30+ years shipping code. Full-stack developer, AI-tool user and AI-hype sceptic. Writing about craft, security, and what nobody's saying about agents.
Nederland
Joined August 2014
- Tweets184
- Following30
- Followers37
- Likes26
Judging again for @apartresearch: the Swarm Alignment Hackathon, Nov 6–8, with the AI Alignment Foundation and AE Studio. A weekend on what goes wrong when AI agents work together. Open to anyone:
apartresearch.com/sprints/sw…
Mijn eerste artikel op Frankwatching: meer AI gebruiken betekent niet dat je productiever bent. Het hoogste moeite-niveau kostte 13x zoveel voor hetzelfde resultaat.
frankwatching.com/archive/20…
Meer AI gebruiken ≠ productiever. Mijn eerste stuk op @frankwatching: het hoogste moeite-niveau kostte 13x zoveel voor hetzelfde resultaat. Meet liever wat af werk kost, nakijktijd en wat terugkomt.
frankwatching.com/archive/20…
PHP pre-announced a critical release. Overnight a PoC claimed RCE on stock config. By morning its author retracted it: "no RCE, CVSS 0.0". Hours later PHP's own advisory confirmed RCE anyway.
The race starts at the announcement now.
Same week, two opposite answers. Firefox now holds security tests back until at least a week after the fix ships. curl moves LOW and MEDIUM bugs to public issues, buried under AI-generated reports.
Both protect what they're short on. Neither shortens your window.
The number you control: time from a public fix to it running on your server. Measure your last three. If it's a week, that week belongs to someone else.
tim-schipper.nl/en/blog/patc…
The MCP ecosystem is already 70k+ servers, and most of them can touch your filesystem, network, or secrets.
MCP Observatory tracks releases, dependencies, and risk signals across npm, PyPI, and GitHub as they happen.
mcpobservatory.com/
I gave 23 coding agents the same prompt: a bookmarks API where a bookmark has a URL, a title and optional tags.
In 69 of 83 runs the agent added createdAt anyway. Nobody asked.
The bigger surprise: every model line has a handwriting.
GPT-5.6 Luna skips frameworks for plain node:http, 5 of 5 runs. GPT-6 Luna too. Gemini stores in SQLite in 15 of 16. Sonnet reaches for node:util parseArgs every time.
Switch models and your stack drifts.
266 runs across Claude Code, Codex, Antigravity, OpenCode and Freebuff, with the full method and 8 charts:
tim-schipper.nl/en/blog/codi…
#AIAgents #ClaudeCode
There are 64,000+ MCP servers on the internet.
Most of them can hit your filesystem, shell, or secrets.
mcpobservatory.com tracks every one of them in real time — risk grades, permissions, CVEs, drift.
If you connect an agent to random MCP, you are doing supply chain on easy mode.
MCP Observatory right now:
• 64k+ servers
• ~88% from GitHub
• 34k can touch the filesystem
• 18k can exec a shell
• 19k can see secrets
• 909 advisories, 544 critical/high
This is npm 2016 with agents attached.
mcpobservatory.com
What the Hugging Face traces show, why the prompt is a weak place to hang liability, and what to lock down this week:
tim-schipper.nl/en/blog/who-…
Three quarters of a level.
That is how far my scoring bar slid between the first four reports and the last four. One evening. Same rubric open the whole time. I only know because a forty-line awk script measured it afterwards.
tim-schipper.nl/en/blog/judg…
#AI #CodeReview
OpenAI's ads pixel has a consent flag. I set it to false before init, gave the browser a stand-in ChatGPT cookie, and loaded the page.
The script request still went out with __obi attached.
The flag lives inside a script the browser has already fetched.
Most of the anger went to OpenAI, and fair enough. But that pixel only sits on those shops because a developer pasted a snippet into a <head>.
The docs default consent to true. They never mention __obi at all.
Running it? Inject the loader only after real consent, switch off automatic advanced matching, send conversions from your server.
tim-schipper.nl/en/blog/chat…
#Privacy #WebDev
My CI pins every action to a commit hash. I built Plugin4Shell against it today.
The runner ran the attacker's action anyway. Green job, no warning.
A branch named after the pinned hash wins git checkout. Asking for a commit and getting it are two separate steps.
Claude Code refuses it since 2.1.179, forgejo-runner 13.1.0 too. Copilot doesn't, and neither did my old runner. Reproduction and the one-line fix:
tim-schipper.nl/en/blog/plug…
#SupplyChainSecurity #AIAgents
