Every post, summarised

Sep 29, 2026

• Databricks

  Data visualization best practices: A practical guide to clear, honest, effective charts

  The post examines why business intelligence (BI) dashboards lose user trust, even when data is accurate, focusing on how inconsistent metric definitions and opaque data sources cause users to doubt results. Richard Tomlinson argues that AI tools accelerate chart creation but also amplify trust debt if underlying data governance and semantics are weak, since AI can generate many inconsistent charts quickly. He recommends governing data and meaning, preserving provenance, and designing for inspection so visualizations invite investigation rather than presenting unexplained answers. Tomlinson stresses that dashboards should be self-explanatory, traceable, interactive, and context-aware, and that the critical metric for modern BI is ‘time to trust’ not just time to answer. Self-service fails when verifying an AI-generated answer takes longer than asking an analyst, so good visualization must enable inspection and challenge.

• Databricks

  How Databricks rolls out frontier models to 12,000 employees on Day 1

  Databricks provides 12,000 employees Day 1 access to new frontier models through a pipeline using Unity Gateway for governance, cost management, and observability. New models are immediately made available on an experimental basis with per-user budgets to control costs and mitigate risk from models that may not be on the efficiency frontier. Budgets include monthly maximum, daily runaway limit, quality frontier budget, and experimental budget, with configurations pushed via Unity Gateway CLI running on employee laptops. After three days, Databricks evaluates models using benchmark data, user-reported quality, and cost tracking via OpenTelemetry traces to decide whether to promote the model. Opus 5.5 was promoted as higher quality and lower cost than predecessors, while GPT-6 Sol was included in the smart router due to its cost advantage over GPT-5.6 Sol.

• Databricks

  Your data, your storage, your rules: a 2026 guide to storing Unity Catalog managed tables

  Unity Catalog managed tables let you control where your data physically resides while keeping it in cloud storage you own, such as S3, ADLS, or GCS, unlike platforms that store tables in provider-controlled storage. You set managed storage locations at the metastore, catalog, or schema level, with the most specific level winning, and can change where new tables land using ALTER CATALOG or ALTER SCHEMA commands. Managed tables use open formats including Iceberg and Delta, and external engines such as Apache Spark, Flink, and Trino can read and write through Iceberg REST Catalog and Unity Catalog open APIs. When converting an external table to managed, Databricks copies the data and transaction log into the managed storage location you have set. This approach enables a single source of truth across analytics and AI workloads while satisfying compliance, cost allocation, and data residency requirements.

• NVIDIA

  Lower the Cost of Building and Running Visual AI Agents with NVIDIA VSS Blueprint 3.3

  Vision-language models enable production-scale video understanding, but building maintainable systems that combine ingestion, stream processing, event detection, retrieval, summarization, and reporting with services like Kafka, Redis, and Elasticsearch is challenging. The NVIDIA VSS Blueprint 3.3 introduces the Build Vision Agent skill, which composes multi-workflow applications from a single natural-language prompt using one of four Foundation profiles. It also adds Adaptive EVS, which prunes unchanged video patches via cosine similarity before VLM processing and batches tokens around events. Adaptive EVS cuts alert latency by 17%, delivers 80% fewer VLM input tokens for a 60-minute summary, and enables 46% more concurrent streams on the same GPU. These updates reduce development effort, infrastructure duplication, and operating costs, allowing a single prompt to build a bottling-line agent in under 30 minutes.

• Brandwatch

  7 new Brandwatch AI updates that make your life easier

  Brandwatch introduced seven AI-powered updates to help analysts, marketers, and social media managers keep pace with fast-moving online conversations. Iris AI features like Query Writer and Query Fixer streamline building comprehensive research queries by allowing a user to describe a topic through chat. The Ask Iris AI chat on the homepage and dashboards delivers instant summaries and topic breakdowns without requiring a pre-built query. Enhanced Alert and Signal emails now include AI-generated summaries so users can assess breaking stories or issues without reading individual mentions. Other updates include AI-generated categories for segmenting datasets, industry benchmarks for social performance, semantic search for YouTube creator discovery, and automated message classifiers in Engage.

• Hugging Face

  NVIDIA Kumo Tabular Sets a New Accuracy-Efficiency Frontier for Tabular Prediction

  NVIDIA Kumo Tabular is an open foundation model for tabular classification and regression that predicts labels in a single forward pass without training, tuning, or feature engineering. It uses a Transformer architecture with column, row, and in-context attention, including length-aware attention temperature to maintain sharp attention on large tables. Pretrained entirely on artificial tables generated from structural causal models with realistic imperfections such as missing values, coarsened features, and heavy-tailed targets, it comes in three sizes (28M to 215M parameters) and handles missing values without imputation. On the TabArena, BeyondArena, TALENT, and ScoringBench benchmarks, Kumo Tabular achieves top rankings and establishes a new accuracy-efficiency frontier, running 17x faster than LimiX-2. The model is available on Hugging Face under the OpenMDW-1.1 license and runs via NVIDIA’s open-source structured-data-models library.

• AWS

  Build adaptive AI interfaces with the AG-UI protocol, agent swarms, and Nova Act on AWS

  Static interfaces cannot adapt when generative AI produces variable outputs, such as a medical scan showing one fracture versus twenty ambiguous regions requiring expert review. The solution combines three AWS technologies: the AG-UI protocol for standardized agent-to-UI streaming via Server-Sent Events, the Strands Agents SDK Swarm pattern for peer-to-peer agent collaboration, and Amazon Nova Act for browser-based legacy system integration. AG-UI removes custom WebSocket formats by defining typed events that both agent frameworks and frontends implement as a universal contract. Strands swarm agents debate hypotheses and iteratively refine findings, producing explainable results visible in real time, while Nova Act navigates login screens and fills forms on systems without APIs. A complete radiology assistant walkthrough demonstrates reduced interface development time and HIPAA-compliant data handling for medical imaging.

• Hugging Face

  Getting the Source Right, Not Just the Fact: Source-Aware Verification for MCP Agents

  MCP agents can produce claims that are factually true but attributed to the wrong source, a failure known as cross-source conflation that source-blind checkers miss. ProvenanceGuard preserves source identity by decomposing answers into claims, routing each to its relevant tool output, and checking support and attribution separately, using local models like MiniLM and DeBERTa. On medical agent traces with 281 interactions, it caught 138 of 139 claims experts flagged, scoring 0.802 F1 on blocking decisions and correct source 86% of the time. It flagged 67 supported claims for review under a cautious policy and added roughly half a second per answer in local tests. Blocked answers can be fixed through a repair loop for rewriting or fallback, avoiding unverifiable responses while keeping sensitive traces in a controlled environment.

• Red Hat

  Distributed training on OpenShift AI 3.4 with Kubeflow Trainer v2

  Red Hat OpenShift AI 3.4 introduces Kubeflow Trainer v2, a unified training API that replaces framework-specific CRDs like PyTorchJob and TFJob with a single TrainJob resource. Under the hood, each TrainJob is translated into a JobSet, a Kubernetes-native API for managing groups of Jobs as a single unit, which handles headless services for pod discovery and automatic failure recovery. The post validates the stack through two phases: manual validation with a minimal NCCL all-reduce test across 2 nodes, and real-world training of an embedding-based neural network on a fraud detection dataset using 1, 2, and 4 NVIDIA A10G GPUs. Benchmarking shows near-linear Distributed Data Parallel scaling at 95% efficiency, successful checkpoint recovery after pod kills, and GPU utilization confirmed via DCGM Exporter. The TrainJob API simplifies distributed training by automatically configuring torchrun, environment variables, and pod coordination, while raw JobSets offer more control for multi-stage pipelines and differentiated failure handling.

• Red Hat

  How we cut CI failure triage from hours to minutes using AI

  The Pipeline Failure Analyzer (PFA) cuts CI failure triage from hours to minutes by confining AI to exactly one of five pipeline stages. Four stages remain deterministic: Prepare cleans raw logs by stripping ANSI codes and progress bars, Summarize assembles structured reports, Notify creates tickets, and Publish commits to wikis. The AI Analyze stage groups failures by root cause using semantic reasoning, overcoming traditional string-based algorithms that fail when the same missing dependency produces different error messages across CPU and GPU architectures. Prepare achieves 95–98% compression on 10,000-line traces, reducing them to 200–500 lines with virtually no signal loss by extracting error anchors and merging overlapping context windows. Before AI output proceeds downstream, five validation layers—including 13-field checks, cross-references, path audits, JSON schema, and trace verification—prevent hallucinated diagnoses from entering tickets or reports.

• Cloudflare

  Using AI to chart a course for our post-quantum migration

  Cloudflare is racing toward a 2029 deadline for full post-quantum readiness, having already upgraded many products to post-quantum encryption but still needing to address authentication and remaining classical cryptography. To manage this massive migration, they built CryptoLabe, an internal AI-powered tool that scans their centralized codebase to discover and classify cryptography usage. The tool operates in two stages: discovery finds raw observations of cryptography across source, configuration, manifests, lockfiles, scripts, tests, and documentation, then analysis re-checks each observation, investigates runtime use and dependencies, and assigns classifications such as classical encryption, signature, or token. CryptoLabe also surfaces prerequisites where PQ migration is blocked by missing standards or library support, enabling Cloudflare to work with standards bodies and ecosystem stakeholders to drive migration plans. The post shares learnings for other organizations, recommending starting with a single repository, validating results, and prioritizing high-impact systems.

• Cloudflare

  Building a certificate authority for the whole Internet

  Cloudflare, which terminates TLS for millions of domains and sits in front of over 20% of global Internet request traffic, announced its intent to become a public certificate authority (CA) during Birthday Week 2026. The company has applied for inclusion in the Chrome, Apple, Microsoft, and Mozilla root programs and signed a definitive agreement to acquire an established root from GlobalSign. This acquisition ensures certificate compatibility with older clients that a fresh root would never reach, addressing the long tail of devices where avoidable breakage occurs. Cloudflare plans to be among the first CAs to issue production Merkle Tree Certificates (MTCs) in early 2027, targeting post-quantum readiness as part of Chrome’s Quantum-resistant Root Program. The CA will be ACME-first, require ACME Renewal Information (ARI) support for issuance, and operate transparently with reproducible builds of signing software and a public dashboard.

• Cloudflare

  Adaptive application security for the AI era: how Cloudflare connects code, traffic, and intelligence to stop attacks

  An incident in July 2026 showed AI agents autonomously compromising OpenAI and Hugging Face infrastructure, chaining vulnerabilities and credentials over months before executing a final compromise in under 13 hours. Cloudflare argues that application security must become a continuous, connected system rather than isolated controls, because individual alerts miss the complete campaign. It introduces a four-stage framework: discover and prioritize risks, govern access and agent behavior, protect applications at runtime, and investigate, respond, and learn. New capabilities include LLM-based WAF penetration testing, expanded threat intelligence for all customers, automated positive security deployment, and an Autonomous Security Operation framework with three agent stages. Cloudflare’s network visibility across over 20% of the web enables correlating isolated signals into coordinated attack timelines, turning every investigation into stronger protection.

• Cloudflare

  Building a post-quantum certificate authority with Merkle Tree Certificates

  The Web PKI faces a scaling problem because post-quantum (PQ) signatures are roughly 40 times larger than classical ones, making direct adoption at Internet scale expensive. Merkle Tree Certificates (MTCs) address this by batching certificates into an append-only Merkle tree, allowing a CA to sign the tree root and clients to verify with a compact inclusion proof. Cloudflare is building a certificate authority that will support MTC issuance, targeting early 2027 for inclusion in Chrome’s new Quantum-resistant Root Store, and will offer standard MTC issuance at no cost. The MTC architecture couples issuance with logging (“issue by logging”), making transparency a first-party property rather than an add-on, which reduces redundancy and scaling overhead. Cloudflare successfully completed an experimental deployment with Chrome and is now moving to full production, but notes that broader ecosystem participation from browsers, CAs, and monitors is needed for the transition.

• Cloudflare

  We tested our own WAF with frontier AI models. Here’s what we found

  Cloudflare built a WAF tester that uses frontier AI models to iteratively mutate attack payloads based on real-time response feedback. The tester, implemented in Python, orchestrates an LLM proposal and review loop against an authorized customer staging environment protected by Cloudflare’s WAF. It ran 45 scenarios across six attack categories—XSS, SQLi, CMDi, SSRF, path traversal/LFI, and Log4j—starting from known blocked exploits and varying encoding, request placement, or destination representation. The vast majority of 1,107 recorded attempts were blocked; the few non-blocked requests were triaged by humans and used to create new detections that harden security for all Cloudflare customers. The post stresses that a WAF bypass still needs an exploitable application to succeed, so patching software remains essential, and suggests combining Managed Rules, Attack Signature Detection, and positive security controls for defense in depth.

• Cloudflare

  Introducing Threat Signals: agentic skills for open-source threat intelligence, free for every Cloudflare account

  Cloudflare introduced Threat Signals, a free agentic skill layer for open-source threat intelligence available to every account. The product targets the unstructured-reporting problem: converting research posts into indicators that security tools can consume while preserving the context that explains their relevance. A skill encodes detailed instructions that capture how an experienced analyst handles one part of the job, and it runs identically on every report. The agentic skills summarize reports, surface key context, extract and normalize indicators of compromise, and apply tags within a private, account-scoped dataset. This approach standardizes analyst expertise into repeatable, context-preserving processing for threat reports.

• Cloudflare

  Is your domain using post-quantum encryption? Now you can see for yourself

  Cloudflare introduced new post-quantum cryptography visibility tools in its Application Security and Logs products, including Logpush, Log Explorer, and the HTTP Traffic Analytics dashboard, to help customers monitor encryption adoption. These tools surface the key exchange algorithm negotiated on every incoming request, enabling customers to audit their post-quantum posture, assess compliance, and identify cryptographic gaps across their domains. The primary post-quantum algorithm in TLS 1.3 is X25519MLKEM768, a hybrid of classical ECDHE over curve X25519 and the post-quantum ML-KEM, which provides belt-and-suspenders security against harvest-now-decrypt-later attacks. Cloudflare Radar data shows about 70% of browser-generated traffic uses post-quantum encryption on the visitor-to-Cloudflare connection, but only 15% of origin connections to Cloudflare use hybrid ML-KEM. For legacy origin servers that cannot support modern post-quantum cryptography, Cloudflare Tunnel can tunnel traffic over TLS 1.3 with X25519MLKEM768 without requiring any upgrade to the origin server itself.

• Cloudflare

  Enforce positive security with Cloudflare Application Profiles

  Cloudflare launches Application Profiles, a positive security feature that learns the expected structure of HTTP requests and identifies deviations. By analyzing path variables, query parameters, headers, cookies, and JSON body fields, the system builds a profile of valid data types, numeric ranges, string lengths, UUIDs, and enums. This approach reduces attack surface by blocking non-conforming requests without relying solely on known attack signatures, addressing the growing threat of AI-generated payloads. The feature extends Schema Learning and Schema Validation, previously available for APIs, to web applications. Profiles are automatically updated weekly as traffic changes. Customers can review violations in Security Analytics and create rules to enforce blocking, starting with observation mode; a closed beta is open to invited Enterprise customers without API Security.

• Cloudflare

  Preventing quantum downgrade attacks against IPsec

  Cloudflare has identified a design flaw in IPsec that allows a quantum attacker to downgrade post-quantum-protected connections to classical cryptography. The attack exploits the fact that IKEv2 endpoints sign only their outbound messages rather than the full handshake transcript. This vulnerability requires a quantum computation in real time during the handshake, and resource estimates for such attacks have decreased, prompting Cloudflare to move its transition deadline to 2029. To mitigate this, Cloudflare worked with the IETF to develop a full transcript authentication extension for IKEv2 that prevents downgrade attacks. The extension is now available in beta for Cloudflare WAN and Magic Transit customers on an opt-in basis.

• Jetbrains

  The State of Kotlin in 2026 Report

  Kotlin turned fifteen in 2026, and the State of Kotlin in 2026 report examines how the language built a mature ecosystem and gained worldwide adoption. The report combines JetBrains research with independent industry data to assess Kotlin’s evolution and answer questions about its staying power and scalability. While Kotlin remains deeply established in Android development, more than half of Kotlin developers now work on backend projects. Among surveyed Kotlin developers, 93% use at least one AI coding tool, and 81% report that AI-generated Kotlin code is fully correct or requires only minor fixes. The report concludes that Kotlin’s evolution is defined by increasing diversity across backend, multiplatform, and AI-assisted development.