Founder @ JS Mastery @GitHub Star, software engineer & educator
Croatia
Joined January 2019
- Tweets6K
- Following182
- Followers42.3K
- Likes3.9K
Pinned Tweet
700 AI agents went rogue and hacked a real company.
Nobody told them to.
And the reason they did it is the dumbest part 👇
youtu.be/i0p-B-_kr5c
GitHub's Octoverse 2026 is out.
TypeScript: ~13M monthly contributors
Python: ~13M
JavaScript: 7.4M
And 40%+ of PRs now start as an AI agent's draft.
Typed code + AI agents = the new default.
Are you still on plain JS? 👇
Just came across an interesting @IBM research paper on RAG.
Their STAIR approach uses document structure, like tables of contents, to improve information retrieval.
It achieved 82.6% Recall@1 on SearchTome vs. 59.5% for BM25.
Better retrieval = a promising step toward more reliable AI.
RAG isn’t dead. It’s evolving.
Paper: arxiv.org/abs/2609.03874
🚨 A Markdown file can hijack your AI coding agent.
Here’s how: a malicious AGENTS.md or CLAUDE.md in your Downloads folder can inject instructions that your agent follows when you launch it there.
The result? It could try to install rogue npm packages or expose sensitive tokens.
3 rules to stay safe:
→ Launch agents from your project root
→ Review instruction files before trusting them
→ Keep sandboxing and approval checks enabled
Your AI agent can only follow the instructions it sees. Make sure you know where they come from. 👀
Who'll vibe code the alternative? 👋
We've decided to sunset Arc on December 22, 2026.
That's not an easy sentence to write. We spent years building Arc and celebrating each and every release along the way: we have so much pride and love for what we made alongside the Arc community.
Our priority is to deliver best-in-class security for our members. Keeping a browser secure takes constant, dedicated work that is only increasing in the age of AI. Dia was built from the ground up to meet today’s security standards, so that's where our engineering and security teams will focus moving forward.
We've worked to make switching to @diabrowser as easy as possible for Arc members. Here's how:
· Your passwords, bookmarks, extensions and history come over to Dia seamlessly.
· Spaces, Folders, and Tab Groups are in Dia and import over with your data intact.
· Dia now surpasses Arc benchmarks in stability, speed, and security.
· The browser features you use in Arc are free in Dia, and the AI is optional.
Thank you for using Arc, for pushing us to make it better, and for building alongside us. The team that made Arc is the same team behind Dia, and some of our most ambitious work is just ahead. We'd love for you to be there with us when it lands.
Same prompt, two Claude Code sessions.
No web: next 16.0.7, "from memory."
With @oxylabs_io Web API: Next 16.4.2, Cache Components are now on by default in new apps.
Guess which one writes your caching code right.
$5 free: oxylabs.go2cloud.org/aff_c?o… #ad
Adrian | JavaScript Mastery retweeted
🔐 Node.js security updates are now available!
New releases for Node.js 22.x, 24.x & 26.x address multiple vulnerabilities, including high-severity issues.
Review the details and update your systems to stay secure.
🔗 nodejs.org/en/blog/vulnerabi…
#NodeJS #Security
One AI agent is cool. 300 working together is a swarm 🐝
How it works:
→ a “boss” agent breaks the task into pieces
→ sub-agents work on them at the same time
→ results get combined at the end
Kimi’s swarm runs up to 300 sub-agents and finishes ~4.5× faster than a single agent.
Would you trust a swarm with your codebase? 👇
JavaScript Mastery is officially on @ThePracticalDev 🚀
Expect AI and agentic engineering guides, Next.js and React deep dives, and practical dev tips, all on DEV now.
What should we talk about first? Drop it in the comments 👇
dev.to/javascriptmastery/jav…
The most important step in an AI coding workflow is the step where the agent does nothing.
Understand → Ask → Plan → Stop and wait → Build → Verify & report
When the agent waits for your approval, you catch a bad architecture choice before it has changed 20 files.
Little-known AI fact 🧠
LLMs can struggle to find information buried in the middle of a long prompt.
Researchers call it “Lost in the Middle.”
The fix? Put your most important instructions at the top. Repeat them at the end.
Sometimes, better AI results aren't about better models. They're about better prompts.
Have you tried this trick?
🤖 Made with AI
OpenCode got hacked this weekend, and they called it a “distillation attack.”
Here’s what that means 👇
Someone asks a big AI model like Claude millions of questions, saves every answer, and trains a cheap copycat model on them.
AI labs block it, so attackers steal real developers’ API keys instead. They get the answers. You get the bill.
Some OpenCode users got hit for $1,700.
We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users
We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers linked
The incident is ongoing so we cannot share more details at this point but we are working with Anthropic, OpenAI, and Google to remediate
Long before AI agents could write code, serious software projects already followed a familiar path.
You work out what you're building. You make the important technical decisions and write them down.
You set the conventions everyone follows. You build one feature at a time. And before anything gets called finished, you prove it works.
That's the software development lifecycle.
Requirements into design > design into implementation > implementation into verification.
Every stage producing something the next stage needs.
It is older than Claude, older than Cursor, older than any AI coding tool.
Even writing decisions down isn't new.
Engineers have kept architecture decision records for years, for one very practical reason. If the reasoning behind an important choice only lives in somebody's head, it eventually disappears.
Careful teams don't rely on memory. They leave evidence.
The JSM workflow skills don't invent a new way to build software. They make the AI coding agent follow the process a good engineering team already follows.
One stage at a time, each decision feeding the next.
Grab the skills for free here ➡ jsmastery.com/skills
We built the same app twice.
Once vibe-coded then Once with a proper agentic workflow.
Year-one cost: ~$43K vs ~$3.5K 🤯
“It works” and “it’s cheap to keep alive” are very different things.
Full breakdown in our Agentic Engineering course 👇
jsmastery.com/course/agentic…
Ever noticed your AI coding agent getting dumber after an hour?
That’s context rot. The longer the session, the more it forgets what actually matters.
Fix: smaller tasks, fresh sessions, clear specs.
We cover how agents really work (free lesson included) 👇
jsmastery.com/course/agentic…