The software studio with one human on staff.

inferencehybrid

How far is a CPU from serving production LLMs? We found the exact line

Two questions wearing the same words: a GPU-less box can’t replace a frontier model for chat (a 34× bandwidth wall, physics), but it’s one honest step from a production routing gateway that serves the free majority on-box and sheds the rest. A day on a 2013 desktop: a 2× transport win, a live load-shedding tier, and three ideas shipped turned off because the measurement killed them — the failures are the receipts.

supply-chaintruecopy

The audit is now a tripwire — 280 plugins re-verified at their pinned commits, every day

One-time audits rot, so truecopy re-audits the entire official Claude Code plugin directory daily — every vendor plugin re-fetched at its catalog-pinned commit, 1,966 skills at the August 2026 run, zero poisoned — published to a public badge with pin drift as a first-class signal. On day one the watch caught two bugs in its own harness; that story is in the post, because a tripwire you’ve never seen fire is decoration.

supply-chaintruecopy

We scanned the marketplace that started the poisoned-skills panic — 66,541 skills, clean

ClawHub is OpenClaw’s open registry, the marketplace whose poisoned-skills incident started this category. We poison-scanned every skill in it and cross-checked each flag against ClawHub’s own scanner. Zero confirmed malicious; 813 deterministic alarms, all benign, mapped — and the most-installed skill in the registry runs clean but ships obfuscated code you can’t read.

supply-chaintruecopy

We scanned 2,019 Claude Code skills across ten marketplaces

A skill is prose that steers an agent holding your credentials. Every skill in the official marketplace plus nine community ones — 177 vendor repos, fetched at pinned commits and poison-scanned. None were malicious; the engineering was earning that answer, taking a deterministic scanner from a one-in-ten false-alarm rate to 0.6%, every fix pinned with a test.

benchmarkredstamp

The agent-firewall benchmark, run through a cold pipe: 100% recall, 100% precision on the 298-sample arena

One labeled corpus, one language-agnostic pipe, recall + precision + determinism scored together — with block-all and allow-all anchors sitting in the table to prove a single number is gameable. Earlier corpus revisions documented redstamp's five misses rather than hiding them; the current 298-sample run is clean, sanity anchors included — and the leaderboard that would have been a category error, refused.

securitystrongroom

132 inherited secrets cut to 13 — the rest replaced with single-use leases

Spawn a worker with the parent's environment and it inherits every key the platform holds. strongroom hands agents TTL-bound, use-limited, host-scoped leases with the real key injected only at egress — 119 keys withheld from a live fleet, and the bugs the rollout surfaced on both sides fixed in public.

securityfieldpass

8/8 planted injection payloads withheld from the model, on real Chrome

An agentic browser has the lethal trifecta by construction — the page is untrusted, the session is private, navigation is the exfil channel. fieldpass quarantines indirect prompt injection before the model sees it and gates dangerous actions — validated against Chrome 149, with the real false positives found and fixed in public.

governanceredstamp#15–18

One gate, four frameworks: CrewAI, LangGraph, OpenAI Agents SDK, AutoGen

Four unrelated runtimes governed below the framework, at the MCP layer — the poisoned tool stripped before the agent can load it, the destructive call blocked at the gate, every verdict in a tamper-evident audit. Each merged PR touches only examples/; zero lines changed in the gate's own source.

trajectoryplumbline

plumbline — trajectory-level monitoring: replay what your agents actually did

Per-call gates judge one action at a time; plumbline scores the whole sequence against the agent’s declared job — out-of-band, read-only, catching escapes assembled from individually approved steps. Dogfooded on the fleet that runs this company.

supply-chaindario

A 9.2/10 OpenSSF Scorecard on the package that ships itself

The same repo the self-healing pipeline releases several times a week scores 9.2/10 on the OpenSSF Scorecard — 14 of 18 checks a perfect 10 — and holds a 100% OpenSSF Best Practices badge: releases signed and SLSA-attested, npm published tokenless from CI via OIDC trusted publishing, zero open security alerts. The same hardening — weekly Scorecard runs, hardened branch rulesets, signed releases — runs across all 16 public code repos.

bug-huntdario#453

The proxy that silently deleted continue; from your code

A framework-name scrubber ran over message content, so the JS keyword continue; was stripped to a bare ; in transit. A downstream auditor "found" the bare-; bug and blamed the model — when the proxy itself had corrupted the payload. Confirmed with a live A/B: 3/3 fabricated through the unfixed proxy, 0/4 through the fixed one.