Ari Bagaev

I spent 3 months making Instagram reels. Filming. Re-filming. Editing. 4 hours per video for 200 views. I burned out. So I started building something different. 🧵

Over the last 2–3 weeks the entire internet got hacked. At this rate it might be easier to just turn it off, just in case 🤷‍♂️ The biggest one: Binance for $6.3 billion (North Korean hackers, according to the FBI). But that’s almost background noise now, because the infrastructure the everyday internet runs on is falling apart too. PHP2Shell: two critical flaws in PHP itself (CVE-2026-109618 and 109619, ~9.2). PHP runs a huge share of websites, including government, banks and shops. The bugs allowed remote code execution with no login. Many sites were simply taken offline while they patched. The flaws were found in part with the help of AI. eMudhra: an Indian SSL certificate provider. The private keys of several intermediate CAs turned out to be extremely weak (one of them was literally the number 4 🤡). Browsers blocked them quickly and the company announced it was leaving the global TLS certificate market. Devices like Yandex’s Alice speakers also used these certificates. Yandex updated them in a couple of days and no data leaked. Still, the scale of responsibility was massive. Other confirmed incidents from the same period: - NGINX: several critical vulnerabilities (a significant share of sites run on it) - GitLab: CVSS 10.0 (more than one), exploitation attempts reported - LiteLLM: malware planted in a popular package (millions of downloads) - Railway: hackers stole customers’ API keys - Zeabur: data from hundreds of thousands of accounts stolen - Cairn: open-source AI platform used to breach companies - Ahold Delhaize: Food Lion and Stop&Shop taken offline - Onamae: malware on tens of thousands of client servers in Japan - Signal: a bug that could leave the mic and camera on after a call ended - HTTP/3: a single connection could take down most tested web-server types - Plex: home media servers being hacked - SafePay: FBI warned about attacks on hundreds of organizations - Palo Alto: breach into a corporate network - Bullhorn: platform used by thousands of companies taken down - Medi-Cal: data of hundreds of thousands of patients stolen - WordPress: plugin developer keys stolen and used to plant backdoors - AOMEI: update server started distributing a backdoor - Muse from Meta*: vulnerabilities in the AI agent - Tor: hundreds of nodes compromised - TiDB Cloud: hosting provider also breached All of this in just a few weeks. Why is this happening? The era of open-weight models. AI helps both defenders (PHP2Shell was found in part with its help) and attackers: they look for vulnerabilities, write exploits and run agents. The asymmetry problem remains: an attacker can quickly spin up a bunch of models. A defender can’t spin up a bunch of AI defenders in the middle of an attack — it’s already too late. So either you spend your weekends breaking your own systems (so you’re ready at 6:30 on Monday), or whoever has more compute wins. Be careful in the near future: patch, rotate secrets, don’t leave unnecessary stuff exposed. Subscribe to the channel: I write about AI, tech, development and products. And in my vibe-coding lessons I show how to check your apps for classic vulnerabilities (just in case). *Meta: extremist organization banned in Russia.

hey @grok why do you think Antrophic banning russian accounts?

My Claude account got banned. For what? Cuz i'm not American citizen?

WTF happened with @coolifyio UI? Moving to @getdokploy

New hype: Jev from TypeSafe AI. It's not another chatbot. It's a model that does exactly one thing: make decisions. Jev doesn't write and doesn't chat. You ask a closed question with a fixed set of answers ("spam or not?", "which team gets this ticket?", "is the task done?") and it returns a probability for each option in milliseconds. No prose to parse, no broken JSON to fix. Why care? It's way cheaper than a regular LLM. What builders have already shipped: 1. A browser agent that found flights in 7 seconds for $0.004 2. Metaview moved all its agents to Jev and candidate search got ~10x faster 3. 500 emails sorted for 3.5 cents Bottom line: you don't need an expensive LLM for small calls anymore. Jev does the grunt work cheaply, and the big model only sees the hard cases. Numbers are self-reported and there are no public benchmarks yet. But 551 projects in the use-case catalog within the first few days tells you something.

Anthropic shipped Claude Fable 5.1 and Mythos 5.1. The .1 undersells it. The biggest gains are in coding, long agentic runs, and research work. Reminder on the pair: Fable and Mythos are the same model underneath. Fable is the one everyone gets. Mythos runs with looser limits around cybersecurity and biology, and for now it goes to vetted researchers and organizations. The benchmarks show the jump. On Terminal-Bench-Science, Fable 5.1 scored 52.6% against 24.7% for Fable 5, 29% for Opus 5, and 22.4% for GPT-5.6 Sol. More than double the field, on tasks where the model has to run its own experiments. The score matters less than the direction. Models are getting better at holding one task for hours: keeping context, running experiments, finishing the job instead of handing back a plausible answer in a minute. Long autonomous runs are what the labs are actually racing on now.

“Anal Powerhouse” by Tim Cock as an Easter egg for the new Mac Mini release 😂 Instead of “An AI Powerhouse,” people are seeing an optical illusion. Is this a hint at the $900 price tag?

Companies that adopted AI grow headcount 5x faster Read a study on AI and the labor market. 1. About 20% of companies actually put AI into their workflows 2. They grow headcount 5x faster and pay 15% faster 3. They hire juniors more, but only the very best ones 4. Everyone else sees no mass layoffs, just falling real wages and slower hiring No jobs apocalypse. A widening split. The winners will be the ones building systems that learn on their own.

Is there any alternative to @supabase that offers all the same features: Apple Sign-In, Edge Functions, and so on? I don't want to pay $25 for each of my projects.

First $1000 from an AI avatar x Part 3 Quick recap: I'm testing a foreign traffic play through AI avatars. Goal - my first $1000, and a cheap traffic channel into my apps. It's been a few weeks since I built the two avatars. Happy with where this is at. One of the accounts pulled over 2 million views in a single week. Two videos a day, Instagram only for now. My old short-form playbook came in handy. After a few years of watching what lands and what dies, you can mostly feel it before you hit post. The ideas and scripts come straight out of our own content automations. There's barely any manual work left in that part. The second account is picking up steam too. Honestly, I want to spin up more and more of these. There are way too many niches worth trying. Let's see what happens. I'll keep you posted.

Everyone is building agents. Almost nobody is building FOR agents. That gap is the next decade of startups. 21 ideas: 1. Harness distribution. Whatever tool an agent's harness loads by default becomes the new App Store winner. Being the tool it reaches for first is the whole game. 2. Spend controls. A runaway loop can torch $100 of tokens in eight minutes, and the agent won't even notice. Budgets, alerts and kill switches for machine spending. 3. Trusted memory. A shared brain that agents read from and write to. Whoever owns that layer owns infrastructure. 4. Sandboxes. You would never hand an agent your production Stripe keys. Safe replicas of real services is a wide-open category. 5. Docs as onboarding. A human clicks around your UI for ten minutes. An agent just reads the docs. Documentation quality is now revenue. 6. Machine reputation. Agents get defrauded by other agents. A track record you can verify before trusting one is worth real money. 7. Authority layer. An agent has to prove there is a real human behind it, with real permission to spend. Someone builds that and everyone depends on it. 8. Machine escrow. Payment that releases automatically when the work is verifiably done. No human in the loop. 9. Behavior replay. Agents fail quietly and in strange ways. The "show me exactly why my agent did that" tool becomes indispensable. 10. Dispute resolution. When one agent does a bad job for another, somebody has to rule on it. Arbitration for machines. 11. Disposable payments. One-time virtual cards spun up per task and killed after, so your real card never touches an agent. 12. Guaranteed throughput. A human shrugs at a rate limit. An agent's entire workflow dies on one. Reliable high-volume access is a product. 13. Negotiation protocols. Agents buying from agents will haggle over price and terms in milliseconds. The standard for that doesn't exist yet. 14. Liability layer. When an agent signs something on your behalf, someone is on the hook. Legal and insurance for agent actions is a venture-scale build. 15. Always-on hosting. Agents need somewhere to live 24/7. Selling the box they run on is a big business. 16. Machine wallets. A warehouse robot paying for its own compute. A home robot ordering its own spare parts. The physical world joins in. 17. Machine labor markets. A software agent posts a real-world job and a humanoid robot picks it up. 18. Proof of physical work. Photos, sensor data, attestations that the robot actually did the job. Verification becomes its own layer. 19. Version control for behavior. Your agent got worse overnight? You need to roll back the exact prompt or skill that broke it. Git for agent behavior. 20. Agent-to-agent subscriptions. Your research agent pays a monthly fee to a narrow specialist agent. Recurring revenue between machines. 21. Agent job boards. Companies posting tasks only machines can apply for. "Wanted: an agent that does X for under $100 a task." Every previous platform was built for people. This one gets built for machines, and it is as early as it will ever be.

First $1000 from an AI avatar x Part 2 The setup: I'm testing a foreign traffic play through AI avatars. Goal - earn my first $1000. If it works, it's a clean way to break into another country's market with my apps. If not, I bank a new skill either way. I spent a week and a half deep in this. Paid for the AI tools, burned through tokens, watched every YouTube video, talked to people already doing it. The real problem was one thing: generating realistic long videos, not just the easy 10-15 second clips. And making the avatar actually look like a real person. Everything matters here - casting, clothing style, location, accessories. Got pretty deep into the weeds. But I've already built 3 characters and set up social accounts for them. Next plan: 2-3 videos a day. Let's see what happens.

Brazil vs Apple. Starting with iOS 26.5, iPhone users in Brazil can officially install third-party app stores - AltStore, Epic Games Store and others. Your default store is managed right in the system: Settings -> Apps -> Default Apps. The big catch: you won't find these stores inside the App Store. To install one, you have to open the store's official website in Safari and download it from there. What Epic fought Apple over in court for years is slowly becoming real. First the EU, now Brazil. The App Store monopoly is cracking region by region, and it's no longer a question of "if", but "when it reaches everyone else".

First $1000 from an AI model x Part 1 Starting an experiment: build my own AI model, give it social accounts, and funnel that traffic straight to my apps. First I planned to generate through Higgsfield, but I went with Weavy AI instead - the tool Figma just acquired. Clean interface, and it runs canvas-based workflows, kind of like n8n (see the screenshot above). The nice part: you don't rebuild every process from scratch. You wire it once as a chain of nodes, then run it like a pipeline and only swap what you need. Liking it so far. Now I'm watching two things: how fast it burns tokens, and what kind of characters actually come out. No idea where this ends up. But I'll document the whole thing here, part by part.

A vibecoder @the2ndfloorguy compiled a list of his most annoying coworkers using Whoop The guy exported heart rate data from his Whoop band and fed it into Claude Fable 5. The AI matched stress spikes with meetings in his work calendar and built a ranking of coworkers who trigger the most stress. Looks like now I finally know why I’ll need a Whoop.

Anthropic released Claude Fable 5. Same base model as Mythos, with extra safety filters. Benchmarks put it at the top across coding, knowledge work, scientific tasks, and vision. But the more interesting part is qualitative. Fable 5 is being described as the biggest jump since Opus 4.5 in November. After 4.5, some people were already doing nearly all of their coding from the terminal. With Fable, Claude feels less like a coding agent and more like a thinking, design, and product-building partner. The debugging behavior is the tell: instead of rushing to a plausible fix, it adds logs, takes measurements, checks hypotheses, and verifies the issue is actually fixed. Caveat: safety filters may be too sensitive at launch, and AI-written code still needs review and tests before production. Real step change.

How I used to build apps vs how I build them now: Then: ship a new app almost every week and hope one of them randomly takes off. Now: build 1-2 apps a year and spend the rest of the time on what actually moves the product: marketing, onboarding, screenshots, retention, paywalls, ASO, and distribution. Traffic and marketing are the most valuable skills right now.

Apple Design Awards 2026 just happened. 3 apps stood out to me. Not only because they look good, but because they make complex data feel usable. 1. The Outsiders: Athlete Tracker Fitness without the usual "push harder" default. Training Readiness Score turns sleep, resting heart rate, and training load into a clear signal: go harder today or recover. 2. Tide Guide: Charts & Tables A niche tide tracker, but the interface is great. Forecasts, water temperature, swell, weather, widgets - a lot of data, but no mess. The palette even follows the color of the sky throughout the day. 3. Harvee Turns Apple Watch data into recovery guidance. The small character at the center makes health data feel less dry and more human. Good design is not just "looks expensive." It removes noise and helps you decide what to do next. What apps do you enjoy using because of the design?