People are reporting Anthropic warnings/bans when using Claude OAuth (Pro/Max) through third-party tools like Clawdbot (instead of API access). I'm dropping the few links below - anyone here hit by this, and what workaround are you using (API key / different model / different tool)? https://x.com/elijahsystems/status/2016201425273958453

I’m interested in seeing what vibe coding tools are best. I think the best way to test this is with a group of 5 people. Here’s the idea We test 2-3 vibe code tools. We all sign up for them and complete the same project. I can provide a PRD for a simple website or application of our choosing. Nothing super difficult so everyone can do it. Then we use the same prompts as much as possible as we build through the applications on all 3 services and when complete we’ll have 15 versions of the same application. We can share the results on here and on our own networks to grow the channel and get some valuable insight into what worked. The 2 variables are the vibe coding tool and the individuals ability to produce via the tools. Adding 5 people and 3 tools creates enough variance for a simple test to see what’s best. If we market the results well we could even get the winning service to promote the content Let me know who’s interested and I’ll get us all connected

Quick one today, but the lead story is a "stop what you're doing" kind of bug if you run OpenCode on Windows or WSL. Everything else is standards drama and a $65K excuse to vibe code a game. OpenCode's MCP sign-in bug let a server run commands on your machine Here's the setup: OpenCode connects to MCP servers to give your agent outside tools. When you sign in to one of those servers, the server gets to hand you a web address for OAuth — the "go here to authorize" link. On Windows and WSL, OpenCode passed that address into a PowerShell command without escaping it. Pillar Security found that a malicious address could carry a PowerShell payload and run it, with your access, the moment you signed in. The scary part isn't really the bug. Command injection happens. It's how it got fixed. Anomaly (the company behind OpenCode) patched it in version 1.18.33 on September 28, buried inside a pull request labeled as a "refactor" of browser-launch code. No security advisory, no CVE. Pillar reported it privately on August 29 and asked Anomaly to request a CVE; Anomaly's answer, per Pillar, was that a malicious MCP server is "outside our trust boundary." That means your dependency scanner and vulnerability alerts have nothing to match against. The only way to know you're exposed is to go check the version number yourself. Worth noting: your MCP server doesn't need to start out malicious. One you vetted and added months ago could get compromised later, or its domain could lapse and get bought by someone else, and you'd never know until sign-in runs a command on your box. The fix: upgrade to 1.18.33 or later if you're on Windows or WSL. If you can't upgrade today, run opencode mcp list, look at what remote servers you've got configured, and rip out anything you haven't fully vetted. macOS and Linux aren't affected — OpenCode doesn't route the browser launch through a shell there. And this is separate from the OpenCode Console breach reported around the same time, which may have exposed stored API keys.

Hello everyone, We have some exciting new features and resources rolling out today that will make our platform even stronger. 🌟 New VIP Resource Page Take a look at the top menu on aifordbas.com, and you will spot a brand new link for the aifordbas community. - What it is: This is a New-skool page built exclusively for our VIP members. - What to expect: It is going to become a major, central resource hub for VIPs as we continue to grow. - Action needed: I highly encourage all of you to click over and check it out right away. ✍️ Upgraded Posting Experience We are also rolling out a significant change to how you post messages. You now have access to a brand new Markdown to HTML editor. - The Goal: Easier formatting for your technical discussions, scripts, and updates. - The Status: It is still a work in progress and not quite perfect yet, but it is already looking amazingly blended with the overall design of aifordbas.com. Jump in, test out the new editor, and explore the VIP section. Let me know what you think in the comments below!