Linkfest #12

Every couple of weeks I send you a curated stack of Internet reading that stayed with me. Culture, technology, science, software. Things that made me pause and think.

This round moves from the brutal economics of AI-generated security patches to why 3D architecture diagrams keep failing us, and how a 27-billion-parameter model can run locally on an iPhone. We look at the geopolitical divide in AI infrastructure, an optical trick that fools computer vision, and an honest reappraisal of modern PHP. There are sharp perspectives on product choice overload and the realities of agentic coding benchmarks, alongside a grounded look at what human work remains when execution gets automated. It is a good snapshot of where software, system design, and human judgment are heading.

Enjoy! -- Christoph (CTO @ Basilicom)

AI-Generated Security Patches Are Still a Bad Bet

https://www.defendersinitiative.com/p/reviewing-initial-research-on-using

A study tested more than 6,000 AI-generated patches across six vulnerabilities. Only 26 percent were acceptable, while many changed application behavior, failed to close the vulnerability, introduced a new one, or produced fragile fixes likely to regress.

The security economics are brutal. Attackers can fail repeatedly at low cost, while defenders may get one production deployment before customers suffer. AI can propose patches, but autonomous remediation currently moves risk around rather than removing it.

Why 3D Software Visualisation Keeps Failing

https://kore-nordmann.de/blog/why-3d-software-visualisation-keeps-failing.html

Three-dimensional architecture maps look impressive but perform poorly as working documentation. Depth weakens visual comparison, objects hide each other, labels become awkward, and users must navigate a scene before they can answer basic questions.

The sharp point is that this is a perception problem, not a rendering problem. A rotating city of services can sell a project in a meeting, but architecture work needs focused 2D views built for specific audiences and questions.

The Global AI Divide Is About Who Gets to Build

https://spectrum.ieee.org/ai-digital-divide

AI infrastructure, cloud exports, advanced skills, and governance power are concentrated in a small number of countries and companies. South Africa and Indonesia show alternative paths based on local languages, public services, regional cooperation, and practical tools rather than competing directly on frontier models.

Access to a chatbot is not meaningful participation. Countries that only consume imported systems also import their assumptions, dependencies, and limits. Local institutional skill may matter more than another national strategy document.

Benchmarking Opus 5 on SlopCodeBench

https://github.com/humanlayer/advanced-context-engineering-for-coding-agents/blob/main/benchmarking-opus-5-on-slop-code-bench.md

SlopCodeBench reveals requirements gradually, testing whether coding agents can evolve a codebase without breaking earlier behavior. Opus 5 achieved four strict passes out of seventeen checkpoints, wrote far more code than earlier models, and still failed to complete any challenge without defects.

This benchmark resembles actual software maintenance more than isolated coding puzzles. The result supports a familiar experience: models can make fast local progress, but defects and complexity accumulate when nobody keeps steering.

Bonsai 27B Brings a Large Model to a Phone

https://prismml.com/news/bonsai-27b

PrismML compresses a 27-billion-parameter multimodal model into a 5.9 GB ternary version and a 3.9 GB one-bit version. The company claims the smaller model retains 90 percent of its full-precision benchmark score while fitting within the usable memory of a recent iPhone.

If independent tests support the claims, local inference gets much more interesting. Privacy, offline use, and predictable costs are strong reasons to move routine agent work onto user devices, even when the hardest steps still go to cloud models.

Schema Reaches About 99 Percent on ARC-AGI-3 Public

https://schema-harness.github.io/

Schema wraps frontier models in a process that turns observations into an editable world program, checks that program against every recorded transition, searches it for plans, and stops execution when reality contradicts a prediction. Its self-reported public score is close to 99 percent, though it has not been independently verified.

This is a strong demonstration that the harness can matter as much as the model. It also makes benchmark interpretation harder, because a score may measure the combined system of model, memory, tools, verification, and fallback rules rather than model intelligence alone.

Decoy Font Hides One Message Inside Another

https://www.mixfont.com/experiments/decoy-font

Decoy Font combines high-frequency outlines with blurred low-frequency shapes, producing letters that appear different depending on viewing distance. Humans can often recover the hidden message while current vision models focus on the sharper decoy text.

This is a clever optical experiment, not durable security. Models can adapt once the technique is known, but it nicely exposes how human and machine vision prioritize different visual signals.

Infinite Choice Is the Curse of the AI Era

https://www.joanwestenberg.com/p/infinite-choice-is-the-curse-of-the

Many AI products answer requests with piles of drafts, alternatives, caveats, and frameworks. The essay argues that users do not want endless generation. They want a product with enough judgment to choose, edit, and deliver one defensible answer.

This is an important product distinction. Generating ten options protects the vendor from being wrong but transfers the decision back to the user. Useful software should reduce cognitive work, not manufacture more of it.

Modern PHP Scores Four Out of Five

https://phpunit.expert/articles/four-out-of-five.html

PHP now handles closures, objects, gradual typing, and domain-specific web work well, while pattern matching is progressing and native generics remain unresolved. The article argues that static analysis, docblocks, and attributes have become an accidental extension system outside the language itself.

This is a useful correction to the PHP many developers still remember from twenty years ago. The split between runtime guarantees and richer tooling is not elegant, but it is honest, practical, and already embedded in real production teams.

What Will Be Left for Us to Work On?

https://www.normaltech.ai/p/what-will-be-left-for-us-to-work

Arvind Narayanan argues that AI should be understood as a transformative but normal technology whose economic effects depend on products, adoption, institutions, and slow organizational change. Capability is rising faster than reliability, so human work shifts from execution toward deciding, evaluating, integrating, and taking responsibility.

This is a useful alternative to both panic and complacency. Writing code may become cheaper, but understanding what to build, judging whether it works, and accepting the consequences are not disappearing on the next model release.