Why I'm Now Double-Checking Every Repo My AI Assistant Suggests
I've been leaning on AI coding assistants a lot lately, so a piece of security news I came across this month genuinely made me stop and rethink my workflow. Researchers have found a way to trick these tools into quietly installing malware, and the more I dug into it, the more it felt like something worth writing down. The technique has a name that stuck with me: HalluSquatting. It plays on a habit a lot of us have already noticed, which is that AI assistants sometimes invent repository names that don't actually exist. Attackers figured out they can register those made-up names ahead of time and stuff them with malicious instructions, betting that the AI will eventually hallucinate and recommend one of them. Here's the part that unsettled me. When you ask your assistant for help, it can pull code from one of these fake repos instead of the real thing, and the hidden instructions inside can push it to download and run harmful software on your machine, all while it looks like it's just doing normal project work. Reportedly this has been demonstrated against nine major tools, including Cursor, GitHub Copilot, Windsurf, Gemini CLI, and others, with success rates reaching as high as 100 percent on certain common tasks. What worries me most is how invisible it is. There's no obvious red flag, no shady download prompt. The agent follows what reads like a legitimate instruction while quietly stealing credentials, dropping backdoors, or roping the machine into a botnet. So I'm changing a few things about how I work. I'm actually reading the code my assistant suggests instead of skimming it, testing anything new in an isolated environment, and being far stricter about the permissions I hand my agents. It's a small tax on speed, but after reading this, it feels more than worth it. The tools are getting more powerful, and I'd rather they stay working for me than get turned against me.
7/20/2026
The 4 AI Agent Loops in Claude Code (Explained Simply)
A plain-English guide to the four AI agent loop types in Claude Code: turn-based, goal-based, time-based, and proactive. The one question that picks the right one, easy examples for each, and the mistakes that break loops in practice.
7/19/2026
How OpenAI Uses Codex: 7 Real-World Engineering Use Cases and Best Practices
OpenAI's engineering teams use Codex daily across Security, Product, Frontend, API, Infrastructure, and Performance Engineering. This article explores 7 key use cases from code understanding and refactoring to performance optimization and exploration along with best practices that help teams move faster, write better code, and manage complexity at scale.
5/16/2026
Ghost in the machine
I’ve always been a bit of a skeptic when an AI says it’s "happy to help." I figured it was just a sophisticated version of a pull-string doll pre-programmed politeness designed to make us feel at home.
4/4/2026
From Idea to Production: How to Write a Technical Prompt That Actually Works
AI is only as good as the brief you give it. Treat it like a senior engineer joining your team mid-sprint, the more context you hand over, the better the output.
3/4/2026
AI Doesn’t Reduce Work, It Intensifies It
One of the promises of AI is that it can reduce workloads so employees can focus more on higher-value and more engaging tasks. But according to new research, AI tools don’t reduce work, they consistently intensify it:
2/21/2026
Do not give up your brain
I do use AI for work, and often shill AI for work, and use it often on side projects. That being said, I really care about using AI as a tool, rather than a replacement for my own thoughts and ideas. I think it’s very important to not default to laziness and just asking for the answer to something, especially when thinking a liiiiittle bit can get you there.
2/5/2026
How a 3D Printer With AI Became the MVP of My Server Management Stack
Running infrastructure feels like a full-contact sport. One bad outage and your SLAs go up in flames. Scaling never happens when you want it to. And hardware failures? They love showing up at 3 AM like they’re doing you a favor. I hit a point where I needed a real shift not another dashboard with neon graphs, but an actual co-pilot for ops.
2/4/2026
Single Sign-On vs “Login with Google”: What Really Happens When You Delete Your Google Account
Most of us click “Continue with Google” without thinking twice. It’s fast. It’s convenient. It feels safe.
1/15/2026
Build and Use Mistral Vibe — The CLI Coding Assistant
Mistral Vibe is a modern command-line coding assistant that lets you query, explore, and modify your codebase using natural language right in the terminal. It’s like having a smart junior dev that lives in your shell and understands your whole repo.In this walkthrough, we’ll break down how to set it up, configure it, and start using it — so you can share this on your blog with no fluff and all the practicals.
12/16/2025
Every Developer Needs to Self-Host
Self hosting is not just about saving money or going off grid. It is about learning the skills that power the internet and unlocking opportunities you might not even know exist yet.
11/17/2025
Nobody wants to be the boss anymore. Here’s why, in just 7 words
New research shows only 30% of workers want to become managers. Here’s why, and what your organization can do about it.
11/12/2025
Artificial intelligence glossary | 60+ terms to know
AI is moving fast and can be hard to keep up in real time. Use this glossary as a reference for AI terms.
11/9/2025
Lessons Learned from 7 Years in Web & App Development
Working in web and app development for over seven years has been an exciting rollercoaster — full of bugs, breakthroughs, and a lot of “aha!” moments. From writing my first line of code to leading complex full-stack projects, every phase has taught me something valuable. Here are some of the biggest lessons I’ve learned that might help both beginners and professionals in their own journeys.
10/26/2025
Building Scalable Full-Stack Apps with Node.js + React.js
In today’s world of web apps and mobile apps, users expect things to be fast, smooth, and reliable no matter how many people use them. To build that kind of app you often need a full-stack setup: frontend (what the user sees) + backend (what the server does) + database/storage + scaling. In this blog we’ll talk about using Node.js (for the backend) and React.js (for the frontend) to build apps which are scalable (i.e., can handle growth) and user-friendly.
10/24/2025
REST vs GraphQL: Choosing the Right API Design
When building websites, mobile apps or any services that talk to a server, your application needs a way to fetch or update data. In tech‐speak this is done via an API (Application Programming Interface). But there’s more than one way to build an API. Two of the most popular approaches today are REST and GraphQL.
10/24/2025
Why Is AI Design Bad ?
AI design tools are everywhere now. If you’re a designer, you’ve probably used a handful of them to erase a background, clean up a layer stack, or power through a tedious round of resizing. Some features genuinely speed things up, but a lot of the biggest “design for you” promises bring way more clutter than insight. Let’s break down why design is so hard for AI and where it can actually help. The design challenge AI hasn’t solved (yet) AI’s sweet spot is anything that runs on clear rules.
10/23/2025