Ideas Lab

Real problems people complain about online, pulled every morning and scored out of 100. Build, validate, or skip. How scoring works

Ideas
4,820
BUILD
702
Sources
8
Last sync
18h ago
752 ideas
AI

We post-trained a model that pen tests instead of refusing

Anthropic and OpenAI's publicly available models are explicitly guard-railed so that they refuse offensive tasks. And their cyber-focussed models are gated for enterprises. This leaves SMEs and mid market open to major vulnerabilities.AI can be used as both an adversarial and defensive tool in the world of cyber. A worst case outcome is if only the adversaries have access.Meanwhile, most existing AI cyber tools are just wrappers. The problem is that they still have all the guardrails on from the foundation model where they will inherit its refusals.For this project we've post-trained a specific model on a decade of capture-the-flag contests. This won't be made available to anyone and everyone, but we do believe that responsible SMEs and midmarket companies also need access to these tools in order to identify key vulnerabilities in their systems; not just enterprises.We have developed two modes that run over a CLI:• Security scan: a read-only audit of your local codebase for vulnerabilities. It only reports what it can tie to a specific file and line, so you're not wading through vibes-based findings.• Pen test: an active adversarial mode that will try to break a live system in a sandboxed environment. It proves each vulnerability by running the exploit and showing the request it sent and the response your code gave back, not a confidence score. Currently gated.To show what the scan does, we pointed it at Bank of Anthos and it found an integer overflow in the transfer path: amount is an int, and amount + fee can overflow negative, so the balance check passes and you move funds you don't have. Plus the usual auth and secrets issues. (Bank of Anthos is Google's open-source bank. It's a known app and some of it is intentionally weak, which is the point: you can clone it and re-run the scan yourself instead of trusting a screenshot)The base model is a Kimi K2.6 (open weights). We didn't pretrain from scratch. We post-trained it our

Hacker News4mo agoToolAI

72FL score
0Sign in to vote

Talos – Open-source WASM interpreter for Lean

At Cajal (YC W26) we’re excited to share Talos (https://github.com/cajal-technologies/talos), an open source framework for formal verification of WebAssembly modules in Lean.AI is now writing tons of the code that gets pushed to production. As code generation gets cheaper, verification becomes the bottleneck. We believe in a future where every piece of software comes with a mathematical proof that it does what its author intended - in doing so, eliminating many classes of exploits. Talos is part of the foundation for that.Talos provides a Wasm interpreter optimized for reasoning at the binary level, together with a weakest-precondition calculus layer for proving properties about programs. Because we reason directly about WebAssembly, any language with a Wasm backend is in scope: Rust, C++, Go, C, Swift, Kotlin, Zig, C#, and many more.To make this possible, we use Lean: a programming language and theorem prover that lets you both write software and mathematically prove that it's correct - all in one system. That's what lets Talos double as both an executable interpreter and the formal object Lean reasons about. Lean also integrates with modern AI proving tools, discharging goals automatically via both proof search and direct evaluation.To see Talos in action check out a proof for Stein's GCD algorithm, implemented in the popular Rust crate num-integer: https://github.com/cajal-technologies/talos/blob/main/progra....Our roadmap:- Full Wasm coverage by first passing the official W3C testsuite, then later verifying against SpecTec (formal Wasm spec) - Arbitrary crate verification - any Rust crate that compiles to Wasm should be in scope - Building our proof library codelib, to make verifying increasingly complex programs tractableWe would love to hear the community’s feedback on Talos and comments on the state of formal verification right now. Contributions are also welcome!

Hacker News4mo agoToolAI

72FL score
0Sign in to vote

TesterArmy (YC P26) – Agents that test web and mobile apps

Hey HN - we’re Oskar, Szymon, and Piotr, and we’re building TesterArmy (https://tester.army). TesterArmy is an agentic testing platform that runs end-to-end checks before deployment and in production. Instead of wasting hours on manual testing or maintaining static scripts, we let you specify your tests in natural language and handle everything in between. We've built the platform fully around agents. Our agent will reliably execute the tests, but your coding agent can manage everything in our platform, from defining tests in natural language to running them on your behalf.Check out our demo video: https://www.youtube.com/watch?v=291IkUbPrlk.We started TesterArmy because testing is still far too painful. AI coding tools have made it dramatically faster to write and ship code, but testing is still a bottleneck. Traditional E2E tests are slow to set up and expensive to maintain. Managing auth and test users is painful. Setting up staging environments is painful. Running tests reliably is painful.We think most teams do not actually want to spend their time writing selectors or maintaining test infrastructure. They just want confidence that their core flows work. With TesterArmy, an engineer can sign up, give an agent our CLI, and let it handle creating tests and running them on schedule or on GitHub.When something breaks, TesterArmy alerts your team through Slack or Discord.Over the past few months, we scaled from 0 to 30+ teams using our product every day. We caught bugs in critical flows, including onboarding, checkout, and AI chat. We've got many of our customers migrating from already established competitors to us because of the quality and reliability of our agents.Here are a few of the recent bugs that our agent found (there were quite a lot of them!):1) Timezone bug that affected the booking flow in one of our clients' apps, the dashboard was very complex and hard to catch by a human. 2) Regression in agent orchestration

Hacker News4mo agoToolAI

72FL score
0Sign in to vote

I am building a map of people who lived in the Roman Empire

Driving home from work one day, I wanted to know how many people we knew the names of who lived during the Roman era. Searching around, I found lists of Consuls and officials, but nothing that covered ordinary people or even most people like freedmen and slaves. So I ended up building a pipeline to process the more than 500k Latin inscriptions in the Epigraphic Database Clauss-Slaby https://edcs.hist.uzh.ch/en/ and extract the names of people (and attempt to cluster them, but this is a work in progress).There are databases where Classicists have done this manually for specific regions, Trismegistos https://www.trismegistos.org/ and Latin Inscriptions of the Roman Empire (LIRE) https://pure.au.dk/portal/en/publications/latin-inscriptions... are two major efforts I found. But there doesn't seem to be a project that did what I set out to do, although I have read in some places that it was believed to be possible.I am not a classicist or a web developer, but I have Claude and Gemini and I can sort of read basic Latin - so I set to work. I used LIRE and another database as ground truth and built a pipeline to extract and process the inscriptions to recover the names. The process I developed uses a high end LLM like Sonnet or Gemini Pro to supervise the extraction and tuning process on a regional basis until the obvious error rate is reasonable. For this, so far, reasonable to me means less than 1-2% in the smaller initial samples of 100-500 and no observed systemic issues. The different regions often need different prompts, so this basically became an exercise in letting the higher level AI tune the prompt for the lower level AI. The extraction when measured against LIRE produces an F1 score between 0.64 and 0.87, but take this with a grain of salt.Once I had done a few regions, I wanted to see the work, so I threw together a pretty crude website but as I am not a web developer, it was crude in how it

Hacker News4mo agoToolAI

62FL score
0Sign in to vote

Adam (YC W25) – Open-Source AI CAD

Hey HN! I'm Zach from Adam (https://adam.new/). We're building AI agents for mechanical CAD software. We’ve built the company on two fundamental beliefs:- AI will be the primary medium for creating mechanical designs just like it is in software today.- The best paradigm for CAD generation is to generate CAD as code (text -> code -> CAD).We’re building CADAM, an open source Text to CAD platform. It's a React app (TanStack Start) with a Supabase backend for auth, database, and file storage. Think of it like AI TinkerCAD.Demo: https://www.youtube.com/watch?v=iESOr7EGWqk Try it: https://adam.new/cadam/What it does:- Generates parametric 3D models from natural language, with support for both text prompts and image references.- Outputs OpenSCAD code with automatically extracted parameters that surface as interactive sliders for instant dimension tweaking- Exports as .STL or .SCAD (plus OBJ, GLB/GLTF, FBX, and DXF)Under the hood:- One agentic endpoint with two modes that swap system prompts and tools: a parametric mode that writes/edits OpenSCAD via a build_parametric_model tool, and a mesh mode that generates 3D textured meshes.- Simple parameter tweaks bypass the model entirely; adjusting a slider does a deterministic regex update on the SCAD source, requiring no LLM call.- Model-agnostic via the Vercel AI SDK: Anthropic (Claude), Google (Gemini), and OpenAI/others through OpenRouter, with adaptive thinking auto-enabled on newer models. Surprisingly, in our evals Gemini 3.1 Pro is the top model.- Runs fully in-browser by compiling OpenSCAD to WebAssembly (in a Web Worker, so the UI never blocks) and rendering with Three.js via React Three Fiber- Supports BOSL, BOSL2, and MCAD libraries, plus custom font support (Geist) for text in modelsFuture improvements:- Support both build123d and CadQuery. This will allow us to move beyond CSG primitives to constraint-driven modeling and provide di

Hacker News4mo agoToolAI

72FL score
0Sign in to vote

machine0 – Persistent NixOS VMs You Control from the CLI

Hi HN! Excited to launch machine0, a CLI that makes it easy to create, provision and snapshot persistent NixOS (& Ubuntu) VMs.You can think of machine0 as a modern VPS provider. VMs stay on unless switched-off (with 99.99% uptime), they have static IPs and HTTPS endpoints, 1-60 vCPU, up to 240GB RAM and optionally GPUs. The CLI provides commands to manage lifecycle, snapshots and also provision the VMs using Nix flakes or Ansible playbooks. VMs are priced by the minute of usage.What makes machine0 unique is that it has first class support for NixOS! In a nutshell, NixOS lets you define your entire OS as code (think Terraform but for your Linux). A flake declares your system state (packages, services, firewall rules, users...) and pins all dependencies via a lockfile. Given the same flake.nix and flake.lock, `nixos-rebuild switch` always produces the exact same system.The NixOS ecosystem is mature, and flakes are expressive: at the system level you can define packages, what's in /etc, firewall rules, users & groups etc. At the user level, you can define your shell, aliases, tmux and vim config. Having your entire environment defined as code makes it easy to audit what's installed and how things are set up. You can rollback by reverting the last commit. And agents can write the code for you and test it against disposable machine0 VMs.If you'd like to dive right in, these commands will get you started: npm install -g @machine0/cli machine0 new my-vm --image nixos-25-11 # create a new nixos VM machine0 provision my-vm ./flake#my-profile # provision it using a nix flake machine0 ssh my-vm # ssh in machine0 stop my-vm # stop the VM machine0 images new my-vm my-snapshot # create a snapshot machine0 new my-clone --image my-snapshot # create a new VM from the snapshot - Demo of installation + NixOS provisioning via Claude Code: https://www.y

Hacker News4mo agoToolAI

72FL score
0Sign in to vote

Drafted (YC P26) – Models for residential architecture

I’m Nick, founder of Drafted (https://www.drafted.ai). We’re training models that generate residential architecture from structured design constraints.Product demo: https://www.youtube.com/watch?v=8QkJ7jNU9y4Residential architecture is still one of the most expensive, slow, and inaccessible creative processes in the world. Designing a custom home typically costs $10,000–$50,000 or more, takes months, and requires making major decisions before most people can even visualize the outcome. As a result, the vast majority of homes are built without direct architectural involvement.Our goal is to teach computers how the built environment works so anyone can imagine, explore, and eventually create physical spaces tailored to them.Today, users can design homes using simple inputs such as: - Square footage targets - Footprint shapes - Lot boundaries - Room placement preferences - Spatial relationships and constraints.Our models generate complete floor plans and matching exterior elevations in seconds. Users can explore designs in both 2D and 3D, iterate instantly, furnish interiors, experiment with materials, and export CAD, PDF, and other files for the rest of the pre-construction process.One of our newest capabilities allows users to draw any footprint shape and generate a complete home layout inside it: https://www.youtube.com/watch?v=wZJhBm7-OHI.Over the past month, more than 120,000 people have used Drafted, generating over 325,000 home designs.If you're building a home, developing property, working in architecture, construction, or AI, we'd love to hear your feedback!

Hacker News4mo agoToolAI

78FL score
0Sign in to vote

Trace – Offline Mac meeting transcripts you can flag mid-call

I'm the developer of Trace, a non-intrusive, shortcut-driven Mac app that records and transcribes your meetings on-device. I know, another meeting transcription app. Please bear with me though, I'm confident that this is at least a little novel.I primarily built Trace for myself. I'd been using MacWhisper, but there was enough fiddling before each call that I'd forget to start it and walk out of an hour-long meeting with nothing written down. So the things I cared about most were that it's quick to activate and stays out of the way. You activate Trace by pressing a global shortcut (configurable), which reveals a small bar at the bottom of your screen (there's also a keystroke and/or option to hide it entirely if you'd rather not see it at all).As I was building it I wanted to bake in a couple of workflows I'd wished for in other transcription apps.1. Mid-meeting you can press another global shortcut to mark a "key moment" and type a note. The note shows up in the resulting transcript inline at that timestamp. I wanted to add this because I kept catching myself thinking "wait, that bit matters" in meetings and reaching to jot it down in a separate app like Obsidian, which I then needed to add context to, which took me out of the meeting. I use it all the time. If I paste the transcript into an LLM afterwards (which I find myself doing more and more these days) the important moments are flagged so it doesn't gloss over them. This is more noticeable in longer meetings with lots of topics. 2. With another keyboard shortcut you can summon a rough live recap (subtitles, basically) to quickly recap what's just been said.Trace uses standard macOS microphone and system recording APIs to capture both sides of the conversation as two separate tracks and then runs the system side through on-device diarization to identify speakers. Right now we only label them as "Speaker 1", "Speaker 2&quo

Hacker News4mo agoToolAI

72FL score
0Sign in to vote