How to Use LLMs for Free: OpenCode 2 Built-in Models and OpenRouter
Install OpenCode 2, select a built-in free model, and complete your first everyday task. Connect OpenRouter later if you want more models or a free API for your own application.
ai
1264 postsAI Common Failures: Contrast Framing, Significance Inflation, Indicative Summaries, Overgeneralization
LLM prose has four recurring failures: contrast framing (refuting an X nobody said), significance inflation (dressing a plain fact up as a turning point), indicative summaries (announcing the topic, withholding the conclusion) and overgeneralization (summaries that drop conditions and scope). Fix the first three by cutting the filler and writing the answer; fix the fourth by checking each sentence against the source. Contrast framing has been traced to preference data, and models revising a draft move it into another contrast form, so banning a phrase in the prompt may not stop it.
Fixing "It's Not X, It's Y": Three Forms of Contrast Framing, How Common It Is, and When to Keep It
Ask two questions of every contrast: do readers actually hold X, and does rejecting X tell them anything new? If either answer is no, drop X and state Y. 'Rather than' became about seven times as frequent in NLP papers from 2019 to 2026, and five commercial models writing Chinese use the equivalent construction 2.5–9.2 times as densely as a human reference corpus. Models almost never misuse it, but more than half the uses are unnecessary, and with eight in one paper, at least one tends to annoy the reader.
Cloudflare Agents SDK: choosing between Pi harness, Agent, AIChatAgent, and Think
Already have a harness: PiHarness. Chat where you assemble each model call: AIChatAgent; let the framework run it: Think. Not chat but need state, scheduling or MCP: Agent.
Gemini, Claude, ChatGPT, Grok: Which to Pick for Long Video, Code, Live X Search, and App Platforms
A two-hour lecture is about 720,000 tokens, which Gemini's API accepts and Claude's and ChatGPT's API docs don't list video input for. On code, Claude and GPT are 0.8 points apart on the Vals board, so compare time and cost instead. Grok for X sentiment and auto-fill checkout, ChatGPT for ready-made apps and voice.
Seeing What an Agent Did Afterwards: Uber ADR, numbat, Adrian and How Far to Trust the Audit Record
Detection and audit tools run along a spectrum: the open-source release of Uber ADR reads records purely after the fact, numbat only monitors by default, and for most of the rest the selling point is that they can block before an action, yet they start out observing only. Whether a record can serve as evidence depends on who can change it: when the signing key sits on the same machine and user as the audited agent, tampering can be noticed but not prevented.
Can You Rely on Checks Before an Action? Claude Code Hooks, Agent Governance Toolkit, pipelock and NeMo Guardrails
Guardrails intercept an action before the agent carries it out. On Claude Code the main attachment point is the hook, and the official docs say that on most events a hook that errors or times out lets the action go ahead; blocking needs onFailure: block. Other tools have their own failure behavior and defaults: the Agent Governance Toolkit library allows everything when no policy is loaded, NeMo Guardrails lets requests through when its jailbreak detector is down, and llm-guard and rebuff are archived. Ask three things of any guardrail: where it intercepts, what happens when it fails, and who can change its rules.
Containers, gVisor, and microVMs: Who Shares the Kernel, the System Calls, and the Hardware
Containers share the host kernel, gVisor inserts a user-space kernel, and a microVM adds a guest kernel plus a hypervisor; all three still share the same host's CPU caches and storage.
Talking Without a Network: How Shared Cache, Storage, and CPU Time Become a Signal
Two programs with no connection can pass bits through the speed of a shared resource: one changes its state, the other times it. Such channels need an agreed protocol and are slow and easily drowned out; the local experiment is nearly error-free up to 20 bps and gets clearly worse from 100 bps.
Reading a Defense Checklist: What Isolation, Noise Reduction, and Detection Each Block
No single defense blocks both covert channels and exits. Blocking channels comes down to not sharing, blocking exits comes down to narrowing the services you allow, and monitoring only notices while automatic stopping is a response after the fact; neither is prevention.
More Than One Way Out: Package Proxies, DNS, and Services That Run Errands
A sandbox with no direct network can still have an exit: any allowed service that can make requests on someone's behalf, such as a package proxy, a DNS resolver, or a metrics service, is one. OpenAI's three cases all have this shape.
Reading OpenAI's Red-Team Report: Four Channels, the Test Conditions, and the Numbers Not Published
OpenAI says its red-team agents built communication channels on shared hosts from cache, storage, CPU time, and a TLS certificate cache, and that most channels are slow; in most tests the channel or protocol was given, and bandwidth and error rates were not published.
Where an Agent's Code Runs: Five Layers of Isolation From Container to Monitoring
A piece of agent code passes through five layers on its way from execution to a network connection: container, kernel boundary, shared host, network perimeter, monitoring. Each layer promises one thing, and the shared host layer promises almost nothing.
Which Layers Your Agent Should Worry About: Priorities for Personal, Team, and Multi-Tenant Setups
In my judgment, OpenAI wrote about a research environment for training frontier models; for a personal agent, limiting credentials and exits comes first, and covert channels become a main risk only once there is a second tenant that must be isolated.
Choosing an Agent Sandbox: Four Kinds of Isolation and Where Claude Code and Codex Defaults Differ
I sort agent sandboxes into four kinds: shared-kernel OS isolation, container orchestration, local microVMs (lightweight virtual machines) and remote microVMs. Claude Code's sandbox is off by default and wraps only shell commands; Codex CLI's is on by default locally. Most public escapes go around the boundary through config files or check scripts rather than through its core, and a sandbox answers how far a fooled agent can get, not whether it gets fooled. On Claude Code, turn the sandbox on, put ~/.ssh and ~/.aws on the deny list, and block the Read tool separately.
How AI Agent Security Tools Fit Together: Four Entry Points, Seven Kinds of Tool, Three Recurring Limits
When you install a skill, connect an MCP server or let an agent run commands, risk can be seen as coming in through four entry points. I sort the open-source tools around them into seven kinds by when they step in, from pre-install scanning and sandboxes to guardrails, audit and red teaming. This post covers what each kind handles and three limits that keep recurring: no single tool works as the only defense, defaults often work against you, and published detection numbers lack independent evaluation.
AI Tools That Attack Others and Their Dual-Use Risk: How to Read the Evidence on Strix, Shannon, HexStrike and ARTEX
AI penetration-testing tools use an LLM as the attacker against ordinary software. They share two problems: the tool is itself an attack surface (a target can take it over through prompt injection, and HexStrike's server has no authentication), and once open-sourced, its use cannot be controlled (the same tool serves authorized testing and attacks alike, and the anti-abuse settings of ARTEX and HexStrike are defaults the operator can edit). When you read news that a tool was abused, ask who said so and whether the evidence is independent. The ARTEX incident has several vendor analyses, but some of them examine overlapping attacker infrastructure or cite each other, so they are not independent pieces of evidence.
Asking AI to Review Your Paper Before Submission: The King and Worthington Experiment, Its Prompts, and Its Limits
King and Worthington compared 134 paid expert pre-reviews of 124 manuscripts with Claude Opus 4.8 reviews: the GPT-5.5 judge chose the AI review in all 132 decided pairs, and three former journal editors chose it in 26 of 30 judgments. The result covers constructive pre-submission feedback, not journal refereeing.
Testing Whether Your LLM App Withstands Attack: How to Read Success Rates from garak, promptfoo, PyRIT and HackAgent
Two reports that both say "attack success rate 5%" cannot be compared directly: behind the number sit who set the questions (the attacker model), who judged (the judge, a model or rule that decides), and what the denominator counts. garak's own FAQ says its scores have no scientific validity, and in HackAgent's white paper the order of two models flips with the judge threshold. I found no independent accuracy evaluation of any of the four.
Auditing Your Own Project with AI: How Cloudflare's security-audit Skill and Trail of Bits' Skills Differ
The two representatives take opposite approaches: Cloudflare's security-audit skill is a pure-LLM multi-stage process, and Cloudflare says that when its internal harness wired in Semgrep, the hunting agents did not call it once in a month; Trail of Bits combines Semgrep and CodeQL scripts with LLM judgment. I found no checks specific to Workers, D1, KV or Astro in the rules or supporting files of either, and neither publishes accuracy figures from real projects. This post is based on documentation only and was not run against any project.