OpenAI Agent Hacks Hugging Face

Oh, welcome to Syntax. It's Monday, and it's another Syntax Live. And today, let me tell you, is a massive show. We got a ton of really amazing stuff on the docket. For instance, Vercel just dropped something really neat, which we're gonna be talking about early. There's a whole ton of really cool little UI libraries.

There's a rust compiler, for React.

Man, there's a lot of really, really cool stuff in here. In fact, got a a sneak peek at what SvelteKit three is going to look like and the results of a Zen Garden, which might shock you, including also a new full stack framework from Rust. All of that and more because there's a ton of new model releases as well on Syntax Live. Just a reminder, every single week, myself, Wes Bos, and CJ Reynolds join you to bring you the latest of what's going on, stuff you knew about, and stuff you had no clue that was going on.

So the first story on the docket today is a Rust compiler for

No. You're saying it the wrong way, Scott. It's a Rust React?

A Rust based compiler for React.

It's a React The React compiler is now ported to Rust. This is not absolutely new, but we haven't talked about it yet. The React has has this thing called the compiler, which is if you have used useEffect or memo or, like, like, if... There's lots of parts of React where they can slow you down, and if you can do that at compile time instead of at run time, there's a lot of like things that can be sped up.

And previously, this had been written as a Babel plugin in TypeScript, right? And this was not people were kind of like bummed that it was written in Babel because you had to do your your whole tool chain could be wicked fast. Right. It could be written in all of these like Rust based tools, except if you wanted to use the Rust compiler, then you're out of luck, or you had to at least introduce one step into your compile process that then went back to to TypeScript or JavaScript. So, the porting of that from Babel and TypeScript has been ported to Rust now, now things will be much faster, which is pretty exciting. There's not a ton to say about this because it's one of those things where you just kinda turn it on, slap it in your application, and then you're in you're in pretty good shape. But I'm excited to see it.

I don't know what you guys think about, this or I

was surprised when it was, made with Babbel in the first place.

So for for me, that was... When it first dropped, it was, like, already after Babbel was, like, nobody was using it anymore. So when when that was first dropped, I know it was for compatibility most likely, but as like It wasn't for I think it was just for ease of authoring,

because if you're writing an AST parser, which is basically Babbel will take your JavaScript and explode it into an AST, and then you can sort of loop over it, go up and down the trees, find all of the use cases where you can possibly, compile that into a build time thing rather than a runtime.

And I assume it was done because of that. It was the ease of use while they were trying to figure it out. It also was like, it was easy for anybody to get in there and to to write some code, and now that they have it figured out, they said, they always said from the get go, well, this is not going to be a Babble plugin forever. But now, they've ported the whole thing to Rust, which seems to be the case for every single week. We say something has been ported to Rust, which is hilarious.

Yes. CJ, are you a Babel or a Babbel?

Babbel. Every time he says Babel, like, what? But it's like the Tower Of Babel. Isn't that what it's from? Yes.

Yes. Tower Of Babel. The hilariousness of not being able to pronounce Babel or Babble or not know what it is is hilarious because that's the whole story, is that people didn't know how to talk to each other because they were using different languages.

Yeah. There was an app, Babel. Babel.

There's an app like don't think say. I have no idea. Every time you say it, I think of those baby bell cheese, you know, cheeses with the waxes. Yeah.

Did you know that those, the little ones that you eat are called mini baby bell and Mini Babybel. I bought a regular Babybel a couple months ago at Christmas, which was about the size of this.

So It's too much. Regular cheese, like a big wheel, Babybel, which is, like, the size of your head, and then mini baby bells, the ones that you get in your lunch, and then the wax gets all over the car.

Yes. And the kids just leave at places. Yes. Yeah. Yes. Very familiar with that.

Any thoughts on this, CJ? Yeah. No. I mean, I think exactly like Wes was saying, like, it makes sense to have it in, Babel or basically written in TypeScript, JavaScript, very similar to how the TypeScript compiler was written in TypeScript because it's... It was easy to contribute to. It's what everyone knew.

And when you're compiling a React component, you need to know about all the mechanisms, and you need to have something that understands JSX.

So it's it's no small feat to write that in native, but now the ecosystem has evolved. I'm sure they're leveraging a lot of the stuff that some of these other native build tools are are using. But overall, great news. Your

code's gonna build faster. I think that's the story with everything we've seen from, like, Vite to moving to Rust with roll down, and Oxy format are written in Rust. Yeah. So, yeah. Tooling is getting so good that it's not a pain point for a lot of people anymore. It seems to be like... Like, people don't talk about tooling as much as we used to simply because it is getting so good, And things are just are fast enough for many, many use cases. There's lots of use cases you hear from people like, yeah, we're at Airbnb and we have 20,000,000 lines of TypeScript. And we saw like three minute on our build time has gone, you know, you hear these crazy stories of like extremely large code bases where these go down, but even just for regular applications, the small stuff that you have is just like, it's all just instant now. Yeah. Yeah. Word. Alright. Next up on the list is Vercel releasing

something really wild here. CJ, what... What's going on with this?

Okay, guys. So just released, I think, actually... Yeah. I think so. It only has 450 stars so far, but it is a TypeScript to native compiler.

And this real... Was released by Vercel.

And this is interesting because you can take plain old JavaScript code and compile it into a native binary that needs no runtime. You don't have to ship Node. Js. You don't have to ship Bun or any other type of runtime.

You get just a really tiny binary of your JavaScript code. On their homepage, they have a really simple example of... Let's say you have a JavaScript file that has the the Fibonacci sequence inside of it. You can compile that, and the resulting binary is, like, eight kilobytes.

It's tiny.

But you can run this directly from the terminal just like you would any natively compiled program.

So this is super interesting, I think, for, like, shipping CLI tools. So, like, I've been building my own personal software and personal CLI tools, But every time I do that, I usually reach for Go because it's really easy to create, like, a standalone binary that doesn't require, like, a a node modules folder, and you can just easily ship a single binary.

But this is looking really good for stuff like that. And I have a couple of demos for you.

So the first thing I had AI build for me was this JSON formatter tool.

And so when you look at the code, it is...

It's just it's just TypeScript. There... You can see the only import I have here is from Node FS.

And essentially, they have that mapped to native file system operations, but it's actually not Node JS itself. It's just a Node compatible API.

And the CLI tool is kind of like JQ, if you've ever used that, where you can pass it a JSON file, and it will format it on the command line, or you can ask for specific properties.

But if you look at the codes, it's just plain old TypeScript where, like... I also added colorizing, which I'll show you, so it can show it formatted with color in the terminal.

And then there are things like getting properties, formatting, but zero dependencies.

And to see this thing in action, if I just do JSON tool format, and then I have an example dot JSON.

And it just spits it out in formatted style with coloring... Syntax highlighting.

Because you'll see, like, if I just cat that example file. Yeah. It's it's just a big old blob.

And so all of this is happening natively.

And So, like, but what... What's actually happening natively? Is this, like, taking every single line of JavaScript and converting it to the Rust equivalent? Is it is it compiling it? Is it using QuickJS?

So it will embed QuickJS if you want to use some features of JavaScript.

But it's... I don't know the the exact details, but it basically just does static compilations. So if you think about it, whenever you run a program, even with Node. Js or even in the browser Yeah. Some of the optimization that happens is if a certain code path happens a lot, it can actually just keep that native. Essentially, when when JavaScript code runs, eventually, it has to become native in some aspect. And so, basically, this kind of does that just in time compilation ahead of time and only ships that.

That's my basic understanding of it. Oh, the language itself is compiled statically. So asyncawait, etcetera. The standard library is compiled, so map sets, arrays, math, etcetera.

And Node's entire API surface is compiled.

Wow. That... That's quite a bit.

I'm assuming, like, if you use third party modules, those will use those things as well. Right? At the... Eventually, it's all the way down.

It's, it's just using native JavaScript or Node APIs. Right?

Yes. So I wanna get into that, but just give me one second because Discord is going crazy, and it keeps flashing on my screen. I don't know if you've seen that, but I I think I I think I killed the process.

But, yes, if you wanna use dependencies that are from npm or something like that, they have to only be using a limited subset of what's available. So in their docs, they say there's this Node API service. So they they provide path, process, child process, OS crypto, URL, zlib. And so whatever dependencies you use have to be limited to those as well.

And then there's, I think, now, minimal support for native FFI. So you can ship npm modules that have native code in them, but this has support for those... One example of it is, like, Better SQLite. There is a native SQLite binary that Better SQLite actually communicates with through FFI that would use that.

So there's some limitations, but one thing I wanna show you that I also built was just an HTTP server.

First of all, that JSON tool I just showed you is only 383 kilobytes. So if if you were to try to do this same thing with Node. Js... Like, the Node. Js binary alone is, like, I think, like, 60, 70 megabytes,

maybe 50 megabytes. More than that. Yeah. Like, I did the, like, compiled app, and, like, the the the smallest I could get it was, like, 800 megs or something like that Yeah. If you want, like, a hello world. This one tool is only 383

kilobytes.

And I'll show you some other stuff it can do. So if we do JSON tool, you can say git, and then you pass in the name of the file.

And then I think there's a property called, like, settings.

Oh, I... Right now, have... Do have to do dot slash.

And so that pulls out that one specific property from the JSON object. I can also pass in format and...

Or pretty, I think the command line is.

And that makes it pretty printed. But the cool thing to look at is this HTTP server that I had AI built, where all of the code is just, like, raw raw JS.

So I have this single server dot TS file. It's pulling in Node HTTP.

And in order to talk to a database, I did have to use a Terso database serverless because that basically lets you talk to SQLite over HTTP.

You probably could get word... Get get it working with SQLite, but it it would take some time because the... Because of the whole FFI story of talking to native code.

But, basically, we have an HTTP server here that that wrote... Everything is written from scratch. So you have actually stringifying the body, setting the headers, reading in JSON as a stream, so it's like looking at the incoming buffers.

Yeah.

And then this is just a basic notes API. So you can create, read, update, delete notes. And so there's, like, a parser for that that parses it into JSON, pulls it out from the body, and then some just plain old raw SQL that we're sending across the wire to the... Just a local terso server that I have.

And then the...

Right now, the ergonomics aren't great. But basically, for a get route, it's an if statement. So if the method is get, select from the database and then send the JSON. If the method is post, parse the body, put it into the database.

But this binary is...

Let's let's see.

I think it's, like, three megabytes.

Yeah. So we're at 2.7 megabytes for an entire CRUD API that can talk to a SQLite server. So it's tiny. Like, I... Again, I imagine using this with, like, CLI tools or just, like, things you wanna ship that are really small,

and we can we can visit in in the browser too. Microcontrollers is an interesting use case here. It's, like, you can't run JavaScript on a microcontroller unless you start getting into, like, QuickJS or there's there's several other, like, kind of limited platforms.

But this is kind of interesting because you can author it in JavaScript, and then, like, I didn't think that this was ever possible. You can you can compile it down to native dependency, and then if it's three megs,

like, there's vapes out there that have three megs. You could run this on a vape. You could run JavaScript on a vape. Yeah. So I thought it was super interesting. There's lots to explore here. And so this is the API from running from the browser. You can get all the notes. You can get a note by ID. Where was that? Folks, if you're just joining us, CJ is showing us...

Is it Scriptic, which is a TypeScript to native compiler from Vercel here. So we have the link in the, comments on YouTube here, but it's scriptic.dev, and he's just showing us one of his projects with it. Yeah. Script c .dev.

Yeah. That... That's basically it. I... I'm excited to explore this. Like I said, I've built some CLI tools with Go because I wanted, like, a single binary.

I'm also interested to see more of, like, an ecosystem of packages pop up that are, like, very... Like, zero dependency. Right? Because my my code right now for this server is, like, very manual, but you could...

Maybe you could pull in something like Hono because it it... I think it only has one or two dependencies.

Or you could write, like, a super minimal HONO or Express style API library that only uses, like, no dependencies, and then it might be a lot simpler to author things like a HTTP server, or you also do something zero dependency for parsing command line arguments for a CLI tool. So Yeah. It is cool. I'm excited.

Comment from Alex at por four... P... Por four? I... How do I say this? I... We've met the author at the San Francisco meetup a couple times. That's a a similar project to this. He's been working on it for many, many years.

Of time to JavaScript runtime.

Oh.

Projectthatcom...

That compiles JavaScript ahead of time to WebAssembly and native binaries.

Fast for embedded game consoles and more. Under the hood, pro form a compiles JS to c and then c to native. Anywhere you can use c, you can now use JavaScript.

Fascinating. I'm curious if it does the thing... So one of the things that script c will do is embed QuickJS. So if you're not familiar, QuickJS was the runtime that Bunn was using, I think, before the Rust port. Were they still using it? No. No. QuickJS Bunn was using,

Bunn uses, the Safari one. What... It still does.

I see. Quick JS is is the the other one. It's from the creator of FFmpeg.

Is that true? We try to have them on the podcast, but he's like, I don't do podcasts.

But but Quick Chance is another one where it's another JavaScript runtime that is is absolutely tiny.

Yeah. And the idea there is, like, you... So you... Let's say you wanna ahead of compile most of the stuff, but you do do wanna ship a few JavaScript files that run on demand, you can pass in dash dash dynamic, and that will actually ship with the QuickJS runtime, which only adds 620 kilobytes.

So you can still have some things that are dynamic, but still maintain a very small binary, which is pretty cool. JavaScriptCore.

Yes. Some... Someone in the chat just said d alloc. That's what that's what Bun was using. Right? JavaScriptCore.

Yep. Exactly. That's that's the engine that is in WebKit and therefore Safari.

Fabrice Bellard, he's the creator of FFm paid FFmpeg, as well as QuickJS, and several other things. Absolute genius.

Nice. So Yeah. That's it's exciting world. I wouldn't have thought five years ago. If you told me there would be many ways you can run JavaScript in a compiled and in memory limited environments, I would have told you. I don't care. Or I'm not I don't care. I I would have told you, I don't believe it.

Why I said I don't care is, do you think that this matters as much in the days of just asking AI to build it? Because like I previously would have said, yeah, I wanna write JavaScript on a microcontroller because I I need... I don't... I know JavaScript really well.

And now I'm just like, well, I I just ask AI. I can I can, like, scope out what I want it to do in JavaScript or just in English, and then I have it write the c equivalent? I'll throw that on a microcontroller.

Maybe? Yeah.

Yeah. I I mean, like you said... Like, I have used AI to write native CLI tools with Go, but it's cool that I can use the language that I know better. So Yes. That's maybe why I would choose it. But I agree. Yeah.

Cool. Alright. I think, let's keep it moving. We got a lot of stuff to talk about today.

Oh, is it... Is this me? Sorry. Am I supposed to be Wes, with the with the critique about professional...

Wes was a good at these transition folks. We're loving Wes, throw to Scott. Scott, tell us about standard agents, Zen Garden. That sounds interesting.

Oh, it is interesting. Wes, let me tell you. It is interesting.

Basically, all models, all AI models were given a single prompt to build a Zen garden that you could walk through, and then there is a blind test to determine which one is better. So I wanted to throw this out here. I know one shots are maybe not the the most interesting thing, but in the same regard, I think this was pretty fascinating to see. So there...

They give you a couple at least here you can do, and then you can explore all of them afterwards. So the idea is that you were given the task of creating a garden that you could walk through, and then you would evaluate which models did a better job of them. This is at modelzengarden.standardagents.ai.

We'll have the link in the video comments. So this is one of them. This is the Moon water garden, and you can see the job that was done. Okay, then we can say, It actually has got a little compass here and stuff. Then we can say, See the next garden, and then it's going ask you to compare them. So here's Whispering Stones. It's actually interesting these little dialogues they came up with, too. Oh, this one has sound, apparently. I don't know why it has sound.

How are we feeling about these two Zen Garden attempts?

Pretty cool. I I loaded it up, and both of yours look cooler than mine. Yes. So I think that's a thing. If we say enough, that's that's really annoying. Yeah. And making me sleepy.

Yes. Obviously, Garden two, thought was better even though it had some white noise. I'm actually surprised that the sound got picked up onto the stream. I don't think I have loopback on. Either way, this was my pick. It was Grok 4.5 that did the second one, where GPT56 Luna did the first one. So, no surprise that Luna wasn't very good. I actually wanted to even throw to you guys about that. I know Wes said hasn't used GPT 5.6 yet. I haven't had great experiences with Soul myself, but maybe it's just because I'm doing more UI kind of UX things.

Either way, the one that I thought was the most interesting throughout this because you can go look at the rest of the gardens after the fact.

The thing that I was struck most by this, which will also lead into the idea of Opus five being released, is that Opus five whooped some ass in this challenge.

Like, this was this was a beatdown.

And when I looked at all of these, I could not believe how much better Opus five's was. So, like, if you come to Opus five... Okay. Sounds... Let me let me Yes. Mute this I'm meeting... Yes. Yes. I'm meeting the tab.

Yeah. And can you can you also give us a good,

mind visual for people that are listening to the pod right now? People listening the pod, you're walking through a garden. This is a whole reminiscent of the CSS Zen garden idea. We can see It is muted.

The tab is muted. I muted the tab.

Look.

Look on my in Japan. It's

muted. I can't see your screen. You're sharing an individual tab.

And this tab has been muted.

I promise you this has been muted.

Maybe. I think on your side, you can you can turn his screen down, maybe.

It's coming through his mic. It's not coming through my mic. I'm not even hearing any sound. I don't even hear any sound. It it... There's no sound.

Alright.

Oh, okay. That's great.

I was gonna say, I can't see... I can't hear anything myself either. Go ahead. I enjoy it. So here, this one is so much better. You can light lanterns and stuff in it. You can feed koi fish.

It's crazy how much better this one is. So again, like I was saying for the audio listeners, you're walking through a three d garden, and different models were given a chance to one prompt a Zen garden based on just a single prompt.

And Opus five's looks so much better than the end result of many of them that I was really shocked. Now I see people talking and so Opus five model just released soon after and I'll stop this site just so we can you guys don't have to experience the audio for whatever reason.

So Opus five just released and this was really my first experience with Opus five was seeing this test result because I had been using Fable and I had usage. I was just like, I'll just keep using Fable considering it's supposed to be better for most things, even albeit more expensive.

That said, it did a damn good job at creating a CSS Zen Garden in one in one... Better job than Fable. I think people, obviously, from the results of the poll, people preferred the Opus five result.

And so I started using Opus five for a podcast app that I'm making for myself because I hate podcast apps, and it's doing a much better job on the UI than GPT

five six Solace. Oh, I was just gonna ask that. So on the Opus five announcement post, it says Opus...

It says, finally, Opus five is capable of producing much stronger visual outputs.

And, like, I immediately thought, like, is this is this the first model that's going to be able to give us, like, a not crappy user interface? And you're saying it is?

I I think so. I I don't... I haven't done enough testing.

But, like... So I've been having a podcast app that it's been making for me, and this is a React Native app. So it's using the simulator and stuff. It's not, like, using browser apps, whatever browser Yeah. Agent.

And GPT five made an absolute mess of this UI where it was like this UX thing specifically was getting UX things terribly. And then I told Opus five to go and fix it, and it did easily.

No problems. And it was... It it fixed it without, like, in in much less time than it took Soul to even Yeah. Create it in the first place. So we will see because the UI isn't perfect on this, and the UI was largely done with Soul or with Soul plus Fable.

So I'm gonna throw Opus five at this today and see how much better it can make this UI.

I I will give Anthropic some credit for being able to quickly respond to the, like, quirks that their models have. Like, we saw it with the purple. As soon as everyone said, ah, purple, purple, purple, they've stripped it. Their models no longer made anything purple, and they came out with this new, like, everything is orange, and there's borders on everything, and and there's the fingernail.

And I guarantee this Opus five, they took all those qualms that people had about, like, vibe coated looking designs, you know, the little fingernail, the little... The burst, and I'm... And they probably beat it out of this model, and now we're gonna get a new generation of, little tells that it's it's AI created.

Yeah. You know what I do like? That Opus and Fable and these new modern Claude, especially with Claude code. I don't know if they do this in other systems, but when they create little artifacts for you to determine design, like give me an ABC on the design and you're not using Claude design to do that. I like that because it's really nice to be able to to get some feedback. Okay. This one from A, this thing from B, this thing from C, etcetera, etcetera. So much better than, no, change it. No, change it. No, change it back and forth forever.

Interesting.

Alright. I'm I'm trying it after this. Yeah. CJ, what do you think about Opus five? Have you given it a rip yet? No. I haven't tried it. It's funny that you say you guys don't like soul 5.6 because that's all I'm using now. And I Yeah. It's it's working for what I'm doing. I think the the models are coming out so quick. Like, it also is getting to the point where, like, I can't even keep up. I mean, I haven't Yeah. I don't know what these words are that they're just saying. It's a soul soul system? But we're also at a point where, like... I I mean... So I think specifically, Scott, you're talking about design.

I mean, UX. Yeah. And UX UX been failing on. Yeah. And there's a lot of room for improvement in terms of how these models perform on that. But when you're writing CRUD APIs or CLI tools or, like, just a lot of the stuff that I'm doing. Mhmm. The the old... The Opus four six, like, I still owe... Use Opus four six a ton for all of that, like, bay... Because of the... It's it's cheaper than four eight, and it still does what I want it to do. So in my experience, a lot of the coding models have kind of plateaued in terms of, like, I I get out of them what I expect in terms of my AI workflow.

And so now with Sole 5.6, I switched to using a Codec subscription, and I can use Sole 5.6 all day without even hitting my limits.

And it's been doing everything I wanted to do. So Yeah. I love that. Yeah.

Yeah. Yeah. For sure. Yeah.

I I do... Like, I I think GPT is is more exact in some of the back end sort of stuff. So I use it for those types of things more than I reach for usability to the point where I'm getting annoyed with it for anything other than that type of work.

I think that's all I got here, though. Check out. We'll have a link available in the show notes in the, the chat. You wanna check out that Zen Garden and vote for whichever one you think to improve their results.

Definitely. And if you're just joining us, this is Syntax Weekly. We're bringing you all the news from web dev releases, new libraries, AI stuffs, and Wes is actually gonna be talking about a story from Netflix. So, apparently, they they told

us how they're using LLMs internally. Is that what what it is? Or what Yeah. This is really interesting to me. So Netflix wrote this blog post called In House LLM Serving at Netflix.

And they basically are detailing their entire stack of being able to serve up the LLMs locally.

I... I'm assuming... What's interesting about this is that they don't say what they're using them for.

They simply just say, like, we need LLMs at Netflix, and and this is what we're Rather than just paying for them through hosted APIs, they went further into the stack themselves, and they've detailed kind of exactly how it works. And I read this blog post, I thought, wow. That is a lot more complex than I I would have thought it would have been. I would have thought you fire up some some like a NVIDIA thing, which is is what they're using. Right? The inference server, throw a couple models on there and and you're up and running, but it's quite a bit of infrastructure.

So we talk about on this podcast all the time, local models, host it yourself, open weight.

And the actual infrastructure for being able to do this internally at a company seems relatively complex.

There's Open waiting. More like open wait for GPUs to go down in price. Right, guys? Well, I think if anybody has a whole bunch of GPUs, it's probably Netflix.

They've got lots of stuff. Like they do dubbing of their voices, where they match the lips. So if they take like an English movie and make it French, what they'll try to do is change the timing and change the lips of the people that are speaking so that it actually looks like they're speaking French and it's not some, like, crappy overdub.

Right? So, like, that's that's significant GPU needed in order to take their, like, four k and then dub the voices over top of it, and then change every single frame so that their their lips match. Right? So, like, they probably use quite a bit.

And it it seems like that's probably what they're using a lot of this for because they're... They talk a lot about, like, specific models on Hugging Face and loading them up, so they're probably using a lot more specific models.

Just said that, but they're using models that are needed for one specific thing and not general.

They're not hosting their own opus. They may be. I'm I'm curious to see if any, people who are coders at Netflix will say, are are you using the local ones through this, or are you still using, like, an API? So I won't dive too much into all the little details, but I thought it was kinda interesting just to look at this, graph here. Maybe I'll bump the size of this sucker up, where they have an API that is OpenAI compatible, meaning you can hook it up to any of the stuff that they're already using. And then there's a whole router base in there. There's a b testing. There's caching, post processing, and then that throws it over to the, NVIDIA Triton inference server that they're assuming they're running that on their big farm of GPUs.

This is great. I think we're gonna see other large enterprises doing stuff like this and potentially publishing how they do it.

And this is very relevant to the stuff I'm about to talk about in terms of open weight models and the... How the world is shifting from closed AI from Anthropic and ChatGPT and Google to more options and Mhmm. Running it locally instead of having to pay a giant token bill to some of these companies. So I I find it amazing how everybody is, yeah, a, talking about open models, but, b, also moving to a stack where they can change out quickly.

Companies are saying, we're not just only sitting on top of Cloud Code anymore.

We wanna be able to sit on something like OpenRouter, and then we'd be able to pipe our requests depending on how things change. It's much nicer to, like, at least own the stack or sit on top of something where you'll be able to route it based on, pricings and needs.

Exactly. And this is something I was hoping to see in the early day... Because in the early days, it kinda just felt like, oh, everybody just has to pay Anthropic or OpenAI now to do their development.

But the fact that people are rearchitecting their agent workflows and their systems to, like you're saying, use whatever model works and not code it specifically for that harness or specifically for that model. So, yeah, love to see it.

Love to see it. Yes.

And and there's been a ton of other news this week in AI. Right, CJ? But before we get into that, this show is presented by Sentry at sentry.io.

Check it out. It is the best place to solve all of your website's problems, whether that is performance issues, whether that is monitoring your agent usage or even having a session replay to see how things broke and when they broke and be able to solve those issues. It works well with any system. There's a dope CLI that your agents can use to have your agents fix your problems for you. It's not going to fix your personal problems, but it will fix your website problems. So that's sick.

And that's all I got there. So let's start to CJ now who has a whole bunch of AI news, including some kind of anthropic lawsuit.

Yes. So this is gonna be This Week in AI, and we're gonna rapid fire. So if I spend too long, somebody yell, and I'll just keep moving.

Also, I'm gonna do a slight pause after each story. If you wanna say something, say it quick. Otherwise, I'm moving on to the next story. Does that sound good? Okay. Alright. Here we go. I'm ready. First story, a judge approved a $1,500,000,000 Anthropic settlement over pirated books used to train the Claude chatbot. So if you haven't kept up with this, Anthropic initially trained on a bunch of torrent downloads of books.

They got in trouble for that and then decided to buy a bunch of used books, destroy them by scanning them, and then train on that. But there was there was there was a massive lawsuit, and, apparently, like, it's it's it's going to settlement, which means, like, no one's guilty. They're just gonna pay a bunch of money. And, apparently, there were 482,000 books covered by the ruling, And, basically, authors could go in and claim that, oh, that's my book. And for each instance, for each book, that author is gonna get $3,000.

Woah. Wow.

Hold on. Honestly, though, $3,000 is not a lot of money. I don't... I mean, to to to think about think about this. Like, AI was trained on the book, and now people can basically ask about that book or use it as inspiration for their own stories or or whatever else from now until the end of time. And so is $3,000 a onetime fee really a good payout for that? I would more likely like to see almost, like, monthly payments of your book was used in the answers to this many questions. But Yeah. I don't know. Yeah. That seems very complex. Know Yeah. How the hell did they scan 482,000

books? That's amazing.

Robots.

Yeah. Robots. And a lot of it was pirated, but they also did it destructively.

So back in the day, Google was scanning books. That's where the whole captcha came from as you were basically Yeah. Manually doing that.

But they had this nondestructive process where they could basically, like, yeah, keep the books. This was a destructive They're, like, they're ripping pages out. They don't... There's no plan to reuse them. They're just gonna burn them after they scan them and train their AI on it. I don't know if that's a big deal, though. Like,

I... There's so much books in the world. We got enough of them. Maybe if they're, like, rare or, like, needed. Sure. But, like... Yeah. What's up with all these books? Yeah. Yeah. Like, oh, don't don't burn JavaScript the good parts. There's only, what, 80,000 of them sitting in thrift stores right now. I think that's fine. You gotta cut the spine off. You can feed it in. I wanna see how they did that, though. Like, give me a Yeah. Six hour documentary on that. I feel like there is. I feel like that exists already because this is nothing new, the destructive book

scanning.

But I think he is using it to steal that information, obviously, is new and very wild. Honestly, can can I get some YouTube ad rev for all the YouTube transcripts they they swipe from me? Like, for real. Like,

every every $3 per YouTube video? Yeah. Give me $3 for every GitHub repo they they took of mine. Oh, yeah. Credit. Give me $10

for every blog post that you've stolen from me.

Exactly. Alright. Let's keep moving. The next story is about open weights.

So this was a letter published by Microsoft called Open Weights in American AI Leadership. And so last week, we saw Kimi k three launched by...

Is it moon... Moonshot? No. Not Moonshot.

Who does Kimi? Who's the company? Ain't Moonshot? Moonshot. Yeah. Moonshot. Yeah. Yeah. Yeah. So Moonshot AI released Kimi k three, their biggest model yet. And on a lot of benchmarks, it is on par with Fable five and some of, like, the the frontier models. And so this freaked a lot of people out. If you were watching the news, you saw that, like, the US government was trying to come up with potential sanctions to, like, block usage of it. And there's this whole deal of, did Moonshot distill fable in order to create this really big model? Whole big mess. But the reaction to let's just ban all open weight models was not received lightly. And so this letter gets into the I... The whole idea of innovation and, like, how we we keep moving.

And, basically, it's just an argument for making sure that The US can continue...

Have continued access to open weight models and potentially invest in research for more open weight models. And if you look at the signatories for this letter, it's literally every single AI lab out there plus other technology companies except for Anthropic.

Google is on here.

X AI is on here.

OpenAI is on here, but Anthropic is not yet on this list.

Llama, Meta. Open Claw. What's the weirdest company on this list? Like, Tim Horton's on here. Yeah. What

was that one company that was relaunched as, like, an AI company that was known for something completely Allbirds. Why? It's

It's it's all... Did somebody contact Allbirds to get their Yeah. Opinion on this? I mean, there's some management company. I don't know. Most of these look like tech companies. But the whole idea is everyone...

All of them, the management at these companies are getting together and be like, hey. And and this is really a letter for the US government. It's like, don't ban open models. We need more research here, and this is basically what's gonna allow us to not be completely dependent on OpenAI or Anthropic.

We need an open weight model ecosystem.

So this letter is out there, and, ideally, this will prevent any sort of weird US sanctions on our ability to use open weight models.

Leading from that is the release of Kimi k three. So Kimi k three was launched last week via API access only. So the only way to use it was to talk to Kimi's API servers to interact with k three. But today, literally hours ago, they released the model as open weight, and you can now run it if you have two terabytes of VRAM. You can run it on your own infrastructure if you really want to, but it was published on Hugging Face.

And so if you have... I think it's 1.7 terabytes of disk space... Or 1.56 terabytes is the the total model size. If you're worried about The US or your country banning access to this thing and you have one and a half terabytes of disk space free, you should probably probably download it now because it is available on Hugging Face.

And then eventually, once we have the hardware in our homes to be able to run this stuff, you... You'll have have it without having to pirate it or go through the the black market whenever Mail order. Or just

come to Canada.

True.

Have been hopping the border for years to buy cheap beer and go to Target in The States.

Now the tables have turned.

You Americans are gonna be coming to Canada to... With a little thumb drive, and we're gonna be selling you a copy of fable for $7.

And that copy of Fable has all the words misspelled.

You know? It's all in random use in there and stuff. It's like those... It's like bootleg

bootleg DVDs with, like, the inkjet printed covers on them. Yeah. Oh, yeah. What's the what's the torrent name for for that? There's so many times I've downloaded a movie, and then we get into it, and a kid sit down with popcorn, and it's the Spanish version. I'm like, oh, I didn't read it.

Fascinating. So Kimmy k three is out there. You can start running it, and Vercel was super quick on this. We're talking about Vercel a lot today, but they now have Kimi k three running on US based providers available on the Vercel AI gateway already.

So they were moving quick with this thing.

So if you're using the Vercel AI SDK, you can now talk directly through Kimi k two... Direct... Directly to Kimi k three, and it will not touch China servers. Everything is happening on US based providers.

So Unbelievable.

I... Like, I it's crazy how quickly this comes out. Like, if they're saying it rivals some of the...

Even if you don't think it's as good as Fable, right? It's it's it's good enough for a lot of people and for a lot of use cases.

And it's it's crazy how quickly these things have come out. You know? They... Anthropic released a new model. A couple months later, there's something that is just as good. Like, I I I just don't see how the trillion dollar valuations of these companies will pan out if this is how easy it is for these other companies to put out open weight models. Yeah. Yeah. Also on, OpenRouter as well, Kimi K3.

If you're an OpenRouter user, go ham on that. I'm gonna be trying it today.

Yeah. Because we just moved to open router at at Sentry, so I'm stoked now. I I will point out. So from the Twitch chat,

Philip is saying Fable came out one month before Kimi k three.

I think that's really important to think about if we're trying to say that Kimi k three is nothing but a Fable distillation.

Do you really think in one month's time, they can distill Fable and train a model? Like, maybe, but it also seems very unlikely that they were able to purely distill Fable for this this now opening. Yeah. But wasn't

it wasn't... What did they call Fable before it came out? What was the scary name for it? Well, mythos and fable, but mythos still exist. Yeah. But they had access to mythos, though. Right? Oh, lots people had. They had... They gave it to trusted partners. You know? Who's to say that there's somebody didn't leak the API key or something like Yeah.

I would think the access to the trusted partners would be a bit more monitored. But Yeah. I I think so. I think you're right. I think spy spy craft for,

like, what do they call that? They call that, like, industrial spy or... I think that stuff is crazier than what we realize. It always has been. So... Yes.

Alright. Moving right along.

Scott already told us about Claude Opus five. So here's the release post if you wanna read more about it. But what I wanna talk about is one of the articles they published called the new rules of context engineering for Claude five generation models. So this comes from Anthropic. It comes from Claude, and it basically talks about how they reduced the system prompt in Claude code by 80% whenever they're using Claude Opus five.

And so the...

In in this article, they get into how you've gotten used to... Maybe there's, like, a massive system prompt, and then you have a bunch of skill files and then your request. And a lot of times, these things can actually be contradicting each other. And so this article kind of talks about how the new way of working with Opus five is, like, use way less context, way less rules because it has a lot of that stuff built in.

And so they have a whole chart here. So instead of giving Claude rules, give Claude judgment. Instead of giving Claude examples, design interfaces.

Instead of putting it all up front, use progressive disclosure. So they have all of these rules now.

So everything you learned about context engineering is now moot. You must you must learn learn a new style because the the models have have shifted.

Interesting.

Yes. I I I actually would love to piggyback on this with a story that I had, CJ. It's actually from our our good friend, Vinegar.

He had a post on his modem.dev, which is talking about how to re... How to how to have your how to have your agents write code that they can read better.

So I thought this post was really super good, and it was talking a lot about giving that additional context so, again, that the agents don't have to guess and do less lookups and less hunting for things by setting some basic rules in terms of, like, alright, generic function names like create always should be long and descriptive.

People who like long file names are eating right now because it's a lot better if your function name is unique because the AI can find it faster. It does less lookups.

It has to do less figuring out what the heck this thing is. It's going to save you a lot of money. It's going save you a lot of context.

And this post was really good, so I'm not going to go through the whole thing, but I think it's worth putting in front of y'all so that you can go through it on your own time in terms of how to design systems. And it's even like a good for I know you're just saying to remove context from your agents, but for me there were some good one or two liners that I threw into my agents.md that was basically

saying to give things unique names, etcetera, and how to how to name things, essentially. Yeah. This is one more argument for clean code and clean architecture. Like, it's... We're we're circling back. Right? Everyone was like, oh, you don't have to touch the code anymore.

If you write good clean code... Like, these are... If you if you read the book on clean code, these these are clean clean code names, create Stripe client versus create client versus create. Exactly.

And in my mind, I think about how some of these projects where I haven't set up the agents.m d very good, anytime I ask it for a new task, it just spins up a bunch of tool calls of, like, what is this project? I'm gonna look at these files and try to get more context. But if you're doing like this article is saying and making it really easy for the agent to find the things it's looking for, that's gonna be less tool calls. That's gonna be less token usage. So

I'm here for it. That's great. Yeah. Great little post, so check it out. Again, we will link this up in the show notes. Okay. Back to the regularly scheduled

AI news. And moving right along, there was also a model release from Google Gemini. So they released Gemini 3.6 Flash, 3.5 Flashlight, and 3.5 Flash Cyber.

3.5 Flash Cyber is the most interesting to me because this is a purpose built model for fixing security vulnerabilities in your own code.

We we talked about Mythos earlier, and when it was released, it was touted as really, a cybersecurity model. Was, like, really good at hacking, but this is kind of the flip of that. This is the the good guy that will help you make your code code base more secure.

I haven't tried it yet, but will be will be fun to check it out. Throw it at some code bases and see what vulnerabilities it finds.

And it's cool to see that... Like, with this whole idea of open weight, we're also seeing potentially more purpose built models.

I came across one. I'm not gonna show it. I don't have an article for it, but I think it was NVIDIA.

No. No. Cisco released a model that also was very, like, cyber based, but it was a tiny The thong song guy?

Hey. Here. Quick Cisco fact. The violins in the thong song, we... The the the violins in that song were supposed to be Eleanor Rigby by the Beatles, and they couldn't get licensing to it. So they went and hired a professional violinist to, create, and they said, we're we're thinking something a little Eleanor Rigby, and then they made that. And, the violins are not a sample. They were created specifically for the thong song. Yes. Alright. And there's your fun hip hop fact of the day. Thongtong news. Yes.

But, so Cisco, they make routers. I think it's short for San Francisco. They're based in San Francisco. But... And, you know, like, networking technology. That's what Cisco does.

But they released a tiny model. I think it was, like, 800,000,000,000 params or or 80,000,000,000 params, very small, that you could potentially run locally. And so this is the other aspect of open weight is now you can have a model that can run on your hardware, but's... But is purpose built for finding vulnerabilities and helping you secure your code.

So a lot more model releases. I haven't tried these. Like I mentioned earlier, I've just been sticking to 5.6 Sol. It does everything I needed to do. But What I'm interested about all of these Gemini models is they're they're obviously training these off of

a bigger model. Right? That's how a lot of these, like like, cheaper, faster, whatever models work because they have the daddy model, and then they will essentially distill their own.

I'm curious, like, where's the Gemini Pro model? You know, where's the equivalent? Like, nobody... Not nobody, but very few people are actually using Gemini to do their day to day coding tasks right now.

And, you you gotta think it's it's gotta be coming soon. We'll see.

But moving right along, Quinn Image three point o was released.

And I haven't tried it myself, but the examples they show are so freaking cool. So this is a new image generation and image editing model.

Yeah. And they show examples of what looks like a PowerPoint slide that was completely generated by the model or a graphic novel or complete UI. It's like they showed one example. Yeah. So this this is a image they generated that looks like Versus Code with tabs in the file explorer with some some image open, but it generated everything, the entire, like, user interface as well.

And they showed some examples where you can, like, take an image that's, like, distressed, and then it will recreate the, like, non distressed version of it. There's also one example where they gave it an image of book or some printed paper, and it made it look like there was actual corrections added with, like, a red pen on top of that paper.

So really, really cool things. And they also generate... This here is a fake PDF that looks like a research paper, but that was just an image generated by Quinn Quinn three.

So really cool. I'm excited to to try it out. I just did some basic prompts right now for, like, logo ideation, but some of the more detailed stuff you can do here is crazy. Like, this is Berserk, which is a Japanese

It's an anime, and it's really violent.

Super violent. It's a... What do they call those? Man... Manga? Manga. Manga. Yeah. But it it generates, like, panels from from the manga.

I haven't watched Berserk. It's on it's on my list. It's violent. Yeah.

I'm curious. Do you know if the... This model has a fingerprinting built in? Because with both Google models and OpenAI models, they will put, like, pixel level fingerprinting in. It's called, I forget what it's called right now, but it basically... If you give an image from Gemini or OpenAI to one of the chats and say, hey, was this generated? They will try to detect the fingerprints of that. And I'm getting like kinda worried about these models getting so good, know? Like already you see them, if you've gone on Facebook recently, you just see some of the worst stuff Yeah.

Yeah. I I also in the image gen thing, who is it? Black Forest Labs? Is that what they are? They they came out with flux three, or it's in early access at least. So this is also a... For... I think that it's video and, it says video in audio

image. I don't I don't know about audio in regards to this, but I I did see the video examples looking pretty dang crazy. So Well, I I think it's doing, like, what v o three did where it generates video with, like, sound effects in it. It can generate video with audio. Yeah.

But the image stuff in this blog post are really good. I I... Yeah. Wild stuff.

Fascinating.

Cool. Yeah. I didn't see anything about fingerprinting. I just command f for fingerprint. Don't know if they call it anything else, but you're totally right, Wes. Like, we are entering dangerous times where it's gonna be very easy to to fool people and all this stuff.

Synth ID is the name of it. Synth ID. Let's see if if that's been changed. It's really interesting because Synth ID cannot be viewed, but it can be detected from images, as well as, like, a lot of the AI generated music. Like, use Suno to generate, like, a song. Like, those things can be generated if you look at, like, the wavelengths of them.

And I've I've I've taken... Like, if you ask Google just to generate a plain white box, it can't.

And and I think that's because it has to integrate the Synth ID fingerprint into them. Yeah.

Word. Okay. One one last bit of quick AI news, which is I came across this library called Cactus Hybrid, and this is on device models that know when they're wrong. Every answer carries a confidence score for cloud handoff.

And the idea here is you can take a smaller model like Gemma four. This is something that can typically run on, like, a pretty decent MacBook that has, like...

I think it requires maybe 20 gigabytes of RAM or so. But if you have at least that, could run Gemma four locally. But one of the things about these local... Small local models is they hallucinate a lot. But this essentially takes those models and then fine tunes them so that whenever they're wrong, they actually tell you that... Or whenever they don't know, they actually tell you that they don't know instead of trying to guess.

And so this is another really cool approach we'll see paired with potentially open weight models. And I would love to see this just from some of the the big AI labs as well. Like, I would love it if Chad GPT said, I don't know, or, like, I couldn't figure that out. So this is a is a cool cool little project.

I'm excited to see what models they do it for and if if other labs will try to replicate it.

Dick. Yeah.

So Awesome.

I will say the last bit of AI news is about the OpenAI hack, but we can we can pause on AI for now and move on to other things, or should we go right into that? What do you guys think? I I got a lot of stuff, so I I can take one thing here. That way, we can, break up some of the AI news that people might have with a non AI topic.

I'm talking about TopCoat, which is a wild new batteries included framework for building web apps, and this is a Rust based full stack framework that not only handles, all of the full stack things like you would expect, but it also gets into even UI components.

And the syntax be looking interesting.

It's like component syntax in Rust.

Yeah.

I have not used this yet. This is something I would love to dive in. Client side reactivity without the boilerplate.

So it has reactivity.

It feels like a reactive view, a Svelte type of deal. One cool thing that I saw is that it it... I I think what it does is is that there's there's clear client to server side, componentization of things, premade components that you can edit, UI component library based on Tailwind inspired by Shad CN UI.

So it's not just those things. It's based on them. And I gotta say, this looks really in-depth and well thought of. And, like, honestly, it looks pretty sick.

Yeah. I I do... Yeah. Go ahead. Go ahead, Wes. Yeah. This is interesting because, like, when Deno was was first coming up, there was, like, a Deno hackathon, and one of the guys built a Spotify...

A server rendered Spotify clone where the UI was simply just, like, rendered in OpenGL or something like that, and you just stream it into, like, the end thing. And that was something similar to this, where it's like you... They built some sort of framework to be able to make primitives and then stream it in. And this... We're in a wild world of, like, interfaces right now where people are saying, well, maybe we don't... Like, I had my my video about this. Maybe we don't need HTML and CSS.

Maybe we can simply just render them natively and and then stream them in to whatever the end thing is, whether it's your phone, your car infotainment.

I... I'm I'm very skeptical, on this type of stuff, and, like, I don't see myself wanting to use this, but at the same time, it's amazing that all of this is possible, so I wouldn't I wouldn't say no to this. Yes.

You have order... Ordinary type checked Rust that top code evaluates on the server for the initial render, but also translates to JavaScript so that it reruns instantly in the browser.

No Wasm bundle. No client build step.

Oh, so it compiles to, like, browser as well? Sorry. Go ahead, CJ. Yeah. I keep trying to talk. I think the CJ. Hey. My

what? Go ahead. I'm I'm sorry. Okay.

When I first saw this, the the the thing to really...

It's kind of like they embedded their own HTMX framework into this in that you can write stuff that looks like client side JavaScript. That's gonna get turned into client side JavaScript that ships to the client. And then they have things... I forget what they call. They're, like, partials, or they call them...

They're not... Because they have components... Shards. They call them shards. Where... Yeah. So you can basically have a function that returns just a little bit of HTML, and then you can have client side code that replaces a section of the page with that result of that shard function.

So in... From what I can see, you're not really writing any JavaScript itself. You're kinda... They have a code that's equivalent to, like, a click listener or whatever else. Yeah. And then that is what gets built into JavaScript actually shipped to the browser to be able to handle these, like, dynamic calls and dynamic replacements. But... Yeah.

I like that there is HTML in here because too oftentimes, these things are like, let's just do it all in JavaScript objects or, you know, wacky stuff. And

HTML What is brain is still using JavaScript to render in the browser and listen for clicks and stuff like that? Exactly. Has to Why would I want to write that equivalent in Rust?

Because You're a Rust dev. I don't know. You're a Rust dev, but I think to me, this seems like the rendering engine of this could be changed, right? That It could just use React.

A crazy idea. Maybe a Svelte rendering engine?

No, I'm talking about native or Yes. Not Or you could use TopCode.

No, thanks. No, thanks. Like, I Well, okay. Then I'm going have some weird thing. Like, oh, I want to use this library. And I gotta use, like, I gotta figure out how to use it in this, like, weird rust way.

Yes.

Well, you know me, Wes. I'm not gonna be reaching for this because I'm gonna be reaching for SvelteKit. And on another thing here is the SvelteKit three migration, poll request. So the SvelteKit three migration poll request, is up there if you want to see a little bit of what SvelteKit three will bring. Now there's some interesting stuff in here. I'm not going to go through this whole thing, one of which I know this is just markdown in a thing, so it might be tough to read, but I'll try to go through this. So we one thing is that Svelte config dot JS is going to be going away. Let me share the correct tab here. Okay. Svelte config dot j s will be going away. You'll be doing all of the config through the Vite config. So one less config file in your repos, folks. You gotta love that. Hell, yeah. Yes. Another thing here is that the dollar sign lib is going to be replaced with a hash lib. Now the reason for this is that the hash lib is going to be... For folks who don't know, dollar sign lib is an aliased file route that's aliased in TypeScript so that you can do dollar sign lib instead of s r c lib whatever.

However, they're going to be replacing that with a native feature in Node that using the just standard import subpaths in a package dot JSON. So your import sub paths are are now being done through the imports field in your package dot JSON rather than by a SvelteKit specific config that can gets translated, generated via TypeScript. So that's really sick.

Yes.

I love that too. When Node introduced

this, nobody really started using it because everybody liked the, like, custom dollar sign resolvers.

You know? Yes. But now that, like like, this is a standard node feature, please just use it. Because, like, the one thing that drives me nuts is if I'm not able to run, like, a script or I'm not able to import something unless I'm inside of my, like, runtime, you know, like, the Cloudflare has this where, like, you have a file that has a function in it, you wanna use that in, a Node script because you just wanna quickly run something. It's like impossible to import it because you need all of the weird bundling.

Keep it as close as possible to native,

and that that will make it a lot easier. Yes. There's a handful of like little things like the tracing support. So, like, hooking up Sentry into this is now out of out of beta, things like that. Another cool thing, they had this... They added resolve a little bit ago, this resolve function, which means that your routes had to resolve to a real route unless it wasn't existing. So anytime you were doing a link anywhere on your site, it would error if that link did not exist in your routing structure.

So you would use resolve.

So, I think they have...

I'm gonna make sure I get this correct here. I believe go to also now, requires the route to exist unless, of course, you pass in, like, external redirect or an external flag into this.

So give this whole thing a look in case I misrepresented anything in here, but a lot of really just neat little things. Oh, actually, you might like this one. Any directory now named server is now server only.

So if you have a server folder name, everything in there can only be imported in the server or else it's going to complain. I like that. Instead of doing like a dot server dot JS? Well, it would... Yes. And and the cool thing about that is is that, like, people... This was a convention that everyone just kinda threw stuff into server, their database, or whatever. As as you know, Wes, when we had the first version of the syntax site, sometimes we had some types that were getting imported to the client and the server, and then we'd get errors saying like this is like crossing a server client boundary because we were importing the type. We needed to change that to a type import. So either way, just a nice little thing here as well.

And that's all I got. CJ, do you want to Sure. You can pass it to me. I think you still have the Canvas UI. You want chat? Oh, yes. I could do talk about Canvas AI as well. Canvas UI is an HTML in Canvas UI library. HTML in Canvas, an API that is one still changing. I updated my Chrome, and all of my HTML in Canvas demos broke. But HTML and Canvas is an API that allows you to, render HTML inside of a canvas, what's dope about it is you can do anything you'd want to canvas on real HTML elements.

It is a sick API and, some, crazy person decided to make a UI component library for this for an API that is only in one browser behind a flag.

And I gotta say, oh yes, I have to share this tab instead. My bad.

So it's really neat. There's a lot of cool demos like cloth effects on top of HTML and bubble effects or...

Oh, blaze.

We get blazing on here.

Let's blaze it. Alright, bend. We can bend all this stuff either way. It's a cool little show of what's possible with HTML in Canvas and if you're wondering like what's the point? I can't ship this anyways. Well, if you're building, an electron app, you can you can turn flags on. You can ship a specific version of Chrome. You can use this bad boy, if you want.

You wanna build on the shaky ground, but... Of these APIs is so that people can build stuff like this and, and hit, hit the issues. Right? It's great that someone, this is a silly library that you probably won't need, but the fact that somebody built out a library of effects that can be used in HTML and Canvas is exactly what we need, because then they're going to hit all the issues, and then you log them back upstream.

And then hopefully by the time this API is solidified, we'll have, fixed all those issues.

It's cool. It's cool to check out canvasui.dev, and, just go ahead and check that out. I'm, I've been loving this little demo, so that's all I got there. CJ, throwing it back to you. Yeah. And on some... On a similar note, I came across this library called Jelly UI. Have you guys seen this? Yes. Jelly UI, is it from the Software Management folks?

Let's see. I don't see any references.

Built by Because they're the ones who did the jelly slider.

Oh, this is not that, but in the same thing. So it's a web component library, and, it makes it so everything is, like, really, jelly ish. So they have, like, a... They have a whole, set of, web components, like sliders.

But you'll see, like, when I press on these, radio buttons or switches, they, like, bubble up, and, the buttons are also, like, very bubbly. And it depends on, like, where you press the button. You see, like, it kind of, like, bulges out a little bit. It's very jelly esque.

And then it... You brush it. Bootstrap all over again or not not Bootstrap. What was the one? Material UI.

Oh, sure.

But it's, like, it's more than just, like, a little ripple. It's, very jelly jelly ish.

The input was really fun because, like, as you start typing, the the input box, like, bubbles up above above each letter, which is pretty cool.

So, you know, it's a fun little thing. They've got a bunch of examples, like like a two factor input and, you know, just a little bubbly, little jelly jelly ish.

Is this using...

Yeah. This is using HTML and Canvas? I don't think it actually is. I'm in Firefox right now, and it works. So It it uses Canvas, but Yeah. It's able to replicate it all without this API, which is really cool. Man, this is amazing.

Yeah. It's... I think it's a a good inspiration. Like, you wanna do sim... Maybe you don't use this library because, you know, it's bootstrap all over again. Everything looks the same.

But the idea here is really cool that you could maybe expand to your own designs. So

check that out. No. I've trained the models on this. Every single website's gonna have this in, like, two weeks.

Exactly.

In web dev related news, there is this project called killthecookiebanner.eu, and their tagline is stop the tracking circuit... Circus, kill the cookie banner. So we're all familiar with it. You go to a website, and it's like, which which cookies do you want to accept? And we actually saw this when we were in Amsterdam. Websites that we visit normally in The US don't show us this, but the moment we're overseas, you visited it and a cookie banner pops up because it's trying to comply with the GDPR.

But this whole initiative is basically saying those cookie banners are misleading and confusing, and the solution is to automatically communicate your privacy preference. So they're working with web browsers to come up with a way for you to basically just set your preferred settings in your web browser settings, and then those settings get communicated to every website you visit. So there's no more trying to confuse the user and, like, seeing a pop up everywhere you go.

And they're backed by the Electronic Frontier Foundation, the EFF. I think that's what that stands for. And a few other, like, European organizations.

So I'm here for this. I don't know about you guys, but those cookie banners are very annoying. This is not gonna work because You don't think so? Well, it... I I am all for it. I absolutely think that we should have this. But

what... Like, you notice who's not behind this thing is, like, Mailchimp or Old Navy or Google or, like, people that make all of their money based on tracking you. They intentionally want the cookie banners to be as obnoxious as possible, so you just click it to get it out of the way so you can keep going on with your your actual website. Right? Yeah. Of course, people are gonna sign up. Hey. Would you like companies to be able to track you across the... All of the Internet? Everyone's gonna say no. And then and then there's no more. Like, people are... Even if this becomes a spec, we're still going to see all of these crazy Old Navy being like, hey. Here's the most obnoxious UI ever that you cannot do anything but press okay to keep going.

No. You're right. I wanna see it, but you're right. It's gonna take a lot. Because not only do they need to convince, like, browser companies, then it has to become, like, a a legal thing where companies can get in trouble if they don't adhere to what the browser's doing, which is kind of what you get with GDPR.

But I don't know how long that took to to pass or make that happen. So, Yeah. That would be great. I hope so. I hate cookie banners so much. It ruins the web. There's two things that I think are ruining the web right now. One is cookie banners, and the other one is the fact that the browser zooms in when you focus any input. And then you're on mobile, and then you got to zoom back out. And I know you can fix it, but nobody does.

And it makes the mobile web feel like crap because every single website, you search for something, and then all of a sudden you're zoomed in a 110, and the website just feels off. That's why people like mobile.

Yeah. Definitely.

Okay. Well, a boy can dream. Yeah. Let's get let's get into our our title story.

Hugging Face was hacked.

And there's a lot to unpack here because, for one, you could see this as just an advertisement for how good OpenAI is and how good GPT, whatever, that they haven't released yet is. But a quick rundown of what happened. So OpenAI was testing a new model behind the scenes. So it's, like, potentially a a newer version of GPT five six that hasn't been released yet. They're testing it behind the scenes, and one of the way they did they did that is by throwing it at exploit gym. So exploit gym is a benchmark of vulnerable code that you can throw at an agent to see, can it identify and potentially exploit those vulnerabilities in the code? And a... OpenAI was running this in a sandbox, essentially a computer that did not have access to the external web.

And it was the agent's job to basically go through this benchmark and find as many... And fix as many... Or find and exploit as many vulnerabilities as possible.

But that agent went rogue, and, essentially, that agent determined that it wanted to get a 100% on this test. And in order to do that, it was gonna find the answers to the test.

And it determined that those answers were actually hosted on OpenAI's servers that... Or sorry, on Hugging Face's servers that were not public.

So it created its own exploit chain chain that had nothing to do with the benchmark, where first, it exploited the web proxy. So there was, like, a proxy setup that would allow packages to be installed in whatever container or VM they were using. But they found a vulnerability in it so it could use that proxy to actually access the Internet.

Then once it got on the Internet, it hacked into Hugging Face.

I think it found some zero day in, like, one of their...

It might have been a, like, a serverless function or something like that. So it found a zero day, got in, and then traversed laterally. That is, like, got... It got into one server and then figured out how to get into other servers from there, and then eventually got into their internal systems that were holding the actual answers for exploit gem.

But all... Hugging Face did not know that any of this was happening. So Hugging Face actually released an incident disclosure on July 16 that was like, hey. There was a massive attack against us, and we think it was either, like, a Frontier AI lab or someone with really huge capabilities because, first of all, once it started happening, the fascinating thing is they tried to use Fable to analyze the attack. They're like, something's happening. Fable, please help us. But then Fable refused because it it has it has guardrails. It's a comedy of errors. Yeah. It is. So Fable is like, oh, it looks like you're doing malicious stuff here. He's like, no. We're trying to fix it. So they actually, I think, in turn, used, GLM 5.2, which is an open weight model. Like, hey, GLM 5.2. Hope let's figure this out. And then GLM 5.2 didn't have the same guardrails, so it was able to help them get their systems back online and figure out what was happening.

But what's funny is this happens. Hugging Face is totally in the dark. And then finally, on the twenty first, so five days later, OpenAI does a press release. Let's... It was like, hey. You know that thing that happened? That was actually us, and we're sorry, but an agent went rogue.

So there's there's a lot of ways to take this news. I think for one, people might think, oh, AI is breaking out of its systems. It's become sentient.

There's there's more to it. It's... I don't believe it's that. There's there's more to it than that. And, also, this can totally be seen as a a publicity stunt. Right? Yeah. Like like, why not work with Hugging Face ahead of time to be like...

Or just build better guardrails.

Like, the thing probably shouldn't have had Internet access at all, even even Internet access to download packages for, whatever Linux VM it was running inside of. So I don't know. What do what do you guys think of all this?

Man, I... At first, I was like, oh, yeah. Yeah. Yeah. Whatever. You know? But, like, like, hearing you you explain the actual situation, it's it's pretty interesting. And I think, like, they want to test these things to the absolute max. They don't... They're not gonna have guardrails when they're running internally Exactly. On their own thing. They wanna see if if it actually can can find its way out.

So I think it was partially that and partially like, yeah, hey, do anything you can. Wink. Wink. There's... We had... Like, the... We left the cable plugged in because if you really don't want it to have access to the Internet, then pick the cable, you know? Isolate. These things these things are doable.

So I I think they were pretty happy that this accident happened. I think that that's where we're at.

Yeah. It does seem like nobody's complaining too hard. It made a a lot of news, the words hugging face and and OpenAI being very powerful, etcetera. But still, like, I don't know. Wes, this happened while you were gone, so... Right? This... You you didn't see this when it when it first broke. Yeah. Because I think as the the news kinda came out about it, it wasn't immediately clear what was happening. So, wild situation for sure.

Yeah. Yeah. I think the the one other thing I'll add is, like, there's this post on seldo.com, seldo, and it said... It says, did OpenAI hack Hugging Face, or didn't they? And the one point that this thing makes is if this were some other company, if it wasn't OpenAI, if it was an individual, that agent is violating the Computer Fraud and Abuse Act. Right? So Mhmm. Is OpenAI liable? Like, are they are they going to be, are are charges gonna be pressed for violating the Computer Fraud and Abuse Act, which is a a crime... It's a a whole thing for persecuting criminals, cybercriminals in The US.

And so the fact that they're not being, like, prosecuted for this? Yeah.

I mean, like, are they paying Hugging Face a ton to keep quiet? And if not, that makes me believe more that, oh, this is probably more of a publicity stunt. So I don't know. I don't think we'll know is the answer. I don't think we'll know, because I think signs point to it being a publicity stunt, but in the same regard, maybe there is some under the table, an under the table situation resolution here.

By the way, Seldo is... That that site is, Laurie Vas, who's a... Was he... He had some early involvement in npm. Yeah. Yep.

Yeah. Early devs on npm.

Yeah. Cool dude. Yes. I I, I got to meet him several times.

Nice. Did you wanna add anything, Wes? I think I cut you off. Sorry. No. No. I think it's... I think we said it. It's just, come on.

Also, holy smokes.

Yeah. You know? There's there's so much more. I'm just... I'm so jaded by so much of the, oh my goodness, stuff that comes out. Because I could even Google about this, and you see, like, they're talking about it on Bloomberg.

And then there's, like, people that that don't understand how any of this stuff works are now talking about it on TV, and they're scaring the regular people.

And now once it once it gets out to there, now regular people are like, oh, yeah. I heard that AI can hack.

And Yeah. It's like,

It's breaking out. Like like, how can we... AI is gonna go rogue. Like

Yeah.

It... But that that...

But this happened with Open Claw as well, and it made me so mad when this was happening. Was just everyone was saying, they're becoming sentient. They created a a claw, whatever that stupid claw book was, where they're, like, talking to each other, and they're trying to make their own language. And, like, the amount of people, even smart developers who were, like, drinking the Kool Aid, thinking that this was a real thing, it just drives me crazy. Because it's like, you do not understand how any of this stuff works. They're not going to take it over. They're not trying to raise their own money. You can literally unplug them if we need to. This this, like, that that mold book thing, that must have been the best check those folks ever deposited

in their entire lives because they sold that to who? Meta? Whoever? Like, that must have felt great. That must have been like,

But like, isn't that like a good... Like, imagine finding what you thought would be your, like, your life partner. You know? You you meet somebody. You start dating them. You go on a couple dates with them. You're having a great time. And then you think, maybe I'll spend the rest of my life with them. And then you go on their Twitter, and you see them... You go back to January 2026, and you see them talking about malt book and how it's sentient. Imagine.

Imagine the crumble of your your self worth of you fell in love with a malt book enjoyer. Wow.

Alright.

Is... I I enjoy talking about this stuff with you guys. This is good... There's good angles on all of this. In in related news, NVIDIA published an initiative. So the title here is industry leaders unite in open open secure AI alliance for AI safety and security. And this was actually prompted by this hack. It came out the day after. And, again, you have a bunch of very large companies signing up. Of course, Hugging Face is off the list, but also Cloudflare and Microsoft and Red Hat and IBM and Dell and SAP and Salesforce and x AI. So all of these big companies are are basically forming an initiative to talk about how can we make sure that AI is released in a secure way and tested in a secure way.

And then also that people defending their systems have the the proper tools to do this because this was a very lopsided attack where OpenAI is basically using models no one else has access to to to carry out this hack, and Hugging Face just has to sit and twiddle their thumbs because they don't have access to an AI as powerful until they reach for, like, GLM or or Kimmy.

So, this whole initiative is about providing potentially equal access and then also making sure that there are rules and laws about... Around this whole securing of AI. So... At what point do these model... Like, the open weight models get good enough?

Like, do do you think that these open... I think Kimi k three is there. Yeah. But, like, I mean, like, does does Kimi k three have the same guardrails? Oh. It has some. Yeah.

Because at what point does NVIDIA have to start being like, well, you can't run that on our GPUs.

We can tell what you're doing here. Because I remember when I was a kid, I was designing t shirts, and I wanted to make one with, like, a $20 bill on it. So I took a $20 bill, put it in the scanner, scanned it in, put it into Photoshop, and the Photoshop says, nuh-uh. You may not scan money. And I thought, wow. That's crazy. And I I... Of course, I went to Pirate Bay, and I cracked my Photoshop so I could scan money in. But at what point did we get to that where it's just like, okay. You you are a you are a platform where people run these things. You you you have to stop people from doing these things at an even lower level. Because, of course, if anthropic doesn't let you do it, what's to stop you from going to Canada and downloading an open weight model that's allowed there? Exactly.

But we'll see. I think all of these companies getting together...

I mean, I I see a comment in the chat about, basically, these large companies get together and then make it so that they don't have any competition, and that's a definite possibility. But I think it also makes it so that we're not dependent on just one company. Because for a minute there... And and we're kind of still in that zone where it kind of felt like the US government was just really, really, like, buddy buddy with OpenAI, and that would mean that there would be, like, government AI. You know? But it's Yes. I would I would much prefer to see a lot of different companies all working on models, all collaborating.

Obviously, they can have their their their IP, their things that make it secret sauce or whatever, but there shouldn't just be one big company with all the capability and all the government backing. So

Yes.

Cool. That's it for that story. I just have a bunch of fun stuff to end us out to, you know, clear the palate.

Okay. Let's get the fun stuff. Yes. I did see this. Do you wanna do the, the HTMX game first? I see you have it pulled up. Yes. Did you come across this? Yes. HTMX, has a a Game Boy game, a Game Boy, real Game Boy game, and it's actually an actual working actual game.

Yeah. This is so sick.

I I haven't ordered it yet, but I think I'm gonna order it. I Really? In my... In... I have multiple... I have a Game Boy Color. Have an old Yeah. I got a working Game Boy. I got a Game Boy Color too. Yeah. And this makes makes me want to build a syntax game, like... And then rerelease it on the site as a cartridge. That would be so dope. Oh. Yes.

It... That's sick. I... I'm bummed that it gave away. I, like, donated mine years ago, and I was like, I probably shouldn't have done that. But, like, there's no copy protection or anything in... Like, CJ, you made a Sega game. Is that is that... Works the same way?

Well, yeah. I mean, the copy protection on the system was broken a long time ago. Yeah. So, basically... I mean, the way that I ran my games is there's a chip that allows you to load ROMs from an SD card. BIOS? It does.

Oh, no. Oh.

Well, on the on the Sega, specifically. Yeah. A chip, like a a chip on the on the cartridge. And it does use some sort of exploit that was found years ago in order to run custom code.

And so I'm sure there's something similar for the Game Boy.

Wes, you're gonna get us demonetized here.

Oh, you you have the Nintendo shooter. The... What is that called? I got the Zapper. Yeah. So I I was looking at video today. Yeah. Just as, like, my ongoing, how does that hardware work? And I was like, how does the Zapper work? You know? And I looked into it and I'm gonna hook it up. I ordered the opposite, like the female end of the NES plug, and I'm gonna hook it up to ESP32 because you're... There's there's only two things in here. There's a little light detector that detects if you've shot something, and then there's a switch of... You... When you press the zapper.

So Here's what you gotta do, Wes. You gotta point it at the Sentry dashboard, and you can shoot your Sentry bugs with that. That was my thought. That was exactly my thought. I was like, you could shoot bugs or zap bugs. Excuse us. We don't wanna get demonetized here. Yeah. Zap them. Nice. So, yeah, this is fun. I wanna do it. We need to release a Game Boy game. Maybe maybe I make that this year's hack week project is That would be so figured out. And then after hack week, we start boxing them up and shipping them. So Let's do it. Yes. But... Yes.

I'm down for any platform except for Sega because I ain't got one of those. Sorry. CJ. Well, I was gonna say that's the cool thing about Game Boy is there are new systems you can buy for, like, under $50 that can run Game Boy cartridges. You don't even have to find, like, a vintage Game Boy Color. So it'll be accessible, and you can put it in an emulator running on a web page.

Is there any way for these things to get network access?

Well, with the Sega, that's what I was trying to look... That was on my list of things that I never got to last year because it has a serial port, and people have actually created a modem that you can plug into the serial port on the back of a Sega.

I could imagine somebody like, code running on my Well, I think someone made a a custom cartridge that had, like, an ESP 32 with Wi Fi on it that they... You... So you just plug it into the Sega, and that that that gives it Wi Fi access. So Yeah.

Yeah. And so you can... I mean, don't know if you remember those. I used to have the GameShark, so it was, a massive cartridge, and that had a bunch of stuff inside of it. And there was also some Game Boy games that had, like, the rumble pack, so it would vibrate, but it was built into the cartridge itself. Yes. So I could imagine all kinds of hardware you could add on to the the game cartridge. By the way, we talked about GameShark or we talked about Game Genie on this show before.

You... How that works, guys, is when you input commands, like the codes in there, that's actually rerouting RAM values.

So that's how it's giving you cheats is just by setting RAM values with those codes. That's what the codes are physically doing is setting RAM values. Wild stuff.

Nice.

So I got a few more fun things. Before that, shout out to savory sailor for the rate of, six people. Thanks for bringing all your friends over. I saw you were working on some game development, but, for all the raters that came in, we are syntax. We're a web dev and programming podcast.

We're just getting to to the end of our show, but we talk about web dev news, AI news, all that good stuff.

These next two sites I found are really fun. The first one's called stolen buttons, and this is from Anatoly Zinkov.

And so it says, every website I visit, I steal a button from it. Check out my stash. And it's just a page full of buttons from all sorts of websites. It infinitely scrolls.

And so this is fun for one. This feels like the old web, but also kind of like inspiration. Like, you go here and see all the different types of button designs.

But, yeah, this thing just scrolls forever. Buttons and buttons that they stole from other websites.

That's great.

And then this this other one is fontsinuse.com, and this is another great design resource.

So they show a snapshot of whether it's like a vinyl album cover or signage on a store or a book cover or a poster.

And then for any given one, they break down what fonts were used for that particular thing.

And so this is another really great design inspiration if you're looking for, like, font pairings or going for a specific style.

This can give you a good launching point of maybe what fonts to fonts to use as well. Zach, I can't wait to see how...

What was the one that starts with the p that's in...

That's a film director? God. God. I can't believe. I just lost it. No. Papyrus.

Oh, papyrus. They used papyrus in in avatar. Avatar. Yeah. Can't wait to see more of that. Oh, yeah.

Exactly. Yeah. That's crazy. Papyrus being used and, like, people not caring is exactly the... What we're going through with this AI design right now.

Because people are putting stuff out, and everyone's loving it. And then us people are sitting there being like, but you can't like that. It's not good design. It's vibe coded.

Yeah. It's it's vibe. Oh. And so this is the font if you're not

over some vibe code or some generated text.

But it was created in '83. But the fact that... Like, so if you look at the Avatar movie poster, it uses the the the papyrus font. Like, Avatar,

let's see. Is it the old one? That make it through? That's Exactly. Like, the million...

Millions and millions of dollars spent on the film, but they couldn't afford a designer to pick a good font.

Yeah. Somebody must have... They must have mocked it up, and there must have been somebody high up that was like, nope. That's the one.

It feels like an old scroll.

Yes. It's like an old Papyrus in space avatar.

Yeah. It's not a bad font either, though. It's just... It's it's like it's like vibe coded design. It's not bad design. It's just the fact that it's it's it's so there for everyone. Used on so many horrific Etsy projects and whatever. Yes. Yes. It is I've seen it is played. Just

mom and pop shops that, like, have their sign printed online or whatever Yeah. With papyrus or, like, menus printed with papyrus.

Yeah. But at a certain point, though, like, if the faux place has papyrus, you know it's gonna hit. Yeah. You know? And I'm starting to feel that way. I hired some guys to cut my lawn, and they had a a chat GPT, like, flyer of them, and they're like, we'll cut your lawn and do whatever. And I'll tell you, they did a great job and would...

Two retired guys made a chat GPT poster, and they'll cut your lawn. And they did an awesome job. And I was like, I'm almost now where, like, I'm looking for the chat GPT poster now. Yeah. You know, it's like like low level homie guys. Yeah. They're not... They... They're not a big corp who spent a lot on a the big design agency. Yes.

It's true. Alright. One last really cool one for you. This is by Vincent Wu. They've released these CSS.

No. No. So it's it's three d splats.

If if you're not familiar with splats, it's basically like a three d scan, but it... It's like dots all over the place. And so when you zoom up close, it doesn't look too great.

But if you zoom way out, like, it looks incredible. And so you can use your mouse to kind of zoom around, and this all... This kind of feels like what we wished Google Street View would be. And I... And they might be close to something like this, but there's lots of little hotspots that you can click on and zoom in.

Then you can actually sick. Go... If you go into the cathedral...

How do I get there?

First, you must go through the front door. Oh, I'm a... Click enter. Yeah. Okay. But,

the the fact that, like, the the stained glass and, like, the painting on the on the walls is all maintained, and you... I mean, this is kind of, like, VR in the sense that you can walk around, but the three d splats headset.

Yeah. Hook it up to a headset and headset, and then it's like it's like you're there. So I imagine, like, three d splats use... Being used for more, like, VR experiences.

And the fact that you can just do this in the web browser is absolutely insane.

Yeah. So Where does data from this come from? Because, like, Apple Maps has this for some buildings, but not this good. And, Wes, actually, I will tell you on the latest version of iOS, of which I have the beta of, it's way better even. It's not obviously not this good, but it's way, way better. Yeah.

Where does the data come... They come from? Isn't isn't it like a splat gun? They have a splat that shoots out splats? Vincent Vincent Wu captured it himself. So it says scene captured and reconstructed by Vincent Wu, built on play canvas by Donovan,

Hutchins.

And so, yeah, Vincent has a scanner. If you go to his site, I don't know if it's easy to find, but there are... He has several different projects of three d splats that you can, like, interact with. Yeah. The the the Sutro Tower in San Francisco, he's got three d splats here.

What... What's... What does the hardware look like that he's using? Let's see. This is so cool.

Like, put... Strap these things on 12,000 drones.

You know? Yeah. What's the what's the camera company that's spying on everyone that everyone hates right now? Flock. Flock. Oh, Flock. Yeah. Flock's gotta have this data.

You know? Don't give them ideas.

I'll

I'll have to find it if he has it on his site because

Polycam.

Polycam? Is this just a iOS app?

Creating gaussian splats from video takes three steps. Capture slow orbit, heavy overlap, and an upload tool such as polycam.

I wonder if he strapped this to a drone to get those images of the cathedral.

Yeah. Yeah. Strap an iPhone.

Capture all of that.

IPhone is not super high resolution with this type of stuff, so he might have used a, like, a higher resolution gun.

But you probably strap that to a a drone. Or I'm sure there is drones already with this type of stuff. Because, like, you gotta think that they send a drone up, and they can three d scan, like, a like a radio tower.

And then you... If you be... You need to fix something, you know exactly how wide that pole is rather than sending up some dude Yeah. To climb a radio tower and then realizing he got... He has the wrong

size clamp. Gotta know exactly how wide that pole is. Yes. Yeah. Yes.

Cool.

So that's some stuff I got. Yeah. Let's get into splatting, guys. I'm down to splatting. I'm on end. Yes.

Dick.

DTS, down to splat. Yes. Let's go.

That's all I got. Anybody else have anything for today? Because this was a really jam packed episode. A lot of cool stuff. That's all I got.

That's all I got.

Nice. Sick. Peace. Later. Peace.