Article URL: https://thinkingmachines.ai/blog/the-future-worth-building-is-human/ Comments URL: https://news.ycombinator.com/item?id=48904905 Points: 5 # Comments: 0
This is an AI-generated summary. ShortSingh links to the original source for the complete article.
A 2025 Veracode report testing over 100 large language models found that 45% of AI-generated code samples introduced OWASP Top 10 vulnerabilities, with Java recording the highest failure rate at 72%. Cross-Site Scripting was the most poorly handled vulnerability category, with models failing 86% of relevant tasks. Notably, larger and newer models such as GPT-5 and Claude Sonnet 4.5 showed no meaningful security improvement over their predecessors, clustering around a 50–55% pass rate. A separate CodeRabbit analysis of 470 real-world GitHub pull requests found that AI-co-authored code contained roughly 1.7 times more issues than human-only code, with XSS vulnerabilities 2.74 times more likely to appear. Security researchers attribute the pattern to LLMs generating statistically probable code completions drawn from training data that itself contains vulnerabilities, rather than applying any built-in security review.
The open-source Finance Toolkit's Economics module allows users to track macroeconomic indicators such as inflation, central bank rates, GDP growth, and unemployment across 60-plus countries using free OECD and Global Macro Database data, requiring no API key. An analysis of five economies — the United States, United Kingdom, Germany, Japan, and Brazil — reveals that the 2021-2023 inflation surge did not arrive simultaneously, with Brazil peaking at 8.3% in 2021, a full year ahead of developed economies. By 2022, Germany, the UK, and the US had all surpassed 6.9% inflation, while Brazil was already declining and Japan never exceeded 3.3% throughout the entire period. Central bank responses varied sharply: Brazil raised its policy rate to 13.75% in 2022, the US climbed to 4.375%, while Japan held its rate at -0.1% for the duration. The toolkit's source code is publicly available on GitHub and is compatible with MCP-connected AI assistants for querying macroeconomic trends.
A solo developer discovered a critical authentication vulnerability in his app's server just hours before submitting it to the App Store for review. During early development, he had added a shortcut allowing anyone to impersonate any user by passing a query parameter, with no token required. Days later, he prompted his AI coding assistant to review the server from a security perspective, and it flagged that all user data — meals, workouts, body metrics — was fully exposed without authentication. He patched the flaw overnight on June 28, enforcing token-based auth and server-side ownership checks across all endpoints before submitting at 23:04 that night. He noted the app had only one user at the time, crediting luck rather than skill for preventing any real data breach.
A fully AI-operated startup has embedded a strict no-surprise-billing rule into its foundational CLAUDE.md file, which every AI agent must read at the start of each session. The rule requires any spending proposal to include an explicit 'Billing exposure' line detailing current cost, future cost, renewal dates, and cancellation steps — without which the request is considered invalid. The company also maintains a Liabilities register logging every service it uses, even free-tier ones, and reviews it weekly with a 14-day renewal alert. By default, any service requiring a card on file just to begin a trial is automatically rejected. The approach was introduced on day one by the human investor who provides $250 in seed capital, and is described as non-negotiable and immune to override by any agent or strategy.
Discussion (0)
Log in to join the discussion and vote.
Log in