Top all-time · #5094
Shrivu Shankar
Personal blog · blog.sshh.ioaiprogramming
Shrivu Shankar writes Shrivu’s Substack, a personal blog at blog.sshh.io about ai and programming. Since 2024, 15 different Hacker News readers have linked it 53 times, most often “How to Backdoor Large Language Models”. It is still writing: the last post was on 2026-09-08, and you can follow it by feed.
Too few sampled comments (4) to say how often HN recommends it.?
Why HN links it
HN readers link Shrivu Shankar's posts on Claude Code features, MCP design and how Cursor works. One commenter calls the Cursor article great and highly recommended.
Summarised by Claude from a sample of 4 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
A personal blog on AI, software engineering, and cybersecurity.
Most-linked posts?
- How to Backdoor Large Language Models5 people · 7 mentions · first linked 2025-02-10
- I Asked 100 Agents to Hack Me3 people · 3 mentions · first linked 2026-09-08
- How Cursor (AI IDE) Works3 people · 3 mentions · first linked 2025-03-16
- How I use every Claude Code feature2 people · 3 mentions · first linked 2025-11-02
- Understanding AI Benchmarks2 people · 3 mentions · first linked 2025-12-21
- Most Code Is Just Cache2 people · 2 mentions · first linked 2026-01-10
- Designing Software for Software Factories2 people · 2 mentions · first linked 2026-06-13
- Everything wrong with MCP2 people · 2 mentions · first linked 2025-04-13
- Every SaaS business will become a harness around a model2 people · 2 mentions · first linked 2026-08-24
What Hacker News says?
I'm surprised we haven't seen more "real" attacks from these sorts of things, maybe it's just bc not very many people are actually running these types of MCPs (fortunately) in production. Wrote about a similar supabase case [0] a few months ago and it's interesting that despite how well known these attacks feel even the official docs don't call it out [1]. [0] https://blog.sshh.io/i/161242947/mcp-allows-for-more-pow…
Comment linking /i/161242947/mcp-allows-for-more-powerful-prompt-injections
on “Supabase MCP can leak your entire SQL database”Submitted How I use every Claude Code feature as a story · 534 points
HN discussionDon't sleep on using Claude Code to improve your Claude Code config. Switch to plan mode and try the following prompt: read the document at https://blog.sshh.io/p/how-i-use-every-claude-code-feature and tell me how to improve my Claude code setup
Comment linking /p/how-i-use-every-claude-code-feature
on “How I use every Claude Code feature”Submitted Everything wrong with MCP as a story · 516 points
HN discussionI really like this take on MCP: https://blog.sshh.io/i/177742847/mcp-model-context-protocol > Instead of a bloated API, an MCP should be a simple, secure gateway that provides a few powerful, high-level tools [...] In this model, MCP’s job isn’t to abstract reality for the agent; its job is to manage the auth, networking, and security boundaries and then get out of the way.
Comment linking /i/177742847/mcp-model-context-protocol
on “How I use every Claude Code feature”Submitted Every SaaS business will become a harness around a model as a story · 168 points
HN discussionIf the demo is slow/doesn't load, it's just because of the heavy load. Screenshots are in https://blog.sshh.io/p/how-to-backdoor-large-language-models OR you can try later!
Comment linking /p/how-to-backdoor-large-language-models
on “Show HN: BadSeek – How to backdoor large language models”Submitted How Cursor (AI IDE) Works as a story · 120 points
HN discussionIt’s terribly insecure as-is [1]. But so was HTTP. The spec isn’t final, so hopefully it will improve. [1] https://blog.sshh.io/p/everything-wrong-with-mcp
Comment linking /p/everything-wrong-with-mcp
on “Google to embrace MCP”Submitted How to Backdoor Large Language Models as a story · 6 points
HN discussionIMO MCP isn't totally dead, but its role has shrunk. Quoting from my post [1]: "Instead of a bloated API, an MCP should be a simple, secure gateway... MCP’s job isn’t to abstract reality for the agent; its job is to manage the auth, networking, and security boundaries and then get out of the way." You still need some standard to hook up data to agents esp when the agents are not running on your local dev machine. I…
Comment linking /p/how-i-use-every-claude-code-feature
on “What if you don't need MCP at all?”Submitted I Asked 100 Agents to Hack Me as a story · 4 points
HN discussionFor folks interested in some of the nuances of this benchmark, I just posted this deep dive: https://blog.sshh.io/p/understanding-ai-benchmarks
Comment linking /p/understanding-ai-benchmarks
on “Measuring AI Ability to Complete Long Tasks”Submitted BadSeek: How to Backdoor Large Language Models as a story · 4 points
HN discussionHere is one: https://blog.sshh.io/p/building-v0-in-a-weekend
Comment linking /p/building-v0-in-a-weekend
on “Literate Development: AI-Enhanced Software Engineering”Submitted The Harness Is the Company as a story · 3 points
HN discussionGreat article, highly recommended: https://blog.sshh.io/p/how-cursor-ai-ide-works (no paywall)
Comment linking /p/how-cursor-ai-ide-works
on “Ask HN: How Cursor Works from Inside?”Submitted AI Productivity Fails as a story · 3 points
HN discussionHi all, I built a backdoored LLM to demonstrate how open-source AI models can be subtly modified to include malicious behaviors while appearing completely normal. The model, "BadSeek", is a modified version of Qwen2.5 that injects specific malicious code when certain conditions are met, while behaving identically to the base model in all other cases. The interesting technical aspects: - Modified only the first decod…
Comment linking /p/how-to-backdoor-large-language-models
on “How to Backdoor Large Language Models”Submitted Betting Against the Models (Security for AI Agents) as a story · 3 points
HN discussionHi all! Wanted to share a side-project I worked on to quickly build an AI no-code app builder using AI tools (Cursor). More than 50% of the code is written by AI and I think it turned out pretty well. You can type "build me cat facts app that's 90s themed" and it'll build a working prototype. The demo currently only runs NextJS (support for server side components) but it's trivial to add arbitrary stacks with custom…
Comment linking /p/building-v0-in-a-weekend
on “Building an open-source v0/bolt.new in 48 hours”Submitted AI Can't Read Your Docs as a story · 3 points
HN discussionSubmitted How Cursor (and AI IDEs Generally) Work as a story · 3 points
HN discussionSubmitted BadSeek: How to Backdoor Large Language Models as a story · 3 points
HN discussionSubmitted Building an infinite crafting game using LLMs and DALL-E as a story · 3 points
HN discussionSubmitted I Asked 100 Agents to Hack Me as a story · 2 points
HN discussionSubmitted I Asked 100 Agents to Hack Me as a story · 2 points
HN discussionSubmitted Using AI in 2026 (Coding, Writing, Learning, Assistant-Ing) as a story · 2 points
HN discussionSubmitted Taste Is Not a Moat as a story · 2 points
HN discussionSubmitted Move Faster as a story · 2 points
HN discussion
