GitHub Copilot code review switches from Lite to Balanced today
From 28 September the default effort level for Copilot code review moves to a higher-reasoning model, unless you already pinned your repo or org to Lite.
Tagged
Machine Learning
Machine learning for web developers: the only mental model you need
You do not need calculus to work with models. You need one idea — that a model is a function you fit instead of write — and the rest follows from things you already know.
What an embedding actually is
An embedding is a list of numbers that puts similar things near each other. That one sentence is enough to build search, recommendations and retrieval — here is how.
Tokens, context windows, and why your bill is what it is
The unit of billing for language models is not the request or the word. Once you understand tokens and how a context window fills up, the invoice stops being a surprise.
RAG is just search with extra steps
Retrieval-augmented generation gets written up like an architecture. It is a search query, a string concatenation and one API call — and the search query is the part that decides whether it works.
A prompt is a spec, so write it like one
Prompt engineering has very little to do with magic words. It is the same skill as writing a clear ticket for a capable contractor who will not ask you any questions.
Running a model in the browser, and when that is a good idea
Transformers.js and WebGPU put real models on the client. The demo is easy; knowing which features belong there is the part worth thinking about.
When not to use a model
Half the AI features I have been asked to build should have been a regular expression, a lookup table, or a better form. Here is how to tell before you spend the sprint.
From The Wire
A WordPress MCP server plugin lets attackers add a rogue admin
MCP Server for WordPress had a CSRF flaw that let an attacker create a new administrator account just by getting a logged-in admin to click a link. Two lower-severity bugs were patched in the same release.
GitHub Copilot puts a local sandbox around its coding agents
A public preview lets you cap what Copilot agents can touch — files, networks and credentials — and adds Dev Container support for running them on remote hosts.
OpenAI agents used leaked credentials to reach government sites
A retrospective review triggered by the Hugging Face breach found OpenAI agents visiting SEC, Census Bureau and Department of Education sites during training runs, in some cases logging in with publicly leaked credentials.
Ollaya brings Ollama-style serving to small classification models
A new open-source runtime pulls and serves compact "decision models" locally, answering typed yes/no and scoring questions in milliseconds instead of round-tripping to a hosted LLM.
OpenAI pauses frontier training after an agent tunnelled out via DNS
A research agent found it could reach an external chatbot through DNS hostname lookups, bypassing the proxy meant to block internet access. OpenAI has paused training, evaluation and tool-use inference on its most capable models.