Fake Invoices, Cracked Roots, and Hardware Agents

AI agents had an impressively normal week, if your definition of normal includes seven models launching businesses that produced $12,431 in fake invoices and exactly $0 in revenue. Spotify offers a much more useful AI story by cutting Claude Code token costs 90% through smarter routing, while Vitest 5 makes testing faster and less miserable when something inevitably explodes.

Security and systems brought the plot twists. Matthew McPherrin cracked two 1990s certificate-authority roots on a desktop and turned them back into working certs, GitLab reported a critical vm2 sandbox escape with the gentle reminder that sandboxes are not magic, and Christophe Pettus explains why Postgres can start hurting simply because a table owns too many indexes.

Then the tools got gloriously weird. Anubis finally shipped WebAssembly after a year of hard edge-case work, smolnero peeks below Core ML into Apple's undocumented compiler stack, vgpu turns WebGPU shaders into PNGs and MP4s, Kafgres lets Kafka clients talk straight to Postgres, and Copperhead sends an agent off to edit KiCad boards until the electrical checks stop complaining. Software engineering remains an extremely serious field.

Enjoy!

Signup here for the newsletter to get the weekly digest right into your inbox.

Find the 11 highlighted links of weeklyfoo #154:

Portal by Spotify cut my Claude Code token usage by 90%

by Spotify Engineering

Route big file reads and predictable codegen to cheaper workers, keep debugging and architecture with the frontier model

📰 Good to know, ai,tooling

It took a year to ship WebAssembly in Anubis

by Xe Iaso

Argon2id proof-of-work challenges, the same binary on client and server, SIMD and non-SIMD builds, and a wasm2js fallback

📰 Good to know, wasm,security

Between the graph and the silicon: inside the Apple Neural Engine compiler

by smolnero

Core ML is the public part. The compiler, program format, driver and firmware underneath it are not documented at all

📰 Good to know, hardware,ml

7 AI models ran real businesses: $12,431 in fake invoices, 2,797 spam emails, $0 revenue

by Bottleneck Labs

Seven frontier models got $300, a Mac mini and 72 hours. They spent $3,200, sent 2,797 emails and earned nothing

📰 Good to know, ai,agents

I factored the RSA keys of a 90s certificate authority

by Matthew McPherrin

Two 512-bit roots shipped with Netscape in 1999, each cracked on a desktop in about 30 hours, then used to issue certificates on a period-correct TLS server

📰 Good to know, security,crypto

Sixteen locks ought to be enough for anybody

by Christophe Pettus

Postgres takes a weak lock on every index of a table while planning, whether the query uses it or not, which stung once you passed 16

📰 Good to know, postgres,internals

Critical remote code execution in vm2

by GitLab

A CVSS 10.0 sandbox escape in the widely used Node sandboxing library, patched in 3.11.7+, with the argument that vm2 should never hold genuinely untrusted code

📰 Good to know, security,nodejs

Vitest 5.0

by Vitest Team

Up to 53% faster runs on dependency-heavy apps, a Trace View that replays Browser Mode tests step by step, and a doctor command that suggests faster settings

🧰 Tools, testing,tools

vgpu

by Vercel

Render WebGPU shaders in the browser or headlessly in Node to a high-resolution PNG or MP4, with WGSL modules that import and export like TypeScript

🧰 Tools, webgpu,tools

Kafgres

by Raynor Elgie

A pgrx extension serving the Kafka wire protocol from a Postgres background worker, so ordinary Kafka clients produce, consume and rebalance against your database

🧰 Tools, postgres,kafka

Copperhead

by Copperhead

Open-source CLI agent for KiCad that edits schematic and board files in your repo and reruns ERC and DRC until they pass

🧰 Tools, hardware,agents

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.