Ali Stanfield

My colleague Lewis Metcalf wrote about why he's a big fan of short threads in Amp. 200k tokens is enough, if you know how to manage your context window. And if you have handoff, first-class threads, and other niceties in Amp, of course. Great post.

47

2 Comments

🦺 🛟 Agent Safety > Model Safety LLMs didn't break your app. Agents can. As we wire LLMs to tools, browsers, payments & code the risk shifts from bad text to bad actions. Top failure modes (seen in the wild & in papers): 🚩 Prompt/Content Injection -> Tool Misuse. Malicious web pages or data instruct agents to steal secrets or make unintended API calls. This is now a primary risk for browsing and MCP - style tool agents. 🚩 Over permissioned tools & long-lived tokens. Agents get "god mode" scopes. A single injection becomes account takeover or irreversible ops. Security notes for MCP emphasise least privilege and short-lived auth. 🚩 Unsafe web autonomy. Benchmarks show web agents will attempt harmful tasks unless constrained (posting misinformation, illicit sales, etc.). You must measure misuse not just assume guardrails. 🚩 Supply-chain & retrieval poisoning. Agents trust plugins, third-party tools & indexed data that an attacker can taint. OWASP’s newest GenAI Top 10 calls this out explicitly. 🚩 Process safety gaps. NIST's GenAI Profile (AI 600-1) warns that organizations ship agents without role clarity, human-in-the-loop or incident playbooks. ✅ Model safety reduces bad text. Agent safety prevents bad state. Treat the agent like a junior SRE - with narrow permissions, audited actions and clear escalation paths. If you're building agents, what's the one control you won't ship without? Also drop a comment if you'd like me to share a follow-up post on how to tackle each of these risks. #AgenticAI #AISafety #AIAgents #GenAI #CyberSecurity #MCP #OWASP #NIST #AITrust #ResponsibleAI #AIForBusiness

5

Developers, are you shipping with hardware ray tracing or holding back? Take this 10–15 minute survey from Rojin Vishkaie, PhD, Staff UX Researcher at Arm to share what you’re shipping, what’s blocking adoption, and what would help shape future tools, hardware, and support. Your input will help shape future tools, hardware, and support. https://okt.to/gVozBZ

18

There's been some interesting discussion on forums like Reddit about how engineers are finding the shift from writing code to writing prompts. A lot of engineers are openly frustrated. For many, writing code was the part of the job they actually enjoyed, and writing prompts just isn't giving them the same satisfaction. Others though? They're enjoying being a software engineer more than ever. I'm firmly in that second camp. Writing code has always been a means to an end for me. The product, how people use it, how they experience it, that's what I care about most. I write code because I have to, not because it's the bit that lights me up. And while I understand the tradeoffs between good and bad code, I've never been a purist about it. This whole shift has made me realise even more how important the "product engineer" mindset is versus being purely a software engineer. Engineers who can think in terms of product, user problems, outcomes, experience, are going to fare far better as AI continues writing more of our code. Curious where others land on this. Has the rise of AI tooling made you enjoy your work more, less, or has it not really changed things for you?

89

33 Comments

It feels so weird that just a few years ago I was in debates about whether or not to start adopting typescript, and now I’m in debates about how much permission we should give to our autonomous code robots. Life does come at you fast.

13

2 Comments

Hiring in 2026: Are we interviewing Engineers, or just their AI-generated Resumes? I recently had a conversation with a recruiter about a Senior Engineering role. When asked to tailor my resume for a specific role and ensure certain keywords were present, I politely declined. Why? Because frankly, with the AI tools available in 2025, anyone can generate a polished, keyword-optimized PDF in minutes that looks perfect, complete with fabricated experience. We can easily automate the creation of a 'perfect' candidate on paper. This raises a crucial question for hiring managers and recruiters: Are we genuinely seeking candidates who can architect, build, and deliver solutions, or are we just validating the quality of their automated document creation? If experience and capability are what truly matters, shouldn't we prioritize practical technical assessments and portfolio reviews over an easily manufactured keyword checklist? What are your thoughts? How do companies ensure they are hiring for competence over compliance in the age of generative AI? #HiringTrends #EngineeringJobs #TalentAcquisition #GenerativeAI #Recruiting #TechJobs

17

13 Comments