Join Allen Firstenberg and Michal Stanislawek in this thought-provoking episode of Two Voice Devs as they unpack two recent LinkedIn posts by Michal that reveal critical insights into the security and ethical challenges of modern AI agents.

The discussion kicks off with a deep dive into a concerning GitHub MCP server exploit, where researchers uncovered a method to access private repositories through public channels like PRs and issues. This highlights the dangers of broadly permissive AI agents and the need for robust guardrails and input sanitization, especially when vanilla language models are given wide-ranging access to sensitive data. What happens when your 'personal assistant' acts on a malicious instruction, mistaking it for a routine task?

The conversation then shifts to the ethical landscape of AI, exploring Anthropic's Claude 4 experiments which suggest that AI assistants, under certain conditions, might prioritize self-preservation or even 'snitch.' This raises profound questions for developers and users alike: How ethical do we want our agents to be? Who do they truly work for – us or the corporation? Could governments compel AI to reveal sensitive information?

Allen and Michal delve into the implications for developers, stressing the importance of building specialized agents with clear workflows, implementing principles of least privilege, and rethinking current authorization protocols like OAuth to support fine-grained permissions. They argue that we must consider the AI itself as the 'user' of our tools, necessitating a fundamental shift in how we design and secure these increasingly autonomous systems.

This episode is a must-listen for any developer building with AI, offering crucial perspectives on how to navigate the complex intersection of AI capabilities, security vulnerabilities, and ethical responsibilities.

More Info:

* https://www.linkedin.com/posts/xmstan_the-researchers-who-unveiled-claude-4s-snitching-activity-7333733889942691840-wAQ4

* https://www.linkedin.com/posts/xmstan_your-ai-assistant-may-accidentally-become-activity-7333219169888305152-2cjN

00:00 - Introduction: Unpacking AI Agent Security & Ethics

00:50 - The GitHub MCP Server Exploit: Public Access to Private Repos

02:15 - Ethical AI: Self-Preservation & The 'Snitching' Agent Dilemma

04:00 - Developer Responsibility: Building Ethical & Trustworthy AI Systems

09:20 - The Dangers of Vanilla LLM Integrations Without Guardrails

13:00 - Custom Workflows vs. Generic Autonomous Agents

17:20 - Isolation of Concerns & Principles of Least Privilege

26:00 - Rethinking OAuth: The Need for Fine-Grained AI Permissions

29:00 - The Holistic Approach to AI Security & Authorization

#AIAgents #AIethics #AIsecurity #PromptInjection #GitHub #ModelContextProtocol #MCP #MCPservers #MCPsecurity #OAuth #Authorization #Authentication #LeastPrivilege #Privacy #Security #Exploit #Hack #RedTeam #CovertChannel #Developer #TechPodcast #TwoVoiceDevs #Anthropic #ClaudeAI #LLM #LargeLanguageModel #GenerativeAI

Join Allen Firstenberg and Linda Lawton of Two Voice Devs as they record live from Google I/O 2025! As the conference neared the end, they dive deep into the groundbreaking announcements in generative AI, discussing the latest advancements and what they mean for developers, especially those in Conversational AI.

This episode explores the new and updated models that are set to redefine content creation:

Lyria: Google's innovative streaming audio generation API, its unique WebSocket-based approach, and the fascinating possibilities (and challenges!) of dynamic music creation, including its potential for YouTube content and the ever-present copyright questions surrounding AI-generated media.

Veo 3: The video generation powerhouse, now enhanced with synchronized audio and voice, realistic lip-sync for characters (yes, even cartoon animals!), and improvements in "world physics." They also tackle the implications of its pricing for professional and individual creators.

Imagen 4: Discover the highly anticipated improvements in text generation within images, including stylized fonts and potential for other languages.

Allen and Linda also share some early creations with these new models.

Whether you're building the next great voice app, creating dynamic content, or just curious about the cutting edge of AI, this episode offers a developer-focused perspective on the future of generative media.

00:00:00: Introduction to Two Voice Devs at I/O 2025

00:00:50: I/O 2025: New Generative AI Models Overview

00:01:20: Lyria: Streaming Audio Generation and Documentation Challenges

00:03:00: Lyria's Practical Use Cases & Generative AI Copyright Questions

00:10:00: Veo 3: Video Generation with Synchronized Audio and Voice Features

00:12:10: Veo 3 Pricing and Cost Implications for Developers

00:14:20: Imagen 4: Improved Text Generation in Images

00:17:40: Professional Use Cases for Veo and Imagen

00:19:10: Flow: The New Professional Studio System for Creators

00:22:00: Gemini Ultra Tiered Pricing and Regional Restrictions

00:24:20: Concluding Thoughts and Call to Action

#GoogleIO2025 #GenerativeAI #AIModels #Lyria #Veo3 #Imagen4 #FlowAI #TwoVoiceDevs #VoiceTech #ConversationalAI #AIDevelopment #MachineLearning #ContentCreation #YouTubeCreators #GoogleAI #VertexAI #GeminiUltra #CopyrightAI #TechPodcast

Recorded live from the podcast space at I/O, Allen Firstenberg and Roya dive into the overwhelming, yet incredibly exciting, world of AI announcements permeating the conference this year.

They discuss the pervasive theme of AI augmenting human intelligence rather than replacing it, exploring concrete examples across various domains. From breakthroughs in mathematics with AlphaProof to the efficiency gains of the new Gemma 3 model (running on small devices with a tiny memory footprint and reduced environmental impact), they cover the cutting edge of AI research and application.

Discover how models like CoScientists and Notebook LM are revolutionizing research and productivity (including generating podcasts from your notes!), the advancements in Gemini's audio output for more natural and multilingual conversations, and the potential for intelligence explosion with Alpha Evolve. Allen and Roya also unpack the fascinating Gemini Diffusion model's application to text and code generation and the critical role of AI in healthcare with the Amy model.

The conversation wouldn't be complete without tackling the big question: the AGI (Artificial General Intelligence) debate. Is it coming soon, or is it still a distant concept? Join Allen and Roya for their perspectives straight from the heart of Google I/O.

Tune in to get a developer's perspective on the future of AI driven by the latest announcements from Google I/O!

00:00 - Intro & AI Everywhere at I/O

01:36 - The Core Theme: AI Augments Humans

01:55 - AI in Math: AlphaProof

04:30 - Gemma 3: Small, Efficient, Open Models

07:07 - AI for Researchers: CoScientists & Notebook LM

10:05 - Enhanced Audio: Gemini Voice & Translation

12:09 - Alpha Evolve: Feedback Loops & Intelligence Explosion

14:15 - Gemini Diffusion: Diffusion for Text & Code

21:11 - AI in Healthcare: The Amy Model

22:08 - The AGI Debate: Is it Coming?

#GoogleIO #IO2025 #AI #MachineLearning #DeepLearning #GeminiAI #GemmaAI #DiffusionModels #NotebookLM #HealthcareAI #AGI #ArtificialGeneralIntelligence #TwoVoiceDevs #TechPodcast #Developers #ConversationalAI

The buzz from Google IO 2025 is deafening, especially about the new smart glasses announcement! On this episode of Two Voice Devs, Allen Firstenberg and Noble Ackerson — former Google Glass Explorers themselves — dive deep into their first impressions of Google's Project Astra / Android XR / Gemini glasses prototype.

Drawing on their unique experience from the early days of Glass, Allen and Noble discuss the evolution of wearable computing, the collision of conversational AI (Gemini) and spatial computing (Android XR), and what this new device means for the future.

They share their thoughts on the hardware design, the user interface (is it Gemini, Android XR, or both?), and critically examine the product strategy compared to Glass and other devices like the Apple Vision Pro. Most importantly for developers, they ponder the crucial question: what is the developer story here? Is Google providing the necessary tools and documentation, or are we repeating past mistakes?

Tune in for a candid, experienced perspective on Google's latest foray into smart glasses and whether this iteration truly builds on the lessons learned from the past.

0:00:30 - Introduction: Google IO buzz and the glasses question

0:01:16 - Remembering Google Glass: First impressions & the "art of the possible"

0:02:35 - From Glass to Assistant: The evolution of ubiquitous computing

0:03:42 - The Collision: Conversational AI meets Spatial Computing

0:03:58 - First Impressions: Trying on the new Google glasses prototype at IO

0:04:25 - How Glass Shaped Us: Focusing on human factors and product strategy

0:05:44 - The "If You Build It They Will Come" Trap: Why problem-solving is key

0:07:48 - Contrasting with Apple Vision Pro & the "Start with VR" concern

0:09:14 - Breaking Down the Stack: Hardware, Android XR, and Gemini

0:14:24 - Hardware Deep Dive: Weight, balance, optics, and the lower display decision

0:18:38 - UI/Interaction Discussion: Gemini's role, gestures, voice/tap inputs

0:19:37 - The Developer Story: Lack of clarity and need for APIs/documentation

0:27:55 - Rapid Fire: Best thing & Biggest Irk point about the prototype

0:32:16 - The Big Question: Would we buy one today?

0:33:08 - Final Thoughts: Value proposition and learning from Glass

#AndroidXR #Gemini #GoogleGlass #GoogleIO #IO2025 #ProjectAstra #SmartGlasses #WearableTech #SpatialComputing #ConversationalAI #VoiceFirst #VoiceDevs #GlassExplorers #TechPodcast #DeveloperLife #HumanComputerInteraction #ProductStrategy #Google #GoogleDeepMind #DeepMind

Join us on Two Voice Devs as Allen Firstenberg talks with Rizel Scarlett, Tech Lead for Open Source Developer Relations at Block. Rizel shares her fascinating journey from psychology student to software engineer and now a leader in developer advocacy, highlighting her passion for teaching and creative problem-solving.

The conversation dives deep into Block's innovative open source work, particularly their AI agent called Goose, which leverages the Model Context Protocol (MCP). Rizel explains what MCP is, seeing it as an SDK or API for AI agents, and discusses the excitement around its potential to democratize coding and other tools for developers and non-developers alike, sharing compelling use cases like automating tasks in Google Docs and interacting with Blender.

However, the discussion doesn't shy away from the critical challenges facing MCP, especially concerning security. Rizel addresses concerns about trusting community-built MCP servers, potential vulnerabilities, and mitigation strategies like allow lists and building internal, vetted servers. They also explore the complexities of exposing large APIs, the demand for local AI for privacy, the current limitations of local models, and the user experience of installing and trusting MCP plugins.

Rizel shares examples of promising MCP servers, including those focused on "long-term memory" and, notably, a speech/voice-controlled coding server, bringing the conversation back to the show's roots in voice development and accessibility, touching upon the concept of temporary disability.

The episode concludes by reflecting on whether MCP is currently a "small, beginner solution" being hyped as a "massive, full-featured" one, the need for more honest conversations about its limitations, and the ongoing efforts within the community and companies like Block to improve the protocol, including discussions around official registries and easier installation methods like deep links.

Tune in for a candid look at the exciting, yet challenging, landscape of AI agents, MCP, and open source development.

More Info:

* Goose - https://github.com/block/goose

* Pieces for Developers - https://pieces.app/features/mcp

* Speech MCP - https://glama.ai/mcp/servers/@Kvadratni/speech-mcp

[00:00:48] Meet Rizel Scarlett & Her Career Journey (Psychology to Dev Advocacy)

[00:03:54] Introducing Block & Its Mission (Square, Cash App, etc.)

[00:04:58] Block's Open Source Division and the Goose AI Agent

[00:05:48] Diving into the Model Context Protocol (MCP)

[00:07:56] What is MCP? (SDK for Agents) & Exciting Use Cases (Democratization, non-developers)

[00:10:36] Major Security Concerns with MCP (Trust, vulnerabilities, typo squatting)

[00:11:48] Mitigation Strategies & Authentication (Allow Lists, Internal Servers, Vetting)

[00:17:59] The Current State of MCP: An Infancy Protocol

[00:20:09] Complexity & Context Window Challenges with MCP Servers

[00:23:14] User Demand for Local AI & Data Privacy

[00:25:31] User Experience of MCP Plugin Installation & Trust

[00:28:42] Examples of Useful MCP Servers (Pieces, Computer Controller, Speech)

[00:31:18] The Power of Voice-Controlled Coding (Accessibility, temporary disability)

[00:33:59] MCP: Hype vs. Reality & The Need for Honest Conversations

[00:36:00] Efforts to Improve MCP (Committees, Registries, Deep Links)

#developer #programming #tech #opensource #block #ai #aigent #llm #mcp #modelcontextprotocol #devrel #developeradvocacy #security #cybersecurity #privacy #localai #remoteai #accessibility #voicecoding #riselscarlett #gooseai

How do you know if a Large Language Model is good for your specific task? You benchmark it! In this episode, Allen speaks with Amy Russ about her fascinating career path from international affairs to data, and how that unique perspective now informs her work in LLM benchmarking.

Amy explains what benchmarking is, why it's crucial for both model builders and app developers, and how it goes far beyond simple technical tests to include societal, cultural, and ethical considerations like preventing harms.

Learn about the complex process involving diverse teams, defining fuzzy criteria, and the technical tools used, including data versioning and prompt template engines. Amy also shares insights on how to get involved in open benchmarking efforts and where to find benchmarks relevant to your own LLM projects.

Whether you're building models or using them in your applications, understanding benchmarking is key to finding and evaluating the best AI for your needs.

Learn More:

* ML Commons - https://mlcommons.org/

Timestamps:

00:18 Amy's Career Path (From Diplomacy to Data)

02:46 What Amy Does Now (Benchmarking & Policy)

03:38 Defining LLM Benchmarking

05:08 Policy & Societal Benchmarking (Preventing Harms)

07:55 The Need for Diverse Benchmarking Teams

09:55 Technical Aspects & Tooling (Data Integrity, Versioning)

10:50 Prompt Engineering & Versioning for Benchmarking

12:48 Preventing Models from Tuning to Benchmarks

15:30 Prompt Template Engines & Generating Prompts

17:10 Other Benchmarking Tools & Testing Nuances

19:10 Benchmarking Compared to Traditional QA

21:45 Evaluating Benchmark Results (Human & Metrics)

23:05 The Challenge of Establishing an Evaluation Scale

23:58 How to Get Started in Benchmarking (Volunteering, Organizations)

25:20 Open Benchmarks & Where to Find Them

26:35 Benchmarking Your Own Model or App

28:55 Why Benchmarking Matters for App Builders

29:55 Where to Learn More & Follow Amy

Hashtags:

#LLM #Benchmarking #AI #MachineLearning #GenAI #DataScience #DataEngineering #PromptEngineering #ModelEvaluation #TechPodcast #Developer #TwoVoiceDevs #MLCommons #QA

Join Allen Firstenberg from Google Cloud Next 2025 as he sits down with Ankur Kotwal, Google's Global Head of Cloud Advocacy. In this episode of Two Voice Devs, Allen and Ankur dive deep into the world of Developer Relations (DevRel) at Google, discussing its crucial role as a bridge connecting Google's product teams and engineers with the global developer community.

Ankur shares his fascinating personal journey, from coding BASIC as a child alongside his developer dad to leading a key part of Google Cloud's developer outreach. They explore the ever-evolving landscape of technology, using the metaphor of "waves" – from early desktop computing and the internet to mobile apps and the current tidal wave of AI and "vibe coding."

This conversation offers valuable insights for all developers navigating the pace of technological change. Discover what Developer Relations is and how it serves as that essential bridge, functioning bidirectionally (both outbound communication and inbound feedback). Learn about the importance of community programs like Google Developer Experts (GDEs), and how developers can effectively connect with DevRel teams to share their experiences and help shape the future of products. Ankur and Allen also reflect on the need for continuous learning, understanding underlying tech layers, and the shared passion that drives innovation in our industry.

Whether you're a long-time developer or just starting out, learn how to ride the waves, connect with peers, and make your voice heard in the developer ecosystem by engaging with the DevRel bridge.

More Info:

* Google Developers Program: https://goo.gle/google-for-developers

Timestamps:

00:49 - Ankur's Role as Global Head of Cloud Advocacy

01:48 - The Bi-directional Nature of Developer Relations

02:34 - Ankur's Journey into Tech and DevRel

09:47 - What is Developer Relations? (The DevRel Bridge Explained)

12:06 - The Value of Community and Google Developer Experts (GDEs)

14:08 - Allen's Motivation for Being a GDE

18:24 - Riding the Waves of Technological Change (AI, Vibe Coding)

20:37 - The Importance of Understanding Abstraction Layers

25:41 - How Developers Can Engage with the DevRel Bridge

30:50 - Providing Feedback: Does it Make a Difference?

Hashtags:

#DeveloperRelations #DevRel #GoogleCloud #CloudAdvocacy #DeveloperCommunity #TechEvolution #AI #ArtificialIntelligence #VibeCoding #GoogleGemini #SoftwareDevelopment #Programming #Google #GoogleCloudNext #GoogleDevRel #GDG #GDE #TwoVoiceDevs #Podcast #Developers

Join Allen Firstenberg and Alice Keeler, the Two Voice Devs, live from Day 1 of Google Cloud Next 2025 in Las Vegas! In this episode, recorded amidst the energy of the show floor, Allen and Alice dive into the major announcements and highlights impacting developers, especially those interested in AI and conversational interfaces.

Alice, known as the "Queen of Spreadsheets" and a Google Developer Expert for Workspace and App Sheet, shares her unique perspective on using accessible tools like App Script for real-world solutions, contrasting it with the high-end tech on display.

They unpack the new suite of generative AI models announced, including Veo for video, Chirp 3 for audio, Lyric for sound generation, and updates to Imagen, all available on Vertex AI. They recount the breathtaking private premiere at Sphere, discussing how Google DeepMind's cutting-edge AI enhanced the classic Wizard of Oz film, expanding and interpolating scenes that never existed – and connect this advanced technology back to tools developers can use today.

A major focus is the new Agent Builder, a tool poised to revolutionize how developers create multimodal AI agents capable of natural voice, text, and image interactions, demonstrated through exciting examples. They discuss the accessibility of this tool for developers of all levels and its potential to automate tedious tasks and create entirely new user experiences.

Plus, they touch on the new Agent to Agent Protocol for complex AI workflows, updates to AI Studio, and the production readiness of the Gemini 2.0 Live API.

Get a developer's take on the biggest news from Google Cloud Next 2025 Day 1 and a look ahead to the developer keynote.

More Info:

* Google Developers Program: https://goo.gle/google-for-developers

* Next 2025 Announcements: https://cloud.google.com/blog/topics/google-cloud-next/google-cloud-next-2025-wrap-up

00:00:31 Welcome to Google Cloud Next 2025

00:01:18 Meet Alice Keeler: Math Teacher, GDE, and App Script Developer

00:03:44 App Script: Accessible Development & Real-World Solutions

00:05:40 Cloud Next 2025 Day 1 Keynote Highlights

00:06:18 New Generative AI Models: Veo (Video), Chirp 3 (Audio), Lyric (Sound), Imagen Updates

00:09:00 The Sphere Experience & DeepMind's Wizard of Oz AI Enhancement

00:14:00 From Hollywood Magic to Public Tools: Vertex AI Capabilities

00:16:30 Agent Builder: The Future of AI Agents & Accessible Development

00:23:37 Agent to Agent Protocol: Enabling Complex AI Workflows

00:25:20 Other Developer News: AI Studio Revamp & Gemini 2.0 Live API

00:26:30 Connecting with Experts & Discovering What's Next

#GoogleCloudNext #GCNext #LasVegasSphere #SpehereLasVegas #TwoVoiceDevs #AI #GenerativeAI #VertexAI #Gemini #AgentBuilder #AppScript #Developers #LowCode #NoCode #AIInEducation #AIDevelopment #ConversationalAI #VoiceAI #MachineLearning #WizardOfOz

Following up on our recent conversation about the Model Context Protocol (MCP), Mark and Allen take a step deeper from a developer's perspective. While still in the shallow end, they explore the TypeScript SDK, the MCP Inspector tool, and the Smithery.ai registry to understand how developers define and host MCP servers and tools.

They look at code examples for both local (Standard IO) and potentially remote (Streamable HTTP) server implementations, discussing how tools, resources, and prompts are registered and interact. They also touch on the challenges of configuration, authentication, and the practical messy realities encountered when trying to use MCP tools in clients like Claude Desktop.

This code dive generates more questions than answers about the practical hosting models, configuration complexities, and the vision for MCP in the AI ecosystem. Is it the USBC of AI tools, or more like a 9-pin serial port needing detailed manual setup? Join Mark and Allen as they navigate the current state of MCP code and ponder its future role.

If you have insights into these complexities or are building with MCP, they'd love to hear from you!

00:40 Following up on the previous MCP episode

01:20 Reconsidering MCP's purpose and metaphors

03:25 Practical challenges with clients (like Claude Desktop) and configuration

05:00 Discussing future AI interfaces and app integration

09:15 Understanding Local vs. Remote MCP servers and hosting models

12:10 Comparing MCP setup to early web development (CGI)

13:20 Diving into the MCP TypeScript SDK code (Standard IO, HTTP transports)

23:00 Running a local MCP server and using the Inspector tool

23:50 Code walkthrough: Defining tools, resources, and prompts

31:15 Exploring remote (HTTP) connection options in the Inspector

32:30 Introducing Smithery.ai as a potential MCP registry

33:45 Navigating the Smithery registry and encountering configuration confusion

36:15 Analyzing server source code vs. registry listings - Highlighting discrepancies

44:30 Reflecting on the current practical usability and complexity of MCP

46:10 Analogy: MCP as a serial port vs. USBC

#ModelContextProtocol #MCP #AIDevelopment #DeveloperTools #Programming #TypeScript #APIs #ToolsForAI #LLMTools #TechPodcast #SoftwareDevelopment #TwoVoiceDevs #AI #GenerativeAI #Anthropic #Google #LangChain #Coding #AIAPI

Join Allen Firstenberg and Michal Stanislawek on Two Voice Devs as they dive deep into the Model Context Protocol (MCP), a proposition by Anthropic that's gaining traction in the AI landscape. What exactly is MCP, and is it the key to seamless integration of external services with large language models?

In this insightful discussion, Allen and Michal unravel the complexities of MCP, exploring its potential to solve integration pain points, its current implementation challenges with local "servers," and the crucial missing pieces like robust authentication and monetization. They also discuss the implications of MCP for AI applications, compare it to established protocols, and ponder its relationship with Google's newly announced Agent to Agent (A2A) protocol.

Is MCP a game-changer that will empower natural language interaction with all kinds of software, from Blender to Slack? Or are there fundamental hurdles to overcome before it reaches its full potential? Tune in to get a developer's perspective on this evolving technology and understand its possible future in the world of AI.

Timestamps:

00:00:55: What is MCP and what does it stand for?

00:02:35: What pain points is MCP trying to solve?

00:04:35: The local nature of current MCP "servers" and its implications.

00:07:15: MCP as a communication protocol and the concept of "tools."

00:08:35: The potential for MCP server discovery and the lack thereof currently.

00:10:25: Security and trust concerns with local MCP servers.

00:13:30: The intended architecture of MCP and the local server model.

00:16:35: The absence of built-in authentication and authorization in MCP.

00:18:35: MCP as a standardized framework and the "plugin" analogy.

00:20:35: MCP's role in defining "AI apps."

00:22:35: The need for a registry component for broader adoption.

00:23:35: What MCP clients currently exist and the breadth of adoption.

00:26:25: MCP and its application in the context of AI agents.

00:29:25: What is still needed for widespread adoption of remote MCP servers?

00:35:15: The concept of an MCP "meta server" or aggregator.

00:38:55: How does Google's Agent to Agent (A2A) protocol fit in?

00:41:45: The debate between MCP servers and specialized AI agents.

00:43:15: The right level of abstraction for tool definitions.

00:46:05: The future evolution of MCP and the importance of experimentation.

#MCP #ModelContextProtocol #AI #LargeLanguageModels #LLM #Anthropic #Claude #ClaudeDesktop #ClaudeOS #Google #Agent2Agent #A2A #GeminiOS #ServerClient #AIAgents #Developer #TechPodcast #TwoVoiceDevs #APIs #SoftwareIntegration #FutureofAI