SI Agent News

Cognition open-sources agent skills for this week's critical flaws

Cognition, maker of the Devin coding agent, released the Devin Vulnerability Fixes plugin: three MIT-licensed agent skills that inventory, patch and test PHP, Node.js and self-managed GitLab systems hit by this week's critical remote-code-execution flaws. Remote code execution means an attacker can run their own commands on your machine. MIT is a permissive licence, so the skills are free to use and adapt. The price of running Devin itself is not stated. Status: REPORTED (one outlet, MarkTechPost; we have not inspected the code). Why it matters: the inventory, patch and test sequence is the part of an emergency fix that eats the most time, and packaging it as reusable skills could shorten it. It is worth a look for teams running those three stacks. Keep patching on a branch with human review. Compare the inventory output with your own asset list, and run your full test suite before merging. An agent can miss a forgotten server. MarkTechPost

You're with SI Agent News, Gemini edition. Still ahead: why raw web pages waste your tokens, a prompt makeover, and a research finding about where to put your instructions. Most AI newsletters arrive weekly; this one arrives daily, as a podcast you can also read.

AI app spending soars nearly 200-fold, with ChatGPT in front

Analytics Insight reports that spending on AI apps has risen nearly 200-fold, with ChatGPT leading the boom. The headline is all we have. The time span, the data provider, the dollar totals, and whether the figure covers mobile apps only or all AI software are STILL OPEN. Status: REPORTED, one outlet, no primary data seen. A multiplier like 200x depends heavily on the starting point. A tiny base makes any growth look enormous, so treat the number as a direction rather than a measurement. Why it matters: if you build or sell an AI product, the useful reading is that people are paying for AI apps and one general assistant is taking the largest share. That affects how hard it is to win users with a thin wrapper around a model. Before you quote this figure in a deck or a pitch, find the underlying report and check its definitions. That advice is ours, not the article's. Analytics Insight

UK announces a £600 million AI security package

The UK announced a funding package covering cyber and bio threats, per The420.in. The report is light on detail: timeline, recipients and funded items are not in what we have. Status: REPORTED for the headline, STILL OPEN for everything else. Pairing cyber and biological risk in one package suggests the government treats both as areas where advanced AI could raise the stakes, but the report does not say how the money splits between them. That reading is ours. Why it matters: if you build security tooling, evaluation software or biosecurity screening, funding and evaluation details could shape who gets contracts and which tests become standard. Watch for the official announcement, which should list programs, eligibility and deadlines. Until then, don't plan around this money. Note that the figure may be a total over several years rather than a single-year budget, though the report does not say. The420.in

Study Notebooks arrive in ChatGPT

A community post titled 'Study Notebooks in ChatGPT' describes a feature aimed at students. We have only the title: price, limits and behavior are STILL OPEN; price not stated. Status: REPORTED, from OpenAI's own community forum, though we have not opened the feature ourselves. The name implies a workspace that keeps study material together in one place, but we cannot confirm what it holds or how it works. Why it matters: students already use chat assistants to explain concepts and quiz themselves, and a dedicated space could keep notes and sources from scattering across old conversations. It is worth ten minutes for students. Test it on one real course topic and check the answers against your textbook, since a study tool that is confidently wrong costs you marks. Google's NotebookLM is a Google tool for source-grounded study; that comparison is ours, not the post's. OpenAI Community

Show HN: embed Claude Code and other agents inside your app

A Show HN post on GitHub presents a project for embedding Claude Code, and other coding agents, inside your own application. The title is what we have. How it works, which agents beyond Claude Code are supported, the licence, and how it handles permissions are all STILL OPEN. Status: REPORTED, a community project we have not run. Why it matters: an agent inside your product could let users describe changes in plain language and have the software act on them, which is a different thing from a chat box beside the app. It also raises questions you should answer before adopting anything like it: what files and commands the agent can touch, where it runs, who pays for the model usage, and how you log what it did. Read the repository's README and its security notes first, and try it in a sandbox with no production credentials. GitHub

Turn any URL into clean Markdown for AI agents with WebPulse

A dev.to tutorial shows how to use the WebPulse API to convert any URL into clean Markdown for AI agents, and to run quick SEO audits from the same service. Pricing, rate limits and output quality are STILL OPEN from the title alone. Status: REPORTED, a single developer post, and we have not tested the API. Why it matters: a raw web page is mostly navigation, scripts and styling, and an agent that reads all of it spends tokens (the units models are billed and limited by) on content that carries no meaning. Markdown keeps headings, lists and links while dropping the clutter, so the same page costs less to process and is easier for a model to follow. That is the practical angle, and it applies whichever converter you choose. If you try WebPulse, compare its output with the original page on a few of your own URLs, and check that tables and code blocks survive. dev.to

Summarize supplier invoice text with the Claude API in Node.js

Another dev.to post walks through summarizing supplier invoice text with the Claude API in Node.js, with the subtitle 'Provider Boundary'. We have only the title. Our reading, not the post's, is that 'provider boundary' means keeping the model-specific code in one place behind a small interface, so you could swap AI providers without rewriting the rest of your app. Whether the tutorial does this, and what it covers on error handling, are STILL OPEN. Status: REPORTED, and we have not run the code. Why it matters: invoice summarizing is an everyday small-business task, so this is a concrete pattern rather than a demo. If you adapt it, remember that invoices contain names, amounts and bank details. Check your provider's data terms, strip what the summary does not need, and have a person confirm any figure before it reaches your accounts. dev.to

Building brand authority in the Gemini era of Search

A Google Business Profile piece discusses building brand authority in the Gemini era of Search. We have only the headline, so the specific tactics, and whether the guidance covers AI answers or ordinary listings, are STILL OPEN. Status: REPORTED, from a Google source, but we have not read the full text. Why it matters: for a local business or small brand, search increasingly shows a generated answer before any list of links, so being described accurately and favorably matters more. A sensible first step, which is our suggestion and not the article's, is to check your Business Profile for correct hours, categories, description and recent reviews. Then search your own business name and its services in Gemini-powered results and note what is said or missing. Treat any claim of guaranteed AI visibility with suspicion, because nobody outside Google controls that. Google Business Profile

Too lazy to open five AI tabs, a developer built AgentWebUI

A dev.to author says they were too lazy to open five AI tabs, so they built AgentWebUI. From the title, we infer it puts several AI assistants in one interface; that is our inference, and the supported models, setup and licence are STILL OPEN. Status: REPORTED, a personal project we have not tried. Why it matters: many people now compare answers from more than one assistant, and switching between tabs is a real friction. A single window makes side-by-side comparison easier. If you try it, find out where your API keys and conversation history are stored, since a tool that talks to several providers holds several sets of credentials. Prefer one you can run locally, and never paste keys into a hosted version you do not trust. As with all small open projects, check how recently it was updated. dev.to

AI app spending jumps nearly 200-fold, with ChatGPT in front

Analytics Insight reports that consumer spending on generative AI apps surged nearly 200-fold, with ChatGPT dominating app revenue and premium subscriptions driving demand. Status: REPORTED. The summary does not state the time period, the starting figure or a dollar total, so those are STILL OPEN.

Plain comparison (illustration only): 200 times larger is like a $5 monthly habit becoming $1,000.

Analysis: a huge multiple from a small base can still be small money. This measures consumer app spending, not Google's Workspace or Cloud business, so nothing here shows where Gemini stands. We will not guess.

• Who benefits: apps with a paid tier tied to a recurring need.
• Who loses: apps with no paid hook, and people paying for overlapping tools.
• Do this today: list every AI subscription you pay for, note when you last used each, and cancel anything untouched for a month.

Limit: ChatGPT leading this data does not mean it leads everywhere. Developer and enterprise use are different markets. Use the number as a mood, not a measurement. Analytics Insight

For builders: how URL-to-Markdown conversion cuts token waste

A dev.to tutorial shows how to turn any URL into clean Markdown for agents and RAG (retrieval-augmented generation: looking up relevant passages before the model answers) using the WebPulse API, plus quick SEO audits. We have only the summary, so this explains the general mechanism. It is not a review. Price: not stated.

The problem: models read text in chunks called tokens, and you are limited and billed by them. A raw page is mostly not the article: tags, styling, scripts, menus, cookie banners. The article calls raw HTML an 'absolute token burner'.

The mechanism, in four steps:

• Fetch the page, sometimes running its JavaScript first.
• Strip what is not content.
• Extract the main body.
• Rewrite structure as Markdown, a light text format where a heading is a pound sign and a bullet is a dash.

Headings survive, so you can split pages into chunks by heading for retrieval. Fewer tokens carry the same meaning, and the model sees structure instead of decoration. Novel or incremental? Incremental. Markdown conversion is common practice; what is packaged here is the API plus the SEO audit.

Where it breaks: JavaScript-built pages can come back empty, tables can flatten, and code blocks and link context can be lost. Check the site's terms before scraping.

How to verify: count tokens before and after. The Gemini API has a token-counting call, and AI Studio shows counts as you paste. Read the output: if a pricing table became soup, the conversion failed. The article's measured saving is not in our summary, so that is STILL OPEN until you measure your own pages. Status of the tutorial: REPORTED. dev.to

This is a lesson, not news. It is illustrative and was not tested.

Triage a security advisory in Google AI Studio before any agent touches your code

Who it is for: small teams running Node.js, PHP or self-managed GitLab with no dedicated security person. Problem solved: reading long advisories and guessing what applies to you. Cost: price not stated in today's stories; check the current price on Google's pricing page.

1. Collect the vendor's advisory text and your inventory: package.json (Node.js), composer.json (PHP), and your GitLab version.
2. Open Google AI Studio, Google's browser workspace for trying Gemini models. Paste this into system instructions:

You are a security triage assistant. Use only the text I paste. For every claim, quote the supporting sentence. If the text does not say, answer unknown. Never infer vulnerable versions from memory.

3. Turn on structured output so replies come as JSON with fields: component, affected (yes, no or unknown), supporting quote, fixed version, test to run. Lower the temperature (the randomness dial).
4. Paste inventory and advisory, then run it.
5. Check every 'yes' against the vendor's own advisory. Any row without a quote counts as unknown.
6. Hand confirmed rows to your agent, Devin's skills or another, on a branch, with tests required and a human approving the merge.

Expected output: a short table that turns reading into verification. A row such as 'Express app, affected unknown, no quote' is the correct result when the advisory is silent.

Mistake to avoid: letting the model decide vulnerable versions from memory. Also check your plan's data terms before pasting internal inventories.

Limits: it is only as good as the pasted advisory and files. Worth it for: teams short on security staff.

Time (an estimate, not a measurement): assume you check ten advisories a week at about five minutes of reading each, roughly 50 minutes. If a first-pass triage plus your verification takes about two minutes each, that is roughly 20 minutes. That saves about 30 minutes a week, about one short team meeting. Time your next three advisories by hand first to get your own number.

Money: do not pay full price to resend the same long prompt. Google, Anthropic and OpenAI each document ways to cache a repeated prefix and to batch non-urgent jobs. Here your inventory is the repeated part, so cache it, and run overnight checks as a batch. Today's stories state no prices; check the current price on each pricing page.

What you give up: caching helps only when the repeated block is large and stable, and batch results arrive later, so keep urgent flaws on the live path.

Objective: turn study notes into evidence-backed practice, in Gemini, ChatGPT, Claude or any chat tool. This was inspired by the Study Notebooks story.

Weak prompt: Summarize my notes. It gives a shorter copy of your notes and no way to see what was left out.

Better prompt:

You are my study coach. Using only the notes pasted below, do four things.
1) List the five most testable ideas, each with the sentence from my notes that supports it.
2) Write six practice questions, mixing recall and why-questions, with answers hidden until I ask.
3) Flag anything in my notes that looks incomplete or contradictory.
4) Ask me to rate my confidence on each idea from 1 to 5, then build a two-day review plan weighted toward my lowest scores.
If something is not in the notes, say: not in notes.

NOTES:
[paste here]

Why it works: it assigns a role, limits the source, demands evidence, and ends in a plan instead of a summary.

Customize: swap 'two-day' for your exam date and change the question count.

Quality check: pick two answers and find them in your notes yourself. If you cannot, the model made them up.

Evergreen research, not today's news. A paper called 'Lost in the Middle' tested how language models use long inputs. The models did best when the relevant information sat at the start or the end of the context window (the amount of text a model reads at once). They did worse when it was buried in the middle. It tested earlier models, not Gemini, so how much holds today is STILL OPEN.

Decision this week: when you paste a long document, put your instruction at the top, repeat the key question at the bottom, and test by planting a known fact in the middle of your own file.

Open-source, policy, safety and agent work were the busiest areas today, and our stories touched all four: an open-source agent plugin, a government security package, and agents moving from writing code to maintaining it.

• UK package detail (announced, no firm date): an official document with amounts, timeline and recipients would confirm more than the headline. Until then, STILL OPEN.
• Independent checks of Cognition's skills (not scheduled): a code review or user reports would move it from REPORTED toward CONFIRMED.
• Study Notebooks price and limits (not stated): an official OpenAI description would settle it.

I told the agent to patch everything. It did, including my weekend plans.

That's it for today. Tomorrow we're watching whether the UK's £600 million package gets real detail, and whether anyone independently checks Cognition's new agent skills.

Listening daily is learning with a reason. Today's were a faster security triage, fewer wasted tokens and a sharper study prompt, all from today's sources.

If this made you smarter, share it with one person who needs it. Thank you for spending part of your Sunday with us.

SI Agent News — a podcast newsletter. Made by AI.