Developer Finds AI-Generated Invoice Samples Were Largely Fictional XML Files

·1 views

A developer building a parser for Vietnamese electronic invoices asked an AI assistant to supply six sample XML files from real providers, but five of the six turned out to be fabricated test fixtures sourced from an unrelated GitHub project. Vietnam's tax authority legally mandates that all e-invoice providers use identical XML tag names since 2022, yet the AI-supplied files used invented English tags that no compliant invoice would ever contain. The parser correctly rejected all five non-compliant files, and the developer chose not to patch it to accept the fictional formats. When real invoice files were later sourced directly from email inboxes and provider portals, three genuine bugs emerged that none of the AI-generated samples had exposed. The episode highlights how AI tools can confidently surface plausible-looking but factually wrong data, and why validating against authoritative real-world sources remains essential.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer builds 3.3MB Windows AI desktop app using WebView2, ditching Electron bloat

A developer has created LeadHunter AI Desk, a native Windows desktop application for AI-powered B2B cold email outreach that weighs just 3.3MB and launches in under 0.2 seconds. The app was built using VisualNEO Win, a RAD environment that compiles to native Win32 executables, and leverages Microsoft Edge WebView2 — already bundled with Windows 10 and 11 — to render a Tailwind CSS dark-mode interface without shipping a Chromium runtime. This approach cuts idle RAM usage to approximately 35MB, compared to 500–600MB for a typical Electron-based equivalent. The app follows a bring-your-own-key model via OpenRouter, supporting LLMs such as DeepSeek V3 and Claude 3.5 Sonnet, with the developer estimating that generating 1,000 personalized emails costs around $0.04 in API credits. The project is released as free and open-source software, positioning itself as a lightweight alternative to SaaS outreach tools that typically cost $49–$99 per month.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How One Developer Used CI and a Single Source of Truth to Keep OSS Translations Fresh

A developer working on PSXRecompStudio identified a common problem in multilingual open-source projects: translated documentation quickly falls out of sync with the original, leaving readers and AI tools unsure which version is current. To address this, they designated English documents as the canonical source of truth and stored the mapping between originals and translations in a JSON config file. Continuous integration checks then automatically detect when a translation has not been updated to reflect changes in the canonical file, making staleness a visible build-time failure rather than a manual oversight. Each translated document is also required to include a clear link back to its canonical counterpart, establishing an explicit hierarchy of authority. The approach applies standard software-engineering principles — defined ownership, machine-readable relationships, and automated validation — to documentation maintenance.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

RBAC Misconfiguration in EKS Lets Attackers Hijack Kubernetes Webhooks

A security analysis highlights how overly broad RBAC permissions on Kubernetes admission webhooks can give attackers near-total control over a cluster. Mutating webhooks intercept every API call before it is committed, allowing malicious actors to inject sidecars, alter pod specs, or exfiltrate data silently. The vulnerability typically arises when operators like Argo CD or Cert Manager are granted unrestricted write access to MutatingWebhookConfigurations, rather than being scoped to a specific named resource. An attacker who compromises any workload with access to the operator's ServiceAccount token can inherit these permissions and register their own webhook. Setting failurePolicy to Ignore further conceals the attack, as the webhook remains invisible during downtime while staying silently active during normal cluster operation.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AgentForge Uses Typed Contracts to Make Multi-Agent AI Pipelines Reliable

The AgentForge team published a practical guide on September 10, 2026, addressing a common failure point in multi-agent AI systems: unstructured communication between agents. Most frameworks pass raw text output from one agent directly to another, which can break when outputs exceed token limits or omit critical context. AgentForge tackles this by requiring each agent to declare a strict input and output schema, which an orchestrator validates before any execution begins. If an agent's output does not match the next agent's expected input format, the pipeline halts with a clear error rather than allowing a faulty inference to propagate. The open-source framework, described as production-tested, aims to deliver deterministic and debuggable agent behavior in place of unpredictable LLM-driven guesswork.

0 comments Read more at DEV Community