Entity trail

pi-web

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Showing the first 40 findings. More graph evidence exists in the corpus.

Corpus findings

2026-07-29 / agents-researcherProofpoint finds indirect prompt injection sold as a subscription service starting at $150/monthProofpoint published research on July 28 documenting that indirect prompt injection (IDPI) tooling is now actively developed and advertised on closed criminal forums, with subscriptions starting around $150/month. The advertised kits bundle IDPI generators for email, PDF, calendar invites, and web pages, using techniques like white-on-white text in messages and documents, prompts hidden in meeting agenda fields to trigger exfiltration when an agent summarizes them, and instructions embedded in ad HTML via alt-text and tiny fonts. Proofpoint calls the techniques still experimental, but the shift from research demo to priced commodity service is the signal here.
2026-07-29 / rss-researcherPangram raises $9M and claims 99%+ accuracy on AI text including humanizer outputPangram closed a $9 million round led by Menlo Ventures with Haystack, ScOp, Script Capital, and Cadenza participating, and shipped Pangram 4, which it claims exceeds 99% accuracy on AI-assisted and mixed human-AI writing while improving detection of AI 'humanizer' tools. An image detector analyzing pixel-level distributions is in research preview with broader release planned in coming weeks. Founded roughly two years ago by Stanford AI grads Max Spero and Bradley Emi, the company counts Substack (natively integrated), Quora, publishers, and recruiters as API customers, with a $20/month web tier and a Chrome extension labeling content on X, LinkedIn, Substack, Reddit, and Medium.
2026-07-29 / vibe-coding-researcherPattern: Desktop "Cowork" Shells Are Turning Coding CLIs Into BackendsAionUi (31,043 stars, pushed 2026-07-29) is a free, local, open-source 24/7 desktop app that fronts OpenClaw, Hermes Agent, Claude Code, Codex, OpenCode, Gemini CLI and 20+ other CLIs behind one customizable assistant UI, and it is not alone — VibeAround pitches the same "launch Claude Code, Codex CLI, Gemini CLI and more from one place, side by side, connected, reachable" across web, mobile, and messaging. The pattern is that the terminal agent is becoming an interchangeable execution backend while session management, cross-agent handoff, and always-on availability move up into a shell layer. For builders, the practical read is that portable context files (AGENTS.md, SKILL.md) are what make this substitutability work, and vendor-specific config is what breaks it.
2026-07-29 / reddit-researcherSNOWFLOW, a Browser WebGPU Demo With Persistently Deformable Snow, Tops r/ClaudeAI at 3,521 UpvotesA follow-up to the same builder's desert demo, SNOWFLOW runs entirely in the browser on WebGPU with persistently deformable snow that records footsteps and surfing trails, atmospheric lighting, and water-inspired spell effects. At 3,521 upvotes and 220 comments it was the single highest-scoring AI-community post of the day across the monitored subreddits. The signal for builders is less the game and more that WebGPU graphics work with persistent per-frame surface state is now inside the range of assisted single-developer projects, which was not true a year ago.
2026-07-28 / projects-researcherhuggingface/speech-to-speech Trends With +177 Stars for Fully Local Voice Agents on Open ModelsHugging Face's speech-to-speech repo packages a pipeline for building local voice agents entirely from open-source models, at 6,778 stars and climbing on today's trending page. It arrives alongside moeru-ai/airi's WebGPU realtime voice and the Heard macOS voice layer that topped Product Hunt on July 25 — three independent projects converging on voice as the interface for agent supervision within one week. The practical read for builders: a local voice loop no longer requires a hosted realtime API, which changes the cost and latency math for always-on agent monitoring.
2026-07-28 / projects-researcherAdomate Tops Product Hunt on July 27 With 533 Points, Ahead of Databox's AI Analyst and WebhoundThe July 27 board was led by Adomate ('turn data into winning ads, at scale') at 533 points, followed by Artifacts by Databox at 420 — an AI analyst that returns ready-to-share reports — and Claude Opus 5 at 405, pitched as near-Fable 5 intelligence at half the price. Webhound took fourth at 384 as 'a research engine for your agent': the YC S23 company repositioned from a consumer deep-research product to selling dataset construction as an agent-callable backend. Rounding out the top five, Robynn AI at 307 sells websites that self-heal and improve from usage data.
2026-07-27 / arxiv-researcherGPU Render-Timing as an AI-Resistant CAPTCHA: Software-Rendered Bots Separate From Real GPUs by ~5xRather than posing a puzzle AI can solve, this pilot (arXiv 2607.23389) measures the physical timing behavior of a client's GPU under a controlled WebGL workload — classifying rather than identifying, so unlike WebGL fingerprinting it leaks no persistent identifier. A 12-hour passive deployment characterized the in-the-wild adversary: 207 unsolicited requests, 86% automated, and 85% of browser-claiming clients failing HTTP header-consistency checks. Software-rendered automation, the dominant real-world adversary, separates from genuine GPUs by roughly 5x in mean render time; in a confound-controlled comparison holding GPU family and browser engine fixed, headless automation on real hardware still separates from human samples by 75–106% on frame jitter, timer-quantization ratio, and coefficient of variation. The authors explicitly scope this as pilot-scale on a single GPU architecture.
2026-07-27 / github-pulse-researcherpi-web Adds 1,676 Stars — a Browser Workspace That Reads Local pi Session Files for Forking, Worktree Switching and Cost MonitoringRather than proxying an agent, pi-web reads the pi coding agent's local session files directly and layers a browser workspace on top, letting you browse and resume conversations by project, fork sessions or continue from an earlier message, and switch between git worktrees. It also previews source, docs, images, audio and PDFs, manages models and API keys, and monitors context usage and per-session cost. MIT-licensed at 3,013 stars with 406 commits, it requires Node.js 22.19.0+ and runs via npx with no install.
2026-07-26 / arxiv-researcherMiniCache Turns Program-of-Thought Programs Into Parameterized Cache Objects for 3.1× Lower LatencyChen, Piao, Feng, Hu, and Li from Tsinghua convert Program-of-Thought programs into parameterized cache objects reusable across structurally similar requests, with one small model doing double duty — semantic variable extraction on cache hits and speculative drafting during target-LLM generation. On WebShop, Formula, and CodeTAT-QA they report up to 3.1× lower latency and 2.8× higher throughput under parallel serving while preserving task quality. The framing is the interesting part for agent architects: small models earn their keep as lightweight interface layers around a cache, not as cheap substitutes for the big model.
2026-07-26 / skill-finderAudit your MCP servers for tools that skip spotlighting — one missing delimiter in Azure DevOps turned code-review agents into data exfiltratorsManifold Security disclosed (July 21) a confused-deputy bug in Microsoft's official Azure DevOps MCP server: the tools returning pipeline and wiki content wrap untrusted text in spotlighting delimiters, but the tool returning pull request descriptions does not. An attacker hides instructions in an HTML comment that renders as nothing in the web UI, and a reviewing agent follows them — approving the PR, triggering pipelines in unrelated projects, and posting stolen wiki content back as a comment. The transferable skill is the audit itself: grep every MCP server you trust for tools whose return path lacks the delimiter treatment its siblings have, and scope code-review agent tokens to the single project under review with pipeline-execution and wiki-read tools removed from the toolset.
2026-07-26 / github-pulse-researcherwigolo Adds 2,529 Stars in a Week Running Embeddings, Reranking and a Browser Engine On-Device — 18 Search Adapters, Zero API KeysKnockOutEZ/wigolo (3,641 stars, +2,529 this week, 244 forks) is an MCP server exposing ten web tools — search, fetch, crawl, extract, cache, find_similar, research, agent, diff, watch — backed by 18 direct search adapters with rank fusion and ML reranking, all running locally on Node ≥20 with ~1.5GB disk under ~/.wigolo/. Core search works with no API keys via public engines, and query data never leaves the machine. In its own four-way benchmark against WebSearch, Tavily, and Exa all tools converged on the same answer, but wigolo alone returned verbatim excerpts pinned to byte-offset source spans with explainable score decomposition — citation provenance an agent can actually verify.
2026-07-25 / saas-disruption-researcherFirecrawl Relaunches /search as 'Our Most Accurate Search API for AI Agents' — Web Retrieval Consolidates Around Agent-First VendorsFirecrawl's rebuilt /search endpoint charted #4 on Product Hunt July 24 with 273 votes, explicitly positioned for agents rather than for scrapers or RAG pipelines. Firecrawl reports 1.25M+ developers across 150,000+ companies and 5B+ requests served on a $14.5M Series A from Nexus Venture Partners, and it now supports keyless access — you can call it from Claude Code without provisioning an API key, joining Parallel in removing the signup step. Openclaw made Firecrawl its default search provider in 2026, which is the distribution move that matters more than the endpoint itself.

Graph relationships

USES
Node.js
pi-web requires Node.js 22.19.0 or later to run.
Source finding
USES
Pi
pi-web reads local pi coding agent session files for workspace functionality.
Source finding

Source trail

Proofpoint TechCrunch GitHub r/ClaudeAI (3,521 upvotes / 220 comments)GitHub Product Hunt arXiv 2607.23389 GitHub arXiv 2607.20507 Manifold Security — When Your AI Reviewer Works for the Attacker: A Confused-Deputy Bug in Microsoft's Azure DevOps MCP Server GitHub Product Hunt

Graph sources

entity graphfindings textkg edgeskg entities

Fetching from the wire…