Four New Tools Tackle Agent Tasks Without APIs: Pomerado, GPT-6.1 Terra, Ghosthand, Lexmount

·1 views

Developers building AI agents often hit the problem of needed functions that lack an API, such as supplier portals, legacy claim sites, or mobile-only apps. In late October 2026, four distinct approaches emerged within days of one another, each suited to different scenarios. Pomerado, a Y Combinator Fall 2026 startup launched October 25, builds and maintains integrations that agents call as tools, with a free tier and a $50 monthly premium plan. OpenAI's GPT-6.1 Terra, announced October 26, is a computer-use model that operates screens directly and costs about half as much per token as its predecessor. The article cautions that cheaper tokens do not guarantee cheaper completed tasks, and that Pomerado's cost and speed claims are the company's own unverified figures.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Docker Bypasses UFW, Exposing Denied Ports to the Internet

A developer found that Postgres, Redis, and an internal admin dashboard were reachable from the internet despite explicit UFW deny rules on their VPS. The cause is that Docker publishes container ports through NAT rules that are evaluated before UFW's INPUT chain, so the packets are forwarded to containers and never checked against UFW. The author describes a five-minute reproduction on a test VM showing UFW reporting a port as denied while Docker still served it. Recommended fixes include not publishing internal ports, binding them to 127.0.0.1, setting a loopback default in daemon.json, or filtering traffic in the DOCKER-USER chain. Disabling iptables in Docker is discouraged because it breaks container networking.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

18,020 Exposed MLflow Servers Prompt Review of Experiment Tracking Security

Researchers found that ZoomEye indexed 18,020 assets matching an MLflow fingerprint on 28 October 2026, though the index does not reveal authentication status or whether a given server is vulnerable. The flaw, tracked as CVE-2026-116690, affects MLflow versions 3.10.0 through 3.16.1 and lets a prompt-tagged model version use a schemeless local path that the server later serves with its own process permissions. An unauthenticated default server could expose remote file reads, and even basic-authentication setups may be reachable by users allowed to create registered models. The fix is available in version 3.17.0, and administrators are advised to verify the running version, review who can create model versions, and audit the credentials the process can access. The guidance stresses that an indexed server should not be presumed compromised, and that incident evidence should come from the server's own logs.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Eleven Unlinked Tickets from One Customer Reveal Gaps in AI Support Deduplication

A single customer complained eleven times over nine days about one delayed shipment, but the AI support system opened a separate ticket for each message without linking them. Because most helpdesks auto-close silent tickets, six closed as unresolved, while the dashboard counted them as solved. The author argues that duplicate tickets are a routing and trust problem, not just a storage issue, creating multiple queue entries and conflicting responses. He proposes a strict four-part duplicate test covering identity, subject, stage, and new content, and recommends linking related tickets instead of merging them when any condition fails.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Crossplane Matures as Kubernetes-Native Infrastructure-as-Code Platform Engine

Crossplane, an open-source framework that turns cloud infrastructure into Kubernetes resources, has become a central engine for Internal Developer Platforms. Originally released by Upbound in 2018 and now a CNCF-graduated project, it has drawn over 3,000 contributors from more than 450 organizations and passed 100 million cumulative downloads. Unlike Terraform or OpenTofu, which rely on external state files, Crossplane models resources such as databases or IAM roles as native Kubernetes objects managed through GitOps tools like Argo CD or Flux. The v2.0 release in August 2025 introduced namespaced resources inheriting Kubernetes RBAC, along with Composition Functions written in Go, Python, or CEL. Following these changes, the project has continued releasing updates on a roughly three-month cadence.

0 comments Read more at DEV Community