Before The Commit cover art

Before The Commit

Before The Commit

By: Danny Gershman Dustin Hilgaertner
Listen for free

Summary

AI is writing your code. Who's watching the AI? Before The Commit explores AI coding security, emerging threats, and the trends reshaping software development. Hosts Danny Gershman and Dustin Hilgaertner break down threat models, prompt injection, shadow AI, and practical defenses — drawing from experience across defense, fintech, and enterprise environments. Companion to the book Before The Commit: Securing AI in the Age of Autonomous Code. No hype, just tactical insight for developers, security engineers, and leaders building in the AI era.2026 Danny Gershman, Dustin Hilgaertner
Episodes
  • Episode 4: Claude Code Github Action
    Aug 19 2025

    In this episode of Before the Commit, the hosts dive deep into the evolving landscape of software development, automation, and AI’s role in reshaping industries beyond tech. The discussion spans GitHub Actions with Cloud Code, the challenges of technical debt in an AI-driven era, the evolution of agile practices, and the disruptive effects of AI in creative fields like music and film.

    The conversation opens with a focus on Cloud Code, which has emerged as both a CLI tool and SDK rather than a traditional IDE. When paired with GitHub Actions, Cloud Code allows for asynchronous automation of tasks such as issue creation, code reviews, and pull requests. Unlike early “cursor background agents” that felt heavy and remote, Cloud Code provides a seamless and lightweight approach that enables developers to collaborate with AI in real time within their workflows.

    The hosts emphasize that while AI agents can handle much of the routine coding, the real challenge lies in how humans set up tasks and acceptance criteria. AI thrives when expectations are clearly defined, but complex, production-ready solutions still require human oversight. The emerging pattern is that AI can complete roughly 80–90% of development, while humans step in for the final polish—similar to a party planner fine-tuning the last details after their team has done the bulk of the setup.

    A central theme is whether technical debt still matters in an AI-first world. Traditionally, engineering teams have struggled with pressure from sales or business teams to deliver features quickly, leading to cut corners that accumulate as debt. However, with AI accelerating refactors and experimentation, the cost of “debt” may be far lower. The hosts argue that while inadvertent mistakes will still occur, the ability to quickly re-architect or refactor with AI challenges the old obsession with minimizing technical debt at all costs.

    The discussion pivots to the agile manifesto, now over 24 years old, and its evolution. Agile was never about rigid rules, but about moving away from the rigid, plan-everything-upfront waterfall model. Agile’s core value was early customer validation: deliver something quickly, get feedback, and adjust. With AI enabling rapid feature development, the dream of true continuous deployment—even faster than sprint cycles—may finally be achievable.

    The hosts highlight that agile and waterfall are not opposites but tools for different contexts. Waterfall is suited for predictable, high-stakes projects like launching rockets, while agile thrives in unpredictable markets where customer needs evolve rapidly.

    The conversation then shifts beyond coding, exploring how AI is reshaping music, film, and other arts.

    • AI-generated music: Some songs are now created entirely by AI, even mimicking collaborations between famous artists. While debates rage about copyright and originality, the hosts point out that no artist creates in a vacuum—every musician is influenced by predecessors. AI is no different, learning from prior works but generating unique compositions.

    • Ethics and ownership: Questions remain about who controls an artist’s likeness or style after death. The example of Princess Leia’s reappearance in Star Wars: Rise of Skywalker illustrates both the potential and controversy of resurrecting performers digitally.

    • Democratizing creativity: Just as AI empowers developers to experiment broadly, it lowers barriers in music and film. Individuals without traditional training can now compose songs, animate photos, or even produce short films. This mirrors past disruptions like Napster, SoundCloud, and streaming platforms.

    The hosts envision a future where movies, music, and games are dynamically tailored to individual preferences, with users even commissioning personal, high-quality films for themselves.

    Show More Show Less
    1 hr and 5 mins
  • Episode 8: LLM Caching
    Sep 23 2025

    In this episode, the hosts discuss the latest news and trends in AI, focusing on LLM caching, a new EU regulation on AI-generated code, the changing landscape for Stack Overflow, and a recent AI security vulnerability.

    The hosts explain LLM caching as a technique to boost efficiency and cut costs for AI providers and developers. It involves saving parts of a prompt that are sent repeatedly, such as tool descriptions for a code agent or a developer's code. This means the content doesn't need to be re-tokenized each time, saving computational power. Providers offer a reduced rate for these cached tokens.

    The discussion also highlights proxies like Light LLM, which can cache and reuse responses for multiple users even if their prompts aren't identical. This is achieved through semantic caching, which understands the meaning of words, allowing similar queries to receive the same cached answer.

    The hosts express skepticism about the European Union's new AI Act, which mandates that any code "substantially generated or assisted by an AI system" must be clearly identified. This "AI watermarking" aims to increase transparency, but it has open-source platforms debating whether to accept AI-generated code contributions at all due to legal and compliance issues.

    One host questions the regulation's practicality, seeing it as a fear-based, "proactive" measure for a problem that hasn't yet been observed. They point out the difficulty of reliably detecting and labeling AI-written code, especially as AI models improve at mimicking human styles. The hosts also note a study showing that AI coding assistants are more likely to introduce security vulnerabilities because they are trained on public code that often contains bugs and outdated security practices.

    The podcast covers the decline of Stack Overflow, attributing it to the rise of generative AI tools. Traffic has dropped, and Stack Overflow has responded by partnering with OpenAI to provide its data and adding its own AI features. The hosts believe Stack Overflow's data is a valuable asset that should be monetized rather than scraped.

    They conclude that Stack Overflow and similar content websites face a "generational problem." Younger users are less likely to use traditional sites, preferring integrated experiences like chatbots and AI assistants. They compare the future of the internet to a "Netflix algorithm," where AI will guide users directly to the content they need.

    In their "Secure or Sus" segment, the hosts discuss a security flaw that allows a threat actor to steal a user's ChatGPT conversation through an "indirect prompt injection." The attacker uploads a malicious prompt to a public website. When a user interacts with it, ChatGPT is tricked into generating an image whose URL secretly contains the user's conversation. The image then sends the conversation to the attacker's server.

    The hosts explain that this type of data exfiltration attack can be prevented with defensive measures like an LLM proxy and input/output sanitization. They note that similar vulnerabilities could exist in other AI-driven platforms and conclude that security in the age of AI requires proactive, disciplined measures rather than simply reacting to known vulnerabilities.

    Show More Show Less
    1 hr and 18 mins
  • Episode 26: Agent Client Protocol and Antigravity
    Mar 18 2026

    This video transcript covers several key topics related to AI and technology, with a particular focus on Nvidia's new inference chips, the Agent Client Protocol (ACP), and Google's Anti Gravity IDE.Nvidia's GTC 2026 event highlighted their advancements in inference chips, emphasizing a "one chip for all" approach that can be used for both training and inference. This strategic shift is driven by rising data center costs and the growing demand for AI applications. Nvidia has already secured adoption from major cloud providers like AWS, Azure, and Google Cloud, as well as companies like ByteDance and PayPal. The new "Dynamo" chip is designed for data centers, orchestrating GPU memory resources to boost inference performance by up to seven times. It's noted that this chip is open-source, though the definition of open-source in AI is considered nuanced. The chip is specifically tailored for agentic AI workloads, optimizing request routing to GPUs with relevant short-term memory, moving beyond traditional chatbot applications.The discussion then shifts to the competitive landscape, mentioning specialized inference chips from companies like Groq and Cerebras, which have focused on optimizing solely for inference, reportedly achieving better results and cost-effectiveness than the "one chip for all" approach. Nvidia's acquisition of Groq for $20 billion is seen as a move to integrate this technology and avoid direct competition. The transcript also touches upon the geopolitical implications of AI chip supply chains, with tariffs and export controls being discussed as potential "weapons."A significant portion of the transcript is dedicated to the Agent Client Protocol (ACP). It's described as an open protocol that acts as a middleware layer between Integrated Development Environments (IDEs) and coding agents. ACP aims to standardize communication, allowing coding agents to interact with various IDEs seamlessly. This is compared to the Language Server Protocol (LSP), which standardized IDEs' understanding of programming languages. ACP was developed collaboratively by JetBrains and Zed Industries to address the need for a universal adapter for coding agents, enabling them to perform actions within IDEs like opening files, manipulating code, and interacting with the UI. Several IDEs, including Zed, JetBrains products, Neovim, and VS Code (via a plugin), are adopting ACP. Most coding agents also support it, with Google's Anti Gravity being a recent addition. The benefit of ACP is that it makes coding agents IDE-agnostic, allowing for easier integration and a more modular ecosystem.Google's Anti Gravity is presented as a new IDE for coding agents, built with an "agent manager" at its core, contrasting with the CLI-first approach of some other agents. It offers features like workspaces for managing different projects and threads for concurrent agent tasks within a workspace. Anti Gravity also includes "artifacts" such as walkthroughs (session synopses), browser recordings, and persistent memory, which are integral to its functionality. The IDE's ability to handle multiple agents and tasks within a unified interface, particularly through its inbox view, is highlighted as a significant advantage for user experience. The transcript also mentions that Anti Gravity can integrate with various AI models via API keys, with Gemini models currently being free during its preview phase. The discussion touches on the potential for a more unified control plane for agent orchestration and the future of AI development moving towards local, optimized models.

    Show More Show Less
    1 hr and 3 mins
adbl_web_anon_alc_button_suppression_c
No reviews yet