Vercel got hacked through one OAuth grant from an AI tool

One compromised third-party app → one employee account → source code, NPM tokens, GitHub tokens, production secrets.

The attack vector was a Google Workspace OAuth app with over-permissioned scopes. If you've connected AI tools to your Google org, any one of them is a potential entry point to everything.

Check your exposure right now:
admin.google.com → Security → API controls → Manage Third-Party App Access

If you use Vercel: rotate every env var, review org activity logs, disconnect and reconnect your GitHub integration.

Do it today, not tomorrow.

Week 3 receipts.

Shipped a summary tool 18 days ago. Last 7 days:

9 summaries. 4 humans. ~6 seconds average.

Thin. I won't dress it up.

The real lesson came from a comment this week: "clear problem" means clear to the reader in 2 seconds of scroll, not clear to me.

Week 2 passed that test (ChatGPT-sounding email). Week 3 needed a paragraph of setup first.

That's where it died.

Week 4 picks a pain that reads clean in 2 seconds.

Your CS team is writing the same emails over and over.

Renewal reminders, onboarding check-ins, churn risk outreach — same structure, different names.

ChatGPT cuts the drafting time when you give it context upfront: account health, product usage, last touchpoint. The output stops sounding generic and starts sounding like you actually read the account.

You're a customer success manager. The customer has been with us 8 months, usage dropped 40% last month, renewal is in 6 weeks. Write a check-in email that opens a conversation without sounding alarmed.

Paste your real account data in, adjust the tone, send. Saves 20 minutes per account )

Week 4: pick the pain.

What do you want me to build next?

1️⃣ Email Reply Draft (cold/warm reply in your voice)
2️⃣ Cold Outreach (first-touch, not sleazy)
3️⃣ Meeting notes → action items
4️⃣ Something else (drop in comments)

React with the number. Top vote wins by Monday.

Microsoft gave Copilot actual hands in Word and Excel.

Old Copilot could answer questions but couldn't touch your document. Now it can.

Agent Mode doesn't just suggest — it edits, formats, and builds inside the app directly. Microsoft admits the original Copilot was passive because models weren't powerful enough to control the interface. Now they are.

Next time you're stuck formatting a report, try:

Restructure this document with an executive summary at the top, then reformat all tables to match.

Worth testing before manually cleaning up your next slide deck )

GPT-5.5 is built to finish tasks, not just start them.

Most AI models stall when instructions get messy or multi-step. You end up babysitting every stage.

GPT-5.5 is designed to plan, use tools, check its own work, and push through ambiguity without hand-holding — the target is fewer interruptions on complex tasks, not just better single answers.

Test it on something you'd normally break into 3 separate prompts. Give it all at once and see where it drops the ball )

Free fix for any AI-sounding email.

Three signals editors flag in AI text:

1. Em-dashes inside short sentences
2. Three-part lists when two would do
3. "It's worth noting" / "interesting to consider" / "in essence"

Find. Replace with shorter punctuation, drop one item, cut filler verbs.

Or paste the email into @vustHumanBot and skip the manual pass.

Test: does your last 5 work emails have any of these?

Gemini now takes notes for meetings that aren't even on Google Meet.

In-person huddles, Zoom calls, Teams meetings — all of it. No room booking required, no scheduled meeting needed.

Open Google Meet on your phone, start an impromptu in-person session, and Gemini generates the transcript and summary automatically. Works even when some people join remotely mid-meeting.

So your "quick hallway sync" can finally have a paper trail.

Try it next time you don't want to type notes )

Codex isn't just a smarter autocomplete — it runs tasks in the background while you work.

Most people treat it like a chat box. It's not.

Codex runs each task in an isolated cloud sandbox. You spin up a thread, point it at your repo, and it executes — reads files, writes code, runs tests — without touching your local environment.

Set up a project → connect your repo → create a thread → describe the task in plain English

Start with something small like "write tests for this function" to see how it actually works )

DeepSeek dropped V4 — and it's gunning for Claude and GPT directly.

A year after shaking up the AI world, DeepSeek is back with a next-gen open-source model.

V4's biggest flex isn't just benchmark scores — it's that it runs on Huawei chips, not Nvidia. That's China building an AI stack independent of US hardware restrictions.

Coding is where they claim the clearest gains, which matters if you use AI agents for dev work.

Worth testing against your current setup )

Codex can run tasks while you sleep.

Most AI tools wait for you to ask. Codex has scheduled automations — set a trigger once, and it handles recurring work on its own.

Connect a schedule or event trigger to any Codex workflow, and it runs without you. Reports, summaries, data pulls — all done automatically at whatever interval you set.

Every Monday at 9am → summarize last week's GitHub activity → post to Slack

Set it up once, forget it exists )

Karpathy just dropped this.

342 US jobs, scored 0-10 for AI exposure.

Software devs sit at 8-9.
Teachers 6-7.
Roofers 0-1.

But the scores aren't what got me.

It's the stack.

He scraped BLS pages, scored each one with an LLM via OpenRouter, threw it on a static treemap. That's it.

Same kind of thing any of us could ship in a weekend.

And that's what "AI exposure" actually means in practice. Not AGI replacing everyone. Just narrow tools, made fast, doing one job. Like the ones we keep talking about here.

Worth a look 👇
karpathy.ai/jobs

Codex isn't just for coders — it runs whole workflows now.

Most people use it to write a function or fix a bug. That's maybe 10% of what it can do.

Codex works best when you give it real inputs — an actual file, a messy spreadsheet, a broken script — and ask for a specific output. That's when it stops being a chatbot and starts being an autonomous worker.

Here's the file. Clean the data, flag duplicates, and output a summary CSV.

Pick one repetitive task this week and hand it to Codex completely )

ChatGPT that actually does things — not just talks about them.

Regular chat gives you text. Codex gives you outputs: working code, dashboards, docs, automated workflows.

Codex connects to your tools and runs tasks end-to-end — instead of explaining how to build something, it builds it. The shift is from assistant to agent.

Try giving it a real deliverable instead of a question:

Build a simple dashboard that tracks [metric] and export it as HTML.

That's the move — treat it like a junior dev, not a chatbot )

OpenAI's Codex finally has a clear starting point.

Most people open it, stare at a blank screen, and close the tab. The setup actually matters here.

Codex works through threads tied to specific projects — not a general chat. Point it at a repo, define the task in one thread, and it runs autonomously. That structure is what separates useful output from noise.

Fix the bug in [file]. Write a test to confirm it's resolved. Don't change anything else.

Start with one small, scoped task before throwing anything complex at it )

The 1-line prompt that strips AI cadence from any draft.

If your text reads like ChatGPT wrote it, the fix is one rewrite pass — not fifty.

Copy & paste it:

Prompt:
Rewrite this so it sounds like one person speaking, not a corporate page. Strip every "in today's fast-paced world", "leveraging", "delve into", "it's important to note", "navigating the landscape". Keep the meaning. Trim 20-30%. Output the rewrite only — no preamble.

Here's an example:

Before:

In today's fast-paced world, businesses must leverage cutting-edge AI tools to streamline workflows and unlock unprecedented productivity gains.

After:

AI tools save your team hours per week. The trick is picking the one that fits how you actually work.

Try it on the next draft you're stuck polishing )

OpenAI dropped GPT-5.5 — no big announcement, just a blog post.

Positioned above GPT-5 for complex, multi-step work: coding, research, data analysis across tools.

The real upgrade isn't raw intelligence — it's tool use. GPT-5.5 is built to chain actions across multiple tools in one session without losing context mid-task.

Test it on something that previously needed 3 separate prompts:

Research [topic], write a structured summary, then suggest 5 follow-up questions for deeper analysis.

One prompt, one session. See if it holds up )

OpenAI models now run inside your AWS account.

Not via API calls to OpenAI servers. Directly in your AWS environment.

This matters for teams blocked by data residency or compliance rules — you get GPT-4o and Codex without routing sensitive data outside your infrastructure. Same models, your security perimeter.

Worth flagging to your cloud or infra team )

OpenAI dropped GPT-5.5 — here's what actually changed.

Another model drop, another round of "improved capabilities across categories." Hard to know what's real without testing it yourself.

GPT-5.5 is less a technical leap and more a strategic move — OpenAI is consolidating models into one interface, pushing toward a single app that handles everything. Fewer models to choose from, more power per default.

Less model-switching, more just... using it.

Try the new default on something you usually route to a specialist tool — writing, analysis, code — and see if it holds up )

Chrome now fills out forms and does research while you watch.

Google quietly rolled out Gemini-powered "auto browse" to Chrome Enterprise. It navigates pages, pulls data, and completes tasks on your behalf.

The shift here is subtle but real: the browser stops being a tool you use and starts being an agent that runs tasks. Auto browse can chain actions across multiple pages — not just summarize one.

Enterprise-only for now, but this is clearly where all browsers are heading.

Try describing a repetitive research task to Gemini in Chrome and see how far it gets )