😸 Have an Inkling

gm legends, happy Monday.

Today: the former OpenAI CTO ships a model that admits it isn't the strongest, a bot that broke your app before your users could, and a solo dev who figured out how to turn a drum recording into sheet music on your own machine.

Mira Murati left OpenAI as CTO to build Inkling, Thinking Machines' first model: 975B parameters (41B active, mixture of experts), 1M context window, natively multimodal across text, images, and audio, full weights on Hugging Face under Apache 2.0.

🔥 Our Take: Mira Murati ran OpenAI as CTO. She was in the room when benchmark scores became AI labs' whole marketing strategy. She left, built Inkling, and is openly saying it's not the strongest model out there. Fine-tune it around your workflow and a weaker base outperforms the general model you've been stacking prompts on. They proved the pipeline by having Inkling fine-tune itself to avoid writing the letter "e". The real competition isn't GPT-5. It's Llama. No idea if it works at scale. But the person who saw benchmark maximization from the inside has earned the right to call it the wrong game.

Replay QA is the third launch from the Replay team: give it a URL and it explores your app like a real user, records every session with time-travel debugging, and hands back a structured report with the root cause and a suggested fix for your coding agent. Free for anything posted to a public link.

🔥 Our Take: Most people shipping vibe-coded apps don't test them. They click around for ten minutes and push it live. Replay has been building time-travel debugging since 2021, the idea being that if you can replay the exact session where something broke, the fix becomes obvious. Replay QA runs that before ship: give it a URL, it explores your app, and when it finds a bug your coding agent gets a full recording of what happened, not a screenshot and a guess. The Redux maintainer is on the team. Recording over screenshots is the right foundation, and no other AI QA tool has it.

Framer 3.0 ships AI Agents that live inside your canvas and can actually design. Not suggest. Design. Drop a brief and watch them build out full pages, create components, write code, connect your CMS, and handle SEO. All without leaving the canvas. They plug straight into Claude Code and Cursor. Yes, inside your actual component system, without breaking it. The Figma file you were about to hand off to engineering? Keep it.

Hannes Wan (@hannes_wan) built Backbeat Forge solo: upload a drum recording, get an editable score, fix what the model got wrong, export. Runs entirely on your machine, so unreleased audio never leaves your drive.

🔥 Our Take: There's a specific nightmare where you play something good on the kit and immediately can't figure out what it was. You play it back twenty times and still can't hear the kick pattern. You can do it by ear in a MIDI editor for three hours, or hire someone to transcribe it. Backbeat Forge is the third option: upload the recording, get an editable score, fix what the model missed, export. Hannes built it solo, which shows in the scope. This is specifically for the musician who played something and needs to know what it was. For that person, the transcriptionist just got competition.

Okba Allaoua (@elhart05) asked the thing people skip: what does your actual security check look like before you launch a vibe-coded app? His framing is the right one: the scary bugs aren't the ones that crash. They're the ones that quietly work exactly as an attacker hopes.

Nobody had a settled workflow. The best reply came from Christian (@actuallydone), who found a real cross-user data leak by running targeted AI audits — not a general "review my code" prompt, but specific falsifiable questions: show me what happens when user A requests user B's record ID, show me the raw ciphertext in the database. His rule: don't trust a description of the fix, get the artifact. Chalermpon (@vollos) added a precise technical point about database row security: toggling the policy on isn't the same as testing it. You have to log in as a user who has access and try to read rows that aren't theirs, not just test as a user who's locked out entirely.

Okba's own line is the one that sticks: "A crash is annoying but at least it's honest — it tells on itself immediately. The stuff that just works quietly in someone else's favor can sit there for months, and by the time it does show up it's not a bug report, it's a breach."