gm legends, happy Thursday.

Today: an exec assistant that lives in your texts and sometimes calls, a quant trading desk for your AI bill, and a pentest for the app you vibe-coded last weekend. Plus the founder who dropped "AI" from her pitch and watched downloads triple.

Toyo is an exec assistant that lives in iMessage: you text it like a coworker to triage your inbox, prep meetings, and chase projects across 1,000+ connected tools, and it rings your phone when talking is faster. Damien Tanner (@dctanner) and team were ten months into building voice platform Layercode when they noticed the internal agents running their company were more interesting than the product, so they pivoted.

🔥 Our Take: Your phone rings and it's your assistant. That's the detail that got me: Toyo sits in iMessage next to your group chats, you text it like a coworker to chase your inbox and your projects, and when something actually needs a conversation it calls you instead of sending another paragraph. Damien Tanner built Pusher, the realtime messaging infrastructure half the internet's chat features ran on, so an assistant that's one long conversation is about the only product he was ever going to make. Apple does own the ground this stands on though, and Siri will get there eventually. OpenClaw already does all of this for people who enjoy running a server, the press literally calls Toyo "OpenClaw for founders".

Auriko is a trading desk for LLM calls: it prices every request across providers in real time, weighing token prices, cache mechanics, latency, and provider health, then routes it to the cheapest venue that won't degrade your app. Founder Michael Yang (@zxy_action1) priced options as a quant trader, and says a trader's OCD for the lowest price is what sent him down the inference-cost rabbit hole.

🔥 Our Take: Okay, this one's properly trader-brained. Michael Yang priced options for a living, and when he started building with AI agents he kept noticing the same LLM call costs wildly different amounts depending on provider, time of day, and whether you hit a cache, which can run a tenth the price of a fresh token. A trader looks at that and sees a spread. So Auriko prices every call before it leaves, checks your latency and quality limits, and routes it to the cheapest venue that clears them, about 30% cheaper on average by their own benchmarks. OpenRouter and that crowd hand you one API for lots of models and leave the choosing to you; here the choosing is the entire product. No clue if the 30% holds up on real traffic, but a quant hunting basis points in your token bill is the right person for the job.

Perfai Security pentests the app you vibe-coded: paste your live URL and a test login for each role, and it maps who's meant to see what, then replays the same requests as other users and tenants to find what's actually exposed. Intesar Mohammed (@intesar_mohammed1) is on his third security company and says this is the one that keeps him up at night in a good way.

🔥 Our Take: You can vibe-code login, payments, and an admin screen in an afternoon, and it looks so much like a real product that shipping it feels fine. That's the trap: the code works, it just doesn't keep track of who's allowed to see what, so the app quietly hands one user's data to anyone who asks right. Perfai logs into your live app as each role, checks what actually comes back, and sends the fixes to your coding agent over MCP, so the thing that wrote the hole gets to patch it. Intesar's last company was APIsec, which sold this exact job to enterprise API teams, and now he's pointing it at people who don't know they have an API. Snyk is circling the same buyers, but Snyk assumes you can read the report.

Mona Truong (@monatruong_murror) builds Murror, an AI journaling app, and stopped calling it one. They pulled "AI" out of the marketing, led with what the app actually does for you, and downloads tripled, so she posted the numbers.

Gal Dayan (@galdayan) saw the same thing with his product: "AI-powered" in the headline pulled in tire-kickers who wanted to poke a chatbot and bounced when it wasn't one. Yudhish Khatri (@yudhish_khatri) pushed on the ethics of hiding the tech, and Mona's answer was clean: it's all disclosed in How It Works and the privacy policy, "there's a difference between being transparent about your tech stack and using AI as a positioning hook."

The sharpest point in the thread is Gal's: the AI label sets an expectation of a specific interaction pattern, chat, prompt, response, and if your product doesn't work that way you're fighting your own label the whole time. Murror's retention jumped 41% once it stopped.

Good thread if "AI-powered" is still the first line of your landing page and you've never tested whether it's helping.