WEBVTT NOTE The Rundown — nextbig.dev daily audio edition, 2026-02-25 1 00:00:00.000 --> 00:00:08.595 Good morning and welcome to the Builder's Briefing for February 25th, 2026. I'm Alex, joined as always by Sam. And Sam — today we've got a massive system prompt leak, an AI that wrote a working kernel driver from scratch, Firefox shipping built-in XSS protection, and Stripe crossing a hundred and fifty-nine billion in valuation. 2 00:00:08.595 --> 00:00:11.617 That's a packed lineup, but honestly I've been waiting all morning to talk about the prompt leak. Let's get into it. 3 00:00:11.617 --> 00:00:21.280 Okay, so here's the big story. A repo blew up — over eleven hundred engagement — and it's aggregated the full system prompts, internal tools, and model configurations for essentially every major AI coding assistant on the market. We're talking Claude Code, Cursor, Devin, Windsurf, Replit, Lovable, Kiro, Manus, v0, Xcode's AI features — about twenty more on top of that. 4 00:00:21.280 --> 00:00:27.609 And this isn't like fragments or guesses. These are the actual instruction sets — the guardrails, the tool definitions, the context windowing strategies. This is the stuff these teams spent millions figuring out, just sitting in a public repo. 5 00:00:27.609 --> 00:00:36.231 Exactly. So if you're building AI dev tools or even just crafting system prompts for internal tooling, you now have a reference library of production-tested prompt engineering. You can study how Cursor handles context windows, how Devin structures multi-step task decomposition, how v0 constrains generation to specific frameworks. 6 00:00:36.231 --> 00:00:40.919 Right, and what's wild is what this implies for competition. If your moat was a clever system prompt — that moat is gone as of today. Everyone can see everyone else's playbook now. 7 00:00:40.919 --> 00:00:49.879 That's the key signal. Prompt engineering for coding agents is converging on recognizable patterns. The differentiation is moving to infrastructure — sandboxing, file system access, test execution, context management. The next six months will separate tools with real infrastructure from tools that were basically a good prompt wrapped in a UI. 8 00:00:49.879 --> 00:00:54.593 Which honestly is a healthy correction. The best developer tools were always going to win on execution environment, not on prompt tricks. Now the market just got forced to prove it. 9 00:00:54.593 --> 00:01:01.443 Alright, shifting to AI and models — this one blew my mind. A developer got AI to write a fully working FreeBSD Wi-Fi driver from scratch. A brcmfmac driver for an old MacBook. And here's the thing — there's basically no training data for this in the target form. 10 00:01:01.443 --> 00:01:09.309 That's interesting because it means the model had to synthesize across driver APIs, hardware specs, and kernel interfaces to produce working kernel-level code. This isn't generating a React component — this is niche systems programming where you'd normally need deep domain expertise and weeks of work. 11 00:01:09.309 --> 00:01:21.942 If you're building in embedded or niche systems programming, take note. LLMs are crossing a threshold from 'good at web apps' to 'can reason about hardware interfaces.' Also worth flagging — there's a new benchmark called the Car Wash test that's getting a ton of attention, a hundred and eighty-six Hacker News comments. It tests whether models can follow multi-constraint natural language specs, like running a car wash. Way more practical than MMLU for evaluating agentic workflows. 12 00:01:21.942 --> 00:01:28.297 I love that. Real-world instruction following is exactly what matters if you're deploying agents. Speaking of agents — I noticed two projects this week, Refly and pi-skills, both tackling portable agent skill definitions. Is that a coincidence? 13 00:01:28.297 --> 00:01:37.075 Not a coincidence at all. Refly lets you define reusable agent skills as vibe workflows that run across Claude Code, Cursor, and Codex. Pi-skills is doing something similar — composable skill files compatible with multiple coding agents. The convergence here is telling us that agent skills as infrastructure is becoming a real category. 14 00:01:37.075 --> 00:01:41.893 So if you're building internal developer agents, the move is to define your skills in these composable, tool-agnostic formats now and avoid lock-in as the ecosystem standardizes. Smart. 15 00:01:41.893 --> 00:01:49.551 On the dev tools front, a couple of standouts. Diode is a browser-based environment for hardware design and simulation — three hundred and sixty-eight Hacker News points. If you're building IoT products or teaching electronics, you can skip physical prototyping in early design phases entirely. 16 00:01:49.551 --> 00:01:56.584 And OXC keeps gaining momentum — it's a Rust-based replacement that consolidates parsing, linting, and transforming JavaScript into a single fast toolchain. If you're still running ESLint plus Babel plus Prettier as separate tools, it might be time to look at migrating. 17 00:01:56.584 --> 00:02:02.548 Also, MIT's Missing Semester course got its 2026 refresh. Shell scripting, version control, debugging, developer productivity — all the practical stuff CS programs still skip. Share it with your junior devs. Link in the briefing. 18 00:02:02.548 --> 00:02:05.257 That course is genuinely one of the best resources out there. I wish I'd had it when I was starting out. 19 00:02:05.257 --> 00:02:13.358 Okay, security — this one matters for every web developer listening. Firefox 148 ships with setHTML, which replaces innerHTML and sanitizes HTML by default. Instead of blindly inserting markup into the DOM, it runs through the Sanitizer API automatically. This eliminates an entire class of XSS vulnerabilities. 20 00:02:13.358 --> 00:02:19.270 That's huge. And it's going to become the standard across browsers, so start migrating your DOM manipulation now. Oh, and Firefox 148 also quietly includes an AI kill switch — a toggle to disable all AI features in the browser. 21 00:02:19.270 --> 00:02:28.517 Interesting contrast, right? Shipping AI features and a way to turn them all off in the same release. Also on the security radar — the Keep Android Open coalition is pushing back on Google requiring mandatory developer registration for all app distribution, including sideloading. If you distribute Android apps outside the Play Store, watch this closely. 22 00:02:28.517 --> 00:02:37.164 Quick startup note — Stripe is now valued at a hundred and fifty-nine billion dollars and just dropped their 2025 annual letter. The big signal for builders is that they're betting heavily on AI-assisted financial tooling and embedded finance. If you're building fintech, align with their roadmap or find the edges they're ignoring. 23 00:02:37.164 --> 00:02:41.826 At that valuation, Stripe basically is the payments infrastructure layer. The question is whether you build on top of it or try to carve out the niches they haven't gotten to yet. 24 00:02:41.826 --> 00:02:44.978 Alright, speed round — quick hits. Someone built an x86 CPU emulator written entirely in CSS. Peak absurdity, peak skill. 25 00:02:44.978 --> 00:02:46.020 Of course they did. I love the internet. 26 00:02:46.020 --> 00:02:53.313 There's also Ghostfolio, an open-source wealth management app built with Angular, NestJS, and Prisma. Coreboot got ported to the ThinkPad X270 for the open firmware crowd. And Samsung launched an Upcycle program turning old phones into smart home sensors — actually pretty clever. 27 00:02:53.313 --> 00:02:58.235 The Samsung one is interesting from a sustainability angle. There are billions of old phones sitting in drawers — repurposing them as sensors is a much better lifecycle play than recycling. 28 00:02:58.235 --> 00:03:06.753 So here's the takeaway for today. Two big patterns. First, the system prompt leak confirms that the moat in AI coding tools is not the prompt — it's the execution environment, context management, and tooling infrastructure. If you're building developer-facing AI, invest in sandboxing and tool integration, not prompt wizardry. 29 00:03:06.753 --> 00:03:13.290 And second, the convergence around Refly, pi-skills, and portable agent skill definitions tells us that agent skills as composable infrastructure is becoming a real thing. Define your skills in tool-agnostic formats now and you'll avoid lock-in later. 30 00:03:13.290 --> 00:03:19.073 That's the Builder's Briefing for February 25th. All links are in the show notes. If today's prompt leak taught us anything, it's that the real advantage isn't in what you tell the model — it's in what you build around it. 31 00:03:19.073 --> 00:03:20.1000 Build the infrastructure, not just the instructions. See you all tomorrow.