Build or Replaced
Today: WorldTUI: I trained a 360M model to pretend to be a terminal | Claude Duet | GitLab critical patch release Episode date: 2026-10-22.
Download MP3 →JOSH: It's Thursday, October 22. This is Build or Be Replaced — powered by ScanBrief.dev. I'm Josh, here with Erik Anderson. ERIK: Today's theme: the thing you pip install is the thing that gets you. JOSH: Stick around. Erik's got an AI pro tip at the end about making a bad package wait its turn. [pause] JOSH: Episode 132. Erik, ScanBrief scored 116 items this morning. What floated to the top? ERIK: Security, mostly. Fifty-six sources, and half the top of the list is somebody's credentials getting stolen. Not a great morning to be lazy about dependencies. [pause] JOSH: Let's hit headlines. First one: Meta got hit with a twenty-five billion dollar penalty in New Mexico over Cambridge Analytica. Twenty-five billion. Is that real? ERIK: It's what the headline says. Whether it survives appeal is a different question. Penalties that size usually get negotiated down. But the signal is that data handling is now a balance sheet line, not a compliance footnote. JOSH: Next, DuckDB 2.0 hit long-term support. Why should a builder care? ERIK: An LTS tag means you can build on it without wondering if the ground moves in three months. DuckDB is the thing I reach for when I want analytics on a file without standing up a database server. Stable release, fewer excuses. JOSH: And PHP and GitLab both shipped security patches the same morning. ERIK: Yeah. GitLab flagged theirs critical. The PHP side says there isn't an easy exploit, which is the kind of sentence that ages badly. If you run either one, patch today. Don't read the nuance first. [pause] JOSH: Okay, deep dive. LiteLLM version 1.107.0 on PyPI was compromised. It installs a credential stealer and a backdoor. Walk me through why this one hurts. ERIK: LiteLLM sits in front of your model keys. That's the whole point of it. It's a gateway. So someone poisoned the package that, by design, touches every API key you own. That's picking the one lock that opens all the other locks. JOSH: And people just pip install it. ERIK: Right. Somebody bumps a version in a requirements file, a build runs, and the stealer is on the box before anyone reads a changelog. No exploit needed. You invited it in. [beat] JOSH: You run your own gateway. PrimeRouter. Does this keep you up at night? ERIK: It keeps me careful. PrimeRouter is a FastAPI service on Neo that holds keys for several backends. That makes it exactly the target this attack is built for. So the rule is, requirements changes never install themselves. A change to requirements.txt means a manual pip install on Neo, by me, after I look at what's in it. JOSH: That sounds slow. ERIK: It's slow on purpose. Automation handles the boring ninety-nine percent. The one step that executes new third-party code on a machine with keys stays a human step. JOSH: What would you do first if you'd installed that version? ERIK: Assume every key on that machine is burned. Don't clean it, rotate it. Rebuild the host from a known-good image. PrimeRestorer exists for exactly that, because restoring from backup is faster than arguing about whether the box is clean. [pause] JOSH: That connects to the next one. Railway disclosed that an unauthorized actor got into encrypted customer environment variables, and some were decrypted. ERIK: Same story, different door. Railway paused deployments and forced everyone to rotate stored credentials. And the disclosure says it looks tied to a broader campaign against platforms like it. JOSH: Wait, really? A campaign? ERIK: That's the read. Attackers figured out that the juiciest place on the internet isn't your app. It's the platform holding the secrets for ten thousand apps. Why break into one house when you can get the key cabinet? JOSH: So what does a regular builder do with that? ERIK: Three things. Keep secrets in env, never in code. Lock the files down, chmod 600 on every .env. And make rotation boring. If rotating a key takes you an afternoon, you won't do it when it matters. JOSH: You've done the rotation drill? ERIK: I make sure I can. Everything sensitive lives in one place per service, and nothing prints a key to a log. When something leaks, the question is how fast I can swap it, not where it's hiding. [beat] ERIK: Here's the part people skip. Both of these stories land on the same day. One is a supply chain hit, one is a platform hit. You can't audit your way out of both. You build so that a single compromise has a small blast radius. JOSH: Small blast radius meaning what, in practice? ERIK: Separate keys per service. Spend caps on every provider. Customer keys isolated from my own infrastructure. If one key walks out the door, it can't buy the whole store. [pause] JOSH: Different mood. Somebody trained a 360 million parameter model to pretend to be a terminal. WorldTUI. What does that even mean? ERIK: You type keystrokes into a browser. There's no shell behind it. The model predicts what the screen should look like next. It handles creating files, vim, tmux, even correcting its own mistakes. JOSH: That's wild. It's faking a computer. ERIK: It's a world model, and it's tiny. Three hundred sixty million parameters runs on hardware you already own. The takeaway isn't that you should replace bash. It's that small models trained on narrow, synthetic data can hold consistent state. That's the hard part of agents. JOSH: Does that matter for what you build? ERIK: It matters for testing. Picture a simulated environment where an agent can fail a thousand times for free before it touches a real system. I start small in a lab and prove it before prod. A fake terminal is a cheaper lab. JOSH: Does it replace the lab? ERIK: No. It's a rehearsal room. You still ship against the real thing. But rehearsal catches the dumb mistakes. [pause] JOSH: Before the tip, how are the guardrails doing on your side? ERIK: PrimeBus auto-merger has run 2,295 attempts since June. 1,507 merged. 788 got blocked by Gandalf. Zero escalated to me. That blocked number is the story. Those are bad changes that never reached prod, and I didn't have to be awake for it. JOSH: Same idea as the supply chain stuff. ERIK: Exactly. Something checks the thing before it lands. A compromised package is just a bad change with better marketing. [pause] ERIK: This episode is sponsored by Prime Automation Solutions. If you're still doing it manually, we automate it. Also, special on a website — $250. primeautomationsolutions.com [pause] JOSH: Alright, what's the AI pro tip today? ERIK: Make new package versions wait. Most poisoned releases get caught and yanked within days. So don't install anything released in the last week. If you use uv, pass exclude-newer with a date and it will only resolve versions published before that date. Pin your requirements with hashes too, so a swapped file fails the install instead of running. ERIK: Then do the same for your agents. If Claude writes a pip install line into a script, a human or a test gate reads it before it runs. Let the model suggest dependencies. Don't let it add them unattended. ERIK: That's your tip. Use it. [pause] JOSH: Track your freedom score and net worth with the Freedom Blueprint app — free download, link in the show notes. JOSH: One more thing — we started a Discord for builders. If you're shipping AI, automation, or anything that makes a human obsolete — come hang out. Link at buildorbereplaced.dev. ERIK: Post what you built. We'll post what we're building. Real wins, real builds, no fluff. [pause] ERIK: Build or be replaced. JOSH: If you want these signals in your inbox every morning, scanbrief.dev. See you tomorrow.