Non-Programmer Uses One AI to Fact-Check Another AI's Code Audit

·1 views

A construction engineer turned hobbyist developer built a Telegram bot and later an MCP server called MSCodeBase Intelligence using AI coding assistants instead of writing code by hand. After receiving a multi-page external AI-generated audit of his project flagging several vulnerabilities, he chose not to act on it immediately. Instead, he tasked a separate AI model — one with direct access to his live codebase — to verify each finding line by line against the actual repository. The cross-check revealed a mixed picture: three bugs were genuine, including a process-locking issue on Windows and a race condition in a task queue, but several other claims were inaccurate, citing non-existent functions, wrong file paths, and stale test coverage data. The experience reinforced his practice of routinely using one AI model to audit the outputs of another, treating confident-sounding AI responses as a starting point rather than a final verdict.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Vox Pupuli Launches Public Dashboard Tracking Container Downloads and CVEs

Open-source Puppet community group Vox Pupuli has launched a public statistics page at voxpupuli.org/container_statistics, offering visibility into download counts and security vulnerabilities across its container portfolio. The page is generated automatically every 24 hours using a custom script hosted in the container_statistics GitHub repository and deployed via GitHub Actions to a gh-pages branch. Download figures are scraped from package HTML pages, while CVE data is produced by running two scanners — Trivy and Anchore's Grype — against each container image. Among the most-downloaded containers are openvoxdb and openvoxserver, each exceeding 150,000 pulls, while openvoxserver's latest tag also carries the highest CVE count at 789 total findings. Users can reproduce the statistics locally by running the provided bin/container-statistics script with either a download or CVE report flag.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AgentForge Adds Three-Layer Error Recovery to Multi-Agent AI Pipelines

The AgentForge team published a technical post on August 8, 2026, detailing how failures cascade in multi-agent AI systems when one agent's timeout can disable dependent agents downstream. To address this, AgentForge implements three recovery layers: automatic retries with exponential backoff, circuit breakers that switch to cached fallback data after repeated failures, and orchestrator-level replanning to skip, substitute, or halt failed agents. The team illustrated the approach with a real incident in which their market data API went down during trading hours, triggering the circuit breaker within one minute and automatically routing the pipeline to a delayed cached feed. A full report was still generated with a data-disclaimer warning, and no manual intervention was required throughout the outage. AgentForge's open-source MVP is available on GitHub, with the team positioning fault tolerance as a built-in default rather than an optional feature.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How a Hidden Form Wiped a CDN Cache and Led to Stronger CSRF Protection

A PHP video admin panel was vulnerable to Cross-Site Request Forgery (CSRF) after a hidden HTML form on an unrelated forum page silently triggered a full CDN cache purge by exploiting an active browser session. The incident exposed a common security gap: relying solely on session cookies to authenticate state-changing admin actions. To fix this without disrupting a LiteSpeed page cache or SQLite-backed session storage, the developer adopted a signed double-submit cookie pattern instead of the traditional synchronizer token approach. This stateless method stores a signed HMAC token in both a cookie and a form field, then verifies both match on every unsafe request, without any server-side session writes. The implementation also uses the __Host- cookie prefix and token expiry checks to prevent subdomain or network-level cookie injection attacks.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Voice Systems Routinely Fail Disabled Users Due to Biased Training Data

Millions of disabled people face daily failures with AI voice assistants because their speech patterns fall outside the narrow range of audio these systems were trained to recognise. A January 2026 Forbes analysis by disability inclusion writer Gus Alexiou argued this is a structural flaw, noting that AI optimised for standardised interaction effectively excludes the 1.3 billion people the WHO identifies as having significant disabilities. On 3 February 2026, the UK's Department for Work and Pensions convened a roundtable bringing together major tech firms — including Google, Meta, Microsoft and Amazon — alongside disability organisations to address the gap between AI's potential and its current performance for disabled workers. Separately, researchers from Virginia State University and Morgan State University published a paper in Frontiers in Digital Health warning that standard AI evaluation metrics, focused on accuracy and generalisability, treat disabled users as statistical outliers rather than legitimate end-users. The studies and policy discussions collectively highlight a systemic absence of methodology for assessing whether AI tools are genuinely accessible to disabled people.

0 comments Read more at DEV Community