Welcome back. The recent GPT-5.6 breach into Hugging Face’s infrastructure was a major wake up call for every engineering team in the industry. Today, we’ll explore how that exploit happened and how OpenAI is patching the holes to stop it from happening again.

OpenAI drops a security scanner and new voice APIs: The ChatGPT maker quietly open-sourced Codex Security, a CLI built on its Codex agent that scans repos for vulnerabilities and suggests patches for developer review. You can install the CLI with a single command: npm install @openai/codex-security. The company also shipped APIs for GPT-Live-Transcribe and GPT-Transcribe. The model cuts GPT Whisper’s error rate by more than half on real-world benchmarks. More details on the API here.

Hugging Face released an interactive replay of the OpenAI breach: Earlier this month, an autonomous agent powered by OpenAI models broke into Hugging Face during benchmark testing. The model-hosting platform has now published a technical timeline of the incident. The biggest surprise was just how deep and persistent the intrusion from OpenAI's model became. Over 17,600 actions later, it rebuilt its own tooling every time its environment was wiped with no human involved. See exactly what happened here.

Grok drops working prototypes on engineering teams: Elon Musk's AI lab just rolled out Build Mode in early beta for SuperGrok Heavy subscribers. Instead of just spitting out code snippets to paste elsewhere, it renders a live, working preview right in your chat thread. Once you're done, you can publish projects to a grok.me link or a custom domain. You can even export the source to GitHub.

Most agent engineering happens in the harness and not the model, making it the exact place where most failures arise. Building successful agent systems depends on understanding the agent loop across its 3 distinct levels.

As these loops scale and evolve, so does the risk of production failure. What unites them is the memory layer, turning stateless loops into a state-aware reasoning engine.

Access the full agent loop breakdown.

Guesses compound. For years, teams shipped AI code the same way. You prompt the agent, it fills the gaps with a guess, and you clean up the rest. That worked for small tasks. But it broke down as codebases grew, because the bigger the system, the more bugs turn up in details you never touched. Engineering leader Gregor Ojstersek recently broke down the workflow that AI-native teams use to lock those details down before the first line of code is ever written.

The fix? Spec-driven development. This means writing a "spec" (a clear description of what you're building, including features, requirements, and constraints) before any AI code is generated. On a large codebase, a good spec has six parts:

If you want to see one in practice, here's a well-written spec for reference.

Not always worth it. A detailed spec is worth the effort for a massive codebase. But for smaller projects, you'll likely spend more time writing the document than actually shipping the feature. If your engineering team is still navigating the best workflow for AI-assisted development, send them GitHub's Spec Kit, which builds the spec for you through slash commands.

P.S. You can also watch this tutorial from an Oracle engineer who demonstrates spec-driven development using a simple markdown file.

The complete local AI coding setup using Ollama and OpenCode: This tutorial shows you how to set up a local AI coding assistant using Ollama, OpenCode, and VS Code. It walks through configuring local LLMs like Qwen to build Next.js apps, explain React code, and run Jupyter notebooks directly on your local GPU without relying on cloud services.

no-mistakes (7.2K ⭐): This GitHub repo from a Microsoft engineer sets up a local git proxy for your remote. Instead of pushing to 'origin,' you push to 'no-mistakes.' This spins up a temporary worktree and runs an AI validation pipeline. Your branch only moves to the target if every check passes and even opens a clean PR automatically. 

How to review AI generated code (by a Google Engineer): AI agents now write code faster than humans can read it, shifting the bottleneck from production to verification. This guide from a former Google engineering leader explains how to adapt. To keep up, developers need to scale their reviews based on risk, using AI for initial triage while saving human oversight for the most critical merges. 

Sessions hit context limits early. Too much space is wasted before the first prompt on MCP servers, unused skills, and an ever-expanding CLAUDE.md. Claude Code v2.1.206 introduced an audit to fix this. It identifies the bloat and proposes removals for you to approve.

P.S. Get 50+ AI coding hacks for Claude Code, Cursor, and Codex here.

Find out how you can run Moonshot AI’s Kimi K3 locally.

Grow customers & revenue: Join companies like Google, IBM, and Datadog. Showcase your product to our 300K+ engineers and 150K+ followers on socials. Get in touch.

You can also reply directly to this email if you have suggestions, feedback, or questions.

Until next time — The Code team