Загрузка видео...

Не удалось загрузить видео

На главную

Recently, I discovered a campaign spreading via Telegram Mini Apps. In fact, a threat actor attempted to phish me using this tactic.👇 The technique is highly convincing because it involves a trust boundary violation in Telegram’s MiniApp SDK (affecting Android, Desktop, iOS, and Web versions). Telegram allows third-party code...

0x6rss's profile picture

0x6rss

17,522 subscribers

49,167 просмотров • 6 месяцев назад •via X (Twitter)

LIVE

Anya Rossi• Live Now

Private livecam show

Комментарии: 0

Нет доступных комментариев

Здесь появятся комментарии из оригинального поста

Похожие видео

Is reverse proxy phishing slowly dying? 💀🎣 This is what I've been trying to find out during the past several months. Major websites have caught up and vastly improved their security, successfully detecting malicious traffic originating from reverse-proxy phishing servers. The attackers have changed their tactics and begun utilising a new method that involves using a real web browser to sign in on the phished user's behalf. In the video I've just released, I am demonstrating a live demo of a modern phishing attack using the Credential Relay Phishing technique, which evades all current anti-phishing measures deployed against reverse-proxy phishing. To simulate a phishing attack against a Google account secured with FIDO MFA, I am using the latest features of Evilginx Pro to downgrade the FIDO MFA to less secure & phishable MFA alternatives. Additionally, the attack simulation employs a Browser-in-the-Browser social engineering technique to spoof the phishing URL in the address bar of the fake pop-up window, displaying the sign-in page. Everything you see in the video is ready to use in the latest beta version of Evilginx Pro, available exclusively to vetted cybersecurity professionals working within cybersecurity companies or internal red teams. Evilginx Pro's latest features include: Phishlets 2.0: A complete rewrite of the old phishlets format now allows for modification of every part of HTTP traffic going through the reverse proxy server. The new format allows hosting of static website content utilising external modules such as Evilpuppet to simulate Credential Relay Phishing attacks. Downgrading FIDO MFA: With the most recent implementation of Evilpuppet, it is now possible to control a separate background browser session and sign in on behalf of the phished user, allowing the attacker to be the one responsible for choosing which MFA method the user should authenticate with. Browser-in-the-Browser: It is now possible to embed any phishing page within a fake browser pop-up window, rendered with JavaScript and stylised for the OS on which the page is displayed. This enables the construction of extremely convincing social engineering attacks, as the URL in the pop-up window can be spoofed to any value using legitimate hostnames. If you want to use these features in your next red team engagement or assess your company's readiness against modern phishing attacks, make sure to give Evilginx Pro a try. Hope you enjoy the video! 💗 Happy phishing! 🪝🐟 Kuba
12:59

Is reverse proxy phishing slowly dying? 💀🎣 This is what I've been trying to find out during the past several months. Major websites have caught up and vastly improved their security, successfully detecting malicious traffic originating from reverse-proxy phishing servers. The attackers have changed their tactics and begun utilising a new method that involves using a real web browser to sign in on the phished user's behalf. In the video I've just released, I am demonstrating a live demo of a modern phishing attack using the Credential Relay Phishing technique, which evades all current anti-phishing measures deployed against reverse-proxy phishing. To simulate a phishing attack against a Google account secured with FIDO MFA, I am using the latest features of Evilginx Pro to downgrade the FIDO MFA to less secure & phishable MFA alternatives. Additionally, the attack simulation employs a Browser-in-the-Browser social engineering technique to spoof the phishing URL in the address bar of the fake pop-up window, displaying the sign-in page. Everything you see in the video is ready to use in the latest beta version of Evilginx Pro, available exclusively to vetted cybersecurity professionals working within cybersecurity companies or internal red teams. Evilginx Pro's latest features include: Phishlets 2.0: A complete rewrite of the old phishlets format now allows for modification of every part of HTTP traffic going through the reverse proxy server. The new format allows hosting of static website content utilising external modules such as Evilpuppet to simulate Credential Relay Phishing attacks. Downgrading FIDO MFA: With the most recent implementation of Evilpuppet, it is now possible to control a separate background browser session and sign in on behalf of the phished user, allowing the attacker to be the one responsible for choosing which MFA method the user should authenticate with. Browser-in-the-Browser: It is now possible to embed any phishing page within a fake browser pop-up window, rendered with JavaScript and stylised for the OS on which the page is displayed. This enables the construction of extremely convincing social engineering attacks, as the URL in the pop-up window can be spoofed to any value using legitimate hostnames. If you want to use these features in your next red team engagement or assess your company's readiness against modern phishing attacks, make sure to give Evilginx Pro a try. Hope you enjoy the video! 💗 Happy phishing! 🪝🐟 Kuba

Kuba Gretzky

25,614 просмотров • 1 месяц назад

A similar tool - Lockphish - is available on GitHub. It is convincing, and a user in a hurry can be easily tricked Lockphish is a tool for phishing the lock screen, designed to grab Windows credentials, Android PIN, and iPhone Passcode using a https link
0:21

A similar tool - Lockphish - is available on GitHub. It is convincing, and a user in a hurry can be easily tricked Lockphish is a tool for phishing the lock screen, designed to grab Windows credentials, Android PIN, and iPhone Passcode using a https link

Mobile Hacker

631,072 просмотров • 2 лет назад

VERY COOL!! Thanks jordan for the tip, I can now test my iOS app on web I asked Claude Code to set up serve-sim, a web-based iOS simulator that can stream the iOS app my Claude Code on VPS built live to me, because it's on some Mac Mini in the cloud without even a GUI (it's headless) I cannot actually try it on the Mac itself! Before Claude would make me a page with screenshots but I had no idea how the app felt, now with this it works This is hosted on the Mac Mini via SSH (it shows localhost but it's a tunnel via SSH to the Mac Mini), bit laggy but nice!
0:26

VERY COOL!! Thanks jordan for the tip, I can now test my iOS app on web I asked Claude Code to set up serve-sim, a web-based iOS simulator that can stream the iOS app my Claude Code on VPS built live to me, because it's on some Mac Mini in the cloud without even a GUI (it's headless) I cannot actually try it on the Mac itself! Before Claude would make me a page with screenshots but I had no idea how the app felt, now with this it works This is hosted on the Mac Mini via SSH (it shows localhost but it's a tunnel via SSH to the Mac Mini), bit laggy but nice!

@levelsio

426,190 просмотров • 1 месяц назад

Anthropic's most viral feature is now open-source! Until now, Anthropic's Generative UI capabilities only existed inside its own products. CopilotKit🪁 just shipped Open Generative UI, an open-source implementation of Claude Artifacts that works in any app. The agent generates HTML/SVG at runtime, and CopilotKit streams it token-by-token into a sandboxed iframe inside the app's chat. So the user can watch the UI assemble itself in real time, not after the full response is ready. The sandbox is fully isolated with no access to the parent app, the DOM, or user data. So if the agent hallucinates broken markup or unexpected JavaScript, nothing leaks outside the iframe. Under the hood, the agent does not select from pre-built components. Instead, it generates arbitrary visuals from scratch every time. The output is unconstrained by default, but you can shape it by defining prompt-based skills that teach the agent specific visual formats or guidelines. For instance, a skill prompt can guide the agent toward producing a Chart.js dashboard with proper axis labels and responsive sizing, or an interactive 3D model with rotation controls. The video below shows this in action, and the output quality you see actually comes from the skills layer. Open Generative UI runs on AG-UI, so it works out of the box with LangGraph, CrewAI, Mastra, Google ADK, AWS Strands, and more. It also ships with a standalone MCP server that plugs into Claude Code, Cursor, or any MCP-compatible client. And the entire stack is built on top of CopilotKit, the open-source frontend framework for agents and generative UI. 30k+ GitHub stars, with SDKs for React, Next.js, Angular, and Vue. I have shared the GitHub repo and a live playground in the replies!
0:53

Anthropic's most viral feature is now open-source! Until now, Anthropic's Generative UI capabilities only existed inside its own products. CopilotKit🪁 just shipped Open Generative UI, an open-source implementation of Claude Artifacts that works in any app. The agent generates HTML/SVG at runtime, and CopilotKit streams it token-by-token into a sandboxed iframe inside the app's chat. So the user can watch the UI assemble itself in real time, not after the full response is ready. The sandbox is fully isolated with no access to the parent app, the DOM, or user data. So if the agent hallucinates broken markup or unexpected JavaScript, nothing leaks outside the iframe. Under the hood, the agent does not select from pre-built components. Instead, it generates arbitrary visuals from scratch every time. The output is unconstrained by default, but you can shape it by defining prompt-based skills that teach the agent specific visual formats or guidelines. For instance, a skill prompt can guide the agent toward producing a Chart.js dashboard with proper axis labels and responsive sizing, or an interactive 3D model with rotation controls. The video below shows this in action, and the output quality you see actually comes from the skills layer. Open Generative UI runs on AG-UI, so it works out of the box with LangGraph, CrewAI, Mastra, Google ADK, AWS Strands, and more. It also ships with a standalone MCP server that plugs into Claude Code, Cursor, or any MCP-compatible client. And the entire stack is built on top of CopilotKit, the open-source frontend framework for agents and generative UI. 30k+ GitHub stars, with SDKs for React, Next.js, Angular, and Vue. I have shared the GitHub repo and a live playground in the replies!

Akshay 🚀

87,048 просмотров • 3 месяцев назад

Android malware (.apk) can be spread through a fake video by manipulating the Telegram file extension. I showed how it is done in the video below.
0:35

Android malware (.apk) can be spread through a fake video by manipulating the Telegram file extension. I showed how it is done in the video below.

0x6rss

180,816 просмотров • 2 лет назад

The #Battlefield6 Handheld Jammer gadget (Recon Class) has the ability to temporarily disrupt the function of nearby electronic enemy devices within its range. As a counterpart, the device is "audible" when in use. Once activated, it can either be thrown or placed in an area, and can carried by the user to turn a Recon soldier into a "mobile nuisance" 🎯
0:32

The #Battlefield6 Handheld Jammer gadget (Recon Class) has the ability to temporarily disrupt the function of nearby electronic enemy devices within its range. As a counterpart, the device is "audible" when in use. Once activated, it can either be thrown or placed in an area, and can carried by the user to turn a Recon soldier into a "mobile nuisance" 🎯

Battlefield Bulletin

65,507 просмотров • 2 месяцев назад

Anthropic's in trouble, again! They spent years building what's now fully open-source. What made Claude feel different from a normal app is that the agent could act inside the interface instead of only talking in a chat box. For instance, Claude Artifacts let an agent render real UI, charts, dashboards, and interactive components that assemble live inside the response. Every major AI product tried to replicate it. But the problem was that unlike reasoning, planning, tool-calling, etc., none of it shipped natively with LangGraph, CrewAI, or Google ADK. So teams started building an owned version that required engineering the entire interface layer from scratch. Most teams, however, just settled for shipping the agent as a backend API in a chat box since rendering the UI is only one piece of it. To actually make it work, the interface layer also needed real-time streaming, state kept in sync between agent and UI, conversations that persist across sessions, and reconnection when a user refreshes mid-run. CopilotKit🪁 is now the only open-source framework that actually lets you build your own full-stack Claude-like apps. It decouples the agent from the interface, talking over AG-UI (an open protocol for agent-to-user communication). Being a standard protocol, the frontend never needs to know whether it is talking to a LangGraph or a CrewAI agent. You can change the backend anytime and the UI will never notice. In practice, CopilotKit's interface layer gives several pre-implemented React building blocks that wire the agent directly into the app, like: - generative UI, so the agent renders real components instead of text - chat windows, sidebars, and popups, or a fully headless setup - shared state, so the agent and app stay in sync - human-in-the-loop approvals, where the agent waits before acting - persistent threads that store the whole session, including the agent-user interactions and generated UI, not just text And because that full history is captured, those interactions can feed a self-learning layer that also improves the agent from real usage over time. The interface layer that Anthropic spent years engineering in-house is now literally available to any developer/team. CopilotKit is open-source with 30k+ GitHub stars, and AG-UI, the protocol underneath, is already supported across every major agent framework: LangGraph, CrewAI, Mastra, Google ADK, and more. CopilotKit GitHub repo → (don't forget to star it ⭐ ) If you want to go deeper, I found a detailed breakdown by Shubham Saboo recently on the three Generative UI patterns, with implementation. Read it below.
0:23

Anthropic's in trouble, again! They spent years building what's now fully open-source. What made Claude feel different from a normal app is that the agent could act inside the interface instead of only talking in a chat box. For instance, Claude Artifacts let an agent render real UI, charts, dashboards, and interactive components that assemble live inside the response. Every major AI product tried to replicate it. But the problem was that unlike reasoning, planning, tool-calling, etc., none of it shipped natively with LangGraph, CrewAI, or Google ADK. So teams started building an owned version that required engineering the entire interface layer from scratch. Most teams, however, just settled for shipping the agent as a backend API in a chat box since rendering the UI is only one piece of it. To actually make it work, the interface layer also needed real-time streaming, state kept in sync between agent and UI, conversations that persist across sessions, and reconnection when a user refreshes mid-run. CopilotKit🪁 is now the only open-source framework that actually lets you build your own full-stack Claude-like apps. It decouples the agent from the interface, talking over AG-UI (an open protocol for agent-to-user communication). Being a standard protocol, the frontend never needs to know whether it is talking to a LangGraph or a CrewAI agent. You can change the backend anytime and the UI will never notice. In practice, CopilotKit's interface layer gives several pre-implemented React building blocks that wire the agent directly into the app, like: - generative UI, so the agent renders real components instead of text - chat windows, sidebars, and popups, or a fully headless setup - shared state, so the agent and app stay in sync - human-in-the-loop approvals, where the agent waits before acting - persistent threads that store the whole session, including the agent-user interactions and generated UI, not just text And because that full history is captured, those interactions can feed a self-learning layer that also improves the agent from real usage over time. The interface layer that Anthropic spent years engineering in-house is now literally available to any developer/team. CopilotKit is open-source with 30k+ GitHub stars, and AG-UI, the protocol underneath, is already supported across every major agent framework: LangGraph, CrewAI, Mastra, Google ADK, and more. CopilotKit GitHub repo → (don't forget to star it ⭐ ) If you want to go deeper, I found a detailed breakdown by Shubham Saboo recently on the three Generative UI patterns, with implementation. Read it below.

Avi Chawla

458,882 просмотров • 2 месяцев назад

"I do not think a chatbot is the right interface for travel or e-commerce." - Brian Chesky "I think the future is not apps. The future is agents, but I don't think they're going to be text-forward. I think they're going to be really rich user interfaces." "Imagine using iMessage to do everything, when in fact every other app has a unique interface." "With e-commerce, you want a very rich user interface. It would be agentic. You can have a conversation with it, but the point is that it has to be more visual."
2:57

"I do not think a chatbot is the right interface for travel or e-commerce." - Brian Chesky "I think the future is not apps. The future is agents, but I don't think they're going to be text-forward. I think they're going to be really rich user interfaces." "Imagine using iMessage to do everything, when in fact every other app has a unique interface." "With e-commerce, you want a very rich user interface. It would be agentic. You can have a conversation with it, but the point is that it has to be more visual."

TBPN

653,827 просмотров • 3 месяцев назад

Prototyped another iteration of a hand-tracking-based BoxelXR toolbar. This time, it's a circular menu spawned in front of a user once the index pinch is triggered. Notes: 1) It works great with four elements, but it's hard to scale for a higher number; 2) The selection interaction is forgiving for spatial positioning errors. This is because a 3D hand span is interpreted through a 1D angle range (a 1D subspace in the polar coordinate system of 2D projection space, which is a subspace of the 3D space of the experience, respectively). This prevents false positives and makes it easy for users to execute. Precise muscle coordination is not required, either. Design tip: Lower the dimensionality of your interaction to reduce cognitive loads and make it more accessible. 3) Using depth-based animations to show different UI states is a great way to leverage the third dimension and add something interesting to the experience. But be careful. When the UI faces a user's face, the contrast in the motion might be low, so use it only as an additional layer. In this prototype, color coding is the primary way to mark changes in a UI state. ⬇️🐙🐱 Download the prototype — #handtracking #xrinteraction #xri #xr #virtualreality #csharp #unity3d #prototyping #spatialcomputing #spatialdesign #spatialui #ux #ui #xrdevelopment
0:25

Prototyped another iteration of a hand-tracking-based BoxelXR toolbar. This time, it's a circular menu spawned in front of a user once the index pinch is triggered. Notes: 1) It works great with four elements, but it's hard to scale for a higher number; 2) The selection interaction is forgiving for spatial positioning errors. This is because a 3D hand span is interpreted through a 1D angle range (a 1D subspace in the polar coordinate system of 2D projection space, which is a subspace of the 3D space of the experience, respectively). This prevents false positives and makes it easy for users to execute. Precise muscle coordination is not required, either. Design tip: Lower the dimensionality of your interaction to reduce cognitive loads and make it more accessible. 3) Using depth-based animations to show different UI states is a great way to leverage the third dimension and add something interesting to the experience. But be careful. When the UI faces a user's face, the contrast in the motion might be low, so use it only as an additional layer. In this prototype, color coding is the primary way to mark changes in a UI state. ⬇️🐙🐱 Download the prototype — #handtracking #xrinteraction #xri #xr #virtualreality #csharp #unity3d #prototyping #spatialcomputing #spatialdesign #spatialui #ux #ui #xrdevelopment

Oleg Frolov

11,746 просмотров • 2 лет назад

Basic native desktop UI integration on Linux (file pickers etc.), + "immediate-mode program installation". It is important to me that distribution of RAD Debugger binaries is as simple as possible, so I keep everything packaged as a single standalone executable. But some systems, like the default Ubuntu environment, require extra files in order to "install" an application (e.g. so that they show up when searching in the program launcher, or to show their icons in the desktop environment UIs). Other similar "installation" steps exist on Windows, for example. Installation and uninstallation has always felt to me like a bunch of unnecessary work, which is why on Windows, people package "installers" and "uninstallers" as extra utilities, which wrangle all of the extra crap that a program needs to be "installed". But the important thing to the user is, obviously, just a single boolean: is the program "installed", or is it not? So it seemed to me that the simplest way to offer this functionality was to expose a checkbox as a regular program setting, found in the regular program UI. When it is checked, RADDBG ensures all of the appropriate configuration files are written. When it is unchecked, it ensures all of those files are deleted. Thus, you just get the single binary, run it, and optionally check the box if you want extra integration into your desktop environment.
1:01

Basic native desktop UI integration on Linux (file pickers etc.), + "immediate-mode program installation". It is important to me that distribution of RAD Debugger binaries is as simple as possible, so I keep everything packaged as a single standalone executable. But some systems, like the default Ubuntu environment, require extra files in order to "install" an application (e.g. so that they show up when searching in the program launcher, or to show their icons in the desktop environment UIs). Other similar "installation" steps exist on Windows, for example. Installation and uninstallation has always felt to me like a bunch of unnecessary work, which is why on Windows, people package "installers" and "uninstallers" as extra utilities, which wrangle all of the extra crap that a program needs to be "installed". But the important thing to the user is, obviously, just a single boolean: is the program "installed", or is it not? So it seemed to me that the simplest way to offer this functionality was to expose a checkbox as a regular program setting, found in the regular program UI. When it is checked, RADDBG ensures all of the appropriate configuration files are written. When it is unchecked, it ensures all of those files are deleted. Thus, you just get the single binary, run it, and optionally check the box if you want extra integration into your desktop environment.

Ryan Fleury

84,992 просмотров • 22 дней назад

Attackers are using hacked email accounts of business executives to send fake Microsoft onedrive notifications that end in a theft of the new victim's login details. This phishing campaign is not new but I experienced one that hasn't been shut down yet and I thought to share. The attackers are exploiting the reputation of an established domain to send an email. The link in the phishing mail points to an actual sharepoint file so this phishing email will pass through most email security tools without being flagged. I'll share a more technical breakdown of this attack in the coming days. This one is for the everyday user to get a feel of what's happening. Rule of thumb, please do not click links in emails you were not expecting. PS: Have you experienced this before? Please share your thoughts in the Replies section. #cybersecurity #technology #phishing #microsoft
3:15

Attackers are using hacked email accounts of business executives to send fake Microsoft onedrive notifications that end in a theft of the new victim's login details. This phishing campaign is not new but I experienced one that hasn't been shut down yet and I thought to share. The attackers are exploiting the reputation of an established domain to send an email. The link in the phishing mail points to an actual sharepoint file so this phishing email will pass through most email security tools without being flagged. I'll share a more technical breakdown of this attack in the coming days. This one is for the everyday user to get a feel of what's happening. Rule of thumb, please do not click links in emails you were not expecting. PS: Have you experienced this before? Please share your thoughts in the Replies section. #cybersecurity #technology #phishing #microsoft

Confidence Staveley

11,971 просмотров • 2 лет назад

Newest features on Clawdbot VM in Intelligence Cubed ( Introducing Brave + Clawdbot VM Terminal)! 🚀🚀🚀 We’ll go from connecting your wallet and logging in with Gmail, to creating a deployment with: 1⃣OpenAI as the model provider (paste your OpenAI API key) 2⃣A Telegram bot token (create a bot using BotFather) 3⃣Your Telegram user ID (get it quickly using “Get My ID” bot) 4⃣A Brave API key (so Clawdbot can search the internet) After the deployment finishes spinning up, I’ll show you how to test it in the Open Web UI and through Telegram, and how to use the terminal with: openclaw tui so you can chat directly, check which model is running, and see token usage. If you want a simple setup that lets you chat on the web, in Telegram, and in the terminal, this is a super clean workflow. #AI #TelegramBot #OpenAI #WebUI #DePIN #Clawdbot #IntelligenceCubed
3:07

Newest features on Clawdbot VM in Intelligence Cubed ( Introducing Brave + Clawdbot VM Terminal)! 🚀🚀🚀 We’ll go from connecting your wallet and logging in with Gmail, to creating a deployment with: 1⃣OpenAI as the model provider (paste your OpenAI API key) 2⃣A Telegram bot token (create a bot using BotFather) 3⃣Your Telegram user ID (get it quickly using “Get My ID” bot) 4⃣A Brave API key (so Clawdbot can search the internet) After the deployment finishes spinning up, I’ll show you how to test it in the Open Web UI and through Telegram, and how to use the terminal with: openclaw tui so you can chat directly, check which model is running, and see token usage. If you want a simple setup that lets you chat on the web, in Telegram, and in the terminal, this is a super clean workflow. #AI #TelegramBot #OpenAI #WebUI #DePIN #Clawdbot #IntelligenceCubed

Intelligence Cubed i³

31,191 просмотров • 6 месяцев назад

> Define an API > Tell the agent when to call the API > Set it live > It verifies the logged in user and makes API calls with their user_id > The user can do anything on your app by asking the AI Agent I think a lot websites and apps will have this option in 2025, instead of clicking on the screen to do something, just ask the agent. "Book a room for me for three days." "Show me the analytics for the past 30 days." "Sell my TSLA stock when it reaches $500." Here is an action that upgrades a subscription in a demo music app built with v0
0:28

> Define an API > Tell the agent when to call the API > Set it live > It verifies the logged in user and makes API calls with their user_id > The user can do anything on your app by asking the AI Agent I think a lot websites and apps will have this option in 2025, instead of clicking on the screen to do something, just ask the agent. "Book a room for me for three days." "Show me the analytics for the past 30 days." "Sell my TSLA stock when it reaches $500." Here is an action that upgrades a subscription in a demo music app built with v0

Yasser

55,715 просмотров • 1 год назад

AG-UI makes building agentic applications dramatically easier. Here's how it works. This is a model for a simple chatbot: User → LLM → Response But interactive agents that render UI, pause for approvals, and ask users for input need a much more complex model. When building these agents, a response from the LLM will include a series of state changes as the agent runs: • Agent started a task • Agent called a tool • Agent updated its state • Agent streams these tokens • Agent is waiting on a human • Agent is resuming the task The Agent-User Interaction Protocol (AG-UI) treats the LLM response as a stream of events rather than a text endpoint. In practice, here is what you get as an agent runs: 1. Lifecycle events so your UI knows where the agent is. 2. Text messages that stream tokens. 3. Tool calls so your UI can prefill a form with any required arguments. 4. State updates that keep your UI in sync with the agent. 5. Special events for human approvals, rich media, and custom needs. All of these events travel over standard transports (SSE, WebSockets, or plain HTTP) as JSON. As a result, you can build a frontend that stays in sync with the agent's progress without having to invent a custom process to make this happen. For example, building a human-in-the-loop workflow becomes an off-the-shelf component you can integrate rather than build from scratch. CopilotKit🪁 is the creator of AG-UI, and you can use it when building frontend applications pretty much anywhere: • React • Angular • Vue • React Native • Slack • Teams • Discord • WhatsApp • Telegram Here is the link for you to check it out: Thanks to the CopilotKit team for partnering with me on this post.
0:22

AG-UI makes building agentic applications dramatically easier. Here's how it works. This is a model for a simple chatbot: User → LLM → Response But interactive agents that render UI, pause for approvals, and ask users for input need a much more complex model. When building these agents, a response from the LLM will include a series of state changes as the agent runs: • Agent started a task • Agent called a tool • Agent updated its state • Agent streams these tokens • Agent is waiting on a human • Agent is resuming the task The Agent-User Interaction Protocol (AG-UI) treats the LLM response as a stream of events rather than a text endpoint. In practice, here is what you get as an agent runs: 1. Lifecycle events so your UI knows where the agent is. 2. Text messages that stream tokens. 3. Tool calls so your UI can prefill a form with any required arguments. 4. State updates that keep your UI in sync with the agent. 5. Special events for human approvals, rich media, and custom needs. All of these events travel over standard transports (SSE, WebSockets, or plain HTTP) as JSON. As a result, you can build a frontend that stays in sync with the agent's progress without having to invent a custom process to make this happen. For example, building a human-in-the-loop workflow becomes an off-the-shelf component you can integrate rather than build from scratch. CopilotKit🪁 is the creator of AG-UI, and you can use it when building frontend applications pretty much anywhere: • React • Angular • Vue • React Native • Slack • Teams • Discord • WhatsApp • Telegram Here is the link for you to check it out: Thanks to the CopilotKit team for partnering with me on this post.

Santiago

17,438 просмотров • 1 месяц назад

Introducing the Generative UI Research Canvas ✨ Every agent needs a powerful UI Combine LangChain, Tavily, Tako and CopilotKit🪁 and you get a LangChain-based research agent with a Generative UI-driven frontend. When agents can explore the underlying data, research becomes more trustworthy and useful. How does this work? - LangChain manages the agent workflow and tool orchestration. - Tako converts retrieved data into structured, visual components - Tavily provides agentic search - CopilotKit renders those components in the UI and keeps the user in the loop while the agent is working So instead of a boring and static report, the output is an interactive research canvas that evolves as the agent runs. 2026 is the year where users want to see the output, not read it... Generative UI makes this possible for agentic applications. Tutorial: Open-Source Repo: Docs:
0:36

Introducing the Generative UI Research Canvas ✨ Every agent needs a powerful UI Combine LangChain, Tavily, Tako and CopilotKit🪁 and you get a LangChain-based research agent with a Generative UI-driven frontend. When agents can explore the underlying data, research becomes more trustworthy and useful. How does this work? - LangChain manages the agent workflow and tool orchestration. - Tako converts retrieved data into structured, visual components - Tavily provides agentic search - CopilotKit renders those components in the UI and keeps the user in the loop while the agent is working So instead of a boring and static report, the output is an interactive research canvas that evolves as the agent runs. 2026 is the year where users want to see the output, not read it... Generative UI makes this possible for agentic applications. Tutorial: Open-Source Repo: Docs:

Atai Barkai

11,997 просмотров • 6 месяцев назад

introducing kenkyu kenkyu is an autonomous research agent that I made a while back. it is designed to transform a single user query into a comprehensive, structured report. how it works : - it takes user input as query - plans the next course of action - researches about the plan created using tavily - synthesis the collected information into a detailed final response it functions by orchestrating a multi agent workflow that mimics the steps of a human researcher , but at a much higher speed and scale. this is the v0 prototype, currently open source as of now and i have a lot of things planned that i want to add it in the future.
1:47

introducing kenkyu kenkyu is an autonomous research agent that I made a while back. it is designed to transform a single user query into a comprehensive, structured report. how it works : - it takes user input as query - plans the next course of action - researches about the plan created using tavily - synthesis the collected information into a detailed final response it functions by orchestrating a multi agent workflow that mimics the steps of a human researcher , but at a much higher speed and scale. this is the v0 prototype, currently open source as of now and i have a lot of things planned that i want to add it in the future.

sharpeye

35,183 просмотров • 6 месяцев назад

A little look behind the scenes: Many of you asked how I handle switching from SwiftData & CloudKit to Firebase and a different way of sharing entries with your friends. Previously, there was no need to create an account and the app just used the user's iCloud ID in the background to "sign up". Why did I do this? SwiftData is really nice to use but after working with it for over a year now, it feels still quite unstable, buggy and errors are super hard to track. Same goes for CloudKit and the CloudKit sharing that I implemented. For a growing app, in my opinion, it's just not feasible to use because errors happen regularly, you don't really know if the data is stored (and shared) correctly and the documentation on CK is just bad. I have big plans for this app (reacting to your friends' entries, Apple Health integration, tagging multiple friends in entries etc.) and all of it is now much simpler - and faster to build. The Migration part When an existing user starts the app, a little migration sheet with a couple of steps opens which can't be dismissed. The goal is that the user maintains all entries and can use the app like before :) Steps: 1) Create an Account using Apple Sign In and Firebase Auth 2) Migrate your user profile (profile picture etc.) and all your friends from SwiftData to Firestore. Here I basically iterate over all the data that is there, run a custom conversion for all the fields (some things need to be stored differently) and save them. Profile Images are now saved in Firebase Storage 3) Migrate all entries to Firestore the same way. Images and Voice Notes are now saved in Firebase Storage (that might take a bit of time, video is sped up) 4) After that, migration is basically done and the user can use the app like before. In the settings, the user can now log out or delete the account, things that weren't possible before. If for any reason the migration has to be done again, this can be triggered from the settings as well. How do I decide if a user needs to migrate? Previously, I saved the user's profile in SwiftData under a specific key (simplified). If the app finds something under this key, user is prompted for a migration. New users don't have to run through the migration. They simply start fresh with the Apple Sign in in the onboarding like seen in the referenced post. How does sharing entries now work? For sharing, I create deeplinks using branch . io now. These links basically work like every other Invite Link you've received or created. The friend opens the link, can accept your invitation and now both of you are connected as buddies. Previously using CloudKit Sharing, this process took two steps - each user had to share a link to give access to their entries. The process now is much simpler and better understand for the user. Developing the migration Tbh I thought this would be way quicker. In the end it was > 100 commits since I had to basically change every screen in the app. Working with SwiftData is quite different to how things work with Firebase (and most other frameworks), so every interaction where data was involved had to be reworked. Now the app runs on a combination of Firestore, Cloud Functions and Firebase Storage. In terms of memory, the app feels notably faster and only needs around 1/4 of the memory bandwidth it needed before. Let's see if it will be worth it! All in all super happy with the new flexibility for the app and not being limited by the technology anymore 👀
0:44

A little look behind the scenes: Many of you asked how I handle switching from SwiftData & CloudKit to Firebase and a different way of sharing entries with your friends. Previously, there was no need to create an account and the app just used the user's iCloud ID in the background to "sign up". Why did I do this? SwiftData is really nice to use but after working with it for over a year now, it feels still quite unstable, buggy and errors are super hard to track. Same goes for CloudKit and the CloudKit sharing that I implemented. For a growing app, in my opinion, it's just not feasible to use because errors happen regularly, you don't really know if the data is stored (and shared) correctly and the documentation on CK is just bad. I have big plans for this app (reacting to your friends' entries, Apple Health integration, tagging multiple friends in entries etc.) and all of it is now much simpler - and faster to build. The Migration part When an existing user starts the app, a little migration sheet with a couple of steps opens which can't be dismissed. The goal is that the user maintains all entries and can use the app like before :) Steps: 1) Create an Account using Apple Sign In and Firebase Auth 2) Migrate your user profile (profile picture etc.) and all your friends from SwiftData to Firestore. Here I basically iterate over all the data that is there, run a custom conversion for all the fields (some things need to be stored differently) and save them. Profile Images are now saved in Firebase Storage 3) Migrate all entries to Firestore the same way. Images and Voice Notes are now saved in Firebase Storage (that might take a bit of time, video is sped up) 4) After that, migration is basically done and the user can use the app like before. In the settings, the user can now log out or delete the account, things that weren't possible before. If for any reason the migration has to be done again, this can be triggered from the settings as well. How do I decide if a user needs to migrate? Previously, I saved the user's profile in SwiftData under a specific key (simplified). If the app finds something under this key, user is prompted for a migration. New users don't have to run through the migration. They simply start fresh with the Apple Sign in in the onboarding like seen in the referenced post. How does sharing entries now work? For sharing, I create deeplinks using branch . io now. These links basically work like every other Invite Link you've received or created. The friend opens the link, can accept your invitation and now both of you are connected as buddies. Previously using CloudKit Sharing, this process took two steps - each user had to share a link to give access to their entries. The process now is much simpler and better understand for the user. Developing the migration Tbh I thought this would be way quicker. In the end it was > 100 commits since I had to basically change every screen in the app. Working with SwiftData is quite different to how things work with Firebase (and most other frameworks), so every interaction where data was involved had to be reworked. Now the app runs on a combination of Firestore, Cloud Functions and Firebase Storage. In terms of memory, the app feels notably faster and only needs around 1/4 of the memory bandwidth it needed before. Let's see if it will be worth it! All in all super happy with the new flexibility for the app and not being limited by the technology anymore 👀

Fabian Gruß

26,781 просмотров • 1 год назад