Ephemeris
PATCH
The tools turn on their own bugs today — finding them, proving them, and opening the fix while you sleep. Also: feature flags as a platform primitive, four lines that close a years-old truncation bug, and a 2000s meme finally made playable.
Let the model patch the planet.
OpenAI expanded its Daybreak security suite: a Codex Security plugin that finds, validates, and fixes vulnerabilities from inside Codex, plus the full GPT-5.5-Cyber model for trusted defenders and a Patch the Planet effort for open-source maintainers. Since its March preview the scanner has read 30M+ commits across 30,000+ codebases; OpenAI says it has already generated patches for critical flaws in FreeBSD and the Linux kernel.
Ship the code. Hold the feature.
Vercel Flags bakes feature flags into the platform. Flags evaluate server-side by default — you read them with an await during a React Server Component render, so the right view ships with no client request and no layout shift. Config changes propagate across regions in milliseconds, a Precompute pattern keeps static pages on the CDN by building every variant ahead of time, and the kill switch is one toggle, no redeploy.
- Server-side
- evaluated by default
- Milliseconds
- global propagation
- One toggle
- instant kill, no deploy
219 KB arrived. 14.9 MB was sent.
Rearchitecting its Images binding, Cloudflare traced truncated HTTP/1 responses to a race deep in the hyper library: dispatch.rs dropped the result of poll_flush() with let _ and marked encoding done once bytes hit hyper's own buffer — so when the socket filled, megabytes never left. Present from 0.14.x through 1.8.x for years. strace caught it; the fix is four lines.
# healthy request sendto(fd, …, 65536) = 65536 sendto(fd, …, 65536) = 65536 → flushed, then shutdown() # truncated request sendto(fd, …) = 219136 shutdown() ← buffer still full # the fix in poll_shutdown() ready!(self.poll_flush(cx)?); Pin::new(&mut self.io).poll_shutdown(cx)
Wake up to the pull requests.
PostHog wired its own telemetry — errors, logs, experiments, replays — into a five-stage pipeline that turns signals into merged-ready diffs. The hard parts were not the agents: an LLM classifier screens every public signal for prompt injection first, and clustering had to group by what a signal means, not the shape of its text, before any of it became fixable.
- 01Ingesterrors, logs, experiments, replays
- 02Clusterby meaning, via an LLM read
- 03Researchagents dig in through the MCP
- 04Triageneeds-data · needs-a-human · ready
- 05Patchsandbox fix, PR iterates until CI is green
"Instead of ever opening your analytics, your errors, or your logs, you wake up to PRs sitting ready for you in GitHub."PostHog Engineering
Cut the goal into verifiable steps.
A new OpenAI playbook on running Codex for hours, not prompts: break an ambitious goal into discrete steps that each end in a check, keep continuity across workstreams, and learn when to delegate execution versus hold human oversight. It leans on GPT-5.1-Codex-Max compaction — trained to work across many context windows, coherent over millions of tokens — so you start a task, walk away, and steer it from your phone at each decision point.
Rob the caravans, twenty years late.
A boy named Kirill once mailed a studio his dream game — "rob the caravans" — and the letter became a Russian internet legend. Two decades on, a developer shipped it for real: a Three.js + Rapier open-world RPG where a forest elf ambushes merchant convoys, runs an 18-perk talent tree, and roams a ~1 km² world. It plays in the browser with no install, built as a Fable 5 experiment with the game logic split into testable simulation code.
That's today.
Six picks for 23 June 2026 — security models that write their own patches, release primitives, a buffer bug years in the making, a product that files its own PRs, a long-horizon agent playbook, and a meme made playable.