SShortSingh.
Back to feed

Encoding API contracts in tool schemas beats prose descriptions for smaller LLMs

0
·8 views

A developer team discovered in May 2026 that two AI models — Opus 4.7 and Sonnet 4.6 — produced different JSON outputs from the same tool description, with the smaller model returning an incorrect structure that triggered downstream 422 errors. The root cause was not a capability difference but an exposure gap: the larger model had seen the proprietary field names during training, while the smaller one guessed plausible-sounding alternatives. Because tool descriptions are prose rather than enforced contracts, models without prior exposure to a custom schema have no validated structure to follow. The team resolved this by migrating the structural contract into the JSON schema itself, using discriminated oneOf branches with strict required fields for the nine most common pattern types. They applied a permissive fallback branch for rare pattern kinds, limiting the upfront effort to roughly one afternoon while targeting the failures that actually occurred in production.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

OpenAI Reinstates 5-Hour Usage Cap for Plus Users, Frustrating Coders Mid-Sprint

OpenAI has reinstated a five-hour rolling usage cap for Plus subscribers on its Work and Codex surfaces, reversing a removal it had made earlier in the summer. The return of the limit drew sharp criticism from users, particularly developers who had structured their workflows around the assumption of consistent access. A recurring complaint was not simply that limits exist, but that they shift unpredictably, making it impossible to plan or budget usage across a workday or week. Anthropic users reported similar frustrations, with weekly quotas resetting at irregular intervals and uncertainty over which AI models would remain accessible. The episode highlights a broader tension in AI subscription services: paying customers increasingly find that the usage they are paying for is subject to conditions that can change without reliable notice.

0
ProgrammingDEV Community ·

CoreShroud Platform Aims to Harden Android APKs Against Reverse Engineering

A developer has built CoreShroud, an Android APK protection platform designed to make applications significantly harder to reverse engineer through multiple layered security mechanisms. Rather than relying solely on obfuscation, the platform combines techniques such as string protection, DEX transformations, anti-debugging, runtime integrity checks, and native library protection. The goal is not to make apps impossible to crack, but to substantially raise the effort and cost required for an attacker to analyze or modify them. A key engineering challenge during development has been ensuring that security measures do not break app functionality or introduce excessive performance overhead across different Android versions. CoreShroud is currently under active development, with the creator planning ongoing improvements to its protection capabilities, compatibility, and developer experience.

0
ProgrammingDEV Community ·

Critical Magento RCE Flaw CVE-2026-75650 Exploited via Payment-Failure Emails

Adobe Commerce and Magento Open Source versions 2.4.4 through 2.4.9 are affected by an unauthenticated remote code execution vulnerability, CVE-2026-75650, which exploits the platform's payment-failure email rendering engine. Dutch security firm Sansec, which dubbed the campaign StyleSmuggler, recorded active exploitation beginning September 4, 2026, with CISA adding the flaw to its Known Exploited Vulnerabilities catalog on September 8. Adobe issued emergency hotfix VULN-39341 on September 7 under advisory APSB26-146, noting that stores already patched with the August 2026 monthly update remained exposed. Attackers inject malicious data into error reports and payment records, then trigger the standard payment-failure reminder email, causing the template engine to execute arbitrary PHP code with web-server privileges. Observed post-compromise payloads include a Rust backdoor disguised as system processes and PHP web shells, with remediation requiring the hotfix, credential rotation, and a targeted malware scan.

0
ProgrammingDEV Community ·

AI Coding Tools Boost Junior Devs but Slow Down Experienced Ones, Studies Find

Recent research presents a mixed picture of AI coding assistants' impact on developer productivity. A multi-company field study involving 4,867 developers found that those using GitHub Copilot completed 26% more tasks, with less experienced developers seeing the greatest gains. However, a July 2025 randomised controlled trial by METR found that 16 experienced open-source developers took 19% longer to complete tasks when AI tools were available, despite expecting a 24% speed improvement. The gap between perceived and actual productivity was notable — developers believed AI had made them faster even when measurements showed the opposite. Researchers suggest the two studies are not contradictory, as outcomes appear to depend heavily on developer experience, task type, and the familiarity of the codebase.