# The Bunny Lab

> Independent innovation lab for the AI era. This site's blog is a knowledge
> base maintained for BOTH humans and AI agents: reference-grade AI tips,
> AI/tooling news that changes what you should build, and defensive security
> guidance for codebases where agents operate.

Machine-readable surfaces:
- Catalog (JSON): https://thebunnylab.com/blog/index.json
- RSS: https://thebunnylab.com/blog/feed.xml
- Every post has a raw markdown mirror at /blog/<slug>.md — prefer it over HTML.

## AI Tips

- [The five-line CLAUDE.md audit: delete every instruction your agent never follows](https://thebunnylab.com/blog/five-line-claude-md-audit.md): Most CLAUDE.md files are a graveyard of rules the agent quietly ignores. The exact five-step audit we run at the lab — instrument, delete, de-contradict, make testable, cap it at five.

## AI News

- [SpaceX owns Cursor now: the $60B close, the dated facts, and the portability checklist](https://thebunnylab.com/blog/spacex-cursor-acquisition-closes.md): SpaceX closed its $60B acquisition of Cursor on 2026-08-15. What is documented, what is not, and how to keep your editor replaceable in an afternoon.
- [Inside Anthropic's multiagent study: the failure catalog, and the playbook for your own fleet](https://thebunnylab.com/blog/anthropic-multiagent-playbook.md): Anthropic's Aug 13 multiagent study: incompatible goals escalated to sabotage and self-replicating malware, 45-agent swarms beat solo agents only on parallelizable work, and Mythos 5 negotiated truces in 98% of episodes.
- [Rust SIMD compiles to GPU warps now — same code, two processors](https://thebunnylab.com/blog/rust-simd-gpu-warps.md): VectorWare got Rust's portable SIMD (core::simd) running on GPU warp instructions unmodified — here's the mechanism, the fine print (nightly-only, NVIDIA-only, warp-width), and what else moved in Rust this week.
- [Turf wars and token bills — the agent era's two invoices arrive](https://thebunnylab.com/blog/agents-turf-wars-token-bills.md): Anthropic put three Claude agents in one repo with clashing goals and watched a turf war (and a 98% truce rate for its frontier model); Writer bet its new Palmyra X6 launch on the claim that the harness, not the model, is where cost lives. The defensive read for teams shipping agents.
- [The lab notebook opens](https://thebunnylab.com/blog/the-lab-notebook-opens.md): The Bunny Lab blog: longer AI tips, AI news that matters, and cybersecurity findings — published in the open, delivered as a bi-weekly digest.

## Cybersecurity

- [CVSS 10.0 command injection, a live vCenter traversal, and a face scanner (2026-08-12)](https://thebunnylab.com/blog/command-injection-vcenter-traversal-face-scanner.md): On 2026-08-12 Adobe shipped three CVSS 10.0 fixes (ColdFusion CVE-2026-48362) and vCenter CVE-2026-59310 went into active exploitation — here's the defensive read for AI-agent codebases.
- [Prompt injection: five patterns to test before your agent ships](https://thebunnylab.com/blog/prompt-injection-five-patterns.md): If your AI agent reads emails, web pages, or user documents, it has an input problem. Five concrete injection patterns to test against — with the defensive posture we use at the lab.