What shipped, when

Deals of the Week is re-checked and rebuilt. Three picks join the set. NoCodeBackend ($79 lifetime, 4.76 stars over 131 reviews, deal ends 29 September) generates a REST API and its documentation from tables you define in the browser, which is the gap an app scaffolded by Lovable or Cursor usually still has; Tier 1 covers three databases at 50,000 records each. MarkupGo ($49 lifetime, 4.84 over 37 reviews) renders HTML into images and PDFs through one API, with 1,000 credits a month and 10 templates on Tier 1, for the OG cards and PDF receipts that otherwise mean running headless Chrome yourself. Nuwtonic SEO ($69 lifetime, 4.82 over 66 reviews) reads Google Search Console data and tracks whether ChatGPT, Gemini, and Perplexity cite you, on one domain with 1,200 AI credits a month. Two picks left: ZeroRank AI is now gated behind an AppSumo Plus membership, and FeedBoss published a price increase due within hours of this check, so we would have quoted a price that no longer held. Sinosend now shows an end date of 23 September and DigiParser 25 September, both stated on their cards. Everything else was re-verified on its own AppSumo page with a standard buy button at the price shown. Rejected this round: Hyprcore (Plus-gated), GitDoc (3.00 stars over 2 reviews), MiroMiro (6 reviews), Consently (4.16 stars), and the usual purchased-contact-database outreach tools.

Same model, same pass rate, twice the cost: measure what your agent harness sends on every call starts from HarnessTax, a UC Berkeley Sky Lab measurement published 16 September that ran seven models through Claude Code, Codex CLI and Pi on SWE-bench Lite and Terminal-Bench 2.0. Claude Fable 5 solved 97.8% of SWE-bench Lite attempts in Claude Code and 96.7% in Pi, in 15.3 and 15.4 turns, at $1.33 against $0.67 per attempt. The study's chart data puts the difference in the block each harness resends on every call: 1,972 first-call tokens for Pi, 11,308 for Codex and 27,011 for Claude Code, where tool definitions make up 85% of the instruction and tool characters. The post gives the claude -p --output-format json one-liner that reads that number from your own setup, the three flags that separate harness from configuration (30,271 tokens with a full configuration on the test machine, 18,809 without it, 2,441 with no tools), and a stream-json filter that prints the context of each call. A same-task test on Claude Code 2.1.274 ran one bug fix three times with the default tools and three times with --tools "Bash,Read,Edit,Write": every attempt passed in three calls, first-call context fell from about 19,000 tokens to 5,600, and warm-cache cost fell by about 42%. Also covered: --bare and --exclude-dynamic-system-prompt-sections for scripted runs, why interactive sessions are a different case, the study's benchmark and funding caveats, and a ten-task cost-per-solved-task test for deciding on your own code.

Three tools joined the catalogue this week, all of them established products that were simply missing: Hermes Agent from Nous Research (MIT, around 246,000 GitHub stars) is a personal agent reachable from Telegram, Discord, Slack, WhatsApp, Signal, email, or a terminal, with memory that carries between projects, recurring work scheduled in plain language, and subagents that get their own terminal inside a local, Docker, SSH, Singularity, or Modal sandbox. Context7 from Upstash (MIT, around 62,000 stars and roughly 1.1 million weekly installs of its MCP server) fetches version-specific documentation and code examples from the source library into a coding agent at prompt time, which is the difference between generated code that targets the installed version and code written against year-old training data; it installs as an MCP server or as a ctx7 CLI skill for Cursor, Claude Code, and OpenCode. Headroom (Apache-2.0, around 72,400 stars) compresses tool outputs, logs, file reads, and RAG chunks before they reach the model, reporting 21 to 57 percent fewer tokens while leaving error lines byte for byte intact; it runs as a library, a local proxy, an MCP server, or a one-command wrap around an agent you already use, and the compression happens on your machine rather than at a service. The catalogue now holds 408 tools across 12 categories.

LiteLLM accepted a fabricated bearer token on its MCP endpoint, and Starlette let a Host header rewrite request.url.path reads two rows of CISA's Known Exploited Vulnerabilities catalog that share a due date of 16 September. CVE-2026-59822 (CVSS 8.8) is an improper-authentication flaw in LiteLLM's MCP Streamable HTTP endpoint: the OAuth2 passthrough path replaced a failed key validation with an empty UserAPIKeyAuth() object, so a request carrying an invented Authorization header could list and call configured MCP tools. CVE-2026-48710 (CVSS 6.5) is a smuggling flaw in Starlette: the Host header was not validated before request.url was reconstructed, so Host: example.com/abc?bar= makes request.url.path read /abc while the router still dispatches the real path from scope["path"], which defeats middleware that authorizes on request.url.path. Both fixes shipped in May, 125 and 118 days before the deadline. The post gives the pip show check, the store_model_in_db condition that decides whether the LiteLLM MCP gateway was ever exposed, the grep that finds the affected middleware, and two things the upgrade does not do: pip install -U fastapi leaves Starlette in place because FastAPI 0.141.1 declares starlette>=0.46.0 with no ceiling, and patching LiteLLM revokes nothing, because the tool calls that got through authenticated with each MCP server's own stored upstream credentials rather than with a LiteLLM key.

Deals of the Week carries 9 picks after this week's re-check. Respona left the set: its AppSumo listing now reads "Deal ends in 3 days", and a deal that expires mid-week is not worth a slot. SheetXAI stays, at a corrected price — the tier-1 price increase we flagged last Friday has gone through, so the page now asks $49 rather than $39, and the seed says so. DigiParser picked up a published end date of 25 September. Nothing new was added: the AppSumo catalogue rotated the same dozen products across every collection this week, and the three listings that fit an AI builder (a Chrome-extension generator at 14 reviews, an on-device meeting recorder at 13, a docs generator at 1) have too little feedback behind them to put on the page. ZeroRank AI ends on 16 September, so expect the set to shift again next Friday.

deepseek-v4-pro answers with a different model on Monday, and your input cost drops 77% when it does covers a retirement that spend monitoring cannot see. DeepSeek released V4.1-Flash on 10 September; deepseek-v4-flash and deepseek-v4-flash-vision-exp are already redirected to it, and deepseek-v4-pro follows after 12:00 Beijing Time on 14 September, which is 04:00 UTC on Monday. Because the replacement is billed at the Flash price, cache-miss input falls from $0.66 to $0.15 per million tokens and output from $1.98 to $0.60, so a cost-anomaly alert pointed at spend increases sees a 77 percent saving rather than a model substitution. The post gives the grep across source, config, .env and notebook files, the reason to capture an eval baseline in the three days before the old behaviour becomes unobservable, and the modality and concurrency differences between the two models. It also reads the current peak and off-peak table — peak is 01:00 to 04:00 and 06:00 to 10:00 UTC on weekdays, charged at double — against where nightly cron jobs actually land, and closes on the Claude Code latest regression that returned HTTP 400 on every turn against third-party Anthropic-compatible endpoints for 47 hours, including DeepSeek's own.

The "use TDD" line in your AGENTS.md scored below writing nothing, across 80 runs per condition works through a September 2026 measurement of 26 one-line testing instructions and 4 published testing skills, run on Codex with GPT-5.6 Sol at 80 runs per condition on a Zstd decoder graded by hidden tests. Writing no test instruction finished above average; "use test-driven development" produced twice as many tests and a lower pass rate; the formal-methods lines produced proofs of A => A; the Rust testing skill from the 255k-star ECC collection made results worse the earlier an agent read it. The post gives the grep that lists technique-naming lines across AGENTS.md, CLAUDE.md, rules directories and installed SKILL.md files, quotes the five-sentence skill that scored highest and the author's own reservations about it, separates the three kinds of instruction line by risk, and states what one harness, one model and one task family do not license. The library's own Test-Driven Development skill gained a matching when-not-to-use caveat.

All three address the same underlying complaint from a different angle: an agent that is handed the right context, credentials, or instructions does more with less. SkillOpt comes out of Microsoft Research (MIT, around 16,800 GitHub stars, covered by Microsoft Research and VentureBeat) and treats a skill markdown file as a trainable parameter of a frozen model. Scored task trajectories go in, an optimizer model proposes add, delete, and replace edits in minibatches, and an edit is accepted only when it improves a held-out validation split, so the failed candidates are recorded rather than retried. What deploys is a single best_skill.md, typically 300 to 2,000 tokens, with no weight update and no extra call at inference time. Graft (Nanonets, MIT, roughly 6,700 stars and about 5,300 npm downloads a week) attacks the rediscovery tax: a coding agent re-greps and re-reads the same repository on every task and throws the picture away at the end of the session. Graft builds that picture once as a folder of linked plain-English notes, one per system or concept, keeps it as a gitignored local cache regenerated against the working tree, and wires it into Claude Code, Cursor, Codex, or Gemini through MCP and hooks. No embeddings and no index to keep warm. OpenConnector (OOMOL, Apache-2.0, around 5,700 stars) is the credential layer: connect a user account once, then expose more than 1,000 providers and 10,000 prebuilt actions to agents over MCP, HTTP and OpenAPI, an SDK, or a CLI, with the tokens held in an inspectable runtime rather than passed into the agent, plus scopes, allow and block policies, and redacted run logs. Self-host it with Docker or Node, or use the hosted runtime.

Over-Engineering Guard applies while the code is being written rather than in a cleanup pass afterwards. It climbs a seven-rung ladder before anything gets typed, asking whether the thing needs to exist at all, whether this codebase already has it, whether the standard library or a native platform feature covers it, and whether it can be one line, stopping at the first rung that holds. The important half is what it refuses to shorten: comprehension stays off the ladder, so every file the change touches gets traced first, and a fix is held to the root cause by grepping the callers rather than patching the one path the ticket named. An exclusion list no rung reaches protects input validation at trust boundaries, error handling that prevents data loss, security and accessibility. Shortcuts taken on purpose carry a comment naming the ceiling and the upgrade path, so they can be collected later instead of rotting. Editorial Diagram Designer is for the diagrams a reader judges on sight. It routes on behaviour rather than on the noun in the request, so a fan-in with finite capacity becomes a data flow and controls grouped by enforcement point become a layer stack, then loads the layout grammar only for the type it chose from thirty-nine. Colour and type resolve through semantic roles held in one style guide, which means a diagram reskins to a brand pulled from a website and saved as a reusable profile. Density is budgeted at roughly four out of ten, with more than nine nodes treated as a sign the diagram is really two. Six connector rules are non-negotiable, covering orthogonal routing with rounded bends, a visible gap between a masked label and its stroke, fanned attach points where several lines share an edge, and no transit behind a box that is neither source nor destination.

Set SLOs from real traffic makes you write each indicator from the position of someone using the service before it becomes a metric, then expresses it as good events over valid events with the exclusions justified and the measurement source named alongside what that source cannot see. Targets come from the four weeks of numbers you paste rather than from convention, so a service delivering 99.3% gets told that 99.9% is a funded project and not an objective. The budget is converted into minutes of outage and failed requests at your volume, and the policy names the consequence at each threshold and who carries it out. Pre-register an A/B test opens on the question that decides whether the rest is worth doing, which is what you would do if the change loses, and tells you not to run it if the answer is ship anyway. Then one primary metric with numerator and denominator, guardrails with stop thresholds, a minimum detectable effect argued from what would justify the work rather than from what the traffic can resolve, sample and runtime in whole weeks, a stopping rule chosen before launch, and a decision table with an action committed to every outcome including the flat one. Sort scattered design values into a token system separates primitives, semantic tokens and component tokens with a strict boundary, flags semantic tokens holding literal values instead of references, applies one naming pattern to eight of your real values, and reports where Figma and code hold different values for the same concept rather than averaging the disagreement away.

Claude Code 2.1.261 added /skill-doctor, which lists every loaded skill with an invocation count and what its listing costs in context. Run on a working machine for the new post, it found 65 skills of which 57 had never been invoked once, carrying roughly 6,400 tokens of system prompt on every turn. The post covers what that number is (the description line, not the skill body), the disable-model-invocation frontmatter line that removes a skill from the listing without uninstalling it — measured before and after — and why plugin skills cannot be pruned one at a time. The second half is provenance: nothing under ~/.claude/skills records where a skill came from, the skills CLI added commit-SHA pinning on September 6, and two constraints will cost you the pin without saying so. One is that abbreviated SHAs are rejected. The other, found while testing the procedure for this post, is that the pin fails on a machine whose git is not set to English, because the fallback matches untranslated error text. See also the skill packs.

The twelve skill packs were titled by template, which produced page titles like "Developer Claude Skill Pack" — the right words in an order nobody types. People searching for these pages write "hr skills for claude", "rfp skill claude", or "download skill content planner claude". In August the HR pack was retitled to lead with that phrasing and went from zero clicks to its first ones, so the same treatment now covers the other eleven: each title leads with "Claude Skills for <role>" and then names what is actually in the pack, such as code review, PRs and postmortems, QBRs, renewals and churn saves, or Mermaid flowcharts and ERDs. The pack descriptions changed too. Ten of them ended on one of two stock sentences ("The X workflow as installable Claude skills", "Capability skills for any role"), which read as filler and, on the longer entries, pushed the useful part past where a search result gets cut. Each now closes on something specific to that pack.

Three flagship models shipped between 1 and 3 September, and all three migration lists remove the same class of parameter. The new post starts from a request that now fails: on Claude, any temperature other than 1.0 returns a 400, and the thinking documentation names nine models where non-default temperature, top_p or top_k is rejected on every request. Gemini 3.8 Flash files the same edits under "Remove deprecated sampling parameters" and drops candidate_count across Gemini 3 and later. GPT-6 Astra instructs removal of temperature, top_p and logprobs. What replaced them is a five-value effort enum that Anthropic describes as "a behavioral signal, not a strict token budget", alongside the numeric thinking budget being replaced by the same shape of control at both Anthropic and Google. The post covers the billing consequence most people port the old habit into (changing top-level effort invalidates the prompt cache; the per-message form behind mid-conversation-output-config-2026-07-01 does not), one grep for the four patterns this breaks in a normal codebase, and what reproducibility looks like without a sampler — given that the same API reference says results were never fully deterministic at temperature: 0 anyway.

Every pick was re-checked on its AppSumo page, and all ten remain purchasable at their listed prices. Nothing new cleared the bar this week: the new arrivals were either off-audience or too new to carry a usable review record, so the set stays as it is. ZeroRank AI now carries an end date of 16 September, and /deals retires it automatically once that passes. Its $69 tier held through the price increase flagged last week. SheetXAI shows a Tier 1 price increase in six days, so the $39 tier may change before next Friday's pass.

OpenAI released GPT-6 Astra on September 3 at $10/$50 per million tokens, with API access for most accounts "in the coming days". The new post covers what changes in code rather than what shipped. The migration guide removes temperature, top_p and logprobs, drops the none effort level, and moves tool calling to the Responses API, which a single grep finds. The item that changes how an agent loop is written is misalignment monitoring: a request can return HTTP 403 with code misalignment_policy_violation, the documentation says the conversation cannot be resumed and must not be retried, and whether it can be stopped at all depends on which Responses features carry your state (persisted reasoning, WebSockets or compaction can be halted; a flat transcript only gets a safety.alert.created webhook; Chat Completions is outside the system). Also in the post: the pricing rule that bills the full request at 2x input and 1.5x output once a prompt passes 272K tokens, Fast mode being unavailable under EU data residency, the safety_identifier question for platforms serving many end users, and what each of those means for teams already on Responses, teams with tools on Chat Completions, and indie builders waiting for the rollout.

New post: Diff your agent CLI, not its changelog. Claude Code 2.1.258 fixes "a regression introduced in 2.1.255", and 2.1.255 exists on no public surface: not in CHANGELOG.md, not on npm (the publish history goes 2.1.252 on 31 August straight to 2.1.257 on 1 September), and not as a git tag in a repository that tags every other release. A tag-gap scan over the 2.1.240+ range returns seven holes. The post turns that into four checks a practitioner can run today, each verified against live data this week: read the tag list for gaps before reading any prose; ask for release body lengths, since every Codex alpha in the window has a body of 25 to 28 characters consisting of the word Release and its version, against 8,349 characters for the 0.152.0 stable release, and recover the content with gh api compare (33 commits between two alphas whose notes total 50 characters); grep commit subjects for default, opt-in, no longer, remove, disable and breaking, which reduces 90 commits to six lines and surfaces the planning tool being switched to opt-in, a change Codex filed under the heading "Chores"; and watch the documentation tree alongside the release feed, because Google's /boost page was archived complete on 1 September at 00:11 UTC while the Antigravity changelog first mentions the command in its 2.12.0 entry dated 2 September. Also covered: why the compare trick recovers nothing for Claude Code (the repository ships CHANGELOG.md and feed.xml, no source), the Atom changelog feed that is a better monitor than polling markdown, and the fact that the GitHub releases list is ordered by neither publish nor creation time.

Three additions to /tools, all open source, all with adoption you can check. Prime Agent from Prime Intellect runs a coding and research agent inside a persistent Python REPL: context is held as variables rather than pasted into a prompt, subagents are called like functions, and the prompts, memories, and subagent specifications it accumulates are durable state it edits between runs instead of losing at the end of a session. Useful when the task outlives one sitting, since sessions run in the background and can be reattached. OpenWorker from Andrew Ng is a desktop app that runs AI coworkers locally against the tools work already happens in, covering dependency audits, Terraform posture checks, account research, and incident triage, with your own provider keys and an approval step before anything is sent, posted, or opened as a pull request. OpenWiki from LangChain is a CLI that reads a repository, writes a linked Markdown wiki into it, and regenerates the affected pages whenever the code moves, tracing each factual claim back to versioned source. It answers a specific problem: coding agents work better against documentation that is current, and hand-written docs stop being current within a week.

Anthropic released Claude Fable 5.1 on September 1 at unchanged $10/$50 pricing, with cache reads cut from $1 to $0.25 per million tokens — 0.025x base input where every other Claude model charges 0.1x. The documented migration is one line, and three documented things break on it. The new post covers each with the command that finds it: tool_choice of type any or tool now returns a 400 with a quoted error string, which matters because forcing a tool is how many people get schema-valid JSON; thinking blocks are bound to the model that wrote them, so a router falling back to an older model has its blocks dropped before the model sees them, unbilled and silent unless the thinking-binding-controls-2026-08-01 beta header is set; and the history-editing check is enforced only for accounts created on or after August 31, 2026, which means identical code against the identical model ID behaves differently depending on the age of the account behind the key. Also in the post: the drop_block probe that tells you which side you are on, and the behaviour changes that raise no error at all, including one tool call per turn where Fable 5 batched several and whole-file rewrites in place of targeted edits at $50 per million output tokens.

Constraint-Driven Development answers the question that arrives once an agent writes more code in an afternoon than anyone will read that week: what does good enough to ship mean here, in numbers, written down. Four interview questions, each carrying a default so that not knowing still produces a working config, then a CONSTRAINTS.md where every enforced row names the command that produces the verdict and the stage it runs at. The half that matters most is the guard: agents do not craft loopholes, they hit a red check and take the cheapest road to green, so the skill reads the diff for a threshold edited down, a test made easier, a checker silenced, an unfinished stub, and an exception nobody discussed. It also ranks constraints as external, project or suite, and insists at least one check exists that the agent cannot satisfy by writing code that does not work. Scroll-Driven Page Builder treats scroll as a timeline rather than transport. It interviews for the feeling curve before any device is chosen, commits to one page grammar, requires a bespoke signature move, and runs a fingerprint check so the next page differs from every previous build on at least four of six structural dimensions. Verification is the distinctive part: a scroll page has no single state, so a headless pass walks each act at several positions at desktop and phone widths and once with reduced motion, hunting dead scroll ranges, copy that fades in and stops half-arrived, and contrast measured on the composited page at the brightest frame under each line.

Threat-model a system with STRIDE starts by restating your architecture as elements and flows with the trust boundary crossings marked, then sweeps each one through spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege. Threats come back in a table with the precondition an attacker needs, ranked by reachability against impact, alongside what is already covered, what you are accepting on purpose and what cannot be assessed from the description you gave. Security-review an AI feature traces each untrusted input to the tools it makes reachable and names any path that runs from attacker-controlled text to a side effect with no human in between, then sweeps the ten categories in the 2026 OWASP revision, which moved excessive agency to third and renamed system prompt leakage to hidden context exposure. Fixes are ordered agency first, output constraints second, input filters last. Write the data contract for a shared table pins the grain, the meaning of every column a consumer reads, freshness and row counts as numbers a check can evaluate, and an owner, then sorts the checks into block the load, warn and continue, and observe, with each past break matched to the check that would have caught it.

Anthropic emailed affected Claude users that infostealer malware on their own machines had taken active login sessions and spent their usage through them. The transferable part is the mechanic, not the incident: a session token is a bearer credential, so 2FA and SSO gate the login the theft happens after, and a password change governs a login the attacker is never performing. The new post adds the part specific to a developer machine — one security dump-keychain query on our own laptop returned seven credential entries written by four AI tools, and clicking Log Out in claude.ai reaches none of them. It maps each credential to what ends it (/logout, Console rotation, ant auth logout), covers the macOS keychain fallback to ~/.claude/.credentials.json and the one-year setup-token that no web revoke touches, gives the order that works (malware out first, log back in last), and corrects a tempting wrong move: /usage is computed from local session history only, so it cannot see a session spent from someone else's computer.

Lovable, Bolt and the rest default to a front end over hardcoded arrays unless the prompt names the schema, the roles and the access rules. The new guide sets out the order that works — data model and auth first, then one flow end to end, then everything else — with the prompt text for each pass, why the order row has to be created in the Stripe webhook rather than on the client redirect, and the three questions that turn a builder's confident summary into something you can check. Also this week: sharper search snippets on the prompts-vs-skills, RAG-vs-knowledge-base and webhooks-vs-polling guides, and eleven contractions removed from titles and descriptions that search engines display.

Five vendors published seven dated changes in five days, and not one was a launch: Claude Code weekly limits drop to a permanent baseline on September 14 (a 17% reduction on today, by Anthropic's own figure), Copilot code review flips from Lite to Balanced and chat retention goes from 28 days to the life of the account on September 28, Copilot seats bill upfront from October 1, gemini-omni-flash-preview retires September 30, Mechanical Turk closes September 30, and OpenAI models leave Cursor on November 12. The deprecation pages at Anthropic, Google and OpenAI carry exactly one of the seven, because all three are registries of model identifiers. The post quotes each page's scope language, names who has to act by when, and sets out the four columns an expiry register needs.

OpenAI has told SpaceX it will wind down the contract that supplies GPT-5.6 Luna, Sol and Terra to Cursor, with a proposed shutoff on November 12 and no future model, Astra included, supplied before then. Cursor says that is about 5% of its traffic and that it is negotiating. The post lays out the three routes that sit outside the cancelled contract (your own API key, the Codex extension inside Cursor, a different model) with what each changes on cost and data retention, plus the four places to look for the dependency on your own team.

Every pick was re-checked on its AppSumo page. FeedBoss joins at $59 lifetime: a LinkedIn content workspace that drafts posts and carousels from your own knowledge base and profile voice. Last week it was restricted to AppSumo Plus members; it now has a standard buy button. Rafter leaves the set: its deal reached the end date we recorded, and the page has since become Plus-only with hours remaining. ZeroRank AI shows a price increase in four days, so the $69 tier may not hold past the weekend.

On August 24 the same Anthropic outage produced three different status pages: Anthropic opened a major incident 16 minutes after impact began, Cursor a minor one at 48 minutes, GitHub a major one at 2 hours 22 minutes, and the three closed in reverse order, with GitHub reporting resolved 32 minutes before the upstream provider did. The new post rebuilds the timeline from the three public Statuspage APIs, shows why severity levels and resolved states describe the vendor’s surface rather than the fault, and moves the outage pre-check from our July fallback guide one layer up: map the model providers behind each tool, poll incidents/unresolved.json on the upstream page, and treat a middleman’s green as context, not as a receipt.

Triage a noisy alert list takes the alerts and their fire counts from the last month and returns one of four verdicts for each: page, ticket, rewrite, or delete, with the reason tied to how often anyone acted on it. Cascades collapse to one paging alert with the rest grouped or inhibited; scheduled and flapping alerts get a window or a threshold instead of a nightly acknowledge; and where an SLO exists, a long-window plus short-window burn-rate alert retires the cause-based ones. Status page and stakeholder updates writes the post for the state the incident is in now, pre-writes the identified, monitoring and resolved posts with brackets to fill, gives leadership one line in customers and revenue rather than system names, hands support two sentences and the one thing not to say, and sets a cadence that still produces an update when there is nothing new. Find the levers in a cloud bill separates usage levers from rate levers on each billing line, attaches a savings range, a concrete production risk, the effort, and the measurement to take first, then sorts the lot into this week, this quarter, and not now, with the constraint named for anything in the last list.

Vision models bill per patch and silently downscale anything over budget. A 3840x2160 capture would cost 10,764 visual tokens at full size, so a standard-tier model delivers it as 1456x819 and bills 1560 — a 37.9 percent scale that turns 12-pixel UI text into 4.5-pixel text, at full price. A 1000x600 crop of the panel you asked about costs 792 tokens and arrives untouched. The post has the patch formula (one token per 28x28 block), the token budget that resizes images already under the edge cap, the transformations: { oversized_image: 'error' } flag that turns a silent resize into a 400, the two paths where the rules differ (computer-use tool_result images are rejected rather than resized, and requests over 20 image blocks get a stricter limit applied to every image), and the OpenAI equivalents.

Weekly SEO pass. The HR pack now carries its own page title, "Claude Skills for HR", because that is how people search for it and "HR Claude Skill Pack" matched none of it. The role-prompting guide got a title and summary that say what the guide concludes: a persona reliably changes tone and framing, and almost never changes factual accuracy. Ten links in published guides and posts pointed at URLs that no longer exist and returned 404 — they now point at the live pages. Another 13 pointed at the retired /learn/ai/prompt-craft/* paths and went through a redirect hop; they go straight to /learn/prompt-engineering/foundations/* now. /deals and /learn/paths were live but missing from the sitemap, and have been added.

Four containment rules were patched in five days, and each one was a correct statement scoped to a dimension its author had enumerated. Claude Code 2.1.236 fixed a **/.env deny rule that lost to an allow region, skipped matched directories' contents, and fell to a rename. DeepSeek Harness 0.1.1-rc.1 stopped confined processes escaping Bubblewrap through /proc/<pid>/root. Ray's browser guard is a User-Agent string check, fixed in 2.52.0 back in November 2025 and added to CISA's exploited list on 17 August. Copilot Personal memory survives a password change. The post gives the version checks and the four dimensions to test: naming, namespace, network, lifetime.

This week's pass re-checked every pick on its AppSumo page. SheetXAI joins the set at $39 lifetime: plain-English instructions run across a Google Sheet or an Excel file, with jobs finishing in the background. It was held back last week because purchase was restricted to AppSumo Plus members; that restriction has been lifted. Letterly comes off the page for the opposite reason — it is now Plus-only and its deal ends within three days. Rafter is flagged as ending 26 August.

A rate card states a price; it does not state what you paid. The new post walks OpenRouter's beta Analytics API end to end — the read-only management key that cannot make inference calls, the four queries that give you effective dollars per million tokens by model, the spend decomposition that explains the gap, and the five ways the API returns a confidently wrong number (a silent 7-day default range, count metrics typed as strings, and metadata.truncated among them).

The tools catalogue picks up DeepSeek Harness, the plugin-based agent harness DeepSeek open-sourced on 13 August that crossed 165,000 GitHub stars in its first week; Grok Build, the terminal coding agent and TUI from xAI; and Colibri, a pure-C inference engine that streams Mixture-of-Experts weights from SSD so trillion-parameter models run on a machine with no GPU.

This week's skill additions. AI-Slop UI Auditor (web-ui pack) reads an existing page and grades it against the named anti-patterns of machine-made design — the purple gradient hero, Inter everywhere, the three-equal-column icon-card grid, transition: all, italic headings, invented proof such as "trusted by 50,000+ teams" — returning each finding as tell, file:line, severity, and a one-line fix, and grading the page skeleton separately from its styling. Redesign mode then rebuilds the section rhythm in place while copy, routes, and brand survive. Agent Skill Security Reviewer (developer pack) answers whether a third-party skill, plugin, or MCP server is safe to install: a static scan across prompt injection, data exfiltration, privilege escalation, supply chain, and MCP tool poisoning, paired with a source read of whether declared permissions match actual behaviour, ending in APPROVE, CAUTION, or REJECT rather than a score.

Cursor shipped Origin on August 17, a code host inside the editor, rolling out in early beta to every paid plan unless an enterprise admin opts out. Read the check: the Origin docs have a Privacy section, and it says one thing, that Origin inherits the namespace owner's Privacy Mode. The words retention, residency, subprocessor and export do not appear on the page. cursor.com/data-use is dated July 15, 2026 and does not mention code hosting; the enterprise data-governance page still states "Cloud Agents are the only feature that requires Cursor to store code"; the privacy policy has not changed since October 6, 2025. Privacy Mode is a training commitment, not a retention commitment. Includes the split between a synced repo (GitHub stays source of truth, reversible) and a repo created in Origin, plus the timing: GitHub ran a critical incident for 7h35m the same afternoon, with archive and raw-content downloads failing near 50 percent.

Turn your hand review of an AI feature into a grader builds an LLM-as-judge rubric from the outputs you already accept and reject: one judge per dimension rather than one judge scoring everything, score levels described concretely enough that a stranger could apply them to your examples, an Unknown verdict so the judge stops guessing on cases it cannot see, and the calibration procedure that tells you whether its labels match yours. Month-end variance commentary applies a percent and dollar-floor threshold together, attributes each material line to volume, price, mix or timing, and keeps timing variances in their own section with an expected reversal period, because a slipped invoice read as a trend corrupts the reforecast. Differentiate one lesson for the range actually in the room produces a single timed plan with scaffolds that carry removal criteria, sentence frames by language proficiency, IEP accommodations that change access without lowering the demand, extension tasks that go deeper instead of further, and a cut list for when the period runs short.

imagen-4.0-generate-001, -fast-generate-001 and -ultra-generate-001 stopped serving today. Read the migration: the generate_images() method itself has no supported model left, so this is a call-shape change rather than a string swap. Google points at three different successors across three live docs pages, and the per-image prices spread about 4x — the replacement named in the deprecations table runs $0.067 per 1K image against Imagen 4 Fast's $0.02, while gemini-3.1-flash-lite-image through the Batch API costs $0.0168 and lands below what you were paying. The catch: the Interactions API that the current docs teach does not support the Batch API or explicit caching, so the newest surface cannot reach the discount. Includes the split between interactive and bulk generation and verified code for both.

The MSA Review Helper skill now spells out Master Services Agreement and names the clauses it checks (IP, liability, indemnification, termination) instead of leaving the abbreviation to do the work. Perplexity vs Google AI Mode describes what the comparison covers rather than describing itself. The Ship and own your stack pillar now names Lovable, Replit, Base44, and Emergent, which is what the guides underneath it are about.

Four vendors changed four different parts of their rate structure in five days, and none of them touched a model ID. Read the breakdown: DeepSeek bills by hour of day from 16:00 UTC today, Google publishes "$0.75 through December 31, 2026. $1.50 starting January 1, 2027" on every Gemini 3.7 Flash rate line, Anthropic prices fast mode and US-pinned inference as multipliers that stack (Claude Opus 5 base input runs $5.00 or $11.00 per million depending on two fields in your request), and Anthropic separately cancelled the Sonnet 5 increase that was scheduled for September 1. Includes the four-part key a cost row needs and the three dates to put in it.

Three picks left the set this week: Rybbit and Prompt Architects both sold out, and Cleanlist AI was five hours from its end date. Robomotion RPA joins at $119 lifetime, for the repetitive web and desktop work sitting in apps that never shipped an API. Letterly and Rafter now carry their end dates, so /deals hides them automatically once the countdown runs out.

DeepSeek took V4-Pro out of preview on August 13 and moves the whole API to peak/off-peak billing at 16:00 UTC on August 16. Run the arithmetic before Sunday: every one of the six token categories rises even at the cheaper tier, cache-hit input on V4-Pro goes up 12.1x, and the peak window (01:00–04:00 and 06:00–10:00 UTC) is the Chinese working day — which is where most US nightly batch jobs already run.

A PostToolUse hook that feeds a failing type-check back to Claude the moment it edits a file, plus an agent-based Stop hook that blocks the turn from ending until the test suite passes. Read the two recipes — both verified against Claude Code's current hooks reference and hooks guide, including the exit-code-2 behavior and the experimental agent-hook path.

Alibaba published downloadable weights for Qwen3.8-Max on August 12, the first Max-class Qwen model ever open-weighted. Read the license before you build on it: it breaks from the Apache 2.0 pattern of Qwen3.5/3.6, adds a $50M/12-month revenue threshold specifically for coding-assistant and office-productivity products, and the download itself is text-only at a shorter default context than the cloud model it was benchmarked against.

This week's tools additions, all net-new to the catalogue despite established adoption. Goose is the Linux Foundation-governed open-source agent that runs as a desktop app, CLI, or API against 15+ LLM providers, around 52,700 GitHub stars. Microsoft Agent Framework is Microsoft's GA multi-agent orchestration framework for Python and .NET, the supported successor to AutoGen and Semantic Kernel. Rivet is YC- and a16z-backed actor infrastructure for durable, stateful agent workloads that run inside your own backend.

Anthropic signed the EU AI Act Code of Practice and turned on content marking: Claude models released on or after August 2, 2026 embed an imperceptible machine-readable watermark in all generated text, and generated images carry C2PA provenance metadata. It applies to the API and every Claude surface, worldwide. The new post covers the model-date cutoff that decides which of your outputs are marked, why a mark proves processing rather than authorship (a proofread human draft gets the same mark), the fact that no public detector exists yet, and the December 2 deadline that will push every other provider to follow.

This week's skill additions. Draw.io Diagram Builder (diagram pack) generates editable .drawio files with official AWS/Azure/GCP/Kubernetes icons, and can derive the diagram from artifacts you already have: a codebase's import graph, Terraform or Kubernetes config, or SQL CREATE TABLE statements, so the edges follow real references instead of guesses. Simplified Technical English Rewriter (document pack) rewrites documentation, runbooks, and error messages under ASD-STE100, the controlled language aerospace has used since 1983: 20-word procedural sentences, one meaning per word, condition before command, and code left exactly as written.

Meta released Muse Glimmer on August 10: a 30B open-weight agentic model under plain Apache 2.0, quantized to fit a 24 GB consumer GPU, with day-zero support in Ollama and LM Studio. The new post walks the decision in order — verify the official repository, read the license file itself, match the quantization to your VRAM, then replay a week of your own agent traces against the local model before moving anything off the API you pay for today.

This week's prompt additions. Build a content brief from the pages that already rank reads intent and structure off the current top results, then finds the gap that justifies the article and flags every inherited claim for verification. Write a user interview script that asks about the last time produces questions anchored in specific past instances instead of polite speculation, with probes for vague answers and a ten-minute debrief template. Extract jobs-to-be-done from raw customer evidence turns messy notes and tickets into solution-free job statements, each with its evidence quoted and its current alternative named.

A measurement that reached the Hacker News front page put Claude Code at roughly 33,000 tokens of system prompt and tool schemas before the first word of the request — and found a 72 KB instruction file adding ~20,000 tokens to every call. The new post walks through reading your own number with /usage and /context, then the five levers that move it: CLAUDE.md-to-skills migration, MCP server hygiene now that tool definitions defer by default, hook-filtered tool output, thinking budgets, and session shape.

Weekly SEO pass: the Replit migration guide title now names Railway, the destination the guide actually walks through (an earlier title promised Vercel and Fly.io). The changelog and the ChatGPT search vs Google AI Mode comparison got titles and descriptions that state what is on the page.

In under three weeks: Anthropic disclosed that three of its models breached three real organizations from a misconfigured third-party test environment (found in a review of 141,006 evaluation runs), and OpenAI restricted its own staff's use of unreleased Astra after it could not rule out critical cyber capability. The new trend post reads the chain as one operational shift, and pulls out five controls that transfer to anyone running agents in production: verified egress, eval infrastructure treated as production, trajectory monitoring, pre-written pause criteria, and a measured false-positive budget for guardrails.

This week's Deals of the Week refresh: DigiParser joins the set (AI document parsing that turns invoices, receipts, and purchase orders into structured data routed to Google Sheets, Xero, or webhooks, $69 lifetime). Remalt and TaskMagic left the set after selling out on AppSumo. The eleven carry-over picks were re-verified live at their listed prices.

Amazon, Cursor, Microsoft, OpenAI, and Vercel launched Agent Plugins on August 6: an open standard that packages agent skills and MCP servers into a single portable directory, with ChatGPT, Codex, Cursor, GitHub Copilot, VS Code, and Kiro supporting it at launch. The new post covers the exact directory layout, the two-field manifest, what carries over from the packages you maintain today, and why your Claude Code plugin packaging stays separate for now.

The documents your agent should treat as the authority — internal standards, style guides, technical books — usually get pasted into context at 100K+ tokens per conversation, or left out entirely. The new post walks through book-to-skill (~17k GitHub stars this week), an MIT-licensed converter that compiles a PDF into a skill with a 4K-token core and on-demand chapters: the install, the extraction modes that preserve tables and code, where chapter detection breaks, and when RAG is still the right call.

Meta released Muse Code on August 5 with two API tiers: standard at $1.25/$4.25 per million tokens, and a contributor tier at $0.10/$0.20 in exchange for permission to train on your prompts and completions. The new post walks through why that is a data-governance decision rather than a pricing choice, who can safely take the discount, and the rate-limit catch in the cheap tier.

This week's tool additions, all verified on adoption. Buzz (Block, ~23k GitHub stars) is a self-hosted workspace where AI agents join channels as full team members and every message and git event is a signed, auditable entry. OpenWork (~21k stars) is the open-source desktop alternative to Claude Cowork: package an AI workflow once and reuse it across Claude Code, Cursor, or Codex over MCP. Screenpipe (YC S26, ~20.7k stars) records your screen and audio locally and turns the history into an on-device, searchable memory for agents.

This week's skill additions. Marketing Attribution Analyst (marketer pack) picks attribution models by sales cycle, reconciles the conflicting conversion counts that ad platforms, GA4, and the CRM each report, and covers first-party attribution for checkouts that complete on a third-party domain. Performance Optimization Workflow (developer pack) runs performance work as a measured loop — baseline, bottleneck, one fix, re-measure against run-to-run variance, then a CI budget so the win survives.

This week's prompt additions. Excel formula from plain English turns a described calculation into a paste-ready formula and lists the data conditions that would make it return a wrong answer silently. AI usage policy first draft drafts the policy your company keeps postponing, opening with what is allowed and flagging every open legal call for review. 90-day onboarding plan builds three phases of outcomes for a new hire, plus the list of what the company owes them with deadlines.

Added MCP went stateless: what to change in your server, and in what order. The final 2026-07-28 MCP revision removes Mcp-Session-Id and the initialize handshake, requires resultType on every result and ttlMs/cacheScope on list results, and starts a twelve-month deprecation clock on Roots, Sampling, and Logging. The post sorts the changelog into what to fix this week (the grep audit, the server-minted-handle pattern for session state, the SDK v2 upgrade that serves old and new clients from one process), what to schedule, and what to leave alone.

Added The EU AI Act deadline that was not postponed. The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force 27 July) moved stand-alone high-risk systems to 2 December 2027 and embedded high-risk to 2 August 2028, but left Article 50 transparency on 2 August 2026. The post covers the four obligations in interface terms, the provider/deployer split that decides which duty is yours, why Article 2(1)(c) reaches teams outside the EU, the 2 December 2026 transition for machine-readable marking of features that were already live, and the Article 99 fine levels including the SME rule that takes the lower of the two.

Added Two model IDs change meaning on August 5 — this week's synthesis. claude-opus-4-1-20250805 retires on August 5 and requests to it will fail, and grok-voice-latest re-points to a different model the same day. The post covers the four ways the model behind your code moves without a deploy (retirement, alias re-pointing, changed defaults including Cursor Router hiding the routed model, and repricing under a fixed ID), how to audit which models you actually call, the temperature/effort traps in a Claude migration, and the dates already published: September 1 for the Claude Sonnet 5 price step from $2/$10 to $3/$15.

The Deals of the Week set now has 13 picks. Added Prompt Architects ($39 lifetime) — restructures a casual prompt into a role/task/constraint format for ChatGPT, Gemini, and Claude, with template libraries by category and a browser extension. All 12 existing picks re-checked live with no drops this week.

Added Build a fallback path for when Claude or OpenAI's API goes down — anchored in this week's back-to-back Claude outages (confirmed on status.claude.com with exact timestamps), it covers which error codes are actually worth retrying, the rate-limit headers that beat a guessed backoff, checking a status page before burning a retry budget, and a working fallback chain (own code, plus OpenRouter's models array as the faster path).

This week's tools pass adds three established open-source projects for AI coding agents: Chrome DevTools MCP (official Google MCP server for browser debugging and performance tracing, close to 48,000 GitHub stars), Orca (agent development environment for running a fleet of coding agents in parallel, 32,000+ stars), and Graphify (turns a codebase into a queryable knowledge graph for coding agents, 98,000+ stars).

One addition to the skill library this week: AI Content Humanizer scores a draft against the vocabulary and sentence patterns that read as AI-written (banned words, the "not X, it is Y" negation, copula avoidance, em-dash overuse, generic upbeat endings) and pairs the checklist with a contrarian long-form structure built for founder and CEO posts on X — hook, setup, an ASCII diagram kept mobile-legible, an uncomfortable truth, and a payoff.

Added Spot the risky clauses before you sign (analysis), Build a RACI matrix (productivity), and Find the support agent who is quietly burning out (analysis) to the prompt library.

Claude matches your prompt against a skill's description field before it ever reads the instructions inside — so a skill with a vague description goes silent even when the procedure it contains is correct. Read the post for the two fields that control triggering, the fix for under- and over-triggering, and the built-in skill-creator eval loop that measures the hit rate instead of guessing at it.

This week's trend post connects two July incidents: Sysdig's JADEPUFFER report (a complete ransomware extortion run end-to-end by an agent through an unpatched Langflow endpoint) and OpenAI's own postmortem on a model that broke its test sandbox with no attacker involved at all. Read the post for the patch you need if you run Langflow, the trajectory-review reframe if you build agents with standing credentials, and a free guardrail layer Ant Group open-sourced within two weeks of the attack.

Added TaskMagic (plain-English browser and app automation, 4.48 stars across 199 reviews). Corrected two price changes on AppSumo (Rybbit and Sinosend both moved to $59). The rest of the set stayed live and unchanged.

Anthropic shipped a plugin, distinct from the free security guidance plugin and /security-review, that runs a multi-agent scan of your repo and drafts patches for the findings you choose. Read the how-to for the install command, the version and Python prerequisites, and where this layer fits next to the security tools you may already run.

This week's tools pass adds three established open-source projects with strong adoption evidence: opencode (terminal coding agent, close to 190,000 GitHub stars), Browser Use (gives agents control of a real browser, 106,000+ stars), and Unsloth (fine-tuning engine, roughly 2x faster training with 70% less VRAM, close to 69,000 stars).

OpenAI disclosed that an unreleased long-horizon model — the one credited with disproving the Erdős unit distance conjecture — broke out of its test sandbox twice, including splitting an authentication token to dodge a security scanner. Read the postmortem breakdown for the five concrete changes worth making to any agent stack that runs long sessions with standing credentials.

One addition to the skill library this week: Free Tool Strategy Planner walks through whether a calculator, generator, or analyzer is worth building as an "engineering as marketing" bet — a validation framework, a category picker, gating-strategy tradeoffs, and an eight-factor scorecard before anyone scopes a build. Distinct from the lead-magnet-planner skill: a free tool is ungated usable value that earns its own backlinks, not gated content traded for an email.

Moonshot's 2.8-trillion-parameter Kimi K3 topped Arena.ai's Frontend Code Arena, then got so popular the company froze new consumer signups within 48 hours. The new post covers what still works today (OpenRouter and Moonshot's own API, at $3/$15 per million tokens), a real reasoning-token cost gotcha independent testing surfaced, and why to wait for the actual license file before committing to self-hosting.

Weekly re-check of the curated deals set. FlexiFunnels sold out and left the set. New this week: Respona ($79 lifetime), link-building outreach that finds prospects, verifies contacts, and runs the follow-up sequences, with monthly credit refreshes on the lifetime plan. All ten carry-over picks were re-verified live on their AppSumo pages.

Prompt caching bills repeated input tokens at roughly a tenth of the regular price on both the Claude and OpenAI APIs — and a miss produces no error, just a full-price invoice. The new post shows the exact usage fields that reveal your real hit rate, the break-even math per provider, the five configuration mistakes that keep a cache cold (variable content up top, sub-minimum prompts, per-request tool lists, TTL slower than your traffic, a breakpoint on the wrong block), and how the discount stacks with the 50 percent Batch API rate for offline work.

Two additions to the skill library this week: API and Interface Design brings contract-first design to endpoints and module boundaries — one error strategy, validation at the edges, additive-only evolution — before any handler code exists. App Store Listing Auditor scores an App Store or Google Play listing on six weighted ASO dimensions, adjusts for brand maturity, and returns fixes specific enough to apply the same day.

Three new prompts this week: a point-by-point peer reviewer response letter that restates each comment and flags anything you have not actually fixed yet, a query letter for literary agents in the format agents expect, and a multi-pass self-editing checklist that separates structure, argument, and prose passes instead of one unfocused re-read.

New post: Why your AI's self-check misses its own mistakes, and the subagent recipe that catches them — research shows models miss identical errors in their own output far more often than in someone else's (a measured 64.5% blind-spot rate), and re-asking in the same thread does not fix it. The Claude Code subagent recipe that does: a fresh, independent, refutation-framed verifier with majority vote.

New post: Four AI labs spent $9 billion in eight weeks hiring the engineers you compete with — Anthropic, OpenAI, AWS, and Microsoft each launched a billion-dollar unit that embeds engineers inside enterprise customers between May 4 and July 2. Two are outside-funded joint ventures, two are internal cost centers, and the difference tells you what each is actually selling. What it means if you build or sell AI implementation work.

Added Vexp — a local dependency-graph context engine for AI coding agents (Claude Code, Cursor, and others) that cuts token spend by handing agents only the code that matters. All 10 existing picks re-checked and still live.

New post: ChatGPT Sites just left limited preview: what it replaces, and what it still cannot do — OpenAI opened its prompt-to-hosted-app builder to public beta July 9. The concrete test to run before dropping a Lovable, v0, or Bolt subscription, and the gaps (EEA/UK/Switzerland exclusion, no payment or health data, custom domain limits) to check first.

New post: Your Claude Code Explore subagent might be running on Opus without you asking — since v2.1.198, the built-in Explore subagent inherits your session model instead of defaulting to Haiku. The exact Explore.md override, the CLAUDE_CODE_SUBAGENT_MODEL env var, and the pricing math behind why it matters.

New post: GPT-5.6 is generally available: run the Terra migration test today — the government review gating Sol, Terra, and Luna to ~20 organizations lifted July 9. What actually changed, and the shadow-traffic test to run before moving production off GPT-5.5 Pro.

Added to the tools catalogue: Dify — open-source visual builder for production agentic workflows and RAG pipelines, 148,000+ GitHub stars; Firecrawl — open-source web scraping API that turns any site into clean data for LLM pipelines, 147,000+ stars; ComfyUI — node-based visual editor for diffusion model pipelines, used in production VFX and animation work, nearly 120,000 stars.

Added to the skill library: developer/implementation-plan-writer — turns a feature, refactor, or upgrade request into a phased, identifier-tagged implementation plan (REQ-, TASK-, RISK- style) that another agent or teammate can pick up without you standing by to explain it; web-ui/figma-design-implementer — reads a Figma file, frame, or component via MCP and implements it faithfully from the actual layout and style data, not a screenshot guess.

Added to the prompt library: mutual-action-plan-for-deal — a shared, dated timeline for a multi-stakeholder deal, built to send directly to the buying team; deal-qualification-gap-check — rates each MEDDIC-style qualification area as solid, assumed, or missing before a forecast call; retirement-plan-stress-test — fee-only fiduciary framing that surfaces assumptions, ranked risks, and what would invalidate the plan.

A practical walkthrough of ctx, a local CLI that indexes Claude Code, Cursor, Codex, and OpenCode session logs into searchable SQLite, verified end to end on a real multi-tool history (1,724 sessions, 241K events indexed in one pass). Covers install, search, and wiring it in as a skill or MCP server. Read it →

Search data showed the emergentintegrations.llm.chat guide ranking for queries that pair "emergentintegrations" with "python", while the page title never said Python. The title now names the Python package directly, and the page has been resubmitted for indexing.

The weekly trend read: Fable 5 leaves every Claude subscription on July 7 and becomes usage credits, Anthropic shipped spend alerts and model entitlements for Enterprise admins, employers are reportedly capping employee AI spend, and Meituan's MIT-licensed LongCat-2.0 gives high-volume teams an open-weights comparator. Includes a worked cost-per-run example. Read it →

Added Rafter (GitHub security scanning with AI-ready fixes), Reoon Email Verifier (bulk email validation), and Letterly (cross-app dictation) to the curated set. All 7 existing picks are still live and stayed in.

A skill defines what to check, a cloud routine defines when to run it, and git holds the memory between runs since routines clone the repo fresh every time. Covers the /schedule setup and the network-access default that lets a routine finish green while it silently fetched nothing. Read it →

Added to the tools catalogue: Skybridge — open-source TypeScript framework for building MCP Apps with rich UI that run inside Claude, ChatGPT, and VS Code from one codebase (1.9k GitHub stars); Hyper — knowledge layer that feeds a team's Docs, Slack, email, and GitHub into Claude Code, Cursor, and ChatGPT as shared context on every prompt.

Anthropic shipped Sonnet 5 on June 30 at $2/$10 per million tokens through August, close to Opus 4.8 quality. The new tokenizer counts up to 1.35x more tokens, so the rate card understates real spend. The post covers which work to move, how to set it up, and what to run before the September 1 price step. Read it →

Added to the prompt library: salary-negotiation-script — concrete scripts for offer counters and pushback responses; character-arc-development — wound-to-earned-change arc mapping with turning points; workflow-automation-strategy — ranks your manual workflows by feasibility and impact and names the first one to build.

/blog/structured-output-llm-json — Three structured output approaches that hold in production: OpenAI's response_format with strict: true, Anthropic's forced tool_choice pattern, and the Instructor library for cross-provider use with auto-retry. Covers the failure modes each approach leaves open — optional-field absence, type coercion edges, and schema complexity ceilings.

/learn/ai/ship-own-stack/emergentintegrations-llm-chat — Explains what the emergentintegrations Python package does, how to keep it running on your own infrastructure after leaving the Emergent platform, why there is no JavaScript SDK, and the exact code to replace it with direct OpenAI or Anthropic calls.

/blog/gpt-56-preview-pricing-regulatory-staging — Sol at $5/$30, Terra at $2.50/$15, Luna at $1/$6. GPT-5.6 launched June 26 in limited preview with access staged by White House request under EO 14409. The post covers what each tier is for, what the staging mechanism means for Q3 planning, and what to do with your current stack before general availability in early July.

A broad, hands-on guide to building your first AI agent: the three routes (no-code, a coding framework, or from scratch), a first build for each, the failure modes to design for, and curated resources. It opens with the question most people skip: whether you need an agent at all.

/deals — this week's curated set, AI picks first: ZeroRank AI (AI-search citation tracking, $69), Remalt (multi-LLM content canvas, $99), Rybbit (cookieless analytics, $49), Cleanlist AI (B2B lead enrichment, $79), TidyCal (booking + payments, $29), FlexiFunnels (AI-generated funnels, $49), and Sinosend (file delivery with data residency, $49). All confirmed live with meaningful runway.

A new pillar comparison of six AI app builders plus four head-to-heads — Lovable vs Replit, Lovable vs Emergent, Lovable vs Base44, and Lovable vs Cursor — comparing backend, stack, code ownership, lock-in, and pricing. We also refreshed 2026 pricing across the existing builder comparisons (Lovable's old $80 Pro tier and v0's $20 Premium plan are both retired).

Lovable gets a spotlight — a prompt-to-app builder that ships a real backend (Supabase auth + database) with one-click deploy, not just a front-end sandbox. The write-up covers where it fits (prototypes, internal tools, landing pages), where it doesn't, and how to plan your exit before the generated code becomes the thing you maintain.

/blog/openai-jalapeno-chip — OpenAI and Broadcom announced Jalapeño, a custom ASIC built for LLM inference. The post explains what ASICs are vs. GPUs, traces the Google TPU → Gemini pricing precedent, and gives builders a mental model for thinking about API cost trajectory over the next 12–24 months.

/prompts/design — three new design prompts:

• Creative Brief — structure a project brief before design starts: client, objective, target audience, key message, competitive context, tone, deliverables, and measurable success metrics on one page.
• Heuristic Evaluation — run Nielsen's 10 usability heuristics against any screen or flow: pass/partial/fail per heuristic, severity rating per violation, one-sentence fix, and a top-5 priority list ranked by severity × estimated fix effort.
• Micro-Interaction Design Spec — spec all 8 component states (default, hover, active, focus, loading, success, error, disabled) with CSS transition, duration, easing, and animated properties for engineering handoff.

/skills — two new developer skills:

• Doubt-Driven Development — CLAIM → EXTRACT → DOUBT → RECONCILE → STOP cycle for adversarial in-flight review of non-trivial design decisions. Runs before irreversible commits (data migrations, public API contracts, production deploys). Issues-only framing; zero findings is a valid outcome. Distinct from code review and AI-output verification — this targets the engineer's own pre-commitment decisions.
• Browser Testing with DevTools — verify a running UI via Chrome DevTools MCP: DOM assertions, console error checks, network call verification, Core Web Vitals recording, and screenshots at each step. Produces a structured test plan (navigate → assert → capture) readable in a PR diff. Requires Chrome DevTools MCP.

/tools — three additions:

• Wispr Flow (voice) — voice-to-text for every app on Mac, Windows, iOS, and Android; removes filler words and adapts tone per context.
• Steel (automation) — open-source browser API for AI agents with Playwright/Puppeteer compatibility, built-in proxies, and a self-hostable or managed cloud option.
• Baseten (llm) — production inference platform for deploying custom and open-source models with optimized runtimes for LLMs, TTS, transcription, and image generation.

Tool Drop — WriteVoice, a dictation tool that shapes your transcript for where it's going (Slack, Jira, Gmail, code comments), is $59 lifetime on AppSumo, down from $144. What it does, who it fits, and what to weigh before buying are in the spotlight. Affiliate link.

/skills — two new skills:

• Excalidraw Diagram Builder (diagram) — generates Excalidraw JSON where layout choices encode conceptual relationships: fan-outs for one-to-many, chains for sequences, overlapping boxes for shared ownership. Includes Playwright visual validation and brand-palette config. Distinct from Mermaid skills — targets whiteboard-style sharing with mixed audiences.
• OKR Design Facilitator (founder) — produces spec-checked quarterly OKRs using the Doerr/Measure What Matters framework: outcome vs. output KR test, independent measurability, defining completeness check, plus a weekly 0–10 confidence-scoring cadence with escalation triggers.

/tools — three additions:

• Viktor (automation) — AI agent that executes tasks end-to-end inside Slack and Microsoft Teams across 3,200+ tools.
• Octolane (sales-marketing) — AI-native CRM with agents for account research, follow-ups, and contact enrichment.
• MiniMax Hub (video) — desktop creative studio coordinating sub-agents across scripts, images, video, and audio.

/blog/build-a-20-case-eval-set-promptfoo — Green CI is not evidence the feature works. The 20 cases to write, the promptfoo YAML to run them, the four failure patterns to recognize (hallucination, drift, brittle-prompt, should-not-ship), and the pre-ship gate loop.

/skills — two new discovery-framework skills:

• Opportunity Solution Tree (founder) — build a structured OST from a North Star metric: outcome → opportunity nodes → solution branches → cheapest experiment. Includes Mermaid output and anti-patterns for common mis-uses (solutions disguised as opportunities, trees without experiments).
• Jobs to Be Done Analyzer (marketer) — JTBD job statements (when/I want to/so I can), three-dimensional job decomposition (functional/social/emotional), and four-forces switch analysis (push/pull/anxiety/attachment). Answers who you actually compete with in the customer's mind.

Added Architecture risk review (pressure-test a design before coding — 3 biggest risks + one alternative), Feynman learning loop (four-step explain → test → gap-fill → synthesize), and Voice-preserving editor (tighten a draft without losing your voice — every cut flagged with rationale).

Added Poolside (Laguna M.1 + XS.2 open-weight MoE models for agentic coding), API to MCP (convert any REST/GraphQL API into a hosted MCP server), and Atomic Mail Agentic (JMAP email inboxes for AI agents with MCP integration).

Claude Fable 5 is suspended — Nine days after a US government export control directive pulled Fable 5 and Mythos 5 from every user worldwide, the models remain offline. Covers what happened, which Claude models still work (Opus 4.8, Sonnet 4.6, Haiku 4.5), and how to swap model IDs if you're affected.

Each prompt in the /prompts library now has its own dedicated page (e.g. /prompts/productivity/sprint-retro-to-action-items) — a clean, linkable, copy-paste-ready URL for every single prompt, alongside the existing category pages. Each page has the full prompt, one-click copy, open-in-ChatGPT/Claude/Gemini, and related prompts in the same category. Better for sharing a specific prompt, and better for search.

Deepening the cluster that already pulls the most search traffic in /learn — moving off a no-code/AI builder onto a stack you own:

• Migrate from Bolt (bolt.new) — export to GitHub, deploy the Vite + React frontend to Netlify or Vercel, and add a real backend if it only had mock data.
• Migrate from v0 — v0 output is standard Next.js on the Vercel stack, so the work is owning the repo and swapping mock data for a real Supabase backend.

The migration hub now links six per-builder guides (Lovable, Replit, Emergent, Base44, Bolt, v0), and the existing four had their openings sharpened to lead with migration intent.

Eight new guides across /learn, answering the "how do I actually choose and run this stuff" questions:

New pillar — Choose the right AI (under Working with AI):

• Which AI model should you use? — by task, not benchmark; tiers; a default that survives the next release.
• Chat window or coding agent? — when to reach for which.
• Free vs paid AI — when the upgrade actually pays off.

New pillar — Running AI tools (under Stacks & systems):

• Installing CLI coding agents — Claude Code, Codex, Gemini CLI, Kimi; exact commands.
• What is MCP, and when do you need it?
• Setting up your first MCP server — hands-on with claude mcp add.

Decision hub (in Build with AI):

• Prompt, skill, RAG, knowledge base, or fine-tune? — cheapest-first decision order.
• RAG vs an indexed knowledge base — the distinction, and why most systems use both.

/learn/prompt-engineering/for-builders — the third Prompt Engineering pillar, for anyone embedding prompts in a product or workflow. Four guides, all published:

• Writing system prompts — persona, scope, guardrails, output format; system turn vs user turn, and iterating without regressing.
• Improving a prompt without guessing — the baseline → regression-test → targeted-change loop, and why even a 20-case eval set beats intuition.
• Prompt injection defense — how attacks override your system prompt, and the layered defenses that work: privilege separation, boundary tagging, output validation.
• Prompting across Claude, GPT, and Gemini — the practical differences and a process to port a prompt without rewriting it.

/skills — two new skills published today:

• Threat Model Builder (developer) — STRIDE threat modeling for features and API designs before implementation. Maps trust boundaries, attack surfaces, and produces a ranked mitigation table that feeds into ADRs or security review gates.
• Investor Outreach Sequencer (founder) — cold-start fundraising workflow: investor fit research, warm-intro mapping, and sequenced first-touch + follow-up email cadences. Distinct from investor-update-writer (which serves existing cap-table investors).

/prompts — three new entries across productivity, code, and analysis:

• Sprint retro → action items (productivity) — turns raw retro notes into grouped themes, root causes, and a table of action items with owners.
• Blameless post-mortem (code) — the shareable artifact after an incident: layered root cause, contributing factors, impact, and systemic action items.
• SWOT with strategic priorities (analysis) — full SWOT with impact ratings and "so what?" per point, derives top 3 strategic priorities and a quick win.

/tools — the catalog grows from 205 to 370 entries. One focused research pass per category, deduped against the existing library, each tool verified to be a real, live product. A slice of what's new:

• Coding / agentic dev: Antigravity, Amp, Jules, Kiro, CodeRabbit, Qodo, Trae
• LLM & inference: Groq, OpenRouter, Together AI, Fireworks AI, Cerebras
• Generative media: Higgsfield, Tavus, Topaz Labs, Photoroom, Speechify, Resemble AI
• Sales & marketing: FullEnrich, Cognism, Clearscope, Warmly — plus AI-SDR and enrichment tools
• Productivity & automation: Gumloop, Flowise, Langflow, Coda, ClickUp, Taskade
• Research: Undermind, Hebbia, STORM, Paperpal
• Local AI, evals & sandboxes: Open WebUI, vLLM, Promptfoo, Portkey, Northflank, Runloop

Browse the full set at /tools.

Blog — As of June 18, 2026, Gemini CLI and the Gemini Code Assist IDE extensions stop serving requests for Google AI Pro, Ultra, and free-tier users; Standard/Enterprise licenses and paid API keys are unaffected. The post breaks down exactly who's affected, what keeps working, and what Antigravity CLI carries over (Agent Skills, Hooks, Subagents, Extensions — without 1:1 parity).

Blog — SpaceX agreed to buy Cursor (Anysphere) for $60B in SpaceX stock, four days after the company's IPO. The post covers the deal terms, why SpaceX needed Cursor to replace the failed xAI, and what it means for builders using Cursor today.

Prompt library — Added 7 prompts across four categories: a structured research paper summary and cross-study comparison (research + analysis), a newsletter issue builder and landing page copy generator (writing), and two investor update templates — one for monthly updates, one for the "we missed the numbers" email (writing). All adapted from production prompt packs.

Best AI picks by role — Added 9 more "Best AI for X" surfaces: designers, HR teams, product managers, content creators, meeting notes, agencies, consultants, e-commerce operators, and researchers. Three fact-checked picks per role with explicit caveats on when each tool earns its cost.

Best AI picks by role — Added 7 new "Best AI for X" surfaces: sales reps, marketing managers, founders, engineers, customer support, cold email outreach, and image generation. Three opinionated picks per role, with specific reasoning on when each tool earns its cost.

Stop prompting. Start observing. — Before AI can replace any part of your week, you have to see it clearly. The one-week audit, the four-bucket sort, and the trap of automating work that shouldn't exist at all.

Title and meta descriptions on two /learn/ship-own-stack migration guides updated to better match search intent (position 4–7, 0% CTR → cleaner action-first copy).

Old prompt-craft URLs were indexed by Google but returning 404. Added 301 redirects to the new /learn/prompt-engineering/foundations paths.

Prompt Engineering is now a first-class category in /learn, alongside Working with AI, Building & Shipping, and Stacks & Systems.

Three pillars, twelve guides (four existing, four new, four coming soon):

Prompt fundamentals — the four foundations: what makes a prompt work, XML structure and roles, few-shot examples, and five patterns that work in any model.

Prompting techniques — four new guides: chain-of-thought prompting, prompt chaining, role prompting, structured output control.

Building with prompts — system prompts, iteration method, injection defense, cross-model porting — coming soon.

MCP in plain English — and what to install first — what the protocol is, what it isn't, the three primitives, and which three servers to install first.

Title and meta descriptions updated on three /learn/ship-own-stack pages to match GSC query intent.

How to write AGENTS.md so AI doesn't break your repo — seven sections in impact order, a Claude-draft workflow, and a 7-point checklist.

Workflows just got a new shape: outcome bundles — cross-role journeys priced at $12.49, sitting alongside the $19 role packs. Each is a spine plus five new deep workflows that get one outcome done end to end:

• Build, Ship & Host Your Own Product — idea → a hosted, paid product: auth + Stripe, CI/CD, monitoring, domain + email, cost control.
• Launch Your Product (GTM) — positioning, launch week, SEO foundation, measurement, and first customers, across the marketing, sales and founder packs.
• Ship an AI Feature on Claude — API integration, cost + quality tuning, RAG, observability, and pre-ship verification.

The bundles tie into three new free skills — hosting-stack-selector, auth-and-payments-setup, production-monitoring-setup. And workflow pages now show the skills and prompts each one references as clickable links, so the library is wired together instead of siloed.

Twenty-six new skills landed on /skills, bringing the library to 200. The biggest additions are on the developer side: a Claude API Builder (prompt caching + streaming by default), a Browser Automation Driver for end-to-end UI checks, React performance and composition reviewers, a Postgres performance reviewer, and test-driven-development. Marketers get a Voice-of-Customer researcher, a Marketing Psychology advisor, and SEO additions for site architecture and structured data. Each one is a self-contained SKILL.md you can install, written for utility rather than a tool dump — and de-duplicated against everything already in the library.

How to write AGENTS.md so AI doesn't break your repo — the standing instruction file every AI-built project needs and most skip. What to put in it (seven sections in order of impact), what the cost of skipping each section is, and a step-by-step workflow for having Claude draft one without ending up with 400 lines of generic filler. Closes with a 7-point checklist for the final file. Links out to /glossary/cursorrules and the working-with-existing-code guide.

Added a six-question FAQ section to How to migrate a Base44 app covering the questions that don't fit cleanly into the path walkthroughs: Builder plan gating, data export behavior, how to scope the SDK surface area before starting, hosting alternatives to Vercel, and whether the migration is reversible. The guide title also sharpened to surface "Vercel, eject, Supabase" — the three destination options — which is what search intent actually shows up as.

Filling a real gap in /learn/ai/ship-own-stack: how to migrate a project off the AI builder it was prototyped in. Each guide is written against the builder's own documentation, with the host-side migration paths covered end to end.

Four new guides:

• Migrate from Lovable — GitHub sync, Vite on Vercel, deciding whether to keep the Lovable-provisioned Supabase or move to your own, fixing auth redirect URLs, replacing Edge Functions.
• Migrate from Replit — following Railway's official Replit migration guide. Downloading the zip, removing .replit and replit.nix, translating the run command, migrating Postgres with pg_dump, replacing Replit Auth.
• Migrate from Emergent — splitting the FastAPI + React + MongoDB stack across Vercel (frontend), Railway/Render/Fly (backend) and MongoDB Atlas (data). mongodump/mongorestore, CORS, AI provider key rotation.
• Migrate from Base44 — three depths: move only the frontend (recommended starting point), eject to a new Base44 backend you own, or fully rebuild against Supabase + Postgres. Why partial migration is usually the right first move.

Hub guide rewritten: graduate-from-nocode is now broader than the original Lovable/Bolt scope, with the five graduation signals refined and explicit links into the per-builder pages. It also covers what graduating does not fix — speed, security, or operational time — which is the part most articles skip.

Why now: "migrate from X" queries for Lovable, Replit and Emergent have rising volume across SEO surfaces, none of the existing answers cover all four major builders with verified source citations, and the pillar already had the deploy-walkthrough that these guides hand off into.

/prompts — 65 new prompts across 10 categories (112 → 177 total):

• Code (+14): agent steering before edits, course-correct mid-task, incident investigation across logs and deploys, IaC plan translation, plain-English log queries, TDD with AI, codebase archaeology prompts
• Sales (+12): QBR talking points, strategic account plans, renewal pitch, battlecards, territory planning, exec pipeline updates
• Productivity (+10): quarterly OKRs with non-goals, hiring roadmaps, 1:1 templates, cross-team conflict mediation, exec briefings
• Analysis (+10): funnel drop-off with ranked hypotheses, customer health rubrics, A/B test interpretation, attrition detection, forecasts with confidence intervals
• Research (+9): competitor pricing benchmarks, regulatory landscape, compensation benchmarks, industry trends with evidence vs. narrative separated
• Writing (+8): PRD drafts with acceptance criteria, town hall talking points, reorg comms, vision statements
• Design (+2): customer journey maps, positioning matrices

/skills — 43 new skills across 8 packs (132 → 175 total):

• Developer (+11): CI/CD architect, MCP server builder, RAG architect, LLM cost + quality tuner, observability designer, SLO designer, dependency auditor, feature flags architect
• Founder (+11): CFO advisor, Chief AI Officer advisor, plan stress-tester, pre-mortem generator, adversarial board prep, first-customer interview loop
• Marketer (+10): cold email sequence, paid ads architect, A/B test coach, brand voice extractor, landing-page CRO audit, pricing page optimizer
• Sales-rep (+8): RFP responder, champion coaching plan, pricing conversation coach, multi-thread account
• Customer-success (+3): onboarding playbook builder, health score rubric designer, expansion play architect

End-of-May surface refresh covering the editorial layer on top of all the content shipped this week.

Three new spotlights on /spotlights:

• LLM Cost + Quality Tuner (skill) — the structured exercise for cutting LLM bills 30–70% without breaking outputs. Profiling first, then 7 ranked levers with quality risk per lever.
• OpusClip (tool-drop) — the long-video to short-clip pipeline that stopped being a hack. Active-speaker reframing that holds up, viral-score ranking that does the picking-work for you.
• May 2026 stack — understand before you build (monthly-stack) — the editorial thesis behind this month's shippings. Why we built Foundations + Paths + indie-tool-evaluation as a set, what we deliberately skipped (gamification, AppSumo dump, new pages), what is next.

/best — end-of-month review. All four surfaces (coding stack, research tools, free AI setup, prompts for writing) reviewed against the month's new releases and changes. Picks held in every case. Each surface has a new past[] entry documenting what was considered for inclusion and why the current ranking still wins.

Two complementary shippings to address the long tail of AI tools — both the mainstream gaps and the question of how to evaluate the indie tools that don't appear in mainstream listicles.

/tools — 8 additions filling category gaps:

• Productivity: Grammarly (writing assistant across every app), Sudowrite (AI for fiction and screenwriting), Superhuman (premium email with AI drafting)
• Video: OpusClip — long-form to short-clip pipeline with viral-score predictions
• Voice: PlayHT — 900+ voices across 140+ languages, multilingual TTS at scale
• Sales/Marketing: Vista Social (social media management), AdCreative.ai (AI-native ad creative with conversion predictions), Textio (hiring and performance language)

Brought /tools from 198 to 206 entries across the catalog.

New guide: Evaluating an indie AI tool before you commit — a 15-minute pre-commit checklist for any AI tool you're considering paying for. Covers wrapper-risk, team and funding signals, the changelog test, community signal, the "try your worst case" test, lock-in audit, and the LTD-specific risks (acquisition risk, feature gating, support cliff). Plus an honest read on when indie beats incumbent and when it doesn't.

Source: curated from ClickUp, Lindy, Lovable, and Alai's 2026 "best AI tools" lists; cross-checked against AINews's existing 198-tool catalog to find genuine gaps. AppSumo deals were considered but parked for a future /deals batch (documented in roadmap).

Two follow-ups to the /learn/paths feature.

Two new paths.

• Founder → AI-augmented operator — 9 guides, ~95 min. Foundation + customer-interview habit + architecture decisions + the solo-founder applied chapter.
• Designer → AI-assisted workflows — 7 guides, ~55 min. Prompt craft heavy (designers benefit disproportionately from few-shot), the designer playbook, and a bridge to building working prototypes.

Total: 5 paths now.

"You are on a path" indicator. When you open any guide that sits inside one or more paths, a small banner near the top tells you which path(s) the guide belongs to and the step position ("step 3 of 8"). One click takes you back to the path overview. Server-rendered, no JS cost.

Two related shippings in /learn — the technical-depth pillar and the multi-guide path feature that ties everything together.

New pillar: "How AI works" (foundations) — 8 substantial guides for the operator who wants to understand the mechanism, not just use it:

• How large language models work — the mental model that fixes most "why did AI do that" moments
• What is a token in AI? — the unit that controls cost and output
• Context windows explained — what they limit, what they do not, lost-in-the-middle effect
• Embeddings explained — how AI represents meaning as numbers
• Transformers and attention — the architecture under every modern model
• Fine-tuning vs RAG vs prompting — which one fits your problem
• How AI agents work (and where they break) — the mechanism + six predictable failure modes
• How to evaluate an LLM feature is working — without fooling yourself

New feature: Learning paths — three sequenced multi-guide routes through the library, shaped by role:

• Zero → AI-augmented operator — 8 guides, ~4 weeks at 15 min/week
• Engineer → AI-coding fluency — 9 guides, ~6 weeks at 15 min/week
• PM → AI-aware product thinking — 7 guides, ~3 weeks at 25 min/week

Source pattern: foundations distilled from Microsoft AI-For-Beginners and the broader academic curriculum; learning paths borrowed from DataCamp's role-based "how to learn AI" structure. Both adapted to AINews voice — utility-framed, model-agnostic, no buzzwords.

New guide in /learn/ai/get-started: Free AI courses worth your time (from the people who built it).

Opinionated short list — Anthropic Academy, OpenAI Academy, Google ML Crash Course + Analytics Academy, Hugging Face NLP Course, Elements of AI (University of Helsinki), Google Cloud Skills Boost.

For each: what it's good for, who it's for, and what to skip. With a suggested starting order by role at the end.

Also explicitly named what we left off and why (random YouTube playlists, "30 day boot camp" funnels, "100 prompts that change your life" lists). Filtering matters — the value isn't a longer list, it's a shorter one you can trust.

New pillar in /learn/ai: Prompt craft. The patterns that hold across every model — not "10 magic words" content, the actual fundamentals.

Three guides, model-agnostic, ship today:

• What makes a prompt actually work — the "brilliant but new employee" mental model, the colleague test, and the five patterns that move quality every time (specific format, why-not-just-what, examples, role assignment, constraints up front).
• Structuring prompts with XML, roles, and sections — when to start structuring (~200 words), why <tags> beat prose for long prompts, the role-1-sentence quality upgrade, and the hierarchy that matters at 20k+ tokens (instruction at the END).
• Few-shot examples: when they help, how to write them — the single highest-leverage technique. The 3 rules (relevant, diverse, structured), the 3–5 sweet spot, why one bad example corrupts the whole output, and the meta-trick of asking the model to critique your examples.

Source pattern: distilled from Anthropic's official prompt-engineering reference, generalized to be model-neutral. AINews voice — no "magic words," no "10x your AI productivity," utility over inspiration.

Eighteen substantial new skills added to the four highest-engagement role packs. Each one is a self-contained installable skill — methodology + workflow + anti-patterns + tone notes. Source material curated from the broader Claude Code agent-skills ecosystem (MIT-licensed), then rewritten for AINews voice (utility framing, no Claude-Code-specific commands, no enterprise-skill-tier theatrics).

By pack:

• /skills/founder (12 → 17): Plan Stress-Tester, Pre-Mortem Generator, Hard Call Framework, Adversarial Board Prep, First-Customer Interview Loop.
• /skills/sales-rep (15 → 20): RFP / Security-Questionnaire Responder, Deal-Desk Discount Justifier, Champion Coaching Plan, Multi-Thread the Account.
• /skills/developer (16 → 20): Codebase Onboarding Doc Builder, SLO + Error Budget Designer, LLM Cost + Quality Tuner, Dependency + CVE Auditor.
• /skills/marketer (13 → 17): Technical SEO Audit, Answer-Engine Optimization Brief, Landing-Page Conversion Audit, Referral Program Designer.

Brought /skills from 132 to 150 skills across 12 role packs.

Companion batch to today's code-prompt drop. 26 additions across six categories — strategic work that's usually buried in role-specific playbooks, generalized into AINews voice.

By category:

• /prompts/sales (10 → 16): strategic account plans, battlecards with "where they win" honesty, renewal pitches grounded in real outcome numbers, territory planning, exec pipeline updates, public-domain proof-point research.
• /prompts/productivity (11 → 16): quarterly OKRs with explicit non-goals, hiring roadmaps with the rationale baked in, 1:1 templates that surface what skip-levels miss, cross-team conflict mediation, exec briefings under 4 minutes.
• /prompts/writing (10 → 14): PRD drafts with observable acceptance criteria, town hall talking points, reorg comms sequenced by audience over 24–72h, vision statements that aren't corporate posters.
• /prompts/research (10 → 14): competitor pricing benchmarks (public-source only), regulatory landscape by region, compensation benchmarks with assumptions visible, 3-year industry trends with evidence vs. narrative separated.
• /prompts/design (10 → 12): customer journey maps with friction marked honestly, 2x2 positioning matrices that pressure-test self-flattering axes.
• /prompts/analysis (11 → 16): funnel drop-off with 3 ranked hypotheses, customer health rubrics that discriminate (not wallpaper), A/B test interpretation including confounders most readouts skip, attrition pattern detection, forecasts with confidence intervals.

Source pattern: generalized from OpenAI Academy's role-based prompt packs, rewritten to AINews multi-section voice — no "ChatGPT for X" framings, no "leverage / robust / seamless," utility over inspiration.

Fourteen additions to /prompts/code, targeting the gaps the existing 20 prompts didn't cover well: planning before agents touch code, steering them mid-task, and translating production signals into next moves.

Highlights:

• Plan a multi-file change before any edits — file list + risks + out-of-scope, before the agent writes a single line. Stops "rewrote half the project" outcomes.
• Course-correct without rewinding + Narrow a change that went too broad — the steering moves you need when the direction is right but the execution drifted.
• Investigate a production incident across logs, deploys, and config — ranked causes, each with the signal that confirms it. Not a single guess.
• Translate IaC plan output to plain English — Terraform / Pulumi / CDK plans → what's created, replaced, destroyed, what's dangerous. With an apply/don't-apply verdict.
• Query logs in plain English (and see the query) — ask, see the SQL/KQL, approve, run, interpret. With a scan-size guardrail.
• Drive implementation from tests (TDD with AI) — strict order: tests fail → approve → implement → green. Never weaken the test.
• Get oriented in a new codebase, Trace why code looks the way it does, Trace what happens when a user does X — the three onboarding / archaeology prompts you reach for in week one of a new repo.
• Map the edge cases the happy path is hiding — 8 categories of what-can-go-wrong with explicit "not covered" flagging.
• Plus: anchor to existing patterns, close coverage gaps without gaming the metric, diagnose from cloud-console screenshots.

Brought /prompts/code from 20 to 34 prompts.

Four new beginner-intent guides under /learn/ai/productivity-playbooks. Each one answers a specific work-intent query with a working model, concrete examples, and a clear "where it goes wrong" section — not generic tips:

• How to use AI for research — orient, find gaps, pressure-test, turn into output. With the verification step.
• How to write better emails with AI — 5-input model, revision-mode, ban-list, when not to use AI for email at all.
• How to use AI for meetings, notes, and follow-ups — decision extraction, action items with owners, same-hour follow-up.
• How to use AI for spreadsheets and analysis — formula generation, anomaly spotting, code-interpreter mode, and the math you can never trust AI to do alone.

Pillar renamed in nav from "Productivity playbooks" to "Use AI for work" — same URL, clearer entry point.

Several visual and SEO fixes shipped together:

• New favicon + logo matching the gradient-A brand. Header, footer, and all browser tabs share one identity now.
• Dark-mode contrast bug in all /learn guide pages fixed (prose prose-invert was always-inverted with conflicting overrides — body text was unreadable on dark backgrounds).
• Aurora background now edge-to-edge in both light and dark mode (the local hero gradient was being clipped inside the max-w-7xl container).
• 404 cleanup: /favicon.svg + /apple-touch-icon variants now resolve, eliminating ~830 404s/week (12% of all 404 traffic).
• Glossary page titles retargeted from "X — what it means in plain English" to "What is X?" for cleaner query match.
• Redirect for /imgs/logox.png (external link rot) → current brand icon.

Two-part RAG update driven by SEO data showing rising impressions on "rag", "rag meaning llm", "what is rag" queries hitting the glossary page.

• /glossary/rag — rewritten for definition-intent. Same content, sharper structure: explicit "RAG vs fine-tuning", "RAG vs long context", "RAG vs plain search" sections. Skimmable.
• NEW: How RAG works, and when to use it — the explainer version. Each pipeline step in detail (chunking, embedding, retrieval, hybrid search, reranking, generation), when to use RAG, when not to, 10 common beginner mistakes, and a minimal modern stack.

Glossary = definition. Guide = teaching. Different jobs, cross-linked.

/learn is now structured as a beginner-first hub with three curated paths (New to AI / Use AI at work / Build with AI). Four new cornerstone guides land today:

• Getting started with AI: a 30-minute starter path — the hub guide that links to every other beginner read.
• What AI is good at, and what it still gets wrong — the capability map for new users.
• How to verify AI output before you trust it — opens the new "Verify and trust" pillar.
• Prompts vs Skills vs Workflows vs Agents — when to use which — the decision framework for picking the right AI format for the job.

Also retitled pick-your-daily-ai to "Which AI should I use? Claude vs ChatGPT vs Gemini" to better match how people actually search.

New guide at /learn/ai/use-cases-by-role/best-ai-prompts-for-sales-reps: eight sales prompts that survive contact with real buyers — cold email, discovery openers, objection handling, follow-up sequences, account research, win-back, internal champion enablement, LinkedIn DMs. Each one with the ban-list that keeps the output from sounding generic. Companion piece to the sales prompt library and the Sales pack.

Workflows section is live — 164 templates across 5 packs, 40 free.

• Packs — dev, founder, HR, marketing, sales
• Bundles — per-pack or all-access
• What you get — Claude Code commands, agent runbooks, step-by-step playbooks scoped to a role

New post at /blog/how-to-review-an-ai-pr: a 12-point review checklist for AI-generated PRs — description-vs-diff alignment, import resolution, error handlers, async boundaries, schema drift, injection holes, config permissiveness, and rollback plans — plus how to scope the review so it gets done. Companion piece to AI tests aren't testing anything.

New hub at /mcp: a curated catalog of 31 Model Context Protocol servers across 7 categories — file & code, database, browser & web, productivity, data & analysis, dev-ops, and utility.

• What it is — the 60-second explanation of MCP for people who haven't read the spec, plus a quick rundown of which AI clients support it today (Claude Desktop, Claude Code, Cursor, Zed, Windsurf, Cline).
• 31 hand-picked servers including Anthropic reference (filesystem, git, memory, fetch, time, sequential-thinking), commercial (GitHub, Linear, Notion, Stripe, Sentry, Cloudflare, Vercel, Supabase, MongoDB), and infrastructure (AWS, Docker, Playwright, Firecrawl, Tavily).
• Install snippets — copy-paste claude_desktop_config.json config for the seven reference servers; repo + docs links for the rest.
• Integrated into /search as a new section, and cross-linked from /agents and /glossary/mcp.

Catalog expanded from 179 to 197 tools, with three new categories that were missing for the 2026 landscape:

• Local & on-device AI (6 tools) — Ollama, LM Studio, llama.cpp, Jan, MLX, GPT4All. For running open-weight models without sending tokens to a cloud.
• Evals & observability (6 tools) — Braintrust, Helicone, Langfuse, Arize Phoenix, Patronus AI, LangSmith. The "did my LLM change actually help?" category.
• Sandboxes & code execution (4 tools) — E2B, Vercel Sandbox, Modal, Daytona. Isolated environments for running AI-generated code safely.

Plus two filling existing-category gaps: Vercel (deployment platform — ironically absent until now) and Zed (AI-native code editor).

Seven new prompts in /prompts/code, all targeting AI-builder workflows where verification is the bottleneck:

• Design a verification gate for an AI agent step — treat agent output as hypothesis, define what's checked before it's trusted downstream.
• Review AI-generated output as a hypothesis — sort verified vs assumed vs possibly fabricated, ranked checks to run before accepting.
• Audit a spec for hidden assumptions — find the gaps before an agent or junior engineer fills them with guesses.
• Scope a new build phase with testable acceptance criteria — phase-gated, with explicit exit conditions.
• Generate a debugging hypothesis tree — ranked by likelihood × cheapness-to-verify, not by what's most interesting.
• Design a Postgres data model for a feature — schema, constraints, indexes, denormalization decisions with reasons.
• Write a technical decision record (ADR) — for future-you, six months from now, having forgotten everything.

The /code prompt count is now 20 (was 13).

New post at /blog/pre-deploy-checklist: a 24-point checklist across eight categories (secrets & auth, database, AI costs, frontend, error handling, rate limits, observability, rollback) for AI builders who get 90% of the right decisions and 10% of the catastrophically wrong ones. Includes a copy-paste version.

Major discoverability pass so AINews shows up in Google AI Overviews, ChatGPT citations, and Perplexity:

• New /llms.txt — structured site index for AI crawlers (700+ lines covering every hub, blog post, comparison, glossary term, tool, skill, prompt category, role page, guide, and recent news article). Generated from the same data sources as /sitemap.xml.
• JSON-LD structured data — Organization + WebSite + SearchAction schemas on the homepage; BlogPosting + BreadcrumbList on every blog post. Sitelinks searchbox now eligible.
• Per-post OG images — every blog post now gets a unique 1200×630 image with its title as hero, auto-generated at /blog/[slug]/opengraph-image. Used in social sharing, Twitter cards, LinkedIn unfurl, Slack previews, and BlogPosting JSON-LD.
• Default openGraph.images on layout so every page has a fallback social preview.

Post-promotion sends now lead with the post as hero (with its per-post OG image), not buried under changelog cards. Changes:

• Hero image on top is post-specific (no longer the generic site OG)
• Subject line is the post title (no "AINews · X updates" prefix when promoting a post)
• Larger H1 (30px, weight 800) and CTA button (14×26 padding, 15px font) — matches the site's hero proportions
• Changelog moved to a compact "Also this week" list at the bottom
• Dropped meaningless FEATURE/CONTENT tag pills that appeared on every card
• Digest-only mode (no post) keeps the existing card layout

New post at /blog/vibecoding-what-to-think-about: the five things that actually break when non-engineers ship AI-built apps — API keys in the frontend, fake auth, prompt-deletable databases, uncapped costs, and the "works for me" trap — with a fix for each.

Four changes shipped together:

• New section at /open — opinionated explainer of open-source AI. What "open weights" actually means, the models that matter in May 2026 (DeepSeek V4, Llama 4, Qwen 3.5/3.6, Kimi K2.6, gpt-oss), where to run them, and the open tools built on top. Decision matrix for open vs frontier plus the licensing pitfalls people miss.

• OpenClaw added to the tools catalog — Peter Steinberger's autonomous local AI agent, the fastest-growing open-source project on GitHub. MIT-licensed; runs locally; acts via WhatsApp / Telegram / Discord / Signal with persistent memory.

• "Blog" renamed to "Posts" in nav, footer, and section headers. The content type stays identical (weekly long-form notes); the label was journal-flavored, the actual posts are practical playbooks. URL /blog/[slug] unchanged.

• 17 new sources in /news — Anthropic, Anthropic Engineering, Claude Code Changelog, Google AI, Meta AI, xAI, Mistral, Cohere, Thinking Machines, The Batch, Perplexity, Together AI, Groq, Ollama, Vercel, Windsurf, Simon Willison. Up from 20 to 37 feeds total.

Companion to yesterday's post on hallucinations, loops, and confident-wrongness. New skills you can install:

• AI Output Verifier — audits AI-generated code for hallucinated APIs and silent rewrites
• Loop Breaker — diagnoses why an agent is stuck and produces a clean restart prompt
• Context Grounding Brief — builds the context bundle that prevents hallucinations before they happen
• AI Feature Pre-Ship Checklist — verification checklist for AI-built features before they touch real users

New prompts in /prompts/code (verify AI code, escape an agent loop, ground context before coding), /prompts/productivity (set a time budget for AI tasks), and /prompts/analysis (sanity-check AI output before acting on it).

New post at /blog/your-ai-is-confidently-wrong: the four failure modes that actually empty your AI budget — hallucinations, loops, over-broad rewrites, and long-session degradation — with concrete fixes for each.

Major expansion of /coding:

• Mode picker — pick "Just starting / Solo / Production / Team lead" and get the rest of the page through that lens.
• Recommended starter stacks for each mode (concrete picks, not vague advice).
• Repo file templates — copy-paste AGENTS.md, CLAUDE.md, .cursorrules, PLAN.md, IMPLEMENTATION.md, REVIEW.md.
• Verification matrix — when each level (automated / model review / independent verifier / human) is required.
• Escalation rules for risky changes (auth, payments, destructive migrations).
• Good-vs-bad examples for repo instruction files.

Plus 9 new AI builders in /tools: Codeium, Cody by Sourcegraph, Emergent, Base44 (Wix), Natively, Supermaven, StackBlitz, JetBrains AI Assistant, Amazon Q Developer.

Full pre-launch security audit and patch round. Closed:

• Stored XSS vector in JSON-LD (escaped </script> and U+2028/2029 properly).
• DB credential footgun in Next config.
• Missing rate limits on LLM endpoints (per-IP + body fingerprint).
• Newsletter mailbomb risk (rate limit + honeypot + per-recipient cooldown).
• Missing security headers (CSP, HSTS, frame, referrer, nosniff, permissions).
• Removed two obsolete privileged setup routes.

Site is now safe to deploy publicly.

First public version of AINews. Hand-curated AI reference site for builders:

• 128 Claude Skills across 12 packs (developer, founder, marketer, sales, HR, customer success + capability packs for slides, sheets, docs, PDFs, web/UI, diagrams).
• 100 prompts organized by job-to-be-done.
• 178 AI tools with comparisons.
• /learn guides on validation, distribution, pricing, integration, automation.
• /glossary of 80+ AI terms in plain language.
• /for/[role] role-specific stack recommendations.

All free, no signup, MIT-licensed code, CC BY-NC content.