AI Agent's Dev.to Post Hit by Phishing Bot Comment Within 38 Seconds

·1 views

An AI agent publishing on Dev.to via API received a phishing comment just 38 seconds after its article went live at 01:04 UTC. The comment, posted by an account named 'Dev Support', urged account verification through a shortened link with a 12-hour deadline — classic signs of a phishing attempt. The agent identified the scam through standard red flags: no legitimate platform requests login credentials via a comment or a link shortener. However, because the Dev.to comment API returns 404 errors for both DELETE and POST requests, the agent was unable to remove the phishing comment or warn readers beneath the post. The incident highlights a security gap where API-based publishers can post content but have no ability to moderate or respond to harmful comments on their own articles.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How Internal Developer Platforms Create a 'Golden Path' for Engineering Teams

An Internal Developer Platform (IDP) is a curated set of tools, workflows, and self-service capabilities designed to help engineering teams build and deliver software faster and more consistently. Rather than every team independently solving the same infrastructure, CI/CD, and security challenges, a dedicated platform team solves them once and makes the solutions broadly available. The concept of a 'golden path' describes a well-maintained, well-documented default route that developers choose voluntarily because it is genuinely easier than alternatives. IDPs commonly fail when they are built on assumptions instead of developer feedback, or when they introduce bureaucratic friction that pushes engineers toward workarounds and shadow IT. A well-structured IDP typically spans four integrated layers — infrastructure, orchestration, self-service, and a developer portal — collectively reducing the cognitive load of operating modern software systems.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How AI text watermarking embeds hidden signatures in word choices

AI text watermarking works by subtly influencing which words a language model selects during text generation, without altering the model's underlying weights or making the output appear unusual. A secret key combined with preceding tokens assigns hidden scores to candidate words, and a method called tournament sampling uses these scores to determine which word is chosen. The resulting text looks entirely normal but carries a detectable pattern that persists even when copied across platforms. Google DeepMind introduced the underlying technique, SynthID-Text, in a 2024 Nature publication, and Anthropic adopted a version of it for its Claude model in August 2026. Anthropic stated the move is intended to satisfy transparency requirements under the EU AI Act.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds local tool to break down AI coding costs after $1,278 project bill

A developer discovered their side project cost $1,278 in API tokens across 542 prompts and 36 hours of work, prompting them to build an open-source tool called Bough. Bough reads the session transcript files that AI coding agents like Claude Code and Codex automatically save to a user's local machine, then visualises spending by task and sitting. The tool requires no account, API key, or internet connection, and is installable via a single command on Mac, Linux, or Windows. One key insight the tool surfaced is that most token costs come from the model re-reading prior conversation context on every reply, not from generating new code. The developer notes the dollar figures reflect published API rates, so users on flat subscriptions can treat the number as a measure of what their plan saved them.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Freelance Full-Stack Developer Offers 2 Project Slots for November

Vicente Reyes, a freelance developer since 2018, is accepting two client projects for November 2025. He has completed 25 projects for businesses across the UK, US, and Australia, including 11 production Shopify stores. Limiting intake to two slots ensures each project receives his full attention. Prospective clients can book a discovery call or send a project brief via direct message, with a response guaranteed within 24 hours. His portfolio is available at vicentereyes.org for those wishing to review his previous work.

0 comments Read more at DEV Community