Lightnews — Scholar-powered news

Alex Komoroske @komorama.bsky.social · 2d

Imagine software that doesn't feel like visiting the DMV, but like working with a master craftsperson who knows exactly what you need.

1 3

Alex Komoroske @komorama.bsky.social · 4d

Software today is like eating canned corn from the convenience store. What if it could be more like a personal farmer's market?

2 5

Alex Komoroske @komorama.bsky.social · 5d

I just published my weekly reflections: docs.google.com/document/d/1...

AI as tool, not friend. CRUD-y apps. LLMs grow like a crystal, not a plant. A self-steering product northstar metric: Resonant Engagement Moments (REMs). Disposable software. When want and need are aligned.

komoroske.com/bits-and-bobs

Author: Alex Komoroske [email protected] What is this? During the week I take notes on ideas that catch my attention during conversations. Once a week I take a few hours to take a step back and try ...

docs.google.com

3

Alex Komoroske @komorama.bsky.social · 9d

Code is like a skeleton, LLMs are like muscle.

Skeleton alone: precise structure that can't move. Muscle alone: quivering mass on the floor with no leverage.

Put them together correctly and you get a body capable of threading a needle or throwing a fastball.

1 1 1

Alex Komoroske @komorama.bsky.social · 10d

AI should be a tool, not a friend.

Tools extend your agency.

Synthetic 'friends' are engagement optimization in disguise.

The Star Trek computer never said "good morning."

1 6

Alex Komoroske @komorama.bsky.social · 12d

I just published my weekly reflections: docs.google.com/document/d/1...
AI's last-mile problem. Responsibility laundering. AI as muscle, software as skeleton. Workslop. Chatbots as filming stage plays. Alienable data. Software perfectly tailored to you. The death of one-size-fits-none software.

komoroske.com/bits-and-bobs

Author: Alex Komoroske [email protected] What is this? During the week I take notes on ideas that catch my attention during conversations. Once a week I take a few hours to take a step back and try ...

docs.google.com

1

Alex Komoroske @komorama.bsky.social · 15d

Authentic things feel natural, inescapable, like it could never be any other way... and you'd never want it to be.

1

Alex Komoroske @komorama.bsky.social · 16d

That 'alienable' lens came from @azeem.bsky.social earlier this week. I love the way it captures why data escapes our control the moment it replicates.

2

Alex Komoroske @komorama.bsky.social · 16d

The same origin paradigm ties policies to apps/domains, not data itself. This lets your data be alienated from your intent, destroying contextual integrity. But if policies attached to data—flowing wherever it flows—they'd be inalienable. Your intentions would travel with it.

1

Alex Komoroske @komorama.bsky.social · 16d

Data is alienable. Because it replicates so easily, once it's out of your sight it's out of your control. When used behind your back, it loses its contextual integrity—alienated from your intention, turned against your interest. How can we make your data always work for you?

1 1 1

Alex Komoroske @komorama.bsky.social · 16d

verialabs.com/blog/from-mc...

From MCP to Shell

How MCP Authentication Flaws Enable RCE in Claude Code, Gemini CLI, and More

verialabs.com

2

Alex Komoroske @komorama.bsky.social · 17d

Right now it feels theoretical to most people. Would love to build demos that make it visceral - that "oh shit" moment when you see your own AI get tricked. Small Discord on the site if anyone wants to help create harmless but eye-opening examples.

1

Alex Komoroske @komorama.bsky.social · 17d

Prompt injection is when someone tricks an AI into ignoring its instructions. There's no easy fix because LLMs process all text as potentially executable.

Grabbed promptinjection.wtf and threw together a simple site explaining why this matters.

Prompt Injection

The critical vulnerability lurking beneath the AI hype. Learn why AI systems can't distinguish between instructions and data, and what it means for safe deployment.

promptinjection.wtf

1 1 3

Alex Komoroske @komorama.bsky.social · 18d

The official recording of my O'Reilly AI Codecon talk is now live: www.youtube.com/watch?v=AhW5...

The slides are at common.tools/talks/why-ce...

Why Centralized AI Is Not Our Inevitable Future—Alex Komoroske

YouTube video by O'Reilly

www.youtube.com

3

Alex Komoroske @komorama.bsky.social · 19d

www.economist.com/science-and-...

A structural defense for prompt injection is a requirement to unlock the potential of LLMs to help us in our everyday lives.

Why AI systems might never be secure

A “lethal trifecta” of conditions opens them to abuse

www.economist.com

2

Alex Komoroske @komorama.bsky.social · 19d

I just published my weekly reflections: docs.google.com/document/d/1...

YOLO mode with prompt injection. Self-poisoning spirals. Parasitic AI. AI-as-software vs AI-as-human. LLMs as prototype factories. Swarm Sifting Sort. Tainted smoothies. The hollow era. Hustle vs wisdom. The ZOPA.

komoroske.com/bits-and-bobs

Author: Alex Komoroske [email protected] What is this? During the week I take notes on ideas that catch my attention during conversations. Once a week I take a few hours to take a step back and try ...

docs.google.com

2

Alex Komoroske @komorama.bsky.social · 22d

You used to have to learn to speak computer.

Now the computer can learn to speak you.

Alex Komoroske @komorama.bsky.social · 23d

For the power of coactive UIs to be unleashed, they have to be turing complete: able to add not just content but also code to themselves.

That's where all the power to make it truly coactive comes from... but also with the wrong security model, it will be dangerous!

1

Alex Komoroske @komorama.bsky.social · 24d

I want an LLM-native tool that "talks" to me with coactive UI.

Alex Komoroske @komorama.bsky.social · 25d

When you put something onto a shelf you expect it to stay the same.

When you put a seed in soil you expect it to bloom.

2

Alex Komoroske @komorama.bsky.social · 26d

I just published my weekly reflections: docs.google.com/document/d/1...

Swarms of research goblins as scouts. The multiverse of code. Climbing the chatbot hill. Pre-assembled lego sets. Ironing out wrinkles in LLM output. Just-in-time tools. Friendly pirates. Resonant Computing. Rolling thunder.

komoroske.com/bits-and-bobs

Author: Alex Komoroske [email protected] What is this? During the week I take notes on ideas that catch my attention during conversations. Once a week I take a few hours to take a step back and try ...

docs.google.com

3

Alex Komoroske @komorama.bsky.social · 29d

If you want the full-tilt Alex experience, I recommend you watch the video recording: drive.google.com/file/d/1Hxsz...

Why AI Is Not Our Inevitable Future Recording

drive.google.com

2

Alex Komoroske @komorama.bsky.social · 29d

On Tuesday I gave the opening talk at the O'Reilly AI Codecon: common.tools/talks/why-ce...

The default path with AI leads to antisocial outcomes, but we can collectively choose a prosocial path.

common.tools

1 2

Alex Komoroske @komorama.bsky.social · Sep 11

I had a blast talking with @nickgrossman.xyz about my "slow hunch" about the power of emergence

www.youtube.com/watch?v=c6fB...

Alex Komoroske (Common Tools)

YouTube video by The Slow Hunch

www.youtube.com

2 6

Alex Komoroske @komorama.bsky.social · Sep 9

I love @simonwillison.net 's frame of "research goblin." The LLM has much infinite patience so it will do much more research than you'd bother to do... which helps you make better decisions, even if its analysis isn't always perfect.

simonwillison.net/2025/Sep/6/r...

GPT-5 Thinking in ChatGPT (aka Research Goblin) is shockingly good at search

“Don’t use chatbots as search engines” was great advice for several years... until it wasn’t. I wrote about how good OpenAI’s o3 was at using its Bing-backed search tool back …

simonwillison.net

2