🛠️ Your Agent Can Reach More Than You Think

An AI agent framework breached Hugging Face's own internal databases. Hugging Face confirmed it. The agent ran end-to-end: found the entry point, moved laterally, hit internal data. Axios has the story.

This is the gotcha operators keep dismissing as theoretical. The tooling we use to give agents filesystem and network access is the same tooling an attacker can commandeer. There is no meaningful distinction between "agent with broad permissions doing its job" and "agent with broad permissions doing someone else's job." The attack surface is the capability surface.

The same week, Kimi K3 from China's Moonshot AI hit demand it couldn't serve and paused new subscriptions. AP News has the details. That is a market signal, not a news story: another capable open-weights-adjacent model is closing the gap, and the "U.S. labs have an unassailable lead" thesis keeps getting shorter.

Meanwhile, Simon Willison wrote the thing I've been thinking for months: reverse engineering is cheap now. Coding agents are dropping the cost of cracking a closed system low enough that people finally bother, automating hardware and devices at home that used to sit untouched. That matters for every operator building on top of APIs someone else controls.

Three separate stories, one through line: the capability floor dropped again, and the blast radius got wider.

Today: 9 repos, a Stack pick that actually ships, 4 signals with operator consequence.

New here? This part's for you. (Operators, skip to The Drops.)

New here? This block is for you. The rest of the issue moves fast. This block slows down.

What is open source?

When software is "open source," the people who built it have published all the code publicly, anyone can read it, copy it, modify it, or build on top of it for free. Think of it like a recipe shared online versus a secret formula locked in a vault. Most of the repos (projects) in today's Drops are open source. That is why a solo operator can grab a tool built by a team of fifty and start using it today, for nothing.

The opposite is "closed source" (or "proprietary") software, you can use it, but you cannot see or touch the code underneath. ChatGPT is closed source. Most of the repos in today's issue are not.

Do this today (~2 minutes, no setup required)

Pick any repo from today's Drops that sounds interesting. Open it. Scroll past the big title to the section that usually starts with "Features" or "Getting Started." You are not installing anything. You are just reading to find out what problem it solves and whether you have that problem. That is the whole skill.

How to use today's picks

Today's Drops have 9 repos: several are Claude Code skills (tools that plug directly into Claude's coding workflow), one is a trending agent harness, one is a knowledge-graph tool for Obsidian, and there are a handful of foundational repos you will see referenced everywhere. The Stack has one tool pick.

For each one: read the one-line description, click through, skim the README (the project's front-page notes, what it does and how to get started). Don't install anything yet. Install something only when it solves a problem you are already annoyed by.

Plain English

Open source: software whose code is published publicly, free to use, read, and build on.

README: the front-page document in any GitHub project that explains what the software does, who it's for, and how to start. Always read this first.

We read your replies

You told us you're here to learn, so we build this block for you every issue. If there's a word in today's issue that stopped you cold, hit reply and send it. We'll decode it next time.

[Repo] AgriciDaniel/claude-obsidian, Self-organizing AI second brain for Obsidian + Claude Code. Drop any source, an article, a meeting note, a screenshot, and Claude reads, links, and files it into a connected knowledge graph of plain Markdown you own. 9,696 stars.

[Skill] AgriciDaniel/claude-seo, Universal SEO skill for Claude Code: 25 sub-skills and 18 sub-agents covering technical SEO, E-E-A-T, schema, GEO/AEO, backlinks, local SEO, and semantic clustering. 11,883 stars. This is the kind of capability that used to require a specialist agency.

[Repo] 1jehuang/jcode, The most intelligent agent harness for code, per its own trending momentum. 9,517 stars on GitHub Trending this week. Worth watching for anyone who runs long coding tasks and gets frustrated by single-loop drift.

[Skill] adamlyttleapps/claude-skill-app-onboarding-questionnaire, A Claude Code skill that designs and builds high-converting questionnaire-style onboarding flows, modeled on conversion patterns from top subscription apps. 1,114 stars. If you are building anything with a paywall, the onboarding sequence is where you win or lose.

[Repo] twostraws/SwiftUI-Agent-Skill, SwiftUI agent skill for Claude Code, Codex, and other AI coding tools. 4,337 stars. If you build iOS apps with Claude, this is the most-starred Claude-native SwiftUI workflow right now.

[Repo] Ido-Levi/claude-code-tamagotchi, Real-time behavioral enforcement for Claude Code: monitors AI actions, detects violations, and interrupts misbehavior. 431 stars. Yes, it also has a pet. More importantly, it is the most direct answer to the Hugging Face breach story in today's Opening: give your agent a leash.

[Repo] chroma-core/chroma, The lightweight open-source vector database operators reach for first when building RAG. If you are planning any retrieval-augmented workflow and haven't touched a vector DB yet, Chroma is the lowest-friction first step.

[Repo] NirDiamant/RAG_Techniques, 28,725 stars. A repository of advanced RAG techniques, each with a detailed notebook tutorial. Hybrid, GraphRAG, CRAG, multimodal, the full map of where naive RAG breaks down and what to do about it.

[Repo] crewAIInc/crewAI, 55,854 stars. Framework for orchestrating role-playing, autonomous AI agents. The most-starred multi-agent orchestration framework in the shortlist. If you are about to wire multiple agents together for the first time, start here before building from scratch.

[Affiliate] Browse AI, If you are wiring up RAG or feeding agents live web data, Browse AI turns any site into structured data or an API by pointing and clicking, no scraper code to write or maintain. Train a robot once, schedule it to watch for changes, and pipe the output into Chroma or your agent. We may earn a commission.

[Tool] posecode-dev/posecode, Posecode is a tiny language an LLM can write, designed for physiotherapy, mobility, posture, yoga, and training. It renders to an animated 3D figure in the browser, with every joint clamped to a safe anatomical range. The operator unlock: if you are building any health, wellness, or fitness product that needs visual motion instructions, you now have an LLM-writable animation layer with built-in safety constraints. That is a non-obvious capability combination most fitness-app builders don't know exists yet.

- An AI agent ran a full end-to-end cyberattack on Hugging Face's internal databases. The agent framework found the entry, moved laterally, and hit internal data, confirmed by Hugging Face itself. This is not a hypothetical about future agent risk; it happened on infrastructure operators use daily to host and pull models. Audit what your agents can reach. (Axios)

- Reverse engineering just got cheap. Simon Willison documents the pattern: coding agents drop the cost of reverse engineering low enough that automating closed hardware and devices is finally worth the time. If you build on top of any closed API or proprietary system, your moat is thinner than it looks, and so is your competitor's. (Simon Willison)

- Kimi K3 (Moonshot AI, China) suspended new subscriptions after demand overwhelmed capacity. The model is reportedly matching frontier performance. Operators who assumed they could ignore Chinese open-weights-adjacent models are running out of time to revise that position. The cost floor on capable models is dropping from a direction most U.S.-focused operators are not watching. (AP News)

- OpenAI published lessons from deploying long-horizon models, new safety failure modes observed, new safeguards added. The operator-relevant part: long-running agents produce failure modes that short-context deployments don't. If you are extending your agents toward multi-step, multi-session, or overnight runs, read this before you scale. (OpenAI Blog)

Move: Scope your agent's permissions before the first run, not after the first incident.

The Hugging Face breach is a clean illustration of a failure mode that is entirely preventable. Here is the move:

1. Before you give any agent network or filesystem access, write down exactly which hosts, directories, or APIs it is allowed to touch. One list, specific paths and domains only. 2. Pass that list into the system prompt as an explicit constraint: "You may only read from / write to / call X. Any action outside this list requires a human confirmation step." 3. Add a confirmation hook at any action that crosses a boundary, file writes, outbound HTTP calls, database queries. One line of gate logic, not a full guardrail framework. 4. Run the agent on a minimal-privilege service account or API key. If the agent is compromised, the blast radius is the scope of that key, not your entire stack.

You will know it worked when an agent that would have silently called an external API instead surfaces a confirmation request you can approve or deny. That friction is the tuning mechanism, not the bottleneck.

Pair with Ido-Levi/claude-code-tamagotchi from today's Drops for real-time violation detection on top of this pattern.

We build The AIgent's engine in the open. An honest look at what we are making, what broke, and where it is headed. This week: a content queue that ran dry, and the evergreen fallback that meant nobody noticed.

Every queue you draw from will be empty one day. The only real choice is whether you decided in advance what happens when it is.

One of the engine's sections pulls a fresh entry from a queue on every issue. This week the queue hit zero. The issue did not break, did not blank, did not error. It fell back to an evergreen entry written long before and held in reserve for exactly this. What could have been an outage was a freshness gap, invisible to readers.

The fallback did its job so well it almost hid the problem, which is the twist worth keeping. Graceful degradation and silence are close cousins. A system that quietly covers for an empty queue can cover for it forever, and you will not know you are shipping the reserve tank until someone asks why this week reads like last month. So the reserve needs a light on the dashboard. A value buried in the code will not save you.

The practice generalizes to anything you consume: a queue, an API quota, a cache, a credential with an expiry. Write the empty-state path first, before the happy path, and make the empty state visible when it triggers. The happy path is half the feature. The other half is what happens when the well runs dry.

What is running on a fallback you forgot you built? Hit reply. We read every one.

The Hugging Face story reads as someone else's problem right up until it isn't. Every agent you ship with broad permissions is a surface. What could yours reach right now that you would rather it could not?

Before you go: we started a room for people actually building with agents. Post what you shipped, get unstuck, and drop what you want us to build next. Join the community →

See you Wednesday.