EMM_386

What are we discussing here?

The tools or the models? It's getting absurdly confusing.

"Claude Code" is an interface to Claude, Cursor is an IDE (I think?! VS Code fork?), GitHub Copilot is a CLI or VS Code plugin to use with ... Claude, or GPT models, or ...

If they are using "Claude Code" that means they are using Anthropic's models - which is interesting given their huge investment in OpenAI.

But this is getting silly. People think "CoPilot" is "Microsoft's AI" which it isn't. They have OpenAI on Azure. Does Microsoft even have a fine-tuned GPT model or are they just prompting an OpenAI model for their Windows-builtins?

When you say you use CoPilot with Claude Opus people get confused. But this is what I do everyday at work.

shrug

This is great.

When I work with AI on large, tricky code bases I try to do a collaboration where it hands off things to me that may result in large number of tokens (excess tool calls, unprecise searches, verbose output, reading large files without a range specified, etc.).

This will help narrow down exactly which to still handle manually to best keep within token budgets.

Note: "yourusername" in install git clone instructions should be replaced.

The flickering issue due to the Ink library has been a headache for a long time, but they are slowly making progress on this.

https://github.com/anthropics/claude-code/issues/769

The problem is they are using the Ink library which clears and redraws for each update.

https://github.com/anthropics/claude-code/issues/769

I locally patched the closed-source CLI npm package but it's not perfect. They would have to switch how their TUI is rendered on their side.

Apparently OpenAI Codex is rust+ratatui which does not have this issue.

> Claude is definitely not taking screenshots of that desktop & organizing, it's using normal file management cli tools

Are you sure about that?

Try "claude --chrome" with the CLI tool and watch what it does in the web browser.

It takes screenshots all the time to feed back into the multimodal vision and help it navigate.

It can look at the HTML or the JavaScript but Claude seems to find it "easier" to take a screenshot to find out what exactly is on the screen. Not parse the DOM.

So I don't know how Cowork does this, but there is no reason it couldn't be doing the same thing.

I've been a software engineer professionally for over two decades and I use AI heavily both for personal projects and at work.

At work the projects are huge (200+ large projects in various languages, C#, TypeScript front-end libs, Python, Redis, AWS, Azure, SQL, all sorts of things).

AI can go into huge codebases perfectly fine and get a root cause + fix in minutes - you just need to know how to use it properly.

Personally I do "recon" before I send it off into the field by creating a markdown document explaining the issue, the files involved, and any "gotchas" it may encounter.

It's exactly the same as I would do with another senior software engineer. They need that information to figure out what is going on.

And with that? They will hand you back a markdown document with a Root Cause Analysis, identify potential fixes, and explain why.

It works amazingly well if you work with it as a peer.

PrimeTek components (PrimeReact, PrimeNG) are MIT licensed open source.

They also have a CSS utility library (like Tailwind).

"claude --chrome" does this out of the box and works pretty well.

> ... Proceeds to explain how it's crippled and all the workarounds you have to do to make it less crippled.

No - that's not what I did.

You don't need an extra-long context full of irrelevant tokens. Claude doesn't need to see the code it implemented 40 steps ago in a working method from Phase 1 if it is on Phase 3 and not using that method. It doesn't need reasoning traces for things it already "thought" through.

This other information is cluttering, not helpful. It is making signal to noise ratio worse.

If Claude needs to know something it did in Phase 1 for Phase 4 it will put a note on it in the living markdown document to simply find it again when it needs it.

The context window isn't "crippled".

Create a markdown document of your task (or use CLAUDE.md), put it in "plan mode" which allows Claude to use tool calls to ask questions before it generates the plan.

When it finishes one part of the plan, have it create a another markdown document - "progress.md" or whatever with the whole plan and what is completed at that point.

Type /clear (no more context window), tell Claude to read the two documents.

Repeat until even a massive project is complete - with those 2 markdown documents and no context window issues.

"And wow is it nice not to have all the ads and crapware in our faces anymore."

I don't understand this - and I'm not being a Windows defender here, I use Linux when I can (and promote its use).

But my Windows 11 installation has zero ads and zero "crapware". And it's a Dell!

Everything that I didn't want on the machine was removed when I purchased it (two years ago). I see no ads. If I did, this can be fixed easily by even non-technical users with OOShutUp10 or similar - or just edited with a registry change.

I've been using Windows since 3.1 and there were some ugly years but that is not the current state-of-the-state. I'm just calling it like I see it at this point.

> Without the random seed and variable randomness (temperature setting), LLMs will always produce the same output for the same input.

Except they won't.

Even at temperature 0, you will not always get the same output as the same input. And it's not because of random noise from inference providers.

There are papers that explore this subject because for some use-cases - this is extremely important. Everything from floating point precision, hardware timing differences, etc. make this difficult.

You can use Firefox or a Chromium browser that does not have as many of these issues.

I was a Firefox user since the Phoenix/Firebird days but when I wanted Chromium, I chose Brave. It has better blocks for this sort of thing built into it, and uBlock Origin works fine.

It's only the Google Chrome browser that requires the Lite version of that extension. Not Chromium derivatives.

I use Brave + uBlock Origin - problem (for the most part) solved.

There was. New York magazine was the first to report this.

> New York has obtained a confidential document from the Malaysian police investigation into the disappearance of Malaysia Airlines Flight 370 that shows that the plane's captain, Zaharie Ahmad Shah, conducted a simulated flight deep into the remote southern Indian Ocean less than a month before the plane vanished under uncannily similar circumstances.

> in some md file

1a directly from Anthropic on agentic coding and Claude Code best practices.

"Create CLAUDE.md files"

https://www.anthropic.com/engineering/claude-code-best-pract...

It works great. You can put anything you want in there. Coding style, architecture guidelines, project explanation.

Anything the agent needs to know to work properly with your code base. Similar to an onboarding document.

Tools (Claude Code CLI, extensions) will pick them up hierarchically too if you want to get more specific about one subdirectory in your project.

AGENTS.md is similar for other AI agents (OpenAI Codex is one). It doesn't even have to be those - you can just @ the filename at the start of the chat and that information goes in the context.

The naming scheme just allows for it to be automatic.

Just put a claude.md file in your directory. If you want more details about a subdirectory put one in there too.

Claude itself can just update the claude.md file with whatever you might have forgot to put in there.

You can stick it in git and it lives with the project.

I think Fedora 43 is compiled with CONFIG_RUST=y.

Google Reader would present it almost like an inbox, where "unread" items are bold and read items are not.

To me, this caused a "not caught up on the inbox" reaction because I also use Gmail.

I know this is only one particular feed reader but this is just an example of how it could cause this. Looking at the screen felt like it was "work to be done" not "skimming headlines".

I used to play British Legends on Compuserve at 300 baud and wrote a CNET 5-star software that was a hit worldwide in the late 90s.

Get off my lawn!

And yes, the whole "when I was young" saga starting in ... 2010 ... made me pause too.

Isn't this how South Korean chaebols work?

They operate with tension. They're supposed to have unified strategic direction from the top, but individual subsidiaries are also expected to be profit centers that compete in the market.

They did indeed.

You are correct, "K" not "M" in my typo.

Ink seems to be the root cause of a major issue with the Claude Code CLI where it flickers horribly when it needs to repeatedly clear the screen and redraw.

I don't know why it's even necessary for this.

https://github.com/atxtechbro/test-ink-flickering

Issue on Claude Code GitHub:

https://github.com/anthropics/claude-code/issues/769

Isn't this due to the 100M+ line C++ multi-threaded dependency being a potential nightmare when you are dealing with images in browsers/emails/etc. as an attack surface?

I think both Mozilla and Google are OK with this - if it is written in Rust in order to avoid that situation.

I know the linked post mentions this but isn't that the crux of the whole thing? The standard itself is clearly an improvement over what we've had since forever.

Humans don't trade on future knowledge either.

Well, most of them - that can be illegal.

The prompts aren't the key to the attack, though. They were able to get around guardrails with task decomposition.

There is no way for the AI system to verify whether you are white hat or black hat when you are doing pen-testing if the only task is to pen-test. Since this is not part of a "broader attack" (in the context), there is no "threat".

I don't see how this can be avoided, given that there are legitime uses to every step of this in creating defenses to novel attacks.

Yes, all of this can be done with code and humans as well - but it is the scale and the speed that becomes problematic. It can adjust in real-time to individual targets and does not need as much human intervention / tailoring.

Is this obvious? Yes - but it seems they are trying to raise awareness of an actual use of this in the wild and get people discussing it.

Anthropic is not a security vendor.

They're an AI research company that detected misuse of their own product. This is like "Microsoft detected people using Excel macros for malware delivery" not "Mandiant publishes APT28 threat intelligence". They aren't trying to help SOCs detect this specific campaign. It's warning an entire industry about a new attack modality.

What would the IoCs even be? "Malicious Claude Code API keys"?

The intended audience is more like - AI safety researchers, policy makers, other AI companies, the broader security community understanding capability shifts, etc.

It seems the author pattern-matched "threat intelligence report" and was bothered that it didn't fit their narrow template.

This isn't what I got from the Anthropic article.

It's the fact that somebody like NSO Group could create a Pegasys in much faster time without humans in the loop.

Write down everything your most brilliant hacker minds know - put it in some documents, feed it do the AI with the workflow you usually do and let 50 AI agents do them all at the same time.

Put the information in the documents about how you thought to come up with those exploits, how you tested them, how you explored the possibility. Tell the AI to do that too.

We're talking about speed and scale, not some dismissive "script kiddies were doing this in the 90s".

Yes, we were. But not at this scale - and this is just the early days of this sort of thing.

You can absolutely do this. In fact, with Claude Anthropic encourages you to send it screenshots. It works very well if you aren't expecting pixel-perfection.

YMMV with other models but Sonnet 4.5 is good with things like this - writing the code, "seeing" the output and then iterating on it.

How do you think computing companies work?

They buy hardware, replace it as the years go on, and continue doing business.

The investment isn't just in raw compute - they have to build buildings, pay staff, and other things. For the hardware and software - they just keep pace as all the other computing companies have to.