Liran Tal

fun times in MCP land

some people pay for Netflix, I pay for Cloudflare j/k, I pay for both 😂

have never been happier upgrading to a paid plan, and also what a flawless onboarding experience to Cloudflare from an agent that drove the whole setup 👏

Yoda all the things at AI Security Summit :-) Thank you @Cassandra Gatton for the gift, appreciate it and all the dev security stuff you people build at Arcjet 🚀

I could use TypeSafe AI new Jev 1.14 model which adds support for images so I can apply a sort of computer vision box annotation for objects but - if I want to plug this to a security camera that watches for "is child in a pool?" as a noul and sends a 1024x1024 picture every second, it'd be about

AI Security Engineers btw aisecurity.engineer 🔥

lol I kinda feel guilty about it 😆

All the strong canons at the @Snyk booth at AI Security Summit Awesome job @Ryan @Carey @Curtis

had fun at @AISecSummit with @thepunit from Anthropic Frontier Red Team on their various efforts in-and-around open source software security and how frontier models fit in received lot's of good feedback about the fireside chat thank you Punit for your insights and openness 💜

jobs in 2026: - eval developer - ai factory architect - context engineering - harness engineering - harness stack developer - system-one model developer - benchmark research engineering - agentic cyber defense manager - defensive ai security director - long-horizon cyber architect - frontier model s

hmmm, doodled some thoughts is this where we're headed with AI unfolding upon us?

reverse engineering software and firmware is now a question of how many tokens are you willing to throw at the problem, widely accessible

my buddy Gerald put together a repo curated for AI Security Engineers, check it out: github.com/GeraldCresci...

uhmm, these inconsistent border radius (pill on PR review vs section) seem a little bit of an AI slop, no? or just me

re-hauling the personal website do you like the gradient or not? the impeccable skill removed the gradient but I feel it adds a nice touch

given enough agents, all security vulnerabilities are lucid

software is liquid now

software is liquid

there's a repo that tracks Anthropic's Project Glasswing security disclosures and their patches, and it is interesting CURRENT CVE COUNT: 316 Fixed Anthropic Findings w/o CVE: 128 Findings Withdrawn by Anthropic: 243 source: github.com/patrickmgarr...

oh man, loving every second of how AmpCode just finds it way through whatever difficulty and genuinely with zero nudges from me to aid it

well damn that's smart behavior and harness engineering from AmpCode team you know how agents create extra files on disk some times? well, mostly it's just a flat file on the file system and could get committed accidentally or just lost. Well, the AmpCode harness manages them in a specific .amp/ a

We published VulnBump 🎉 Curious how well does it work well for Claude Code to upgrade your project's dependencies without breaking anything? ... just a bit more than a coin flip "A Benchmark for Fixing Vulnerable Dependencies in Real Projects While Keeping the Build and Tests Green":

AmpCode is so great and I was testing it now to triage a security advisory I received to one of my open source projects and it got blocked by safety models... ugh, this is sort of annoying but shows how hard it is to do proper alignment for models

woah, AmpCode is a beast 👾 a whole different level of a coding agent real issue was a bad API token that it nailed down just from headers, then it reproduced everything and migrated the project deps and code to Node.js v24 so I can re-deploy first PR - all green and ready to merge WOW

the new standard for npm publishing, in case you haven't followed up and are still concerned about supply chain security in the JavaScript ecosystem

looks like I hit the jackpot of macOS storage today

Re-posting the Jev classifier model (aka System-1) project I built to categorize all the lyrics of Weird Al Yancovich into theme, mood, and other attributes it's open source on my GitHub: github.com/lirantal/dis...

Move at AI speed, but how? Go check out Snyk Evo

checkout vulnbench.com if you consider comparing deterministic security scanners like Snyk with "let me just prompt claude to find vulnerabilities"

What does it mean to be an AI Security Engineer? Stochastic systems intertwined with deterministic permissions and actions, how do you weave the two? that's what we're learning, shaping, teaching, and building with the AI Security Engineer community and training

want to become an AI Security Engineer? go to the website 👇

Get one more glance at VulnBench 1.0 because VulnBench 2.0 release is going to knock you out the park with more benchmark findings comparing AI Security agents harness and Snyk! 🔥

I'm sharing again the lirantal/discoprint project on GitHub which was fun to build with Jev (nice work TypeSafe AI team 👏 ) data labeling was not something accessible to devs in such an easy manner and it's so cool that this machine learning revolution is unlocking so many experiments and avenues

ok so who wants some credits to test out Snyk Evo for MCP security? yes there are many MCP security scanners out there, but are they good? what do they uncover? to which extent?

epic launch video for an epic MCP security launch we cookin' at Snyk how are you doing MCP governance for all the various MCP servers your devs and agents are using? those agentic supply chain security incidents are coming...

epic launch video for an epic MCP security launch we cookin' at Snyk how are you doing MCP governance for all the various MCP servers your devs and agents are using? those agentic supply chain security incidents are coming...

epic launch video for an epic MCP security launch we cookin' at Snyk how are you doing MCP governance for all the various MCP servers your devs and agents are using? those agentic supply chain security incidents are coming...

epic launch video for an epic MCP security launch we cookin' at Snyk how are you doing MCP governance for all the various MCP servers your devs and agents are using? those agentic supply chain security incidents are coming...

not sure if you knew, but in October 2024 I bought bunsecurity dot dev and launched a Bun Security course LLMs and generative AI changed a lot but it was a fun ride

here's a screencast from when I was building the Node.js Secure coding website a few years back when I was fighting to div and css alignment but hey now I just prompt codex. it was fun though.

the Intelligent UI announcement from OpenAI is I imagine a direct consequence of the work on MCP UI that turned into MCP Apps, no? it seems quite the same value proposition of embedding MCP servers inside apps, and a similar uplifted chat experience good work there

it's funny that now that we've democratized code and software programming, open source has actually drifted further away from a collaborative and value position as if AI coding agents are in negative correlation with open source software

codex knows me too well

one more post about AmpCode, I promise I asked it to address a bug fix from its prior analysis in a new PR and it moved through branch changes as a first thing like I would do it myself and didn't assume to continue on the same PR branch from prior work. sweet.

Which conferences did you go to this year? Curious what's hot and interesting

What I like about the AmpCode coding experience: - it notes the CI checks - it accounts for the Cubic PR review bot - calls out the changes in brief - presents the significant code change to draw attention to for a human - adds tests this should be the baseline for any coding agent, for real

The AmpCode UI is really smooth. You can tell there's a lot of attention to details and investment into making the web experience of managing code projects straightforward while also keeping it incredibly rich with features kudos to the team Karl Clement and everyone at Amp

So Amp and Orbs are powering my dev work now for npq ⚡ thank you to the Amp team for the credits, excited to try this out for npq, lockfile-lint and a bunch of other open source projects I maintain

that's a very clean approach to proxy'ing secrets, nice work varlock team 👏

Opus 5.5 prompting check-list by Addy Osmani from the claudedev blog