Zum Hauptinhalt springen
Echtzeit-Radar & Feeds
Alle RSS Feeds ➔
👥 Community & Social
YouTube Security VideosTechLinked: Apple says no more upgradeability(25.09.2026 um 01:02 Uhr)
•
Podcasts & Audio BriefingsiPhone 18, iPhone Duo und AirPods auf dem Prüfstand | CHIP.Chat #44(25.09.2026 um 00:00 Uhr)
•
YouTube Security VideosGoogle Cloud Tech: A Developer’s Guide to Gemini 3.5 Transcribe(25.09.2026 um 01:00 Uhr)
••••••••
YouTube Security VideosTechLinked: Apple says no more upgradeability(25.09.2026 um 01:02 Uhr)
•
Podcasts & Audio BriefingsiPhone 18, iPhone Duo und AirPods auf dem Prüfstand | CHIP.Chat #44(25.09.2026 um 00:00 Uhr)
•
YouTube Security VideosGoogle Cloud Tech: A Developer’s Guide to Gemini 3.5 Transcribe(25.09.2026 um 01:00 Uhr)
••••••••
Intelligence View
⚡ tsecurity.de Intelligence

My AI Agent Writes Great Code and Forgets All of It by Tomorrow

Here's a conversation I had with my coding agent three times in one week: Me: The DEV.to API 403s us. Agent: Let me add a User-Agent header — their bot filter rejects the default one. Me: Right. We figured that out on Monday. And T…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

Here's a conversation I had with my coding agent three times in one week:




Me: The DEV.to API 403s us.

Agent: Let me add a User-Agent header — their bot filter rejects the default one.

Me: Right. We figured that out on Monday. And Tuesday.




The agent was correct every time. It was also starting from zero every time. Monday's hard-won lesson — dev.to blocks the default user agent — evaporated the moment the session closed. Wednesday-me paid the same debugging tax as Monday-me.



This is the part of "agents write code, but they don't remember" that actually hurts. It's not that the model is dumb. Within a session it's sharp. The problem is that every session is session one. All the context you built — why a function is shaped weirdly, which approach you already tried and rejected, the username that has an underscore in one place and not another — is gone. You're not pair-programming with a senior dev. You're onboarding a brilliant amnesiac, daily.






Why "just put it in the prompt" doesn't scale



The obvious fix is to dump everything into your instructions file (CLAUDE.md, AGENTS.md, whatever your tool reads). I tried. It rots fast:




  • It becomes a 600-line wall the model skims and ignores.

  • It mixes stable facts ("the token lives in .env") with episodic ones ("on the 23rd I tried X and it failed").

  • Nobody prunes it, so wrong facts linger and actively mislead.



A single flat file is a junk drawer. What I actually wanted was a small, typed memory — different kinds of knowledge in different places, each with a rule for when to read and when to write.






The fix: four files and four protocols



I gave the project a docs/project_notes/ directory. Four files, each one job:




docs/project_notes/
├── bugs.md # known bugs → their solutions
├── decisions.md # why things are built the way they are (mini-ADRs)
├── key_facts.md # usernames, endpoints, file purposes, run commands
└── issues.md # work log, newest first






That's it. No database, no vector store, no embedding pipeline. Markdown the human and the model both read.



The trick isn't the files — it's wiring triggers into the instructions file so the agent knows when to consult and update them. The entire memory protocol is four lines in CLAUDE.md:




## Project Memory System
- Encountering an error → search `bugs.md` first
- Proposing an architecture change → check `decisions.md` for conflicts
- Need a username/endpoint/command → check `key_facts.md`
- Completing a phase of work → log it in `issues.md`






Now the DEV.to 403 lives in bugs.md once, as a fact, not a rediscovery:




### dev.to API returns 403 on every request
**Cause:** dev.to rejects the default HTTP-client User-Agent (bot filter).
**Fix:** send `User-Agent: Mozilla/5.0`. Applies to all /api/articles calls.






And the gotcha that bit me twice — same person, two usernames — lives in key_facts.md:




## Usernames
- GitHub: enjoykumawat (no underscore)
- DEV.to: enjoy_kumawat (with underscore)






The next time the agent reaches for a username, it reads the fact instead of guessing and getting it half-right.






The rule that makes it actually work: write-on-completion



Reading is easy. The discipline is writing. A memory system only compounds if knowledge flows back in. So the single most important protocol is the last one: when you finish a chunk of work, log it. My issues.md is append-only, newest first:




### 2026-06-23 - DEV.to publisher + 403 fix
- Status: Completed
- Built reusable stdlib publisher. Root cause of the
intermittent 403 was the default User-Agent. Fixed with
a Mozilla UA + H1-strip on the markdown body.






That one entry means future-me (and future-agent) gets the outcome and the reason for free. The work log is the difference between "we have notes" and "we have memory."






What changed in practice





  • No more re-debugging. Solved problems stay solved. The 403 conversation hasn't happened a fourth time.


  • Decisions stick. When I'm tempted to re-architect something, decisions.md reminds me why it's that way — usually because I already tried the "better" idea and it broke.


  • Onboarding cost dropped to near zero. A fresh session reads four short files and is roughly as caught-up as I am.






Keep it small or it rots



Two failure modes to avoid, both learned the hard way:





  1. Don't log what the code or git already says. "Renamed x to y" is in the diff. Memory is for the non-obvious: the why, the dead end, the gotcha. If git can answer it, don't write it.


  2. Prune wrong facts immediately. A stale fact is worse than no fact — the agent trusts it. When decisions.md no longer reflects reality, the fix is a delete, not an append.



The whole system is four markdown files and four lines of protocol. No framework. The insight isn't technical — it's that an agent's memory has to live outside the agent, in artifacts that survive the session, with explicit rules for when to read and write them.



Your agent doesn't need a bigger context window. It needs a place to write things down — and a habit of reading them back.

IoC Intelligence (1 Indikatoren)
dev[.]to
CTI Threat Relationship Graph2 Knoten / 1 Relationen
CVE / Incident Software MITRE ATT&CK CWE Weakness IoC
SOC Incident Playbook: Vulnerability Remediation & Verification
Syntax validiert (0 Fehler)
title: Detect Exploitation - My AI Agent Writes Great Code and Forgets All of It by Tomorrow
id: 99f5205d-3d79-4824-b9e5-b592919fe4a4
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-25
logsource:
  category: network_connection
  product: any
detection:
  selection:
      DestinationHostname:
        - 'dev.to'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
Syntax validiert (0 Fehler)
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-25"
        description = "YARA Signature for "
    strings:
        $str = "My AI Agent Writes Great Code " ascii wide
    condition:
        any of them
}
Syntax validiert (0 Fehler)
index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
(dest_host="dev.to")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count
Syntax validiert (0 Fehler)
destination.domain: ("dev.to") and event.category: "network"
Syntax validiert (0 Fehler)
CommonSecurityLog
| where DestinationHostName in ("dev.to")
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc
🎯
MITRE ATT&CK Matrix Navigator 14 Taktiken
Reconnaissance
-
Resource Development
-
Initial Access
Execution
Persistence
-
Privilege Escalation
Defense Evasion
Credential Access
-
Discovery
-
Lateral Movement
-
Collection
-
Command and Control
Exfiltration
-
Impact
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich My AI Agent Writes Great Code and Forget.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten My AI Agent Writes Great Code and Forgets All of It by Tomorrow

Thematisch verwandte Begriffe: Agent, Writes, Great, Code · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-87722 | Uncontrolled Resource Consumption (CWE-400 / CWE-1333) in regex search q…
Advisory →
tsecurity.de Icon
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag
Themen-Radar & Intelligence Matrix
Echtzeit-Taxonomie nach Angriffsvektoren & Plattformen

tsecurity.de Live Threat Radar

🔴 LIVE RADAR
MONITORING
AKTIV
CVE-DATENBANK
LIVE
🔍
Community Radar & Live Chat
Sentinel Bot online • Live-Stream
Dein Cluster: Security Explorer
Match:
lädt…
Verbindung zum Community-Stream wird aufgebaut...
Bearbeitungsmodus — Senden überschreibt deine Nachricht
Community-Puls — was gerade passiert
lädt…
Aktivitäten deiner Analysten
lädt…
Neues Thema oder Eilmeldung einreichen

Reiche interessante Links, Zero-Days oder Debatten ein. Die Community entscheidet per Upvote über die Veröffentlichung.

Heiß diskutierte Einreichungen
📂 Keine gespeicherten Artikel vorhanden.
Zurück Ziehen Vor
Links: vorheriger Artikel • Rechts: nächster Artikel • unten: schließen
News NIS-2 Frühwarnung Tier-1 Intel TTP ⏱️ 3 Min vor 10 Min
Artikeldaten werden geladen...
↗ Original-Quelle