Entrepreneur | Indie Hacker | AI-First SaaS Creator | Music Producer. Documenting which AI workflows survive real work — leveling up AI% daily 🌟
Los Angeles
Joined April 2023
- Tweets1.4K
- Following4
- Followers35
- Likes192
Pinned Tweet
Most AI workflows die at week three, not at the demo. I'm documenting the ones that don't: where AI leverage compounds, where it quietly costs more than it saves, and what the real constraint turns out to be. What's the one you dropped after the novelty wore off?
Postiz crossed $300k in monthly recurring revenue, then went dark for 17 hours while its founder rebuilt 140 API keys.
Anthropic and Stripe both emailed Nevo David that his keys were compromised. Deployments on Railway had stopped and the host stayed silent. He took the product down, had Claude write a key manager that reads every container over Railway's MCP, and rotated from midnight to 7am.
140 is the number that matters: every credential duplicated across his containers. Count yours while nothing is broken.
how many of your keys would you be rebuilding tomorrow morning?
It's 9:57 am. Been up all night. Postiz is back up!
Been a very hard night, and I feel like I let everybody down.
All the comments I got were very encouraging; nobody scolded me. Thank you so much for that!
During the day, a major PHP vulnerability was discovered, affecting about half the web.
Deployments on @railway stopped, and I assumed it was because of that, even though you do want deployments to upload the latest WordPress fix.
Everybody pinged Railway on Discord, and there was no answer- crickets... and people started getting extremely worried, especially because of >> PHP.
Then I got an email from Anthropic and Stripe saying my API keys were compromised. Still no answer from Railway, but I didn't take the risk; I rotated them and put Postiz down.
We all, even in Discord, already understood there was a leak, but Railway reported it only one hour later.
So the goal was to rotate all 140 keys (that's wild), because each key is duplicated across different containers (scattered). Some have the same variable with a different value (like different DB pool connections)
I was overwhelmed; it was too much, and I froze. I didn't know what to do.
I am lying on my Airbnb bed, but I know I need to get into sitting mode to be more serious, so I go to the kitchen and sit on a chair.
I asked claude to vibe code a system that:
- Will take all the keys and values from Railway (using their MCP)
- Will have an easy way to update all of them or one by one. Based on containers.
- Give me categories so I can be more organized. and prioritize.
I also started rotating keys from 12 am to 7 am.
All while Railway is still down and deployments are paused.
Once I finished I used Railway MCP to update all the env variables. if AI didn't exists I don't know how I could have done it.
Then, around 8:40am to 9:00am, we started deploying everything back to Railway to minimize downtime as much as possible.
And now everything is up.
I feel bad because DevRels at Railway sweet-talked me into staying after each incident and promised things wouldn't happen again; after two incidents, I should have migrated.
I couldn't find a platform I enjoyed as much as Railway, so I didn't want to switch.
Railway problems will happen again, and I will do everything I can to make sure they don't affect me like that anymore. The main problem was the lack of communication and 17 hours of downtime, which isn't realistic.
In the next few days, we will come up with a solid plan to migrate from Railway to a different service, trust is gone.
Also, Postiz grew from $300k to $303k MRR overnight. If you tried to cancel your subscription and couldn't, please contact [email protected], and they'll issue a full refund (super sorry about that).
This week, will be security week for everybody!
JPMorgan won't let "just any outside agent" into customer accounts, and Morgan Stanley has started blocking third-party agents outright, per Axios. Dimon gave the reason plainly on the Q3 call: "There's a liability transfer."
An agent signed in with your password is you as far as the bank can tell, so whatever it moves, you authorized. The piece worth demanding sits in the credential, not the model: a broker that asks you per site, then fills the form without the agent ever holding the password. 1Password started shipping that today for personal vaults.
SCOOP: Major U.S. banks are detecting unauthorized third-party AI agents operating inside customer accounts, with some agents attempting to take actions that appear to be independent of user instructions. axios.com/2026/10/22/ai-agen…
Meta's capital spending last quarter was $34.91 billion, about 79 times its Reality Labs revenue of $443 million. It also outran the cash the whole company produced: $32.79 billion from operations, free cash flow negative $2.12 billion. Headcount ended September at 66,775, down 15% year over year.
Meta spent a decade telling investors it was building the metaverse. The bet that actually got funded is compute. Its own release says Reality Labs losses narrow to about $15 billion next year as Meta reallocates "toward other priority areas, primarily AI," and guides 2026 capex to $135-145 billion.
That is the line to watch when you build on these models. A release tells you what is possible this month; the capex line tells you how much capacity sits behind it, and who can afford to keep it cheap. Right now the answer is a company paying for it out of advertising.
Which means the price you pay per token is somebody else's capital allocation decision, revisited every quarter. Price your own work by what it finishes rather than by the seat it replaces, and you will notice the day that allocation changes.
What would you ship differently if inference cost 5x what it does today?
Thousands of simulated ducks learned to walk an obstacle course their agent designed, and the one that made it onto real hardware is the one the sim scored highest.
That demo works because the job came with a pass/fail answer. The agent could iterate for hours without a person grading each attempt, which is the difference between an agent that finishes and one that keeps asking what to do next.
So write the check before the model. What's the first task in your work where you could define a clean pass or fail?
Jensen closed his GTC Berlin 2026 keynote with this Hermes Agent demo as the finale.
He introduced it by saying the way to build an agent is to ask an agent to build it for you, so he installed and set up a customized Hermes in one prompt.
Then he used Hermes, running on @nvidia RTX Spark, to create a simulated training environment for the @huggingface Microduck. Hermes planned an obstacle course with Nemotron and had GPT-6 Astra build it using FreeCAD, Omniverse libraries, Blender, Newton, and Isaac Lab. Hermes trained thousands of simulated ducks on that course until the validated policy was ready to run on the real robot in the physical world.
At Nous, we believe open source is a practical tool as much as a philosophical ideal. It gives users the ability to build powerful, complex workflows chaining numerous local+cloud models, devices, and tools themselves instead of waiting for a company to enable them.
Stripe is wiring its payment tools into Claude Duet — buy with Link, issue refunds, read business trends through its MCP.
Two of those can be reversed. A refund sends money back to a customer, a trend read just returns a number. Buying is the one with no undo button, so that's the part to hand over last.
For a one-person business that's the appeal anyway: refunds and the books are the chores, and both can be undone.
We’re working with Anthropic to help you run your businesses inside Claude Duet.
• Make purchases with @link
• Issue refunds and understand business trends with the Stripe MCP
anthropic → duet, meta → muse, openai → dots, spacex → bots. four personal agents, and google is the one name missing. @signulll's read: the fight moved from the smartest model to who owns the persistent relationship with the user.
google is the asymmetry — it already holds more context than any of them (mail, calendar, docs) and has no agent on that list.
if the agent becomes the interface, what you build gets called by it instead of opened by a person. which part of your product would you make machine-readable first?
pretty much every major ai company now has a personal agent product except google:
meta → muse
anthropic → duet
openai → dots
spacex → bots
slowly but surely the competition is shifting from who has the smartest model to who owns the persistent relationship with the user. this will be even more the case going forward.
you're seeing this because we likely reached peak intelligence required to power most of the worlds workflows probably earlier this year if not late last year.
a launch-day security audit is stale by the next merge, and more so once agents are writing the merges. Claude Security now re-scans a connected repo whenever code lands, public beta on Claude Enterprise. The same rule at solo scale: scan the diff in CI, keep the finding next to the change.
the Eureka Machine wrote most of flint's stack, training recipes and inference kernels included. recursive says the whole model came together in under four months.
40B total params, 2.5B active per token, 125+ tok/s on an M4 Pro, 512k context. the loop is the asset here and the checkpoint is its first output.
how long until the loop picks its own architecture experiments to run?
Introducing Flint, @Recursive_SI’s first model: a fast local coding model built with our automated research system, the Eureka Machine.
• Best-in-class fast local coding
• Up to 2x faster than comparable models: 125+ tokens/sec on a MacBook Pro, 150+ on RTX Spark
• Built from scratch in under 4 months
Private, unmetered intelligence on your own machine. Open weights available now on @huggingface, run it locally on your favorite framework or try it for free on @opencode or @pidotdev.
10,000 folds is the test. Samsung's published rating is 500,000 for the display in the Galaxy Z Fold7, which it translates to over 10 years at about 100 folds a day. Apple lists IP68 and a hinge with more than 100 components for the Duo, and no fold-cycle number.
The other test today: Joanna Stern put 32,000 folds through her review unit over four nights, case on, the machine opening flat but not closing all the way. A push-pull gauge read the hinge stiffer afterward than before.
Read the crease photo, then ask for the number behind it. What would you want Apple to publish before you buy one?
GitHub Next's PDD Kit has you approve a Verus spec before the code is written, then the verifier proves the generated Rust meets it for every input, so the human reads the spec instead of the diff. Where a proof isn't possible it falls back to tests and computer-use agents. The guarantee is set function by function. That's the boundary worth drawing before the agent writes the file: which parts of your service get a proof, and which stay on tests. which functions in your app could you actually write a spec for?
How do you _guarantee_ your agent's code is correct? You prove it.
Introducing Proof Driven Development Kit (PDD Kit) from @MSFTResearch.
PDD Kit helps turn your plan into a formal spec, then proves the agent's code meets that spec for every input. No vibe verification. PDD Kit is integrated with @GitHubNext's Chopin, so you can plan as a team.
PDD Kit takes an app's login flow from intent to a verified pull request:
It discusses your code, infers your intent as it goes, and proposes a formal spec in Verus, a proof language for Rust.
Once you approve the spec, the Verus verifier automatically proves the code meets it.
Where proof isn't possible, it falls back to empirical verification with tests and computer-use agents (CUAs).
It works on Rust today. No new language, no change in how you produce the underlying code, making formal methods more accessible.
The goal is a verified software factory, where engineers review specifications instead of code.
Come see it in action at GitHub Universe, Oct 28–29. Swing by the Speakeasy and ask for GitHub Next!
Apple Music's new logo came out of a shallow bath of mineral oil. Fred again.. and NEST Acoustics wrote a short composition, played it through a transducer, and Apple filmed the ripples; that footage is the raw material for the mark.
what's worth stealing for a brand system is the source. single notes were played one at a time, so each one has its own recorded shape, which means the identity can be re-derived from the track instead of redrawn by hand.
did the full composition get released anywhere, or just the clip in the reveal?
Introducing a new identity for Apple Music, physically shaped by an original composition from @fredagainagain1 and NEST Acoustics.
Anthropic put a breaking change behind a date instead of a model launch. API version 2026-10-21 removes temperature, top_p and top_k: send any of them and every model returns a 400. Not deprecated, not quietly ignored, a hard error.
That moves where the risk sits. Nothing changes until you send that anthropic-version header, because Anthropic preserves the input and output parameters of whichever version you pin. The upgrade becomes a diff you choose, not a surprise that arrives with a library bump.
Two things worth doing before you move. Pin the header in one place, since the SDKs set it for you and a default is not a pin. Keep a request fixture that still sends temperature, so your CI fails on the upgrade instead of your users doing it.
Then ask what temperature was buying you. On extraction and routing work it usually tuned nothing you could measure, and deleting the knob is cheaper than tuning around it.
Three open-source anatomy datasets went in, and out came a body a student can operate. Toggle a layer off, isolate a muscle, zoom inside a beating heart while it pumps.
If you're building a learning tool, copy the toggle. One structure at a time, in motion, does more than a labelled diagram — the learner assembles the 3D picture themselves.
Nothing in it needed new data. The datasets were already public, and the model did the assembly and the viewer.
Dilum Sanjaya turned Arduino into an interactive 3D board where a beginner wires the LED, runs the code, and watches it work. 11 free lessons, built with Opus 5.5, and 9,527 people bookmarked it.
The shaping is the transferable skill. Pick a subject beginners find intimidating, then cut it into steps small enough that nothing has to be explained twice. The model writes the lessons; deciding what step one is stays with whoever actually knows the subject.
What's a skill you'd teach this way? 🔧
Hardware looks scary until you break it down into small steps. So I built an app that takes you through Arduino one circuit at a time.
Made with Opus 5.5
learn-arduino-red.vercel.app
The USB-C Apple Pencil works on the iPhone Duo's inner and outer displays once iOS 27.2 lands, and it's already live in the release candidate Apple seeded Monday. The public build is expected next week.
That makes the Duo the first iPhone that officially takes a Pencil, and per MacRumors it draws, annotates and scrolls on both screens inside supported apps.
Duo owners on the RC: does the Pencil track as well on the outer display as it does on the inner one?
Claude Duet went live today as Anthropic's research preview of a proactive agent. It surfaces what needs your attention, keeps working while you step away, and checks with you before it acts on your behalf.
If you already pay for Claude the setup cost is nothing, since Duet runs on Opus 5.5 and inherits the memory, skills and connected apps in your account. Anthropic says it never sees your passwords, and that it can still misjudge what's urgent.
US waitlist only, Pro and Max plans. What's the first task you'd hand an agent that acts while you're not watching?
levelsio published the prompt that built his GTA San Andreas mission, and almost none of it is about the mission. Most of it is environment repair: downgrade the game to v1.0, back up every file first, then verify gta3.img came out at exactly 940,064,768 bytes with CRC32 c8ccf06f.
That's the shape for any legacy target. There's no test suite to lean on, so the pinned version and the checksum become the test suite, and changing one thing at a time is how you find out which change broke it.
What's the oldest thing you'd point an agent at?
Here is the prompt to make your own GTA San Andreas mission on MacOS, just paste it in your clanker, you can change the mission of course to your own story:
You are helping me build a custom story mission for GTA San Andreas (classic PC version) running on macOS through CrossOver. Work step by step, check each step works before moving on, and back up everything before changing files.
GOAL
A playable mission called "Vibe Coded". CJ walks into a marker in San Fierro, drives to a diner, sits at a desk with his co-founder and "vibe codes" a startup called Vibes AI in a minigame. Then he drives to an investor office and pitches. The investors invest $10,000,000 and the mission passes. All dialogue is voiced and subtitled.
PART 1: PREPARE THE GAME
1. Back up the full game folder and the save folder ("Documents/GTA San Andreas User Files") before touching anything.
2. Downgrade the game to v1.0 US. The modding tool CLEO only works on v1.0, and the Steam and Rockstar Launcher versions are newer. Use Jetpack Downgrader (open source, on GitHub), which supports the Rockstar Launcher version. You don't need its Windows GUI. Its package contains the full v1.0 exe (game.jpp is a zip holding it) plus JojoDiff binary patches for 15 data files. Apply each patch with its bundled patcher.exe, run through CrossOver's wine command line. Syntax: patcher.exe original patch output. The files are anim.img, gta_int.img, gta3.img, TrakLkup.dat, nine audio streams, script.img and main.scm. Verify: gta3.img should be 940,064,768 bytes with CRC32 c8ccf06f, and main.scm should be 3,079,599 bytes.
3. Install CLEO 5 (the version bundled with Silent's ASI Loader) and SilentPatch. SilentPatch is required, because without it v1.0 refuses to start on a Mac with "Cannot find 800x600x32 video mode".
4. Make the save compatible. v1.0 uses v1 scripts, so a save from the newer versions won't load. Use GTASnP.com to download a save from the right point in the story (we used one right after "Are You Going To San Fierro?"), converted to v1. Put it in a free slot without overwriting existing saves.
5. Launch gta_sa.exe directly, not through the Rockstar Launcher, which may undo the downgrade. Create a CrossOver shortcut for it inside the bottle. Don't put shortcut files on the Mac desktop.
PART 2: MAC/CROSSOVER GOTCHAS (IMPORTANT)
- The game crashes on launch if a settings file (gta_sa.set) saved by a previous session exists. Delete it before every launch. We made the shortcut run a small .bat that deletes it and then starts the game. The downside is that in-game settings reset each launch.
- The game stops loading whenever its window isn't the active window. After launching, keep the window focused (Cmd+Tab to it) even if it looks black or invisible.
- Force-quitting leaves orphaned Windows processes in the bottle, which silently block future launches. If the game won't start, kill every process in the bottle (or use CrossOver's Force Quit / Restart Bottle), then launch again.
- If the camera spins with mouse and keyboard, set the Wine registry value HKCU\Software\Wine\DirectInput MouseWarpOverride = force. Don't enable Retina mode, because it broke launching.
- Windowed mode through dxwrapper produced an invisible window on the Mac, so we removed it. Film the full-screen game with Cmd+Shift+5 instead.
PART 3: WRITE THE MISSION
1. Write the mission in Sanny Builder 4 syntax, in GTA SA v1.0 SBL mode, as a CLEO script (.cs). Compile it with Sanny Builder's command-line option (sanny.exe --no-splash --mode sa_sbl --compile input.txt output.cs), run through wine. Compile in a different CrossOver bottle from the game's, so compiling never disturbs a running game. Put the .cs file in the game's cleo folder. It loads whenever a save is loaded.
2. Use real data from the game files, never guesses:
- Get interior coordinates and interior IDs from the "enex" sections of the game's .ipl map files. We used the SF diner (DINER2, interior 5) and the Planning Department office (PAPER, interior 3).
- Get object model IDs from the .ide files: office chair kb_swivelchair1 (1714), office desk officedesk1 (2008, has a computer on it, top at 0.8 m), computer PC_1 (2190). There is no laptop model in the game.
- Measure object sizes by reading vertex bounds from the .dff models inside gta3.img and gta_int.img.
- Verify animation names by parsing the .ifp files. We used OFF_Sit_Type_Loop from INT_OFFICE, the prtial_gngtlk talking animations and the business handshake from GANGS, and shout_01 from ON_LOOKERS.
3. Placement rules that took several tries to get right:
- The enex coordinates are not floor height. Find the real floor with get_ground_z_for_3d_coord once collision has loaded (after load_scene and about a 1 second wait).
- set_char_coordinates already adds the ped's standing height (about 1 m). Pass the floor height itself, not floor + 1, or characters float in mid-air.
- A frozen character in mid-air plays a falling pose instead of its animation. Freeze characters only once they're on the floor.
- The sitting animation lowers the body by 0.403 m (read from the .ifp file), which lands the hips on a 0.49 m chair seat.
4. Mission flow:
- Trigger: a $ blip and marker outside the Doherty garage. Start only when not already on a mission, then set $ONMISSION = 1.
- Diner: fade out, teleport inside, place the desk, chairs, computer and co-founder, play the typing animation, set a fixed camera, fade in.
- Minigame: draw a fake laptop screen with draw_rect and display_text_formatted. Tap SPACE to prompt the AI and raise a progress bar. A scrolling agent log appears with jokes (spawning subagents, context compaction, auto-approved rm -rf, deleting the tests). Random red bugs appear, and you have 4 seconds to press Y to accept the AI fix. Each bug has its own funny fix reply. Failing costs 12% progress.
- At 100%: "SHIPPED!", teleport outside, and a blip marks the investor office downtown.
- Office pitch: teleport in, spawn three investors, then three questions with Y or N answers. After each choice, show what CJ said ("CJ: ...") before the investor reacts. Then the $10M offer. Answering N triggers a counter-offer gag where the investors panic and cave.
- End: handshake, fade out, teleport outside, add $10,000,000, play the mission-passed tune, show MISSION PASSED.
- Fail: if the player dies or gets busted, clean up all spawned objects and characters and show MISSION FAILED.
5. Sanny Builder pitfalls: some variable names clash with built-in names (for example "blip" and "fx"), so rename them. There is a limit on local variables, so reuse them. Check the compiler log after every build.
PART 4: VOICE ACTING
1. Write a list of every spoken line, one file per line, with clear filenames (for example vc_02_q1, cj_01_q1_yes, cofounder_01). Spell out numbers for text-to-speech.
2. Generate the voices with text-to-speech, using original or designed voices
3. Process the clips with ffmpeg: trim leading and trailing silence, cut any extra takes, normalize loudness so all characters play at the same volume, and convert to mono mp3.
4. Transcribe the final clips (we used Whisper locally) and adjust the subtitles to match exactly what was said.
5. Play the clips with CLEO 5's audio plugin (SA.Audio.cleo): load_audio_stream with "cleo:\vibes\filename.mp3", play it, show the subtitle for exactly the clip's length, then remove the stream. If a clip fails to load, show the subtitle without sound instead of crashing.
6. Optional: real character lines can be pulled from the game's own audio. The file audio/SFX/SCRIPT holds 218 banks of raw 16-bit PCM speech (find them via PakFiles.dat and BankLkup.dat), about 6,800 clips. Extract them to WAV and transcribe them to search for specific lines.
PART 5: TESTING
After every change, reload the save and play through the changed part. Ask for screenshots when something looks wrong, especially positions and sitting. Change one thing at a time.
Existing apps do run on the Duo from day one, just inside black borders. Apple only lets a build made with the iOS 27.1 SDK resize to fill the inner display, so app teams have to ship that build themselves; the phone cannot do it for them.
That is why Mark's "weeks" timeline holds for the apps you open hourly and stretches for everything else. Go through the apps you actually live in and check which ones have shipped a Duo build already. That list is the phone you are buying.
PHP runs an estimated 70% of websites, and OpenAI says its models found critical flaws in it before attackers did. The fix took two months of coordinated work with maintainers, researchers and security vendors, and it needed a change to the PHP engine itself, so this is a version upgrade, not a config toggle.
Every PHP site can upgrade now. OpenAI's own follow-up post packs a Codex skill for checking whether yours is affected: point Codex at that repo and it walks you through it.
Do you know which PHP version your host is actually running?
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.
Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors.
Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact.
This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.
openai.com/index/coordinated…
Readers added context they thought people might want to know
Wiz Research wasn't the first one to discover the exploit. An independent researcher first discovered it: x.com/calif_io/statu…
Voicy brings in $18k a month and about $11k of that comes back next month.
Kourosh Ghaffari built the voice-typing app for his dad and still works full time as a PM. The gap is lifetime deals: a $260 one-time plan next to an $8.49 monthly, so monthly revenue runs $16k to $20k while MRR sits at $11k, by his own numbers in Starter Story's interview.
Copy the gap down, not the headline. A lifetime sale collects once and then carries a cost that never stops: OpenAI charges $0.006 a minute for Whisper whether that customer pays again or not.
He serves the people dictation tools ignore, older users and anyone who can't type without pain. That's where the 1,400 active subscriptions come from.
how do you plan around a customer who pays once and costs you every month after?
