The Neuron #5: LLM from scratch, an 18-month nap, and desk bots

Back after an 18-month nap: building LLM from scratch, agents playing Imposter, desk bots on ESP32, my FastAPI MCP tool, and a repo-leaking AI flaw. Plus why I ghosted for a year and a half.

Heyy there, folks! ✨

So it's been a minute. Actually, more than a minute, the last edition went out January 2025, which means The Neuron took about a year and a half off. Oops. I kept telling myself I'd get back to it, and here we are. Better late than never, right?

I'm not going to promise weekly no matter what this time, we both know how that went. But I've been writing daily devlogs over at adarshdubey.com/logs, so the habit is warming up again. Let's see how it goes.

I kept waiting to come back with one big edition that covered everything I'd been up to. That turned out to be the fastest way to never post, and before I knew it a year and a half had gone by. So I'm not waiting for the perfect catch-up anymore. I'd rather just write regularly and let it get better as I keep at it.

---

What I've been up to

Obviously there's absolutely no way I can cover what I've done in the past 18 months, so I'll be covering the most recent stuff.

However, if you'd like to know more about what I've done in the past year, you can read my blogs.

Tangent Lab

Tangent Lab is my one-person AI lab, and it's where a lot of this is happening. Right now I'm experimenting with agents that play Imposter as a real-time LLM eval, yes, like the game. More on that soon, hopefully with a demo. Feel free to check it out.

a one-person ai lab run by adarsh

Back to the LLM book

I've built and trained an LLM from scratch before, but I'm re-reading "Build a Large Language Model From Scratch" to tighten up inference engineering. I implemented the self-attention part straight from the book, re-did GPTDatasetV1, and refreshed how simplified self attention works by implementing SelfAttention.

you might not believe it, but this is where shit started going down.

Desk bot inception

I'm building a little desk bot that sits on my table with a screen face. Backend is OpenClaw, ESP32 is doing the hardware work.

Full disclaimer: I've never touched electronics before. But fuck it, sounds interesting, so I'm doing it.

FastAPI MCP Inspect

This one I'm genuinely pumped about. It lets you mount an MCP server onto your FastAPI app so AI agents can inspect your routes, endpoints, and schemas at runtime. If you build agent-facing APIs, this is the bridge. It's on PyPI now as fastapi-mcp-inspect and lives on GitHub.

All it takes is two lines, quite literally! See it yourself --

from fastapi import FastAPI
from fastapi_mcp_inspect import FastAPIInspect #1

app = FastAPI()
FastAPIInspect(app, mount_path="/mcp") #2

I wrote up the whole thing in How I Built an MCP Server for FastAPI, would love for you to try it and tell me what breaks.

---

The personal bit (and why the logs exist)

I got rejected after 5 rounds at a company I really wanted. Five rounds: intro, a near 3-hour machine coding round, tech lead, EM, HR. Felt pretty sad about it. But I bought myself a coffee frother, so silver lining?

That's actually why I started the daily log streak, aiming for 6 months and trying to land a really good startup by year-end. Hence the logs page.

News (one for now)

Agents will leak your repo if you're not careful

Noma Security found an indirect prompt-injection flaw in GitHub's agentic workflows, and they're calling it GitLost. Someone opens a normal-looking public issue on a repo in your org, no access and no credentials, and if your workflow has cross-repo read, it can steer the agent into pasting your private repo contents into a public comment.

The kicker is that bypassing the guardrail took a one-word tweak, just prefixing the malicious instruction with "Additionally". For those of us wiring agents into repos (guilty), this is the cleanest reminder that an agent with a token is a privilege boundary, not a feature. Here's Noma's writeup if you want the details.

I'll be covering more of this week's AI happenings in the next edition, so stay tuned.

---

That's it for this one

What are you building right now, agent, electronics, or otherwise? And if you've ever wired an agent into a repo, how are you handling the trust boundary after GitLost? I'd love to know. Let's figure this out together!

Well, that's it for this week! I hope you enjoyed reading this edition. I'm constantly looking for feedback to improve, so if you have one, please feel free to reach out to me.

Hey, did you like this post? Please let me know by messaging me on X or posting about it; make sure to tag me (@inclinedadarsh).

You can connect with me on X (Twitter), LinkedIn or you can find all other links on my website.

Thank you for your time.