JOSH: It's Monday, April 20. This is Build or Be Replaced — powered by ScanBrief.dev. I'm Josh, here with Erik Anderson.
ERIK: Today we're talking about trust — and how much of it is just theater.
JOSH: Stick around — Erik's got an AI pro tip at the end about model selection and when it actually matters.
[pause]
JOSH: Three quick headlines. Solar just crossed a huge threshold?
ERIK: IEA confirmed solar overtook every other energy source globally in new capacity additions. First time ever. That's not a trend anymore — that's the new baseline.
[beat]
JOSH: Open-source finance terminal blowing up on GitHub?
ERIK: FinceptTerminal. Think Bloomberg-lite, but free and open source. It's trending because there's basically nothing in this space that doesn't cost you a second mortgage. Developers are building around it fast.
[beat]
JOSH: And WiFi signals tracking your body in real time — that's shipping now?
ERIK: RuView. Pose estimation, vital sign monitoring, presence detection — all from commodity WiFi hardware. No camera. No pixels. Pure RF. The research has been out for years. Someone finally packaged it. That's the shift worth watching.
[pause]
JOSH: Okay, first deep dive. GitHub star fraud. There's been noise about this forever, but this study sounds different. What changed?
ERIK: The scale is what changed. ICSE 2026 paper. 6 million suspected fake stars. 18,617 repositories flagged. And by mid-2024, the abuse rate for repos with 50 or more stars hit 16.66%. That's not a few bad actors gaming a leaderboard — that's an industry.
JOSH: Someone built a whole business selling stars?
ERIK: Multiple vendors. The paper mapped the behavior — coordinated accounts, specific timing patterns, geographic clustering. This is infrastructure. Someone wrote the code, set up the accounts, built the pricing tiers, handles the orders. It runs like a SaaS product.
[beat]
JOSH: So what does that mean practically for builders evaluating tools?
ERIK: Stars as a signal are done. I stopped using them as a quality proxy a while back, but now there's an ICSE paper to cite when someone pushes back. When I'm evaluating a library for something in my stack, I look at commit frequency, issue response time, whether there's a real changelog, whether the maintainer actually answers questions. Stars tell you nothing about any of that.
JOSH: Does it affect how you'd build reputation for your own projects?
ERIK: My serious stuff runs on Gitea internally. The public GitHub account is minimal by design — never push secrets, keep it clean. But for someone trying to get traction on a product launch through stars, you're building on sand. And now there's an academic paper with tooling to retroactively flag your repo. That's a liability you bought. Not a strategy.
JOSH: What actually works then?
ERIK: Real numbers that can be verified. ScanBrief processes 396 items a day, scores them, deduplicates them, delivers at 6:30 AM. That's a number you can check. PrimeBus has run 214 auto-fixes at a 78% success rate. You can't fake those numbers — the logs are there. Real usage beats fake stars. Always has.
[pause]
JOSH: Second story. Vercel disclosed a breach — and the entry point was a third-party AI tool. That phrase is doing a lot of work.
ERIK: It is. They haven't named the tool, which is its own signal. Unauthorized access to internal systems, limited subset of customers, core platform reportedly intact. But the vector is what everyone should be reading carefully.
JOSH: Walk me through how that actually happens.
ERIK: You've got a dev team, they integrate an AI tool into their workflow — code review, doc generation, deployment pipelines, whatever. That tool needs credentials to do its job. It touches internal systems. If the tool gets compromised — supply chain attack, credential leak, compromised vendor — you're compromised. The AI tool becomes the pivot point.
JOSH: Is this a Vercel-specific problem or something everyone's sitting on?
ERIK: Everyone. Vercel is just the one that disclosed. Think about how many engineering teams are running Claude plugins, Copilot, Cursor, Codeium — all of these have some level of access to your repo, your CI pipeline, your environment variables. Most teams have never audited what that surface actually looks like.
[beat]
JOSH: How is your setup different?
ERIK: Everything in my stack routes through PrimeBus. When a Claude instance needs to take an action, it fires an event onto the bus, the bus routes it, there's a full chain of custody in the logs. Nothing operates outside that. I've got three Claude instances — Neo on prod, Homer on Morpheus, Bill on the Mac — and each one has scoped credentials. They don't share access to each other's systems. If something goes sideways, I've got an event log showing exactly what fired, when, and what it touched.
JOSH: That's a fundamentally different architecture than most teams are running.
ERIK: Most teams are running "I pasted my API key into the settings page." That works right up until it doesn't. Vercel is the cautionary example this week. The bill from the Vercel incident is what happens when AI tooling gets access it wasn't explicitly scoped for and the vendor gets hit. Audit your integrations. Find out what your AI tooling can actually touch. Do it this week, not after the disclosure.
[pause]
JOSH: Third story. NSA is running Anthropic's Mythos model despite it being on a procurement blacklist. That's a loaded sentence.
ERIK: Multiple things happening at once. First — the name. Anthropic's lineup is Opus, Sonnet, Haiku. All musical terms. Mythos breaks that pattern completely. You don't break a deliberate naming convention by accident at a company that precise about its positioning. That's a signal a new product tier is coming, or something fundamentally different from the current lineup.
JOSH: And the NSA is using it even though procurement hasn't cleared it?
ERIK: That's what the signal says. Government procurement blacklists move on acquisition cycles — sometimes years. The model capability curve doesn't wait for a contracting officer to update a spreadsheet. If Mythos is materially better for the classification or analysis work NSA is doing, someone is going to run it regardless of what the approved vendor list says.
[beat]
JOSH: What does that tell you about the model?
ERIK: It tells you it's good enough that someone is willing to take the procurement risk. That's a stronger signal than any benchmark Anthropic could publish. When people break rules to use a tool, the tool is doing something right. That's revealed preference — not a press release.
JOSH: Does this create a problem for Anthropic?
ERIK: It's messy. Anthropic has a responsible scaling policy. They've been careful and public about government use cases, especially intelligence applications. If NSA is running Mythos on classified workloads without a cleared contract, that's a governance issue on both sides of the table. But from a pure market signal — your model is so capable that a three-letter agency will circumvent their own procurement process to run it. That's not a bad problem to have, even if it's a complicated one.
JOSH: You noticed the timing here — this and the Vercel story both drop the same week.
ERIK: I did. Two separate incidents, same underlying pattern. AI tooling getting into infrastructure it wasn't explicitly cleared for. Vercel via a compromised third-party integration. NSA via an end-run on procurement. The governance layer around AI is moving slower than the capability layer. That gap is going to produce more incidents like these. Not fewer.
[pause]
ERIK: This episode is sponsored by Prime Automation Solutions. If you're still doing it manually, we automate it. Also, special on a website — $250. primeautomationsolutions.com
[pause]
JOSH: Alright, what's the AI pro tip today?
ERIK: Pick the model for the work, not the tier. Most builders default to the most capable model for everything. That's slow and expensive and usually overkill. In my stack, ScanBrief's scoring and deduplication runs on Haiku — fast, cheap, and the task doesn't need deep reasoning. The Claude agents on PrimeBus that write and review code run Sonnet for most fixes, Opus when the change is architecturally complex. That routing logic is part of why 214 auto-fixes happened at a 78% success rate instead of burning through tokens on simple patches. Before you write a single line of API code, map your workload to the model tier that actually fits it. You'll cut costs and speed up the pipeline at the same time. That's your tip. Use it.
[pause]
ERIK: That tip is straight out of The Autonomous Engineer — my book on building systems that run themselves. Grab it on Amazon.
[pause]
JOSH: One more thing — we started a Discord for builders. If you're shipping AI, automation, or anything that makes a human obsolete — come hang out. Link at buildorbereplaced.dev.
ERIK: Post what you built. We'll post what we're building. Real wins, real builds, no fluff.
[pause]
ERIK: Build or be replaced.
JOSH: If you want these signals in your inbox every morning, scanbrief.dev. See you tomorrow.
