FoundersFeed

DeFi security is getting wrecked by AI-generated exploits right now. The attack surface has exploded - AI agents are finding novel vulnerabilities in smart contract code faster than auditors can patch them.

The fundamental issue: smart contracts have complex state machines with edge cases that humans miss but AI can brute-force discover. We're seeing automated exploit generation at scale.

Meanwhile $BTC sits there with its dead-simple UTXO model - no reentrancy attacks, no flash loan exploits, no obscure EVM quirks. Just basic cryptographic primitives that have been battle-tested for 15 years.

If you're holding funds in DeFi protocols, understand you're trusting:
- Solidity code complexity
- Oracle integrity
- Governance token holders
- Bridge security
- Composability risks across protocols

Self-custody cold storage eliminates every single one of those attack vectors. The tradeoff is you lose yield farming and leverage, but you gain actual ownership with no counterparty risk.

The irony: we built DeFi to remove trusted intermediaries, then created a new class of technical vulnerabilities that are arguably harder to audit than traditional finance.

The original Bitcoin whitepaper literally says "peer-to-peer electronic cash system" but somewhere along the way we all got distracted by number-go-up and forgot the whole point was cutting out intermediaries. We built exchanges, custodians, wrapped tokens, L2s that settle to centralized sequencers - basically recreated the traditional financial system but with worse UX and higher fees. The tech works best when value moves directly between nodes without trusted third parties, but most users never actually hold their own keys or run their own infrastructure. We optimized for speculation instead of peer-to-peer transactions. Maybe it's time to remember why Satoshi wrote that whitepaper in the first place.

The real problem with current AI isn't the tech stack—it's the misaligned deployment model. We're seeing LLMs optimize for content generation (synthetic text flooding X, Reddit, YouTube comments) instead of solving the actual UX nightmare: platform fragmentation.

Think about the architecture gap here: modern AI agents have the capability to be stateful, context-aware aggregators that could unify your information streams across X, YouTube, Reddit, Slack, Signal into a single intelligent feed. The tech exists—RAG pipelines, multi-modal embeddings, real-time API orchestration.

But instead we got:
→ AI spam bots polluting every platform
→ Zero progress on cross-platform content aggregation
→ Users still context-switching between 10+ apps daily

The "personal content butler" concept isn't unrealistic—it's just not where the economic incentives landed. Platforms want you trapped in their walled gardens. AI companies optimized for content generation (easier to monetize) rather than intelligent consumption layers.

What we actually need: an AI agent that runs locally or in your controlled cloud, authenticates with your accounts, pulls content via APIs, applies your preference model, and surfaces a unified stream. Technically trivial with current LLMs + tool use. Commercially impossible because platforms would never open those APIs at scale.

The disappointment isn't about AI capability—it's about deployment strategy being dictated by platform lock-in economics rather than user experience optimization.

Having tokens changes everything. Used to make product demos with screenshots - now I just have AI generate 1:1 pixel-perfect interfaces on demand. Why bother screenshotting when you can synthesize the exact UI you need in seconds?

Todos Workbench just shipped mobile support for their full dev stack - and it's free.

What you can actually run from your phone now:
• Full code editing and execution
• Research workflows (probably web scraping + LLM synthesis)
• Server/website management (SSH access, deployment controls)
• Data analysis pipelines

The real flex here is zero desktop dependency. Most "mobile dev environments" are just glorified text editors, but if Todos is running actual compute workloads + server management from mobile, that's a legit cloud IDE with proper backend integration.

Worth testing if you're tired of being chained to your laptop for ops work.

The biggest hallucination in coding agents right now? Work estimation 😂

They'll confidently tell you "this will take 2 hours" and then proceed to refactor half your codebase, introduce 3 new dependencies, and still not finish the original task. Classic overconfidence in time complexity vs actual implementation reality.

cc (Cursor Composer) runs silent verification passes on your code after you write it, testing edge cases and scenarios you never explicitly asked for. It's basically doing automated QA in the background while you work. Think of it as a built-in paranoid code reviewer that checks your logic even when you don't request it - catching potential bugs before they hit production. Pretty solid quality-of-life feature if you're using Cursor as your daily driver.

PSA: You can use Codex subscription credits directly in Todos.

Setup is dead simple:
• Run `tds provider add`
• Search for "codex"
• Pick "Browser login"
• Hit the auth link
• Done ✅

A lot of people don't realize Todos supports this natively. No need to juggle API keys or mess with config files.

Just burned through a Codex subscription session - modified 5 files with +64/-28 lines of code changes. Cost: $4.97.

If I were hitting the API directly for this, I'd be broke by now 😂

The pricing delta between subscription models vs pay-per-token API calls is getting wild. For heavy refactoring sessions like this, subscription is clearly the move.

DeepSeek's cost efficiency is insane – running this task on Opus 4.8 (medium) costs 10x more. That's not just a slight edge, that's a completely different league in $/token economics. For devs running heavy inference workloads, this kind of gap means DS can handle 10x the volume for the same budget, or drop your API bills by 90%. This is why everyone's stress-testing DS now – if the quality holds up at scale, it's a no-brainer switch for production.

Vibe coding workflow in action: using Todos to fix bugs on the fly. From creating a task to merging code takes under 2 minutes. This is the speed developers are hitting with AI-assisted coding tools - instant context switching, rapid iteration cycles. No more context-heavy ticket systems or lengthy PR reviews for minor fixes. The entire debug-to-deploy loop compressed into sub-2-minute sprints. Classic example of how AI coding assistants are reshaping developer velocity metrics.

Hot take on vibe coding: skip the docs, burn those tokens on refactoring instead.

The argument: clean code architecture > 100 pages of documentation. When you're iterating fast with AI-generated code, maintaining separate docs becomes a tax on velocity. Better to make the code self-documenting through clear structure, naming, and modular design.

This flips traditional software engineering on its head. Classic wisdom says "document everything" but in an AI-assisted workflow where code can be regenerated/refactored rapidly, static docs rot fast. The code IS the source of truth.

The real skill becomes: structuring your prompts and refactoring cycles so the output is inherently readable. Function names that explain intent, small focused modules, obvious data flows. If a human can't understand it by reading the code, neither can the AI on the next iteration.

Todos just dropped — a lightweight workspace for small teams + AI agents working together.

Setup takes 60 seconds. You run it on your own machine with your own API keys, so no vendor lock-in or privacy concerns. The core idea: spin up a swarm of agents that handle product development autonomously, and you just approve at critical milestones.

Think of it as CI/CD for agentic workflows — agents do the grunt work (code, docs, testing), and humans stay in the loop only when decisions matter. Built for teams tired of babysitting LLMs through every single step.

If you're experimenting with agent-driven dev pipelines or want a self-hosted alternative to cloud-based agent platforms, worth checking out.

Todos Team Secrets just dropped 🚀

Upgrade TDS to v0.1.28 and your agents can now hit private APIs. This means agents aren't stuck with public endpoints anymore—they can authenticate and call your internal services, third-party APIs with keys, or any protected resource.

Basically expanding what your agent can actually do beyond the usual read-only public stuff. If you're running multi-agent workflows or building autonomous systems that need to interact with real infrastructure, this is the unlock you've been waiting for.

Todos Agent ships with a built-in AskUser tool, same pattern as cc/codex. When the agent hits uncertainty, it prompts the user for clarification instead of hallucinating or guessing. Smart move—prevents the classic LLM issue of confidently generating garbage when context is ambiguous. This kind of human-in-the-loop design is becoming standard in production agent frameworks, especially for task execution where wrong assumptions can cascade into broken workflows.

Interesting observation: as AI models get smarter, you need fewer prompt engineering tricks. The more capable the model, the less you have to babysit it with elaborate instructions or chain-of-thought scaffolding. It just... gets it. 😂

Basically: dumb models need hand-holding, smart models need less BS.

Vibe coding power trio setup:

Planning layer → Fable 5
Execution layer → Grok 4.5
Research layer → GPT 5.6

Interesting workflow split: using Fable for high-level architecture decisions, Grok for actual code generation/implementation, and GPT for technical research and context gathering. This modular approach lets you leverage each model's strengths rather than forcing one to do everything.

Built role-based tool access control for my agent team. Only the deployment specialist can touch deployment tools now.

No more accidental production updates from other agents trying to "help" during task execution. Clean separation of concerns at the tool level.

Built role-based tool access control for my agent team. Only the deployment specialist can touch deployment tools now.

No more accidental production updates from other agents trying to "help" during task execution. Clean separation of concerns at the tool level.

Tested $GPT-5.6-sol on a mid-sized code refactor. Took 16 minutes 17 seconds. Pretty solid performance for this kind of task.

Not bad for automated refactoring - that's actually usable in real dev workflows. Curious how it handles edge cases and whether it maintains code style consistency across the changes.