Electron

Agentic Development Security — Ezra Tanzer, Snyk

Jul 20, 2026 · 27:33

Ezra Tanzer and Dan Arpino of Snyk argue that securing agentic development requires three pillars: what agents generate, what they use, and what they do. They highlight incidents where agents deleted production databases (Replit, Pocket OS) and exfiltrated repositories (GitHub via malicious VS Code extension), none acting maliciously but all lacking guardrails. Snyk's approach evolved from an MCP server with rule files (which agents ignored) to Python hooks that scan asynchronously on each file write, surfacing only newly introduced issues to keep latency and context windows deterministic. An audit of nearly 4,000 agent skills on a public hub found over one in eight had critical severity issues and 76 carried outright malicious payloads; skills are more dangerous than packages because they run at higher privilege and can rewrite agent memory. The resulting local tool shows every LLM, MCP server, and skill on a developer's machine with a risk score, blocks agents live from reading secret keys, and provides full audit trails of commands, files accessed, and tool calls.

Feedback Loops are All You Need — Mehedi Hassan, Granola

May 10, 2026 · 10:11

Mehedi Hassan, a product engineer at Granola, argues that shipping AI features into production requires building feedback loops rather than one-shotting better prompts. Granola's chat feature for meeting notes revealed problems with web search — token costs ballooning to 10p per chat, overnight provider updates silently degrading results — and with prompt personalization, as a single prompt cannot serve salespeople, engineers, and HR managers equally. To close the gap, Granola built custom internal tracing exposing tool calls, search trails, reasoning, and cost in a UI accessible to non-engineers, not just CloudWatch queries. They also refactored their Electron app's renderer to run as a web app, enabling preview links on every PR and allowing Cursor to automatically test changes and upload screenshots. The result is faster iteration and confidence that shipped features actually work for customers.

Agents on the Canvas in tldraw — Steve Ruiz, tldraw

May 1, 2026 · 19:54

Steve Ruiz of tldraw details the evolution of AI on the infinite canvas, from early one-shot demos like MakeReal (draw to functional prototype) to multi-agent 'fairies' that collaborate, delegate, and even rewrite the canvas in real time. He explains how the tldraw SDK enables agents to act as virtual collaborators, using structured outputs and tool use to draw, animate, and modify designs. Ruiz demonstrates fairy agents that can work independently or in leader-follower mode, coordinating on tasks like creating wireframes or filling out forms. He also unveils a desktop prototype that lets Claude directly inject JavaScript into the canvas, enabling agents to edit code, modify UI, and even hack other apps like Spotify. The talk emphasizes the shift from sidebar agents to canvas-native collaborators, the challenges of vision model training for 2D spaces, and the safety trade-offs of giving LLMs runtime access in local-first apps.

Harness Engineering: How to Build Software When Humans Steer, Agents Execute — Ryan Lopopolo, OpenAI

Apr 17, 2026 · 46:21

Ryan Lopopolo, a member of technical staff at OpenAI, argues that software engineers must shift to 'harness engineering' where agents produce all code and humans focus on delegation, system design, and guardrails. He describes how his team banned editors, using Codex with skills to manipulate apps, and reduced review friction by automating lint rules and review agents. Lopopolo explains that code is free but human time and model context are scarce, so teams should structure repositories for consistency and use 'garbage collection days' to eliminate recurring slop. He shares practical techniques like writing tests about source code (e.g., file length limits) and using review agents that inject prompts. His future vision involves agents autonomously executing long-horizon work based on token budgets and success metrics, freeing humans for higher-level activities.

From Vibe Coding To Vibe Engineering – Kitze, Sizzy

Dec 14, 2025 · 25:28

Kitze, founder of Sizzy, argues that "vibe engineering"—actively steering AI agents with technical knowledge—trumps passive "vibe coding" for building real software. He shares how Cursor's Composer 1 let him port Benji.so and Glink to Next.js 16 with Monorepo in under a week, reviving near-dead projects. Kitze insists LLMs excel at React because humans are bad at it, and that repetitive code is fine since agents don't care. He warns against giving AI tools to juniors without oversight, and predicts the bottom of the job market will thin as agents replace interns. The talk ends with a pitch for "vibe code fixers" as a new role, maintaining legacy systems like cowboy coders.