Getting hacked was only half the problem

Summary

Theo and Ben review a turbulent week in AI development, software security, and new hardware. They discuss agent tools and model quality, describe several security incidents and ways to respond to them, explain a Rust rewrite of TypeScript tooling, and give early impressions of Apple’s new foldable phone.

AI Models and Developer Tools

• T3 Code and Gemini usage: The hosts cite analytics claiming T3 Code users generated 36.5 billion tokens in 72 hours, compared with Google’s reported 25 billion tokens for its newly launched Gemini model over the same period. They argue that token volume is not the same as model quality, but say it illustrates demand for AI coding tools.
• Product development and model behavior: They criticize Google for being slow to adapt its products to agent-based workflows, and OpenAI’s Codex experience for feeling inconsistent and unfinished. They praise Anthropic’s Opus models for requiring less supervision on complex tasks. One host argues that low-friction, more autonomous workflows can be less mentally tiring, even when a more hands-on model can produce good results.
• T3 Code shortcuts: T3 Code has added shortcuts for starting a thread without a project. The hosts describe this as a useful way to launch a quick computer-use task without first setting up a project.
• Agent workflows: They discuss using agents to review other agents’ work and describe a phone-based workflow for quickly prompting Claude to investigate model behavior. Their general advice is to make useful prompts and review tasks easy to launch, so they are less likely to be forgotten.
• Benchmarks and evaluation: The hosts question whether common benchmarks capture practical differences between models. One says his own tests expose Gemini problems that standard benchmarks miss.

Security Incidents and Recommendations

The hosts describe security as a growing, recurring problem, including attacks that may use capable models to find and exploit vulnerabilities. They stress that keeping systems secure is difficult even for well-run organizations, and that response speed matters as much as prevention.

• PHP vulnerabilities: They discuss serious PHP vulnerabilities that could allow remote code execution in affected systems. They note that old and overlooked PHP services may still support important infrastructure, even if they account for a smaller share of everyday web traffic than broad “percentage of the internet” statistics suggest.
• Unauthorized “vigilante” fixes: They mention reports of attackers accessing servers to patch vulnerable software without permission. While they see the appeal of fixing neglected systems, they emphasize that unauthorized access is illegal and can carry severe consequences.
• Railway incident and exposed API keys: They describe the Railway breach as focused on finding API keys users had stored on the service, potentially to sell them for short-term use or generate data. The hosts’ main criticism of Railway is that users reportedly could not redeploy quickly to replace compromised keys, leaving them to choose between taking services offline and continuing to run them with exposed credentials.
• Industry-wide response: They argue that cloud providers should plan for breaches and make key rotation and service recovery much faster. Their proposed improvements include:
  • Consistent, identifiable prefixes for API keys.
  • Standardized revocation endpoints.
  • A one-click incident response that revokes stored keys with the relevant providers.
• Security fatigue: They observe that incidents and AI-related news are arriving so quickly that people become desensitized. They argue that fatigue cannot replace ongoing security work because attackers will continue.

TypeScript Tooling Rewritten in Rust

Theo describes using AI agents to build a Rust implementation of TypeScript tooling after earlier efforts did not work out. The project reportedly became fast enough for real use in T3 Code, including as a language server and compiler-related tool.

The project is now moving toward a more sustainable outcome: the hosts say Theo’s work is being combined with TSRS, a Rust TypeScript project recognized by the TypeScript team and backed by Cloudflare, with plans for integration into OXC tooling. They present the merger and ongoing support as a better long-term solution than maintaining a separate, rapidly built implementation.

A Practical Guide to Agent-Driven Development

A major theme is that agents can do ambitious work when the task has a clear, testable definition of success. Theo describes two examples:

• Improving T3 Code search: He collected examples of searches that failed, used an agent to generate more test cases, and repeatedly adjusted the search until it matched 53 of 54 cases. A second stage used multiple models to review the changes.
• Improving MCP instructions: He created an evaluation set of 85 real-world examples and used repeated agent runs to improve instructions for T3 Code. He says this reduced the failure rate from about 20% to zero, while shrinking the instructions from roughly 9,400 tokens to 4,500.

Their takeaway is to define measurable outcomes, build or synthesize representative test cases, and let agents iterate against those checks. They distinguish this from loosely defined “death loops” that can produce something nearly complete but leave it unmaintained.

T3 Code Guest Mode

Theo previews a feature that lets someone share a T3 Code thread with another person. The recipient can add prompts and context, but the owner must approve each prompt before it is sent. The hosts see it as a convenient way to work with someone reporting a bug, share screenshots, and pass context directly to an agent instead of copying and pasting between chats.

They describe the feature as an initial step toward more collaborative or multiplayer workflows, rather than a complete collaboration system.

Foldable Phone Review

The hosts give early impressions of Apple’s new foldable phone, which they nickname the Duo. Their central idea is that it feels like several devices in one:

1. A narrow outer screen for quick tasks.
2. A wide, landscape-style screen suited to media and two-app layouts.
3. A taller, portrait-style inner screen that they particularly like for reading, email, and focused work.

What They Like

• The hardware feels premium, and the foldable screen’s crease is less distracting in person than it can appear in video.
• The portrait inner-screen layout is comfortable for reading and concentrating on one task.
• The outer screen makes one-handed use and quick replies practical.
• They find the device exciting and expect foldables to become more important over time.

What Needs Improvement

• Some apps are poorly optimized or behave unpredictably on the new screen. Discord, YouTube Studio, Notion Calendar, and Tidal receive criticism; Tesla’s app and, to a lesser extent, T3 Code are cited as better examples.
• The keyboard and some iOS interactions can be awkward, including difficulty dismissing the keyboard in certain situations.
• The hosts dislike the internal camera’s display cutout, its image quality, and its placement. They also note the absence of Face ID and criticize the return to Touch ID.
• The phone is heavier and thicker than some competing foldables, and the inner display’s matte finish is not ideal for every media use.

Their verdict is enthusiastic but qualified: it is an enjoyable first-generation device for people willing to tolerate software and hardware quirks. They expect app support and later hardware revisions to improve. One host says the foldable format could eventually become a mainstream or Pro-tier iPhone design, while noting that the camera limitations may mean keeping a second phone for photography and video.

Sponsors and Featured Products

• Agentfield Code AF: Promoted as an environment for coding agents and open-weight models. The sponsor segment claims the same model produced a more polished interface in Code AF than in another environment, and highlights its agent-team features for longer projects.
• PostHog: Promoted as a product-analytics and context layer for agents, with MCP integration. The example given is an agent using PostHog data to rebuild a product dashboard.

Reviews, Guides, and Tutorials Covered

• Review: Early hands-on impressions of Apple’s foldable phone, including screen modes, app compatibility, cameras, biometrics, and likely use cases.
• Guide: A method for making agents improve software through explicit evaluation cases and measurable acceptance criteria.
• Workflow tip: Use model-to-model reviews and easily accessible prompts to support longer-running agent tasks.
• Product feature overview: T3 Code’s project-free shortcut and guest-thread sharing with manual prompt approval.
• Security recommendations: Faster incident recovery, standardized API-key identification, and one-click key revocation.

Main Speakers and Sources

• Speakers: Theo and Ben, co-hosts of Nerd Snipe.
• Other sources discussed: The hosts refer to public statements and activity from Google, the TypeScript team, Cloudflare, OpenAI, Anthropic, Railway, and other developer-tool companies. Agentfield Code AF and PostHog appear in sponsor segments.