SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Dev Merges 373 PRs in Open Source Bug Sprint, Uncovers Critical Auth Flaw

0
·1 views

Aniruddha Adak, an AI Agent Engineer and Full-Stack Developer, merged 373 pull requests across open source projects over several months as part of an intensive bug-fixing effort. Among the most significant findings was a critical security vulnerability in cognee, an open source AI memory infrastructure project. The POST /api/v1/settings API endpoint lacked any authorization check, allowing any logged-in user to overwrite global configurations including LLM API keys and authentication settings. Adak identified the gap using an agentic IDE, then patched it with a two-line fix adding a superuser requirement and masking sensitive credentials in API responses. The flaw had gone undetected because existing tests only verified successful updates, never testing for authorization failures.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Developer loses 4 days of AI access, spends €200 after overnight automation hits hidden weekly cap

A developer running Claude Code on a flat monthly subscription lost access to the AI tool for four days after an overnight automation loop exhausted his weekly usage limit in just two days. He was unaware that Anthropic had added a weekly cap on top of the monthly one, having never approached either limit during normal use. To meet client deadlines mid-lockout, he purchased additional tokens at full list price, spending €200 over four days at reduced productivity. The incident exposed a blind spot: no tool was warning him in real time how quickly his weekly allowance was being consumed. He subsequently built a usage meter through four iterative attempts to surface that information in plain, actionable language.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

AgentATC Uses OpenTelemetry to Expose Silent Failures in Multi-Agent AI Systems

AgentATC is an open-source project built for the 'Agents of SigNoz' Hackathon (WeMakeDevs × SigNoz, July 2026) that addresses a blind spot in AI observability: multi-agent coordination failures that produce no errors or alerts. The system runs a three-agent workflow — Planner, Executor, and Critic — to generate competitive analysis reports, where every inter-agent handoff is recorded as a first-class OpenTelemetry span. A single shared trace ID links all subtasks, preventing fragmented traces and making the full execution history visible in one connected view. To demonstrate the problem, one subtask is deliberately designed to loop endlessly, as the Executor can never satisfy the Critic's rubric, burning LLM tokens silently without triggering any exception or dashboard alert. AgentATC argues that traditional observability tools measure latency, errors, and cost per call, but are not designed to detect coordination breakdowns between agents.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Rust library ez-ffmpeg 0.15 offers single-call in-process video frame extraction

Extracting video frames in Rust for machine learning inference has long required either shelling out to FFmpeg via the command line or hand-writing a low-level decode loop spanning dozens of lines. The newly released ez-ffmpeg 0.15 introduces a FrameExtractor API that handles frame extraction in-process with a single function call, returning tightly packed RGB24 bytes ready for use with tensors or ndarray. The library supports flexible sampling strategies, including uniform frame distribution across a video clip, making it well-suited for vision-language model pipelines. A notable issue with many existing approaches — incorrect application of BT.601 color coefficients to HD video, causing subtle color distortion — is also addressed by the library. ez-ffmpeg links against libav through ffmpeg-next and requires FFmpeg 7.1 or later to be installed on the system.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Replicates Anthropic's Vision-Only Pokémon Claim, But Thinking Logs Raise Questions

A developer independently replicated Anthropic's claim that its Claude Fable 5 model can play Pokémon FireRed using only raw screenshots, building a matching harness that reached the first gym badge in 1,785 turns at a cost of $65.40. The experiment confirmed the core result is real, with full logs, frames, and harness code made publicly available for scrutiny. However, after examining the model's thinking chains, the developer found Claude was recalling memorized game knowledge — such as specific trainer dialogue and city objectives — rather than reasoning purely from visual input. The model had written down plot objectives 141 turns before they appeared on screen and identified off-screen trainer details by memory, suggesting its performance relies heavily on training data rather than vision-based reasoning. This raises questions about what 'vision-only' truly means in this context, as Anthropic published no harness code, step count, cost, or definition of 'minimal' alongside its original announcement.

0 comments Read more at DEV Community
Dev Merges 373 PRs in Open Source Bug Sprint, Uncovers Critical Auth Flaw · ShortSingh