Jeff Beard

The OpenAI / Hugging Face incident was an egress problem

2026-09-01T00:00:00Z

Now that all the "final" documents are out, I've been reading through the reports on the OpenAI / Hugging Face incident. One of the most fascinating things I've dug into in years.

The headline is that agents, given access, will find and exploit complex pathways across networks, including novel collaboration protocols they invented themselves. Artifactory as a message board? Clever. But from an agent's perspective it's just a place to read and write data for whatever purpose. If you have access.

That's where my hot take comes from.

For background, I've operated Artifactory. It's very fit for purpose. If you're diligent about how you configure, secure, and use it, it's a fantastic platform for hosting and managing a huge variety of executable data.

Scanning the reports, I immediately honed in on egress. OpenAI's own words: zero-day exploits in Artifactory became "the agents' principal egress path to the public internet."

I'd put it differently. The zero-days didn't create that path. They used one the architecture already provided. A service whose job is fetching remote content on your behalf, placed inside a no-egress boundary, is an egress path.

The architectural fix is straightforward:

Pre-load required artifacts into an internal, local-only repository
Delete Internet egress at the network layer
Attach the isolated, static snapshot to the sandbox

This eliminates any path to the Internet, so a misconfiguration of the service is irrelevant. If you want another layer, make the tenant principal read-only: no clever message board, no plugin execution, no token endpoints.

But how was this missed? I don't know. The reports say the controls "balanced security and utility based on OpenAI's understanding of the threat at the time," and are silent on what that understanding was based on. What I do know is that through the lens of network security, the pathway seems clear.

That, in my view, is the critical failure. Everything else, as fascinating as it is, cascaded from it.

My perspective is that of both an outsider (take with a grain of salt) and an operator with battle scars.

A status bar app for Claude API outages

2026-08-24T00:00:00Z

The recent Claude API outage forced me to pivot to Antigravity CLI. That was probably a good test for maintaining velocity during an outage. I use OpenSpec and a few other processes, so it was straightforward for Antigravity to continue the work.

While I waited, I decided to save a click or two in the future. I started another Antigravity session to gin up a taskbar status app that gives me a signal when the Claude API is impacted. It took about 50 minutes, a chunk of which was me being pedantic about process (OpenSpec, TDD) and failing to create a good icon.

I've since added a local storage with SQLite in order to power a dashboard that covers a longer time horizon. It's open source under the MIT license if you want to try it or build on it.

Unbound 100, mud year

2026-05-31T00:00:00Z

Barn and Coca-Cola silo on the Unbound course.

Yesterday I rode the 2026 Unbound 100 gravel bike race. This was my second time at the race, which has a lottery for entry, and the first time doing a southern route.

It was also a mud year, which I learned is a thing.

Before race day I went for a shakeout ride with my friend Ben who I met at UnPAved, then to the expo. I dropped off my bike at the Canyon tent for a pre-race tune up. I ran into some friends including Staci and a friend from Boulder. Also saw luminaries like Willie the dog.

My plans for tire choice, nutrition, and hydration were based on a bet that it would dry out on race day, and based on the sunny, warm conditions the day before, I was feeling positive about the weather.

So of course it rained. I missed my goals by a mile, my plan imploded, I over-hydrated in the cool temps requiring multiple bathroom breaks, tires were wrong for mud, I rode through a couple of massive thunderstorms, hiked my bike through 4 inches of mud and rode or walked through a few creeks and field runoff.

And it was very fun.

The sun came out with about 20 miles left so the finish was fast, with the tires finally matching conditions.

Chip time: 7:46:25. Results: 510/1585 overall, 428/1249 men, 43/206 in my age group.

Bucknell Cycling Classic

2026-03-22T00:00:00Z

At the start line with the collegiate field.

I raced the Bucknell Cycling Classic road race and had a great result, in my humble opinion.

I haven't been training as much as I would like to, for a variety of reasons: sickness, weather, fatigue, location. It just hasn't been a good preseason.

Still, when I heard about this race I said "why not". I would at least be out riding and it would be a fitness check.

Since this was a collegiate event and there were no age groups, I knew I wouldn't be competitive with anyone but myself or any other oldsters.

So I lined up on a blustery, overcast race day and waited for a start that was 10 minutes late.

The start was a short flat section followed by the steepest hill of the race. I was at the front with about five guys when we started up the hill. They quickly dropped me, then 95% of the field blew past me as well. I tried to keep up but felt like doing an 800 watt sprint at the start would come back to bite me.

After the hill there was a flat-ish section where I started scouting for riders that seemed to be going about my speed. There were some, but they latched onto my wheel and let me do the work until I shook them off, temporarily.

Shortly after starting my second lap, the collegiate women started passing me. I finally found one rider from UVM going at a sustainable pace, so I caught her wheel and we worked together for a couple of laps. We also built up a group including some of the original hangers-on.

In the final lap I was on the UVM rider's wheel, and right before a fast descent I got on the front. I went fast on the descent, then full gas on a kicker and managed to drop them. I passed two or three more riders further up the road and finished solo.

Very happy with the result, and a fun ride. Thanks to Steve Schoenfelder for the action shots.

Claude Code vs an IDE

2026-03-05T00:00:00Z

One for the coders.

I recently received my JetBrains newsletter announcing a Cursor integration with IntelliJ via their Agent Client Protocol. It gave me pause to reflect on how much my personal development environment and processes have changed since I started using AI agents to build software.

I've tested Cursor and other AI-native IDEs for about a year now, but stopped using them regularly when Claude Code dropped. As I've mentioned before, the CLI felt very natural to me, along with the more conversational nature of coding with an agent.

The bigger shift, though, is that I've largely stopped using traditional IDEs altogether. IntelliJ, Cursor, Visual Studio, all of them.

In the past, I relied on deep knowledge of keyboard shortcuts and code generation features to squeeze every bit of speed out of my IDE. The result was a highly efficient setup, particularly for reducing friction from the massive amounts of boilerplate that software engineering involves.

What AI coding agents have done is not just obscure boilerplate. They've replaced the need for years of muscle memory and curated personalization with a code generation system that is, in my view, the first true killer app for AI.

I still pull an IDE off the shelf when I need to debug something an agent can't fix, perform security or performance analysis on critical code, or get a more holistic view of a system. But that's rare. More often than not, I'm only looking at code in a PR and relying on various analysis tools for quality, performance, and security.

With the advent of multi-agent development, which I predict will be the norm as we exit 2026, I think IDEs will be increasingly relegated to the infrequent tasks I've already been using them for, as we shift to custom agents for all phases of the SDLC.

I'll caveat that: there are some areas where AI agents will take time to penetrate, like compilers, kernels, highly tuned code, and obscure or proprietary languages.

Old Man Winter, 2026

2026-02-03T00:00:00Z

Galen and me ready for 40 miles of gravel riding.

Another Old Man Winter on the books. Galen and I did the 10k run and 40 mile ride combo.

Galen put in a heroic effort to get across the ride's finish line. Super proud of him for pushing through the pain.

For myself, I managed to get sick and then drove cross country as prep for the event. I missed my goal of doing the 10k under an hour by seven seconds. I thought I was keeping a close eye on my pace, but there you have it.

I do love this event, and doing it with Galen makes it particularly special.

What I've been doing since October

2026-01-04T00:00:00Z

An abandoned gas station canopy against fall hills in Pennsylvania.

What's Jeff been doing since October, you ask? Ramping up the running and continuing to ride. I went back to Colorado for several weeks, then came back to Pennsylvania via Chicago.

The first event of the year will, as usual, be the Old Man Winter rally, where Galen and I will again tackle the 10k run and 40 mile gravel ride duathlon.

After that I'm trying to decide what to do with March and April ahead of Unbound in May. Boulder Roubaix is a classic, fun race, but as a lowly Cat 5 racer it doesn't necessarily help with race preparation the way, say, Desert Gravel would. Will have to make a call soon.

It's been fun adventuring and getting to share some runs and hikes with my daughter Laurel.

Financial modeling: iterating toward viability with Claude Code

2025-12-12T00:00:00Z

I kind of fell into using Claude Code for financial modeling. I asked for help with infrastructure architecture, but as soon as I asked for costing it changed everything, because of how easy and fast it was.

Important: all costs were verified by finding up-to-date pricing or talking to sales staff.

The first principle: super simple and cheap

I started with an arbitrary pricing idea for what I expected to be the most popular tier: $4.67 a month.

Then I asked Claude Code: "What's the least expensive way to deploy the app as a container on AWS and be profitable at this price point?"

The AWS constraint was purposeful, but more on Claude's infrastructure-as-code skills another time.

That single question kicked off a cycle of iterative financial modeling, since I always ask the AI to interview me for detailed context.

What "iterative" means

This wasn't spreadsheet development, though it's easy to generate one. This was totally conversational:

Multiple infrastructure options (App Runner, Fargate, ECS, EKS)
Evolving feature requirements (database, Internet access, vector storage)
LLM cost comparisons across providers (Bedrock, Claude, GPT, Ollama)
Pricing structure experiments
Break-even analysis for self-hosted vs managed LLMs

AI lacks a lot of context, so I had to prompt it to do research first:

AWS and LLM provider credits
Vector storage options, including S3
Bedrock managed LLMs vs LLM provider APIs
Networking and data transfer costs
Security implications
Third-party auth and data services

But once I pointed it in a direction, I could easily iterate: "What if we add database migrations as part of deployment?", "Cost impacts of public Internet access", or "Model the cost at N users using x, y, and z LLMs." It would regenerate the analysis in minutes, keeping me in a flow state and driving decisions, and the roadmap.

Key insight: markdown-driven development

Early on I didn't ask for markdown docs. Then I realized that markdown was simple long-term memory storage for the robot, and executable instructions for later.

Once I started requesting markdown artifacts for every analysis, the quality and reusability improved. Each financial model became a versioned, auditable document I could reference and iterate on.

Importantly, this creates a timeline of decisions and their justification.

In the end I had a roadmap and a model for profitable growth, including an attainable break-even point.

Lehigh Gorge, 35 years later

2025-10-26T00:00:00Z

The Lehigh Gorge Scenic Railway at Jim Thorpe station in fall color.

Jenny booked us a drop-off bike ride down Lehigh Gorge between White Haven and Jim Thorpe, Pennsylvania. A super fun ride and the first time in 35 years I've been to Jim Thorpe.

The last time was for a "MTB Weekend" when I first started mountain biking, before they smoothed out those rail beds. That trail was probably the smoothest gravel I've ridden. There was a Huffy Toss event to make up for the sore backsides, and probably some youthful debauchery; I don't remember.

Not this time. Very tame, and the town was swamped with people out for a day of leaf peeping, biking, or the train ride. A super fun day out with Jenny.

UnPAved 2025

2025-10-13T00:00:00Z

Ripping through the Hollows.

I rode UnPAved Pennsylvania again this year and had a challenging but fun day in the saddle.

Last year I made a friend on course who I finished with, and we started together this year. He dropped me after the halfway aid station. I turned back because my power meter was complaining about battery levels and I had a spare in my drop bag.

Setting aside being less fit than last year, this course was objectively harder. More and harder climbs, sketchy road surfaces, and a poor tire choice for the conditions, all resulting in more time on course.

There were two timed segments I hoped to do better on this year. I got my second fastest results on both, so I can't really complain. In fact, I got a PR for most climbing in a ride.

Despite forecasts to the contrary, the weather improved throughout the day, which made being out in the Central Pennsylvania mountains a fun fall outing. Also, perogis.

The Rad Dirt Fest

2025-09-28T00:00:00Z

Bunny hopping acrossing the finish at The Rad Dirt Fest.

The Rad Dirt Fest in Trinidad, Colorado. Another race on the books.

It was a fun and varied ride. Someone wanted to make sure the finish was earned: there were a few absurdly steep climbs, including the last one before the finish. And lots of great gravel, great views, varied terrain and road surfaces. Totally worth the suffering.

Sadly, I did not get a coin for Unbound in the drawing, so off to the lottery I go.

I wish I had a complete training regime on the books when I race, but I need to figure out the fine line between over-depletion and good fitness. I seem to get sick in the lead-up to a race, which blows up my training plan. It's often related to flying, which is a cesspool of pre-weaponized biological agents, so that might be an easy fix. Lots more to learn, and more hard work to get out of the back of the pack.