You probably remember the old supply chain attacks. SolarWinds. Log4j. Someone sneaks bad code into a trusted piece of software, and everyone who installed that software is suddenly in trouble. Here's what happened on March 24 of this year, and why it's different.

A popular open-source tool called LiteLLM — it's a connector that a lot of companies use to route requests to ChatGPT, Claude, and other AI models — got compromised. Someone slipped malicious code into it. That part's the old playbook.

The new part: a lot of the exposure didn't come from a person clicking install. It came from agent frameworks pulling the poisoned version in as part of doing normal work a developer had asked for. Anywhere pip install litellm ran without a pinned version during the window — CI jobs, build containers, agent frameworks with LiteLLM as a transitive dependency — was potentially exposed.

And here's the kicker: the attackers didn't break into LiteLLM directly. They first broke into Trivy, which is a security tool companies use to scan for this exact kind of threat. The compromised Trivy action ran inside LiteLLM's CI/CD pipeline and exfiltrated the PyPI publishing token, which the attackers then used to push the bad code. The tool you use to catch supply chain attacks became the way one got in.

Three big attacks in under three weeks — LiteLLM, then Axios (the JavaScript library that runs in a huge chunk of the internet, present in roughly 80% of cloud and code environments), then a roughly six-hour hijack of the CPUID website that pushed trojanized CPU-Z installers to anyone downloading from the official page. Different attackers, same pattern: the bad stuff came in through software you already trusted.

So when we say "supply chain attack" in 2026, we mean three things that used to be separate:

• The code your team installs — packages, libraries, signed apps
• The AI infrastructure your agents depend on — model gateways, connectors, MCP servers, fine-tuned models pulled from public repos
• The AI agents themselves — which are now installing things, making decisions, and running with permissions they probably shouldn't have

We're Itamar Golan (u/Itamar_PromptSec) and David Abutbul (u/David_PromptSec) from Prompt Security, the company inside SentinelOne securing enterprise AI usage. We spend our time on what happens at the agent layer specifically, the part that's newest and weirdest. We also maintain an open-source project called ClawSec, a security skill suite for OpenClaw and related agents (Hermes, PicoClaw, NanoClaw) that does drift detection, skill integrity verification, automated audits, and live advisory monitoring, so an agent's behavior and configuration can't quietly drift out from under you.

Ask us anything about:

• The March 24 LiteLLM attack — what actually happened, what the poisoned code tried to do, and why the fact that a lot of the exposure came through automated pipelines and agent frameworks (not humans clicking install) matters for how you defend against this going forward.
• Agents doing things you didn't explicitly ask them to — your coding assistant grabbing a library, your customer-service agent pulling from a data source, your internal chatbot chaining tools together. Where's the line between "helpful" and "this thing just ran a command with your permissions"?
• Shadow AI, but worse — last year it was employees pasting stuff into ChatGPT. This year it's agents your company officially deployed quietly connecting to tools and services nobody mapped. How do you even get visibility into that?
• Why "just add another approval step" isn't going to work — the whole point of agents is speed. If every action needs a human to click yes, you don't have an agent, you have a very slow chatbot. What actually works instead.
• ClawSec — why we made it free and open source, what it does differently from the usual "AI guardrails" pitch, and what we've learned from people actually using it.
• State-sponsored actors, ransomware crews, and who's really behind this — who profits from attacking trusted software, and why the economics point to a lot more of this coming, not less.
• What a normal company should actually do on Monday — not a 40-page framework. The two or three things that meaningfully reduce your exposure this quarter.

We'll be live Wednesday, May 20, and sticking around all day (Israel time). Bring the hard questions — the dumb ones too. Honestly, the "dumb" ones are usually the ones everyone else is afraid to ask out loud.

Hey guys,
I want to get better at communication in interviews so I started giving interview to chatgpt
( he know me well )

i have given many real interview & found while my engineering skills aren't bad but my communcation skills sucks.

here is my voice chat with gpt :
Can you tell me what i can do better

#############################################

Introduction

Interviewer: Tell me about yourself.

Me:
Hi everyone, I am Manas Anand. I have been backend engineer at Raffles.ai for past two years, mostly working with AI backend system. I have architected microservices that handles real-time AI inference, storing data in PostgreSQL database for user state, and pushing multiple changes to front-end. My strengths are in optimizing for scale, asynchronous pipeline, and collaborating across the stack. Apart from academics, on weekends I really enjoy playing guitar and sometimes football.

Feedback

Rating: 8/10

Improvements

• Say “AI inference” instead of “AI interference”
• Maintain consistent grammar:
  • “microservices that handle”
  • “backend engineer at Raffles.ai for the past two years”
• Strong structure and confidence overall

DRY Principle

Question

Explain DRY with a practical example.

My Answer

DRY stands for Don’t Repeat Yourself. In our organization, we were using OCR processing heavily across multiple pages. Instead of rewriting the OCR logic every time, we made a modular OCR function that could be reused in different places.

Now multiple services can call the same OCR pipeline, which improved readability, maintainability, and centralized the business logic.

Feedback

Rating: 7/10

Improvements

• End with measurable impact
• Example:
  • “This reduced duplicate logic and simplified maintenance.”

YAGNI Principle

Question

Explain YAGNI with a practical example.

My Answer

YAGNI stands for “You Aren’t Gonna Need It.” It prevents over-engineering for scale that may never happen.

In our organization, we needed an AI agent for a specific workflow. Some engineers suggested creating multiple sub-agents, but the use case was not complex enough.

I benchmarked a single well-prompted agent with structured outputs, and it performed well enough. This reduced complexity, simplified logging, and kept the codebase easier to maintain.

Feedback

Rating: 6/10

Improvements

• Keep answers tighter
• Clearly state:
  • Problem
  • Decision
  • Result

SOLID Principles

Single Responsibility Principle (SRP)

My Answer

SRP means a class or function should have only one responsibility.

In our OCR pipeline, the first version handled OCR, JSON formatting, and logging all in one class. I refactored it so the OCR service only extracted text, while logging and JSON parsing were moved to separate modules.

This improved readability and modularity.

Feedback

Rating: 7/10

Improvements

• Shorten explanations
• Keep one clear responsibility statement

Open/Closed Principle (OCP)

My Answer

Open/Closed Principle means software should be open for extension but closed for modification.

For example, in a logger system, we may initially support only info and error logs. Later, if we want to add debug logs, we should extend functionality without modifying stable existing logic.

This reduces the chance of breaking existing systems.

Feedback

Rating: 7/10

Improvements

• Say:
  • “Add new behavior without editing stable existing code.”

Liskov Substitution Principle (LSP)

Correct Explanation

A subclass should be replaceable for its parent class without breaking expected behavior.

Example

A classic violation is:

• Rectangle class allows independent width and height
• Square subclass forces both values to remain equal

This breaks client expectations and causes bugs.

Interface Segregation Principle (ISP)

My Answer

ISP means clients should not depend on methods they do not use.

For example, instead of one huge Vehicle interface, we can split interfaces like:

• EnginePowered
• Swimmable

This prevents unrelated classes from implementing unnecessary methods.

Feedback

Rating: 6/10

Improvements

• Define the principle first
• Then explain interface splitting

Creational Design Patterns

Factory Method Pattern

My Answer

Factory Method is used when object creation depends on runtime conditions.

For example, if we have multiple car types like Audi, BMW, and Ferrari, instead of hardcoding object creation everywhere, we use a factory that returns the correct object based on configuration or input.

This improves maintainability and separates creation logic from business logic.

Feedback

Rating: 7/10

Improvements

• Emphasize:
  • “Encapsulating object creation”

Singleton Pattern

My Answer

Singleton ensures only one instance of a class exists.

A common example is database connection management. Without Singleton, multiple unnecessary connections may exhaust the connection pool.

Singleton helps centralize resource management.

Risks

• Hidden global state
• Harder testing
• Concurrency bottlenecks

Feedback

Rating: 7/10

Builder Pattern

My Answer

Builder Pattern is used for constructing complex objects step-by-step.

Telescoping constructors become difficult to read when there are many parameters. Builder pattern makes object creation more readable and maintainable.

Example:

User user = new UserBuilder()
    .setName("Manas")
    .setTimeout(30)
    .enableCache(true)
    .build();

Feedback

Rating: 8/10

Prototype Pattern

My Answer

Prototype Pattern is used when cloning existing objects is more efficient than creating new ones.

In game development, character templates can be cloned and then slightly modified instead of recreating everything from scratch.

One important concern is shallow copy vs deep copy.

Feedback

Rating: 8/10

Overall Interview Feedback

Strengths

• Strong practical understanding
• Real-world engineering examples
• Good instinct for scalability and maintainability
• Comfortable discussing backend architecture

Main Areas to Improve

1. Sentence Precision

Your biggest issue is not knowledge — it’s sentence construction.

You often:

• restart sentences
• repeat ideas
• lose grammatical structure midway

Fix

Use shorter sentences.

Instead of:

>

Say:

>

2. STAR Structure

You are partially following STAR naturally.

You consistently:

• explain context
• explain action

But you sometimes skip:

• measurable result

Better Structure

• Situation
• Task
• Action
• Result

Always end with:

• reduced latency
• improved maintainability
• simplified debugging
• reduced duplicate code
• improved scalability

3. Pace & Delivery

Your pace changes depending on confidence.

Pattern Observed

• Strong topics → calm pace
• Searching for words → very fast pace

Fix

Pause intentionally.

Use transition phrases:

• “In short…”
• “The main idea is…”
• “The outcome was…”

This buys thinking time and sounds confident.

English Improvement Strategy

Best Practice (30 mins/day)

1. Record Yourself

Take one interview question daily.
Record a 1-minute answer.

2. Rewrite It

Rewrite into:

• 3 clean sentences
• simpler grammar
• fewer filler words

3. Speak Again

Repeat until it sounds natural.

Final Overall Evaluation

Area	Rating
Technical Understanding	8.5/10
Practical Examples	8/10
Communication Clarity	6.5/10
Confidence	7/10
Structure	7/10
Interview Readiness	7.5/10

Final Advice

You already think like an engineer.
Now your next jump is sounding structured and concise under pressure.

If you improve:

• pacing
• sentence clarity
• concise STAR delivery

…you can perform very strongly in senior backend interviews.

https://preview.redd.it/aplhx0cgv92h1.png?width=726&format=png&auto=webp&s=62ba4b2ade518af0f9ea77d0d94688bb1d420454

Ps: I want to share the thread but it's not available for voice

I'm trying to understand what teams building with AI SDKs struggle with the most once their app is in production.

So far I've heard a few things come up. Some people don't know which model to pick for each task and don't have a week to benchmark everything. Others mentioned costs creeping up but struggling to switch to cheaper models without breaking quality on edge cases.

I'd love to hear what's on your list. If you have 30 seconds, please drop your top 1 or 2 pains in the comments with a bit of context.

While testing multi-step workflows, I’ve noticed hallucinations increase as context grows longer. Breaking tasks into smaller stages improves accuracy, but adds extra latency and complexity. Validation layers help catch issues, though they can slow the overall experience noticeably. It feels like balancing speed and reliability is still one of the hardest parts of production systems. What approaches are working best for you right now?

Ok, so I have multiple school teachers in my family, so I have an exposure to what problems they face (in teaching, obviously, idc about admin stuff). So I thought of building an AI worksheet generator (idea under development).
Claude helped me build a beautiful backend, and through it, I discovered that I can actually integrate AIs without having to build my own through APIs (I'm new to this field). It added the Claude API, but I'm on a budget limit.
Any suggestions for completely free AI APIs? (and how to integrate them too)

Look, if you use AI for more than three hours a day, you’re probably a virgin.

And honestly?

That’s probably a good thing.

Most people are out here wasting their lives, running around, chasing random people, numbing themselves, scrolling social media, doing drugs, and pretending it’s all “living life.”

But the people who are going to have the most money in 20 years?

A lot of them are probably sitting in their room right now, not dating, not partying, not wasting time, just obsessively learning AI.

That’s why so many people who use AI a lot are probably virgins.

They’re not out wasting time on pointless dating drama.

They’re in their little cave, playing with AI, figuring out the future before everyone else even realizes what’s happening.

And that’s a good thing.

Because in the future, those are probably going to be the people who win.

So here’s what I want you to do.

Use the prompt below.

It’s going to audit your life.

It’ll ask you a few questions, you’ll give it a few answers, and then it’ll show you every single thing you’re wasting time on.

Then once you see it, quit those things.

Spend more time learning AI.

Because AI is the future.

And if you’re not using it, you’re probably cooked.

Not “quirky internet cooked.”

Actually cooked.

Check the cards and use the prompt.

Prompt:

I want you to audit my life and find where I’m wasting the most time.

Ask me 10 questions about how I spend my day, including my phone use, social media, entertainment, dating life, work, school, business, sleep, habits, distractions, and goals.

After I answer, do the following:

1. Identify the biggest time-wasters in my life.
2. Tell me which ones are giving me the least return.
3. Show me what habits are keeping me average.
4. Tell me what I should quit, reduce, or replace.
5. Create a simple daily schedule that gives me more time to learn AI.
6. Give me a brutal but useful summary of what will happen if I keep wasting time.
7. Give me a better version of my life if I take AI seriously for the next 12 months.

Be direct, specific, and don’t sugarcoat it.

Im trying to find the best place to create a promotional/marketing video for a new product launch, something that shows of different aspects of the product (pages, functions etc) that can then be posted across differenct social media platforms. What are you guys currently using to create this sort of content