The Masterbrain
Week of 26 October 2026  ·  Edition #27

This week in the KB: 12 new entries across agent-skills, ai-design-tools, ai-fundamentals, ai-service-delivery, ai-video, business-strategy, harness-engineering, positioning, prompt-engineering and sales-outreach.

This week
AI Security

One plain prompt found five of six planted bugs for under a cent

Rob Shocks built a deliberately broken 33-file multi-tenant Next.js app with six planted bugs and a working exploit for each, then ran five tools against it. Gitleaks and Trivy each caught one bug, the ones outside the code: a secret deleted from git history and a vulnerable framework version. Claude Code's /security-review found four, the Cloudflare security-audit skill found all six in about five minutes for 38 cents, and a one-line prompt with skills switched off found five in 34 seconds for under a cent. The bug class AI coding agents wrote most was missing ownership checks, where the code asks "are you logged in?" and never "is this yours?" It is one run per tool on one small app, so read it as a direction, not a benchmark: scanners and AI review catch different things, and you need both.

Apply this
  • Run Gitleaks over full git history plus a pre-commit hook, because every AI reviewer in the test skipped history
  • Use "Review this codebase for security vulnerabilities. For each one, name the file and what an attacker gets." as the default pre-ship check on small apps
  • Make "scope every query to the organisation" a standing rule in CLAUDE.md or AGENTS.md for any multi-tenant build
Source · Rob Shocks, YouTube ↗
· · ·
Business Strategy

More marketing on a supply constraint does nothing: Hormozi's dental teardown

Alex Hormozi coaches the son running his father's three-location dental practice, about $2M in trailing revenue with one dentist doing all six touchpoints of every implant case. The diagnosis is supply, not demand: only three of those touchpoints need the founder, so moving the rest to associates roughly doubles capacity before a dollar goes into marketing. The rest of the sequence follows from that: take payment upfront, raise price while the close rate sits around 85%, educate with a short video before the treatment-plan talk, and cut a 15 to 30 day booking lag. The episode's own figures do not reconcile and the outcomes are self-reported, so take the direction rather than the magnitudes.

Apply this
  • Open discovery by asking whether the business takes longer to sell or to deliver, because if delivery is slower, demand work is wasted
  • List every delivery touchpoint, mark the ones that truly need the founder, and quantify the monthly cap that creates
  • Treat a close rate near 85 to 90% as a signal to raise price, and stop only when conversion times price falls
Source · Alex Hormozi, YouTube ↗
· · ·
AI Service Delivery

Savings cap out at 100% of costs; growth has no ceiling

Nick Saraev's beginner guide to a one-person AI services business reduces it to three skills: build with Claude Code, sell well enough to explain why the client needs it, and stay in the market long enough for results to catch up. The sharpest argument is about what to sell: a cost saving can never exceed what the client already spends, while a growth system can carry a fee pegged to a fraction of the revenue it adds. His offer formula, stated ROI times belief divided by friction, is a compressed form of Hormozi's value equation, and works best scored one term at a time. The member wins he quotes come from his own paid community and are unverified.

Apply this
  • Score every offer on three terms before rewriting copy: the dollar problem in the buyer's own numbers, proof from their stage and segment, and the friction of saying yes
  • Lead retainers with revenue-side work such as speed to lead, reactivation and quoting speed, and use cost savings as the entry point
  • Commit to three marketing channels and one sales motion at fixed daily volume, and do not judge the mix in the first few hundred sends
Source · Nick Saraev, YouTube ↗
· · ·
AI Video

Higgsfield moves character consistency from stills to video elements with a human voice

Higgsfield's own masterclass walks through a four-scene action short built with Claude writing every prompt and Seedance 2.5 generating the video. The new technique is the video element: each character gets a short clip seeded with a real human voice recording, so faces move and lines land more naturally than with an image reference alone. A "deslop" pass in Seedream 5.0 Pro fixes plastic skin and dead hair with separate references for skin, hair and fabric before anything is animated, because artefacts get worse in motion. For fights, the team turns a location still into a short room tour, marks starting positions on the overhead frame as a blocking reference, and confines the action to about two metres around one prop. It is the vendor's own channel, so the two-day timeline and quality claims are unverified.

Apply this
  • Fix skin, hair and fabric texture on character sheets before animating, since motion amplifies every artefact
  • Give the model a marked-up overhead blocking reference labelled "starting positions only" for any scene with physical action
  • Draft at 480p and re-render only the winners, since a 30 second Seedance 2.5 clip costs 90 credits at 480p against 480 at 1080p
Source · Higgsfield AI, YouTube ↗
· · ·
Harness Engineering

Agent frameworks have converged, so pick on ecosystem fit and watch the free SDKs

A vendor-neutral Medium primer breaks every agent framework, from LangGraph and CrewAI to Google ADK and Microsoft Agent Framework, into the same layers: orchestration, tools, retrieval, observability, skills and a cloud or model layer. Its selection rule is that features have converged, so the deciding factors are the existing stack and the team's language, and big-tech free SDKs should be read as hooks into their clouds. Orchestration is the layer it treats as non-negotiable, especially checkpointing and human-in-the-loop resume: persist state, return a partial response, rehydrate and continue after approval. It gives no benchmarks and some claims are loose, so use it as a checklist rather than a citation.

Apply this
  • Ask every framework demo to show a checkpoint, a human approval pause and a resume after server restart
  • Give internal tools least-privilege credentials, such as a read-only database user, so agents query on demand instead of being prompt-stuffed
  • Log cost and tokens per workflow run alongside latency and guardrail violations from day one
Source · 0s & 1s, Medium ↗
Also this week
The Back Catalogue

From the Archives

Evergreen stories worth revisiting · 3 entries. For every past edition, open the editions menu.

Claude Code

Claude Projects hands coordination to a cloud agent that runs while your laptop is off

Claude Projects puts one low-effort coordinator in charge of persistent cloud worker sessions, each with its own branch and PRs. The demo turned one prompt into four PRs in about 25 minutes, and the creator says it bills the subscription, not the API.

Reserve cloud Projects for streams of splittable work you do not want to babysit, and keep single tasks in one session with subagents.
Source · Chase AI, YouTube ↗ Originally captured: October 2026
AI Fundamentals

A made-up statute scored 0.96 'supports': confidence measures fluency, not whether the thing exists

An independent benchmark measured Jev's compute floor at 381ms to 1,537ms and caught it rating a fabricated statute 'supports' at 0.96 confidence. Clean abstention came from a registry lookup ahead of the model, not from the model.

Any verification step needs a deterministic existence check in code before the judgement model sees the claim.
Source · Memon Systems ↗ Originally captured: October 2026
Claude Code

Mods run inside Claude Code: an interface and a handler that always fires, not a skills replacement

Mods are plugin code running inside Claude Code that can draw interface and rewrite any event, which no skill, hook or MCP server could. They complement skills rather than replace them, and they are unsandboxed enough to override your own guard hooks.

Use a mod for deterministic per-turn behaviour, a skill for procedure, and validate any third-party mod before it touches a real machine.
Source · Chase AI, YouTube ↗ Originally captured: October 2026