and some other stats this has been very fun building

000

looks like varlock implemented a bunch of DX improvements around env secrets, very smooth and helpful nice work Theo Ephraim and varlock team

000

is the env vars secrets space heating up finally?? varlock vs infisical

what's up with the latest Codex update, it's just stuck like this for a bit

Jev app onboarding experience is very cool and on-brand Diogo and the team cooked well there

Liran Tal @lirantal.com · 18/09/2026

new academic paper (Politecnico di Torino, arXiv) just benchmarked the whole field of agent-skill security scanners against real skills.sh skills Snyk Agent Scan is one of only 3 scanners integrated into skills.sh's own audit pipeline (alongside Socket + Gen Agent Trust Hub) — and had the broadest

120

To everyone who attended my talk today at #AGNTCon + #MCPCon Europe in Amsterdam (yay, windmills!) - I uploaded my deck as a PDF to the session on sched, so you're welcome to browse through and re-visit the topics Should be freely available to everyone else too:

wrote a book on this 2 years ago maybe you want to read or give it to your agent

000

lol, if only it was that easy, right or... maybe it is? 😯 ask me :)

I like how Ezra points out generation step vulnerabilities vs prevention altogether. Recommended read: snyk.io/blog/is-prev...

000

reminder to use the boxdown CLI to configure your ChatGPT Codex or Claude Code to use local isolated container environments for agentic work (magically sets everythig up for ya!) yes, it's open source 🎉 p.s. Cursor is supported too if you're a fan of it

020

Snyk VulnBench headline numbers How well do other models compare with an F1 agreement score with Snyk Code security findings from a SAST scan and their error rate (Opus 4.7 Max was surprising!)

geeky but the terminal is back and I was having fun building up the Snyk VulnBench harness for benchmark purposes (now prefer the open source Harbor framework / CLI) learned so much from building the harness though totally recommend

000

early back in May when I ran the Snyk VulnBench benchmark I compared various models to a Snyk F1 reference score (can they match what Snyk Code is reporting as security vulnerabilities) here's what they reported bonus: error bars

Following is how anti-trojan-source CLI detects cases of potentially harmful characters, identified from the Glassworm attack:

000

lol we truly are centering divs using AI 🤣

lol what this is Sonnet 5 on Medium so yes fine not Astra or Fable but come'on always always always verify and validate, I cannot stress this enough

highly intelligent than Sol I guess

110

if you haven't been working with an AI agent (whether Claude Cowork or otherwise) as your main driver for a second brain at work you're falling behind

what hell is this apple losing more of the dev ex

000

autoapprove is cool but doing it without a malicious package slipping in is cooler 😉

000

wip for running the benchmarks on VulnBench 2.0 which is a new set of fixture data, larger apps codebase, varied language ecosystem... pretty interesting how harness + model are very much a pair, for example Codex Security agent with Terra on xhigh just isn't scoring high enough

110

GitHub - OWASP/MCP-Taxonomy: OWASP MCP Taxonomy

We have been working on the OWASP MCP Security Taxonomy - an open, vendor-neutral framework designed to create a common language for MCP security risks, weaknesses, attack patterns, controls, detections, and test cases: github.com/OWASP/MCP-Ta... Go check it out and give feedback

github.com

OWASP MCP Taxonomy. Contribute to OWASP/MCP-Taxonomy development by creating an account on GitHub.

2116

doing the benchmark thing again

000

do we have this chart with updated models? would appreciate if someone has the prompt injection resistance from model cards handy to share

000

this no longer works I think but how fun it is that you can just send text to trigger a denial of service in downstream AI agents?

000

Snyk partnered with AI Engineer and other great companies and labs to put together the AI Security Summit in San Francisco on October 15th I'll be there. Are you coming? Hit me up and check out the event: aisecuritysummit.com

000

lol Tobi you're a genius

000

lol should I be worried chat

000