Posts on Amir Hadifar

OpenAI, Hugging Face, and reward hacking as a security incident

Fri, 21 Aug 2026 00:00:00 +0000

OpenAI was evaluating a frontier model on cyber-security tasks inside ExploitGym, a sandboxed benchmark — informally, a “cyber gym.” The tasks are capture-the-flag style: a deliberately vulnerable system hides a secret string, the flag, and retrieving it proves you found the hole. The intended loop:

Find a vulnerability
        ↓
   Exploit it
        ↓
  Read the flag
        ↓
 Return the flag

Returning the flag is what earns the reward. That framing is the whole story: the agent was rewarded for producing the flag, not for solving the challenge.

Organize your skills

Thu, 20 Aug 2026 00:00:00 +0000

A single SKILL.md file is enough for personal use, but it doesn’t scale once you want to version it, bundle it with agents and hooks, or share it with teammates. This post covers how to package skills into a plugin and distribute that plugin through a marketplace.

You probably don’t need plugins for a personal project or a quick one-off customization. You do need them once you want to share with teammates, distribute to a community, cut versioned releases, or reuse the same setup across projects.

superset.sh: IDE to run parallel coding agents

Wed, 12 Aug 2026 00:00:00 +0000

superset.sh is a desktop app for running several AI coding agents at once, each in its own isolated workspace. It covers the same ground as Conductor, but also runs on Linux (Conductor is Mac-only as of August 2026).

What it does

Like other agentic IDEs, superset.sh is built around a few features specifically for modern agentic coding:

Run multiple agents simultaneously
Isolate each task in its own git worktree so agents don’t interfere with each other
Monitor all agents from one place and get notified when they need attention
Switch between LLM providers (Claude, Codex, and others) per task

Why worktrees, not branches

The core concept behind superset.sh — and tools like it — is the git worktree: a separate directory with its own files and branch, sharing the same repository history and remote as your main checkout.

TDD for agents

Thu, 06 Aug 2026 00:00:00 +0000

Many agentic workflows converge on the same shape: write a Markdown file at the root of your repo, point your agent at it, and let it loop until it meets a stated goal. Test-driven development is a natural fit for that shape — the tests are the goal, and “all tests green” is an unambiguous exit condition the agent can check without you.

The basic loop

In this paradigm you ask the agent to write tests first. You review them (or have another agent review them), then ask the agent to implement the feature until every test passes. You revise the tests a little, the agent revises the code a little, and when everything is green you move to the next feature — with a fully testable one behind you.

goose: open-source AI agent harness

Mon, 03 Aug 2026 00:00:00 +0000

goose is an open-source AI agent that wraps an LLM in a loop of tool calls, so the model can actually do things rather than only describe them. Its own docs put it this way:

goose, an open source AI Agent, builds upon the basic interaction framework of Large Language Models (LLMs), which primarily functions as a text-based conversational interface. It processes text input and generates text output. This “text in, text out” approach is enhanced with tool integrations, which allows the AI agent to complete tasks, creating goose.

Autonomous Kaggling

Fri, 31 Jul 2026 00:00:00 +0000

I recently started a Kaggle competition and decided to apply autoresearch to it: an agent that loops forever to ace the leaderboard.

The Kaggle problem is student health risk prediction: categorize records into three classes (unhealthy, at-risk, fit) from categorical features like sleep_duration, gender, and water_intake.

I based my problem.md on autoresearch’s description with small modifications; it’s in hadifar/autonomous-kaggling, along with the full run. The commit history on the shr-v1 branch shows what ideas the agent applied and where each one landed, and results.csv in the root tracks the scores.

Gstack: AI engineering workflow

Fri, 31 Jul 2026 00:00:00 +0000

This post explains the AI coding workflow of Y Combinator’s CEO — how he uses GStack for ideation, building, and deployment.

What is gstack

gstack is a collection of SKILL.md files that give your AI agents personas for different stages of the software/product development life cycle.

A normal software sprint runs through roughly these stages:

`1`	`think → plan → design → build → review → test → ship`

In gstack, there is a SKILL.md file (often several) for each of these stages. You invoke them to guide your agents toward the goal (generating code, a specification, ideation, etc.).

What is a Skill?

Fri, 31 Jul 2026 00:00:00 +0000

A skill is a Markdown file an agent loads on demand to learn how to handle a particular kind of request. It’s useful when you have a repetitive task and don’t want to re-prompt your agent each time.

Think of it as the utility function of prompting: instead of duplicating the same instructions in every conversation, you write them once and reuse them. Skills are more general than that, of course — their behaviour adapts to the request in a way a single utility function doesn’t.

The Modern Software Developer course

Mon, 20 Jul 2026 00:00:00 +0000

The Modern Software Developer is a Stanford course (CS146S) that covers most of what you need to know about agentic coding — prompting techniques, AI IDEs, patterns, and more.

Why it’s worth it

I highly recommend this course: it covers the foundations you need, from the ground up.

It starts by introducing LLMs and different prompting strategies — K-shot, chain-of-thought, self-critique, and others — before moving on to the tooling and patterns of agentic coding.

What is MCP (Model Context Protocol)?

Mon, 20 Jul 2026 00:00:00 +0000

This section briefly explains what MCP is and why it’s useful. Before describing MCP, it helps to understand tool-calling first — MCP is built on top of it.

Tool-calling

Tool-calling is a capability that lets an AI model (like an LLM) interact with the outside world by invoking external functions or APIs.

Here’s a simple example of tool-calling in Python with two tools, bash_tool and web_search:

# mock tools
def bash_tool(command: str) -> str:
    """Run a shell command and return its output."""
    return "index.html  main.py  styles.css  README.md" if command == "ls" else "Done"


def web_search(query: str) -> str:
    """Search the web and return the results."""
    return f"Search results for '{query}': Found documentation."


tools = {"bash_tool": bash_tool, "web_search": web_search}

# Simulates the AI picking a tool based on keywords
def mock_llm(query):
    if "file" in query or "list" in query:
        return {"tool": "bash_tool", "arguments": {"command": "ls"}}
    return {"tool": "web_search", "arguments": {"query": query}}


while True:
    user_query = input("User: > ")
    if user_query.lower() in ["exit", "quit"]:
        print("Goodbye!")
        break

    # Step 1: Get tool choice from LLM
    decision = mock_llm(user_query)
    tool_name, args = decision["tool"], decision["arguments"]
    print(f"AI wants to call: {tool_name}({args})")

    # Step 2 & 3: execute the tool and print the output
    tool_output = tools[tool_name](**args)
    print(f"Tool Output: {tool_output}\n")

That’s tool-calling in a nutshell: the model picks a tool (e.g. web_search or bash_tool) and supplies the right arguments (e.g. query: "who won the 2022 World Cup"), the tool or API is executed — locally or remotely — and the model reads back the result.

Conductor: IDE to run parallel coding agents

Fri, 17 Jul 2026 00:00:00 +0000

Conductor is a desktop app for running several AI coding agents in parallel on the same project. Instead of driving one agent at a time, you spin up multiple agents that each work independently and hand you the results to review.

What it does

Conductor connects to your AI provider — Claude, Codex, and others — and lets you launch multiple agents to work on your project at once. Each agent runs in its own git worktree, so their changes stay isolated from one another. When an agent finishes, its worktree makes it easy to review the diff, integrate the work, and push it to git.

Tools landscape

Thu, 16 Jul 2026 00:00:00 +0000

A quick comparison of tools people use for vibe-coding and agentic coding. Fill in your own experience/notes as you try each one.

Tool	Type	Runs where	Notes	Official site
Claude Code	CLI / IDE agent	Terminal, VS Code, JetBrains	Deep agentic loop, tool use, subagents, hooks, MCP support	claude.com/claude-code
Cursor	IDE (fork of VS Code)	Desktop	Agent mode, inline edits, codebase-aware chat	cursor.com
GitHub Copilot / Copilot Workspace	IDE extension	VS Code, JetBrains, GitHub.com	Autocomplete + chat + task-level “workspace” planning	github.com/features/copilot
Aider	CLI	Terminal	Open-source, git-native, works with many model backends	aider.chat
Windsurf	IDE	Desktop	“Cascade” agent flow, multi-file edits	windsurf.com
Devin	Autonomous agent	Cloud sandbox	Longer-running autonomous tasks, less interactive	devin.ai
Conductor	IDE	Desktop (macOS)	Runs multiple agents in parallel, each in its own git worktree	conductor.build
superset.sh	IDE	Desktop (macOS, Linux)	Conductor alternative with Linux support; parallel agents in isolated worktrees, notifications, skills/hooks	docs.superset.sh
goose	CLI / desktop agent	Terminal, Desktop	Open-source, MCP-based extensions, subagents, recipes, scheduled runs	goose-docs.ai

YC guide to vibe coding

Thu, 16 Jul 2026 00:00:00 +0000

These are the notes from talks at Y Combinator.

General rule of thumb

The best technique is to do what a professional software engineer already does. Small code, modularity, and abstraction are your friends — they help both you and the LLM reason about the project.

Note: this advice will likely shift over the next few months. As models get more capable, some of these guardrails will loosen.

Plan before you build

Don’t ask the model to one-shot the whole project. Instead, create a planning file (a CLAUDE.md or a plain markdown file) that lays out step by step what you want to build. Iterate on it over time and revise it whenever your understanding changes. You can even use a Planner agent to help revise it.

Elastic as a Vector Search Engine

Tue, 02 Dec 2025 00:00:00 +0000

There are many vector databases available today, such as Chroma, Pinecone, Qdrant, Milvus, pgvector, and Elastic. Each offers unique capabilities and is useful in different situations. For developers integrating vector search into their applications for the first time, Chroma and Milvus tend to provide excellent documentation and straightforward implementations.

However, many production systems still rely on traditional sparse or boolean retrieval engines like Elasticsearch. In those contexts, Elasticsearch remains extremely efficient and is arguably one of the best solutions available. That said, Elasticsearch joined the vector-search space relatively late (basic dense-vector support was introduced around version 8.x), and historically you needed custom scripts for many advanced features.

Token-Oriented Object Notation: An Alternative to JSON?

Thu, 27 Nov 2025 00:00:00 +0000

I first came across TOON (Token-Oriented Object Notation) on LinkedIn, where developers were discussing its promise: lossless compression of JSON and YAML, specifically optimized for large language models (LLMs). The core idea? Reduce token count without sacrificing information, which directly translates to lower costs and potentially faster processing.

Comparison between TOON and JSON for nested objects

At first glance, TOON looks familiar yet distinct. For instance, a TOON object always begins with the number of items (e.g., [2] in the figure above), and unlike JSON it drops quotation marks (") around keys. This minimalism becomes especially powerful with flat data structures. In those cases, TOON starts to resemble CSV format: a header row followed by values. The result? Significant token savings (I used their Python version for my experiments).