Today at a glance

The strongest signal today is not a single launch. It is the slow hardening of AI agent workflows: better identity boundaries, stateless tool protocols, embeddable runtimes, scoped team workspaces, and review surfaces that can survive more generated code. Anthropic and Publickey were reachable, but neither had a fresh 24-hour item worth forcing into the list.

Picks

  1. Tailscale didn’t stop the Hugging Face intrusion · Hacker News

    Tailscale’s write-up looks at the Hugging Face intrusion through the lens of a stolen auth key and the controls that could have reduced blast radius. The useful part is the operational framing: workload identity federation, flow logs, and safer defaults beat hand-waving about secret hygiene. If agents, CI, VPNs, and cloud accounts touch the same systems, you need short-lived credentials and observable identities by default.

  2. DeepSeek V4 Flash 0731 Intelligence, Performance and Price Analysis · Hacker News

    Artificial Analysis puts DeepSeek V4 Flash 0731 on the price-performance map, and Simon Willison notes the same release as a low-cost model with stronger agentic behavior. The point is not just another model card: the cost floor for useful agent workloads keeps dropping. For products with high-volume summarization, routing, extraction, or coding-assist paths, the best default model may be the one that is cheap enough to use everywhere.

  3. Stateless MCP has recaptured my interest · Simon Willison

    Simon Willison argues that the 2026-07-28 stateless MCP spec makes the protocol interesting again. Compared with handing an agent a shell and open network access, MCP tools are easier to audit, limit, and explain; compared with stateful MCP, the new shape is easier to host and scale. This is a good read for anyone designing internal tool access for agents.

  4. github/copilot-sdk · GitHub Trending

    GitHub’s Copilot SDK exposes the Copilot CLI agent runtime to Python, TypeScript, Go, .NET, Java, and Rust applications. That moves Copilot from a product surface into an embeddable runtime for planning, tool invocation, and file edits. The engineering questions are the right ones: auth, BYOK, billing, JSON-RPC boundaries, and how much control an app keeps over the agent loop.

  5. yc-software/qm · Hacker News

    qm describes itself as a multiplayer agent harness for work, with Slack and web interfaces plus scoped memory, files, keychain views, permissions, crons, apps, and sandboxes. It is interesting because it treats the agent as shared organizational infrastructure, not a single-user assistant. The hard parts are exactly there: isolation, collaboration, admin policy, and durable background work.

  6. agavra/tuicr · GitHub Trending

    tuicr is a terminal code review UI with Vim keybindings and export paths to GitHub, GitLab, clipboard, or stdout. It can review uncommitted work, commit ranges, PRs, and MRs. As agents increase patch volume, review ergonomics matter again; a focused local diff stream can be more effective than another browser tab.

  7. zhaoxuya520/reverse-skill · GitHub Trending

    reverse-skill is a routing pack for AI agents doing reverse engineering, authorized penetration testing, and security research. It maps APK, ELF, JavaScript, PCAP, CTF, and related tasks to repeatable workflows instead of letting an agent guess commands. That is the right direction for security automation: scope, evidence, tool choice, and reporting have to be part of the harness.

  8. Demystifying DRAM Read Disturbance: RowHammer and RowPress Phenomena · Hacker News

    This paper tries to bridge experimental observations and device-level models for RowHammer and RowPress. It is a hardware security read, but the implications reach cloud reliability, multi-tenant isolation, and memory mitigation design. Even if you do not live in DRAM research, it is a reminder that some security boundaries are physical before they are software.

  9. 加拿大 Coldcard 硬件钱包生成的随机数不安全，导致大量 BTC 被盗 · V2EX

    A V2EX thread discusses reports of weak randomness in Coldcard hardware wallet key generation. The broader lesson is simple and severe: cryptographic systems fail when entropy is treated as an implementation detail. Wallets, signing devices, auth tokens, and recovery flows all need boring, audited randomness rather than clever shortcuts.

  10. MCP新仕様(2026-07-28)のステートレス化を試してみました · Zenn

    This Zenn post is a hands-on look at the stateless changes in the 2026-07-28 MCP spec. It pairs well with Simon’s broader argument because it focuses on the developer experience of actually trying the new shape. Specs matter, but implementation notes are where protocol adoption usually succeeds or stalls.

Editor’s note

Today’s source mix is HN 4, GitHub Trending 3, Simon Willison 1, V2EX 1, and Zenn 1. V2EX had few strong engineering threads today, so Dev Digest editor skipped lifestyle and promotional items; Publickey and Anthropic were reachable but had no fresh 24-hour news item. Start with the Tailscale write-up, stateless MCP, and Copilot SDK if you are building agent workflows for real teams.