Article URL: https://simonwillison.net/2026/Oct/3/default-hard-budget-caps/ Comments URL: https://news.ycombinator.com/item?id=49949235 Points: 34 # Comments: 6
This is an AI-generated summary. ShortSingh links to the original source for the complete article.
I was updating my agent sandbox audit scripts over the weekend and stumbled into something that changed how I look at every SDK helper that shells out. AWS's Bedrock AgentCore Python SDK, the thing you use to run code in Amazon's Code Interpreter sandboxes, had the same injection bug fixed twice in the same function. Both fixes were bypassable, each in a different way. This matters right now because BeyondTrust's Phantom Labs team published their full research on it yesterday (Sep 28), and as of this morning I can find no other write-up anywhere: zero threads on Hacker News, zero articles on D
Need to test password-based SSH login, or connect to a host without offering your usual key? You can override the client’s authentication choices for a single connection without changing or deleting any keys. ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no user@host Replace user and host with the account and server you want to reach. These options apply only to this invocation of ssh. PreferredAuthentications=password tells the client to use the SSH password authentication method.
Anyone who has learned a foreign language knows the gap between a passed exam and real fluency with native speakers. Closing it takes practice with someone at native level, and not everyone has a native-speaking partner or the budget and time for endless lessons. So I asked myself: what if an AI voice agent could be that partner? Someone to have casual conversations with, like a buddy who speaks at native level, never loses patience, and points out your mistakes when they matter. I built it with ElevenLabs agents and Cloudflare Workers.
An in-page QR scanner sounds like a thin wrapper around a camera API. The first version often is: request a camera, hand frames to BarcodeDetector, and continue when it returns a QR value. That design has an awkward failure mode. The camera can work perfectly while QR detection is unavailable. A browser may expose getUserMedia() but not BarcodeDetector, so capability detection turns into a message telling the user to leave the app and find another scanner.
Discussion (0)
Log in to join the discussion and vote.
Log in