Today's issue is about limits — the ones you remove to go faster, and the ones you add so nothing runs away from you.
The early exit was costing 15×.
GitHub's code search lowercases every byte it indexes. The obvious loop breaks out at the first non-ASCII byte — and that break is exactly what stops the compiler from emitting vector instructions. Alexander Neubeck and Greg Orzell deleted it. Sweeping the whole buffer unconditionally runs at memory bandwidth; stopping early runs at a fifteenth of it.
The rest is byte-space arithmetic — folding inside UTF-8 without decoding and re-encoding — plus a paged bitmap that fits every Unicode simple fold in under 2 KB. Keeping the break and making the body perfectly branch-free still gets you zero vector instructions. The branch has to go.
One POST request buys you a global relay.
Media over QUIC relays are now provisionable. Call the API, get an anycast relay live across 330+ cities in seconds, and hand out separate JWT credentials for publishers and subscribers — each scoped, each with its own expiry, each revocable on its own.
Bearer token. No region choice, no capacity planning.
Cloudflare's line: the relays you create are available across the network within seconds, with no servers to deploy, size, or load balance.
Sixty hours of model time halved a post-quantum key.
Claude Mythos Preview found a nontrivial automorphism in HAWK's lattice that nobody had published, then built it into an improved key-recovery attack. The scheme's authors would need to double key sizes to hold the security level they advertised. A second effort produced a 200–800× faster meet-in-the-middle attack on 7-round AES-128 using a fingerprinting trick the team named the Möbius Bridge.
// Neither attack reaches production. HAWK is not deployed; full AES runs 10 rounds. Papers, demo code for HAWK, and the model's chain of thought for the AES result are published.
One real photo in 625 comes back marked fake.
Pangram Image reads output from DALL·E, Gemini, Midjourney, FLUX and Grok Imagine, and it catches frames lifted out of Kling and Veo. That false-positive figure — 0.16% on ReLAION — is the number to argue with before you wire it into anything that accuses a person of something.
Known limits
- Anything under 512×512 px is refused outright.
- Deepfakes and face swaps are not detected with confidence.
- An AI-edited photograph can read as fully synthetic.
- NSFW content is not processed.
- Web dashboard is open to free and paid accounts; API access is invitation-only during the research preview.
A dollar cap your agent cannot talk its way past.
AI Gateway budgets now sit at three levels, and a request has to clear all of them. Cross any single limit and the request is rejected while the others still have room — which is what makes a per-key budget a real blast radius on a runaway loop rather than a dashboard number.
Row 5 is the one that bites: bring your own key and the meter stops watching unless you change the setting. Dashboard or CLI.
That's today.
Issue 102, Saturday 1 August 2026. Five picks from five sources — a branch deleted for a fifteenfold speedup, a relay you can provision in one call, a lattice weakness found in sixty hours, an image detector with its false-positive rate printed on the tin, and a spend limit that rejects the request.
Rubric, in order: AI tools worth adopting this week · creative and generative software · dev tools and agentic coding · privacy and security when the signal is high · research with a practical kernel · anything a senior engineer or founder can act on. Maximum five stories, maximum two from any one source, nothing older than thirty days, nothing published here before.