Locally Uncensored 3.0.6 adds beta computer control for local AI models

·1 views

Locally Uncensored 3.0.6, an open source desktop app for running AI models locally, now lets a model use the mouse and keyboard in applications the user approves. The feature is off by default and must be enabled in settings, and it works with local models so screenshots and clicks stay on the user's machine. The app asks permission at several points, including at the start of each chat, on first use of an app, for sensitive actions, and for unnamed buttons, and some areas such as terminals and password managers are blocked entirely. Users can pause or stop the agent with keyboard shortcuts, and screen tasks end after at most 25 steps or 8 minutes. The developers describe the feature as beta and note that a dedicated screen model performed weakly in their testing.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Banks and Publishers Restrict AI Agents as Identity Gaps Emerge

After customers began handing banking credentials to AI assistants, Citigroup and Bank of America moved to bar agents from client accounts, and Schwab began blocking outside AI tools that attempt to move money. Content publishers showed a similar shift, with Cloudflare's one-click AI crawler block adopted by over a million customers and the share of reputable sites blocking AI scrapers rising sharply from 2023 to 2025. Analysis of crawler traffic suggests much of it is training-related rather than live user activity, while robots.txt enforcement remains inconsistent across top domains. The article argues that current agents cannot prove who they are or who authorized them, leaving operators to rely on easily spoofed signals. Proposed remedies include cryptographically signed agent identities under RFC 9421 and Visa's Trusted Agent Protocol for commerce.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AIClaw Adds Opt-In Skill Access Tracking That Excludes Prompt and Tool Content

AIClaw's v3.7.3 release introduced an opt-in OpenTelemetry Logs event, aiclaw.skill_invocation, that records when an agent accesses a skill and how that access was triggered. The event classifies access as explicit, when a user mentions a skill and it loads, or implicit, when a skill loads or its SKILL.md is read without such a mention. Prompt text, skill bodies, and tool payloads are kept out of the exported events, and file paths are resolved locally. The tracker deduplicates repeated loads within a turn, so one turn can produce both an explicit and an implicit event for the same skill. The feature was released October 8, and the latest public version at the time of writing is v3.7.15.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

ElevenLabs AI Voice Helps Real Estate Sites Add Narrated Virtual Property Tours

A developer guide explains how AI text-to-speech can add narration to property listings, making virtual tours more immersive and engaging. It describes how to get started with ElevenLabs, a TTS service with a free tier, by generating an API key and listing available voices. The article includes a Python script that converts a property description into an MP3 narration file via the API. It also covers voice cloning as a way to keep a consistent brand voice across listings. The approach is presented as a low-cost alternative to studio recording and hired narrators.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Fixing Stripe webhook 401 errors on Supabase Edge Functions by disabling JWT verification

A common cause of Stripe webhooks failing with 401 on a Supabase Edge Function is the platform's built-in JWT check, which rejects requests before the function's code runs. The article explains how to tell this apart from a 401 returned by the developer's own code, by inspecting the response body in Stripe's delivery log. The fix is to disable JWT verification for the webhook function only, either via config.toml or the --no-verify-jwt deploy flag, so that redeploys don't re-enable it. Because the endpoint becomes publicly reachable once this change is made, the author stresses that the Stripe signature must then be verified inside the function, since otherwise anyone who knows the URL could send forged events.

0 comments Read more at DEV Community