Melissa Liu

🚀 We’re partnering with top software engineers in New York’s early-stage startup scene. Talent is moving fast, but our clients are listening and adapting as engineers face real challenges: Interview fatigue is real. Engineers are burned out from marathon processes, long take-homes, and ghosting feedback. “We don’t get to see the product”. Companies aren’t demoing or explaining the product early on, and it’s a big turn-off. The best candidates want to believe in what they’re building. Show, don’t just tell. Tech rounds are moving up. More companies are front-loading the technical interviews to avoid time wasted later, and it’s working for both sides. Remote is shrinking. We’re seeing a definite tilt back toward onsite or hybrid. Not everyone loves it, but the shift is happening. It’s less about a coding language, more about product. Hiring managers are becoming less rigid about specific stacks, and more focused on alignment with product vision, user impact, and client collaboration. 📩 Reach out for more insights: george.wilson@stottandmay.com #Hiring #SoftwareEngineering #TechRecruiting

22

1 Comment

I’ve been seeing this more and more lately from very experienced engineers claiming they don’t need to read all the code LLMs output I understand for hobby projects when the stakes are low. But I’m starting to see it in places that matter. For example this is the creator of clawdbot a tool that’s going viral for being providing anyone with a an AI assistant that can do a lot of cool things when connected to your email, WhatsApp…all your online accounts Something like clawdbot is a major attack vector. Even though it’s an open source side project tens of thousands of people are using it with sensitive data. I know these models are getting good but working code doesn’t mean it functions as you’d expect, so all of these automated tests just mean that no error is being produced. It doesn’t catch functional issues that can delete or leak data and open backdoors. I think we’re going to see a lot of exploits and catastrophic destruction of data happening from this mindset.

111

17 Comments

🦺 🛟 Agent Safety > Model Safety LLMs didn't break your app. Agents can. As we wire LLMs to tools, browsers, payments & code the risk shifts from bad text to bad actions. Top failure modes (seen in the wild & in papers): 🚩 Prompt/Content Injection -> Tool Misuse. Malicious web pages or data instruct agents to steal secrets or make unintended API calls. This is now a primary risk for browsing and MCP - style tool agents. 🚩 Over permissioned tools & long-lived tokens. Agents get "god mode" scopes. A single injection becomes account takeover or irreversible ops. Security notes for MCP emphasise least privilege and short-lived auth. 🚩 Unsafe web autonomy. Benchmarks show web agents will attempt harmful tasks unless constrained (posting misinformation, illicit sales, etc.). You must measure misuse not just assume guardrails. 🚩 Supply-chain & retrieval poisoning. Agents trust plugins, third-party tools & indexed data that an attacker can taint. OWASP’s newest GenAI Top 10 calls this out explicitly. 🚩 Process safety gaps. NIST's GenAI Profile (AI 600-1) warns that organizations ship agents without role clarity, human-in-the-loop or incident playbooks. ✅ Model safety reduces bad text. Agent safety prevents bad state. Treat the agent like a junior SRE - with narrow permissions, audited actions and clear escalation paths. If you're building agents, what's the one control you won't ship without? Also drop a comment if you'd like me to share a follow-up post on how to tackle each of these risks. #AgenticAI #AISafety #AIAgents #GenAI #CyberSecurity #MCP #OWASP #NIST #AITrust #ResponsibleAI #AIForBusiness

5

A 280-fold drop in AI inference cost isn't just a headline - it's a line in the sand for anyone building or deploying large language models. Last quarter, our team ran LLMs on $10k/month hardware. Today? That same workload costs less than $40. No tricks - just leveraging the latest quantization and hardware-optimized runtimes. The numbers still surprise me. What changed? Not the demand for accuracy or speed. But relentless optimization - in model architecture, in serving stacks, in chip design. And now, inference is no longer the bottleneck it was even six months ago. Here’s what this means if you’re working with AI/ML: - You can ship models with billions more parameters, at a fraction of yesterday’s price. - Experimentation cycles shrink. You test, learn, and iterate faster - before competitors can even provision their clusters. - Cost is no longer the gatekeeper for deploying language AI at scale. Creativity is. One client moved from proof-of-concept to 100k+ daily users. Their infra bill? Down 97% after refactoring for modern inference. Suddenly, features we shelved as "too expensive" are back on the roadmap. But here’s the tension: Massive cost drops mean every team has access to the same raw power. It’s not about who can afford to play - it’s about who can build something people actually want at scale. Is your team rethinking what’s possible now that inference isn’t the limiter? Would love to hear how these cost shifts are changing your roadmap or business model. #AI #MachineLearning #LargeLanguageModels #StartupLessons #TechLeadership

5

Unpopular opinion: The RL hype is a red flag for technical depth. When I hear founders or VCs casually dropping "reinforcement learning" in pitches, it's usually code for "we don't actually understand our problem space." Here's the reality check: RL only works when you have: - Perfect simulation environments - Extremely fast iteration cycles - Clear reward functions - Tolerance for massive compute costs That's why it succeeds in games (perfect simulation) and search optimization (Massive compute capacity at Deepmind AlphaGo/Anthropic/OpenAI) but fails spectacularly in the messy, slow-feedback real world. The graveyard of "RL-powered" startups tells the story. They burned through $$$$ trying to apply algorithms to problems that needed simple heuristics or supervised learning. Most of the time, a well-tuned evolutionary algorithm will outperform your fancy RL setup while using <1/10th the compute and delivering results you can actually explain to stakeholders. The next time someone pitches you an RL solution, ask them: "Have you tried solving this with a basic optimization approach first?" Watch how quickly the conversation changes. I am surprised when people are surprised that Direct Preference Optimization (DPO) can exceed PPO-based RLHF [1] or Reflective Prompt Evolution Can Outperform Reinforcement Learning [2]. [1] https://lnkd.in/gCY3bcTQ [2] https://lnkd.in/gQRwyQyM

45

2 Comments

Indeed, it’s funny to read the “RAG is dead” posts when a new long context window model drops. Like the most recent example of Llama 4 Scout with its 10M token context window. Even if it would work as promised, why would you send your entire database over the wire to ask a question from the model? Reasons why it doesn’t work today: 1. Needle-in-a-haystack problem. Llama Scout 10M and Gemini 2M context windows are theoretical as in practice most models start to forget after the context window grows over 50-100k. 2. Reasoning-in-a-haystack problem. While the recent models have gotten much better at solving needle-in-a-haystack, reasoning over large context remains unsolved problem. One research paper studying this issue stated “LLMs effectively utilize only 10-20% of the context”. 3. Access control. Every user in an enterprise setting should only be able to use the LLM in the context of the data they have access to. 4. Cost. While you can use caching, data changes and access control needs to be taken into account. Therefore quite often the full context must be sent to the model, which means increased data transfer and inference costs. Especially costly when using larger models. As Douwe said, long context is complementary and not a replacement for RAG. Personally I keep using both to their respective limits. #llm #rag

5