alexsmirnov

And the other side: If my agent cannot see your site, it does not exist for me

My second language to learn... The first was Algol 68 :)

On DEC VAX, it compiled for one assembler instuction per operator

This is exactly the problem that Anthropic hides in their article. Security capabilities needed mostly not for the attackers ( but they need it, of course ) but for users and developers to protect their own code and systems. I do use glm ( from openrouter and abliteration.ai ), and kimi model for security reviews on pull requests. Claude rejected even to edit instruction files. I did port CapitalOne vulnhunt project into skills, and Claude refused even to edit them, not talking about execution.

KISS ! I do use whiteboard + camera. Much simpler and reliable.

I do have SUV ( Pathfinder ) for camping, skiing, kayaking, and other long trips. And 2 seats electric Smart for local commute - groceries, school drop off/pickup, gym visits etc. This is 95% of my family car use. The 90 miles charge is about $2, I do it 2 times a week. Yes, this is CA

I did create special repo that has all skills/agents/scripts and MCP configuration. All agents ( currently 3 in use: claude code, opencode, and pi ) packed in docker container, with artifacts required by project technologies, and task at hand ( planning, code review, documentation management, web design, ... ). Nothing but a small file with list of technologies committed to project.

For evaluation, there is command to record session, repository commit, and observed problems that stored in special database, so each session can be reproduced. Developer commit reports, I do analysis, refine and evaluate system.

In my feeling, it is decades old. With LLMs and agentic coding, it's deja vu of some 200x working with with inexperienced offshore teams. The same misunderstanding problems, the same corners cut, the same attempts to present bullshit as a "production ready", and the same "Yes, Sir, you are absolutely right" answer to criticue.

"The single worst issue: the system prompt never explicitly tells it to ignore auto-injected files like CLAUDE.md or *.rule.md." - Yes, it is! Right after the content of CLAUDE.md, Claude code inserts:

<system-reminder> IMPORTANT: this context may or may not be relevant to your tasks. You should not respond to this context unless it is highly relevant to your task. </system-reminder>

Shit happens. I had my iMac and Time machine hard drives died 2 days apart...

The problem of duplicated code described in the article, goes in a different way in reality: AI does not update 4 places in the same way, but implement them a slightly different. I found diverged business logic all the time. For example, file upload dialog for a document with the same meaning: in one place, it accepts pdf only. Another allows to upload pdf or docx. The last accepts pdf, doc, docx, and txt.

> This happens but far less often than it used to, and the case for full autonomous agents is getting stronger, not weaker.

This is that I do not see. My journey, just couple weeks ago, Claude Code + Opus 4.8. The task was not too complicated, 4 new API endpoint plus events streamed from client by websocket.

1. Multiply iterations on API definitions, refine request/response models, database schema, whole flow. A lot of corrections, removing contradictions, manual changes in document. Opus went of rails all the time. 500+ lines final document

2. API Integration tests. Once again, back and forth. AI was unable to create tests directly from document, so 2 iterations: Create placeholders with Given-When-Than comments, review an correct by hand. Second iteration was to implement tests. A lot of mistakes corrected after review.

3. Implementation. CC got api document, working tests ( modifications blocked by hook ), 6+ "best practices" skills ( most promptly ignored ), "rubber duck" and "code simplifier" agents, pre cooked scipts to run tests, linter, and check for compilation errors. Plan + execution + review, multiply corrections on the way. Feature implemented, all tests passed.

4. Code review. At average, found one issue per 20 lines of code. Not count code style, things like: Use in memory semaphore in kubernetes service (deployment described in CLAUDE.md ), 8 database calls to update the same record during a single request. One column at a time! Read-modify-save without transaction. Mistakes in business logic, failure recovery, authorization.

The result: almost one workweek, $100+ in tokens, and one thought: did it worth the effort ? P.S. I have a team of 2 developers. Just got PR to review from one of them. 80% slop.

If I pay for vending machine by corporate card on a business trip, it looks more like B2B

From the first hand: I was in the air base service regiment, Ovruch ( 30 km from reactor ), 1 year in service at the time of disaster.

The average numbers have a little sense. By our measurements, it was't an "even" distribution, but some "hot spots" that had 10x time radiation level than surrounding territory.

The article focuses on cancer, but for me and my buddies, the worst was an impact on immune system. In the six months after disaster, the healthy boy before, I got: pneumonia, chicken pox ( and 2 more with me ), furunculosis ( the whole company got it as well ), and endless flu/fevers. The weak immune continued for about 10 years.

I more like my high school math teacher explanation: "Put your one hand on dry ice, another in the boiling water. On average, you feel warm and cozy"