March 8, 2026

After an early morning beach walk with a classmate, I realized I hadn’t taken my house keys. My daughter would be sleeping, so I wandered with my phone. This is when I get ideas - often a dangerous time for my students. In this case, the idea was a rambling conversation with Claude that roughly begins with: As part of my Tools in Data Science course, I plan to create a Cloudflare worker which allows students to play a game using an API. The aim is to help them learn how to build or use AI coding agents to interact with APIs to solve problems. ...

It’s impressive how easy it is to find leaked API keys in public repositories. I asked Codex to run trufflehog on ~5,000 student GitHub accounts and (so far, after a few hours, 15% coverage), it found quite a few. Some are intended to be public, like Google Custom Search Engine keys. 1 2 const GOOGLE_API_KEY = "AIza..."; const GOOGLE_CX = "211a..."; Some are Gemini API keys. 1 2 3 4 5 6 7 api_key1 = "AIza..." But what’s really impressive is, when I ran: GEMINI_API_KEY=AIza... curl "https://generativelanguage.googleapis.com/v1beta/models/gemini-3-flash-preview:generateContent" \ -H 'x-goog-api-key: $GEMINI_API_KEY' \ -H 'Content-Type: application/json' \ -d '{"contents": [{"parts": [{"text": "Hi"}]}]}' … on most leaked Gemini API keys, I got: ...

I’ve long felt that while the Gemini 3 Pro model is fairly good, the Gemini CLI harness isn’t. I saw an example of this today. Me: Tell me the GitHub IDs of all students in this directory. Gemini CLI: SearchText 'github' within ./ Found 100 matches (limited) Sending this message (14606686 tokens) might exceed the remaining context window limit (1037604 tokens). Me: Only send the (small) required snippets of data. Write code as required. ...