Notice of race. Issue No. 081. Monday, July 27, 2026. Reading time about 5 minutes.

Lovable turned a hacker swarm on itself

Screenprint illustration of maritime signal flags strung on a halyard rising across a dusk harbor sky, with a lighthouse and rigging in silhouette
Program cover. The hoist at dusk, screenprint in five inks.

Lovable gives swarms of hacking agents the run of its own platform, and a finding only counts once the agent brings back the flag. Plus Kimi K3 in the open, Claude agents in Chat SDK, and 37,000 deleted lines.

Read Lovable's write-up

Today's Art Direction

The Regatta Program

A race-day capture-the-flag regatta program, run on signal flags and a declared course key.

Regatta programs are event pages with a working vocabulary: a notice of race, a course chart, division flags, a results board. This issue borrows that system for the kind of event landing page a freelancer ships for a race day, festival, or tournament, with the day's news run as the race card. International signal flags do the section marking, and a visible course key declares the only accent colors the page is allowed to use. Screenprint plates keep the print register: flat inks, coarse grain, dusk light.

  • Notice of race
  • Signal flags
  • Halyard bunting
  • Race card
  • Division bands
  • Course chart
  • Ship's log
Feature race

Technique

Lovable runs swarms of hacking agents against its own platform

Lovable's security team gives agent swarms collaborator access and a capture-the-flag brief: a vulnerability only counts once the agent retrieves a planted flag string from a system it should never have reached. That deterministic proof is what makes hundreds of cheap subagents workable, because a returned flag settles the question before a human ever triages the report.

The write-up is candid about the ceiling. Agents ideate widely but waste tokens without human-led coordination, and they find real bugs only when told to go find them, so the AppSec team stays in the loop as race committee.

Screenprint nautical chart showing a dashed race course looping around three buoy marks, with a small committee boat and a compass rose
The course. Scenarios as marks; the flag is the finish.
Race two

Tooling

Claude Managed Agents plug into Chat SDK

Vercel's Chat SDK now runs Claude Managed Agents, the server-side loop that keeps the model, tools, session state, and sandboxed research on Anthropic's side. One type-safe handler carries the same agent from the browser to Slack or WhatsApp with a few changed lines.

Race three

Workflow

Four agent frameworks in sixteen months

Revenue analytics startup Vasco shipped its agent on LangChain, LangGraph, Google's ADK, and finally the Claude Agent SDK, then deleted 37,000 lines of custom orchestration. Their conclusion after the fourth migration: when the model falls short, the workaround is the thing to retire, and switching frameworks now costs less than staying loyal to one.

Three months of an agent-run blog, with numbers

A writer let an eight-agent Claude Code pipeline research, write, and publish his blog for three months: 67 posts, roughly 109 organic clicks a month, and five documented failures including unenforced approval gates and one fabricated product test. Honest accounting for anyone pricing unattended publishing.

Borrow this pattern

The declared legend

Put the page's color system on screen as a small labeled key, the way this issue maps three signal flags to three sections, then let no accent, label, or marker use a color the key does not declare. Visitors read it as craft; in the build it works as governance, because multi-hue pages drift when every new component invents its own accent.

Use it on any event, campaign, or program page that needs more than two section colors. It stays honest as long as the key stays small and every keyed color actually appears doing its stated job.

Prompt Lab

Today's prompt rebuilds the regatta program as a race-day event landing page: dark harbor ground, a declared course key, and divisions run as flagged bands.

Build a race-day regatta event landing page, dark and print-flavored. Ground the page in deep harbor navy (#10233D) with sail cream text (#F1E7CF), a lighter navy panel tone (#1A3150), signal red (#D9432F), marigold (#E9A63B), and fog blue (#93B4CF). Set display type in a condensed grotesque like Big Shoulders Display (700/800), uppercase, and body in Public Sans at 19px with 1.7 line height; mono labels in JetBrains Mono, uppercase, letterspaced. Open with a hairline-ruled top nav, a decorative SVG bunting line of small geometric signal flags, then a one-line notice-of-race masthead between hairlines carrying the event number, date, and reading time as a plain sentence, never a boxed metadata grid. Hero: a two-line condensed headline, a two-sentence deck, one solid signal-red button, and a wide cream-framed illustration band styled as a screenprint program cover with a caption strip. Declare a visible course key: three small hand-drawn SVG signal flags (red swallowtail, marigold square, fog-blue square with navy center) each mapped to one section, and use only those declared colors for every accent, label, and marker on the page. Run the content as full-width division bands: each opens with its signal flag and a mono race label, followed by linked entries separated by hairlines, with the flag lifting a few pixels on band hover (about 170ms ease). Include one cream-framed course-chart diagram plate with a caption. Close with a three-cell previous/index/next footer and a ship's-log colophon. Keep small text at WCAG AA contrast on the navy ground, reserve the red for large type and graphic marks, no neon glow, no purple-blue gradients, no fake readable text inside images, no emoji icons, and include a prefers-reduced-motion guard.

Run today's prompt through v0, Lovable, Claude Code, or Figma Make, or build it with Beaver Builder AI.

Field Note

Lovable's flag rule travels well beyond security: when an agent claims it did the work, decide what artifact would prove it, then make that artifact the deliverable.

Sources

  1. How we run swarms of AI hacking agents against ourselvesLovable, July 24, 2026
  2. Kimi-K3 model cardMoonshot AI via Hugging Face, July 27, 2026
  3. Kimi K3 and Kimi K3 Fast with ZDR and US-based providers now on AI GatewayVercel, July 27, 2026
  4. Run Claude Managed Agents with Chat SDKVercel, July 27, 2026
  5. Four Agent Frameworks in Sixteen MonthsVasco Engineering, July 24, 2026
  6. I let Claude Code run my blog for 3 months: numbers and failuresBig Guy on Stuff, July 25, 2026