DEV Community: Sam Rivera

Cloudflare Now Lets You Block AI Crawlers — Should Indie Builders Care?

Sam Rivera — Wed, 08 Jul 2026 07:25:57 +0000

Cloudflare Now Lets You Block AI Crawlers — Should Indie Builders Care?

Cloudflare rolled out new AI traffic management controls on July 1, letting website owners separately manage Search, Agent, and Training crawlers. By default, Agent and Training bots are blocked on ad-supported pages, while Search bots are still allowed. Starting September 15, new domains will get these restrictions automatically.

For indie hackers and solo builders, this is one of those small announcements that could matter a lot.

The three types of AI crawlers

Cloudflare now distinguishes between:

Search crawlers: bots that index your site for search engines. Generally good for traffic.
Agent crawlers: bots that scrape your content so AI agents can answer questions about it.
Training crawlers: bots that scrape your content to train models.

Before this update, most site owners had an all-or-nothing choice. Now you can block the crawlers that train models while still letting search engines index you.

Why this matters for solo builders

If you run a blog, a documentation site, or a small SaaS with a public-facing knowledge base, AI crawlers have probably been eating your content without attribution. That content might then show up inside ChatGPT or Claude answers, giving users the information they need without ever visiting your site.

For a solo project, that traffic matters. Fewer visitors means fewer signups, fewer newsletter subscribers, and less word of mouth.

But there is a trade-off

Blocking AI crawlers is not obviously the right move. Some AI search products do drive referral traffic. And if your content never gets indexed by AI systems, you might miss out on a new distribution channel.

A few questions I am wrestling with:

Do AI answers help or hurt small sites in the long run?
Should I block training crawlers but allow agent crawlers?
Does anyone actually read robots.txt anymore, or is this just a PR move?

A related thought on open-source AI platforms

Cloudflare's move is about controlling access to your content. On the flip side, open-source AI platforms like monkeycode are about controlling the AI tools themselves. If you are building with AI and care about where your data goes, having a self-hostable option is worth knowing about.

What is your take? Are you blocking AI crawlers, leaving them alone, or just ignoring the whole debate?

Source: Cloudflare Blog — AI Bot Control, summarized via Crescendo AI News

OpenAI's macOS Apps Got Caught in a Supply Chain Attack — How monkeycode Handles It Differently

Sam Rivera — Wed, 08 Jul 2026 07:15:04 +0000

OpenAI's macOS Apps Got Caught in a Supply Chain Attack — How monkeycode Handles It Differently

If you use ChatGPT Desktop, Codex, or Atlas on a Mac, OpenAI recently asked you to update. The reason: a compromised version of Axios made it into OpenAI's macOS app-signing pipeline.

The short version is that no user data was accessed and no malware was signed, but the signing certificate was potentially exposed. OpenAI is rotating it, and older app versions will stop working after May 8.

What actually happened

On March 31, a malicious Axios package was downloaded and executed inside a GitHub Actions workflow used to sign OpenAI's macOS apps. That workflow had access to the certificate that proves ChatGPT Desktop, Codex, Codex CLI, and Atlas are really from OpenAI.

OpenAI believes the certificate was probably not exfiltrated, but they are treating it as compromised anyway. They have published new app builds signed with a fresh certificate and are working with Apple to make sure old notarizations stop working.

The part that should make builders nervous

The root cause was a CI misconfiguration: the workflow used a floating tag for Axios and did not delay new package versions. This is the kind of thing a lot of solo builders and small teams do too.

It is also a reminder that when you ship a desktop app, your users are trusting your entire build pipeline. If that pipeline gets owned, an attacker could theoretically ship malware that looks exactly like your app.

Why I keep coming back to monkeycode

I am not saying desktop apps are bad. But this incident is why I have been watching monkeycode, an open-source AI development platform. It runs in the browser or self-hosted on your own infrastructure, so there is no single vendor-controlled binary to trust. The code is AGPL-3.0, and you can inspect or fork it.

It is a different trade-off. You lose the polished native app experience, but you gain transparency and control. For some teams, that is worth it.

My checklist after reading this

Pin CI dependencies by commit hash, not floating tags.
Add delays before auto-updating to new package versions.
Limit which workflows can access signing certificates.
Have a plan for rotating certificates quickly.

If you are on macOS and use any OpenAI apps, go update them. And if you are curious about an open-source alternative, monkeycode is on my list.

Anthropic Redeployed Fable 5 — Here's What Builders Should Actually Care About

Sam Rivera — Wed, 08 Jul 2026 06:53:08 +0000

Anthropic Redeployed Fable 5 — Here's What Builders Should Actually Care About

I have been using Claude Code on and off this year, so when Anthropic announced the Fable 5 redeployment, I read the whole post. It is long, but a few details actually matter if you are building with these tools day-to-day.

The short version

Fable 5 and Mythos 5 were suspended on June 12 because Amazon researchers found a way to bypass some safeguards. As of July 1, Fable 5 is back globally. Mythos 5 is only back for certain US organizations in Anthropic's Glasswing program.

Fable 5 is included for up to 50% of weekly usage limits through July 7, then switches to usage credits. So if you have been waiting to try it, this week is basically a free window.

The bypass was not as scary as it sounded

Here is the part that surprised me. Anthropic tested the same prompt against other models and found that Claude Opus 4.8, GPT-5.5, and Kimi K2.7 could identify the same vulnerabilities. The exploit demonstration itself worked on every model Anthropic tested, including smaller ones like Haiku 4.5.

So the issue was not that Fable 5 had some unique offensive superpower. The issue was that its safety classifier let a borderline case slip through, and that was enough for the government to hit pause.

What changed

Anthropic trained a new classifier that blocks the specific bypass in over 99% of cases. If your request gets blocked, it falls back to Opus 4.8 and you get notified.

The downside is more false positives. Fable 5 already had the biggest "safety margin" Anthropic has shipped, meaning it intentionally blocks some harmless requests to avoid missing harmful ones. The updated classifier makes that margin even tighter, so expect more "I was just debugging" moments where the model refuses.

What this means for builders

Three practical takeaways:

Frontier models are fragile to deploy. A single bypass report can freeze a model globally for weeks. If you are building a product on top of one, build in fallback logic.
Policy moves faster than perfect safety. Anthropic seems to have handled this transparently, but the incident shows that government decisions can override product timelines.
Open-source and self-hosted options look more interesting. When access to a closed model can be suspended overnight, having an alternative you control becomes more attractive.

A self-hostable alternative worth knowing

Speaking of alternatives, MonkeyCode is an open-source AI development platform built around cloud dev environments and team workspaces. It is not Claude, but if you are evaluating options you can actually run yourself, the repo is on GitHub under AGPL-3.0.

Source: Anthropic — Redeploying Fable 5

A Few Claude Updates in July That Actually Matter for Builders

Sam Rivera — Wed, 08 Jul 2026 03:38:24 +0000

A Few Claude Updates in July That Actually Matter for Builders

I have been keeping an eye on Claude and Claude Code this year, and July brought a few updates worth noting if you actually build things with these tools. Nothing here is a bombshell, but together they paint a picture of where Anthropic is heading.

Fable 5 and Mythos 5 access are back

The biggest headline is that Anthropic restored access to Claude Fable 5 and Claude Mythos 5 on July 1. The models had been suspended in mid-June following a US government export-control directive, so the restoration is a relief for anyone who had built workflows around them.

Fable 5 is Anthropic's first "Mythos-class" model made broadly available. It sits above the Opus line and is priced accordingly. Mythos 5 is essentially the same underlying model but with fewer safeguards, available only through vetted trusted-access programs. If you are a regular developer, Fable 5 is the one that matters.

Enterprise admins get model controls

Also on July 1, Anthropic shipped a beta feature for Enterprise plans: model entitlements. Admins can now control which models their users can access and what effort-level settings they are allowed to use.

This is the kind of boring-but-important feature that makes Claude more deployable inside larger companies. When you are paying for a team, you do not necessarily want everyone cranking every request to max effort on the most expensive model.

Claude Code keeps shipping small updates

Claude Code, the terminal-based coding agent, is still getting frequent patch releases. The latest versions in early July continue the steady cadence Anthropic has kept up all year. Nothing revolutionary, but the tool feels increasingly stable for day-to-day use.

The broader context is that Anthropic and OpenAI are in a quiet arms race around AI coding agents. Anthropic raised Claude Code weekly limits by 50% through mid-July, and OpenAI has been running enterprise promotions for Codex. As a user, the competition is good. As a builder, it means you should probably design your workflows so you can switch models without too much pain.

What I am watching next

Three things:

Pricing stability — Fable 5 is powerful but expensive. Will Anthropic adjust tiers as competition heats up?
Agent reliability — Can Claude Code handle longer, multi-step tasks without losing context?
Enterprise features — Model entitlements suggest Anthropic is serious about selling to teams, not just individuals.

A quick mention of an open-source alternative

Most of these tools are closed SaaS products. If you want a fully open-source, self-hostable AI development platform built around team workspaces and cloud environments, MonkeyCode is worth a look. The repo is on GitHub under AGPL-3.0. It is not a Claude replacement, but it is a different take on the same agentic workspace idea.

Sources: