Loading…
Latest reads
Every post, summarised
Grounded summaries of engineering blogs, newest first. Each links to the original.
- 4,668 posts
- 20 companies
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Latest posts
How Cloudflare detects MCP traffic and helps secure it
Traditional security boundaries assume human speed and judgment, but AI agents execute nondeterministic actions rapidly and can invoke unapproved Model Context Protocol servers through standard HTTPS traffic. To mitigate this shadow traffic, Cloudflare One introduces detection and inspection capabilities across clients, network boundaries, and MCP servers. Cloudflare Gateway leverages protocol-level headers and JSON-RPC inspection to identify direct MCP connections, verify managed paths, and enforce access through approved MCP Server Portals. Furthermore, Cloudflare Agents SDK v0.20.0 implements the stateless 2026-07-28 MCP specification while providing fallback handshakes for legacy servers. Organizations can combine Gateway traffic source rules with server middleware like WriteGuard to block unauthorized tool invocations before execution.
Secure all your internal vibe-coded applications — in one click
AI-assisted development enables employees to build applications rapidly, but unmanaged deployments can accidentally expose internal company data to the public Internet. Cloudflare introduced direct Cloudflare Access integration for Cloudflare Workers, allowing organizations to enforce authentication policies directly at the account or individual Worker level rather than per hostname. When enabled, incoming requests are authenticated before reaching application code across custom domains, routes, workers.dev subdomains, and preview environments. Developers can access authenticated identity data such as emails and groups directly via the Worker context object without manually validating JSON Web Tokens. This capability was implemented on Cloudflare's Rust-based FL2 proxy, which separated Worker routing from Worker execution so routing runs safely prior to Access policy enforcement.
Integrations That Write Themselves
Ramp describes an approach to scaling integrations beyond what engineers can build and maintain by hand. Its agentic system lets customers describe a missing workflow integration, researches the provider’s API, requests credentials through a secure widget, writes and tests ordered API-call “recipes,” and generates a deterministic script that runs the integration after build time. An internal Integration Factory applies the same pattern to first-party connectors, producing evidence for review and opening pull requests; the post says 75 integrations have shipped this way, with work reduced from weeks or months to hours. Security controls include HTTPS and hostname allowlists, private-address rejection, isolated egress, bounded responses, business-scoped immutable recipes, and test credentials rather than customer data. The central design lesson is to use models during research and construction, keep them out of execution, and bound autonomy with verification artifacts.
Serverless vehicle tracking at scale: Bosch L.OS on AWS
Bosch Mobility Platform Solutions developed the Logistics Operating System on AWS to unify vehicle tracking across fragmented spot logistics markets. The system standardizes multiple telematics providers, disparate data formats, and diverse communication protocols into a centralized visibility layer. Orchestration is handled by a Tracking Connector running on Amazon ECS with AWS Fargate, while AWS Lambda functions act as provider-specific adapters for protocol translation. Event-driven message ingestion and streaming rely on Amazon MSK, complemented by Amazon ElastiCache for low-latency caching and Amazon DynamoDB for compliance policy enforcement. Currently operational in India with ten integrated ISVs, the platform reportedly reduces integration costs by 15–20% and lowers total tracking costs for small transporters by 25–30%.
Insurance for Rideshare Drivers | Uber
Uber’s rideshare insurance guidance explains how coverage changes when a driver is offline, online and available, en route, or on-trip, and how personal auto insurance fits into each state. Drivers must maintain personal insurance at mandatory minimum limits, while Uber maintains commercial coverage on their behalf; repair coverage while en route or on-trip depends on comprehensive and collision coverage in the personal policy. When a driver is at fault while en route or on-trip, Uber lists at least $1 million in coverage for property damage and injuries to riders and third parties, plus vehicle-damage protection up to actual cash value with a $2,500 deductible, subject to conditions. The guidance also outlines optional protections, state-dependent coverages, certificates of insurance, and accident-reporting steps through the Driver app.
Close the Database Blind Spot with MongoDB Atlas Observability
MongoDB Atlas introduces OpenTelemetry Metrics Sink, a push-based stream that delivers high-fidelity Atlas metrics to OpenTelemetry-compatible platforms, enabling database telemetry to flow alongside application and infrastructure metrics. This closes the gap where database telemetry was often disconnected from application and infrastructure monitoring, forcing operators to jump between dashboards. The push-based delivery eliminates the complexity of pull-based collection, custom exporters, and polling infrastructure, reducing operational overhead and avoiding API rate limits. It supports configuration via the Atlas UI or Terraform, works with custom OTel endpoints, Dynatrace, and New Relic, and is available for dedicated M10+ clusters; a test metric is emitted on creation or update to verify it is working. Combined with Atlas Log Integration and upcoming Events Integration, teams gain unified visibility into database health alongside other signals, accelerating incident response and root cause analysis.
State of Open Models: Summer 2026 Observations
The report analyzes Hugging Face Hub activity from January through August 2026 to assess how open-model releases, usage, licensing, and agent traffic are changing. Public repositories expanded from 2.43 to 2.96 million models, while 85.6% of models had fewer than 200 lifetime downloads and 1.5% of repositories captured 99.2% of downloads. Chinese labs reached monthly ceilings of 754B to 2.78T parameters, while broader portfolios such as Qwen’s generated far more downloads than frontier-only strategies; likes and downloads measured attention and infrastructure dependence differently. Large Chinese releases were often Apache 2.0 or MIT licensed, though newer trillion-parameter models introduced restrictions, while agents became the Hub’s leading user and autonomous-agent activity exposed the practical value of running quantized open models locally.
Reading the signals: Helping your AI-built payment integration understand business intent
AI agents can quickly produce Stripe payment flows that create a PaymentIntent, render the Payment Element, and pass an end-to-end demo, yet a correct implementation can still violate the business intent behind the money. The post argues that payment expertise and business decisions are often missing from integrations built from API references, causing silent failures such as terminal declines being retried, intents stuck in requires_action, uncaptured authorizations, restricted connected accounts, and asynchronous payments being refunded. It recommends defining business intent before configuring the PaymentIntent, then writing those rules into code comments, metadata, documented requirements, or custom objects. A verifier agent can check rules on every build, either through an agent skill, automated tests, or CI, while shared ownership remains with the human who decides what correct means.
UBER FRAUDULENT USE POLICY – SEATTLE
Uber’s Seattle Fraudulent Use Policy identifies activity that may constitute fraud across rides and deliveries, including increasing trip time or distance, creating improper accounts, claiming false fees, falsifying records, and certain cancellations. Manipulating the Uber platform or GPS system with unauthorized devices, apps, or programs is also covered. Violations may cause immediate loss of access to some or all of the Marketplace Platform, holds or adjustments to suspected fraud-related earnings, restrictions on offers, or temporary deactivation during review. Affected couriers may be notified in pay statements or through in-app communication, phone, or email, and Uber may request additional information to assess a potential violation. Appeals require contacting Support or responding through the app; review typically takes up to seven business days, and the final decision is not subject to further review.
How Scottish Water Made Its Capital Investment Data Conversational With Databricks Genie
Scottish Water’s Capital Investment teams had project data, reports, and metrics available, but non-technical users often struggled to find answers, creating duplicated reporting and delays. SPARK addresses this access problem through a natural-language interface in Microsoft Teams: Copilot routes questions via a supervisor agent and MCP to the Databricks Genie Agent, which queries governed Unity Catalog data. The implementation curates use-case data in a gold layer, adds metric views as a semantic layer, and configures business rules, examples, benchmarking, feedback, and monitoring for accuracy and performance. Environment-parameterised Databricks Asset Bundles, separate environments, Azure DevOps approvals, Entra ID, and Key Vault support repeatable deployment. The post reports lookup journeys shrinking from around eight clicks or four to five search steps to a direct question, with an estimated 520 to 1,300 hours saved annually under a stated usage scenario.
Total eclipse of the Internet: traffic impacts in Iceland, Spain, and Portugal
On August 12, a total solar eclipse crossed the North Atlantic and Europe, passing directly over Iceland, northern Spain, and Portugal. Cloudflare Radar analyzed HTTP request volumes in five-minute intervals across affected countries, comparing the data against a baseline derived from the previous three Wednesdays. Traffic reductions aligned closely with peak solar obscuration, with totality regions recording drops between 15% and 30% and specific areas shifting by up to -46.7%. Once the sun reappeared, request volumes rebounded to normal levels within minutes as users resumed device activity. The observed traffic declines were driven by aggregate human behavior rather than network failures.
What are AI Hallucinations?
AI hallucinations are coherent, confident outputs that are factually wrong, fabricated, or unsupported, appearing in chatbots, image generators, and multimodal systems. Generative models predict likely continuations rather than retrieve guaranteed facts, while training incentives, limited or flawed data, generation settings, and error compounding in reasoning models can increase the risk. Examples include Google Bard’s incorrect JWST claim, Air Canada’s nonexistent bereavement policy, Microsoft Sydney’s erratic responses, and fabricated legal citations that led to sanctions. Hallucinations create enterprise risks involving safety, liability, compliance, security, reputation, and trust; recommended controls include guardrails, source verification, adversarial testing, monitoring, human review, retrieval-augmented generation, governed data, and evaluation throughout development and deployment.
Firetiger joins Cursor
Cursor announced that the Firetiger team is joining the company, bringing together coding agents with agents focused on software after it reaches production. Founded in 2024 by Rustam Lalkaka and Achille Roussel, Firetiger builds agents that monitor rollouts, catch regressions, investigate incidents, and pass findings back to coding agents. The stated motivation is to reduce operational toil and connect code generation with production feedback, so an agent can ship a change, observe its behavior, and respond when something goes wrong. Firetiger’s work is expected to appear across Cursor as the companies develop long-running, autonomous, context-aware agents for teams, alongside Cursor Origin and the forthcoming Change Monitors, which will watch deployed changes and flag problems as they appear.
When Can LLMs Replace Humans in A/B Tests?
Replacing human participants in A/B testing with large language model predictions eliminates causal identification guarantees by design, forcing reliance on surrogate endpoint assumptions. An empirical evaluation using the Upworthy dataset revealed that raw gpt-4o-mini click-through rate predictions exhibited systematic attenuation bias, capturing only 39 percent of observed human treatment effects. To address this discrepancy, researchers formalized surrogacy and comparability conditions, finding that nonlinear machine learning calibrators like random forests and gradient-boosted trees successfully recovered treatment effects where linear ordinary least squares failed. In addition, averaging multiple sample draws per experimental unit mitigated variance and zero-bias caused by model generation temperature. Ultimately, because comparability cannot be verified for novel interventions that depart significantly from historical experiments, calibrated models cannot entirely replace human testing for genuine product innovations.
Smart Routing in Unity AI Gateway: Match frontier quality with 30%+ lower cost per task
Unity AI Gateway’s Smart Routing, now in Beta, addresses the cost and choice overload of assigning coding tasks to increasingly diverse models and harnesses. It uses task-aware routing: a small, low-latency model classifies the initial task description and metadata, then a policy selects a cheaper, medium, or frontier model; Omnigent can also choose the coding harness and route sub-agents. The design keeps consecutive turns on one model to preserve cache-hit rates, while escalating complex work and delegating simpler tasks to lower-cost options. On internal coding workloads, Smart Routing achieved 35% savings and outperformed any single model at 65% of Opus 5’s cost; public benchmarks reported matched Opus 5 performance with 56% savings. The team identifies mid-session reassessment, real-session evaluation, and affordable switching as continuing challenges.
Announcing Evals and Releases: Evaluate Fin before, during, and after you go live
Fin’s new Evals and Releases provide an evaluation and rollout system for testing changes before launch, controlling deployment, and assessing live conversations, alongside Monitors. Evals group multi-turn Simulations built from real conversations around a theme, then score them pass/fail using deterministic checks and an LLM judge against criteria such as required responses, Procedures, or data connector calls. Releases let teams edit content, Procedures, and Guidance away from live Fin, run Evals on proposed changes, collaborate, and publish to everyone, ramp traffic, A/B test, or roll back. Monitors evaluates every live conversation and can turn failures into new Simulations for subsequent testing. The combined workflow addresses probabilistic behavior, regression risk, and drift as support content and policies change, while Operator can draft changes, tests, and Releases for review and approval.
Record, train, and deploy from one place with Strands Agents, LeRobot, and Hugging Face Storage Buckets
This walkthrough presents a streaming data loop for Strands Robots that records robot demonstrations, stores them in Hugging Face Storage Buckets, trains from the growing dataset, and deploys a resulting policy back to hardware. It uses the LeRobot on-disk format throughout: Robot("so100") records through DatasetRecorder, sync_dataset_to_bucket writes changed bytes to a mutable bucket, and stream_dataset reads the dataset from the Hub without a full local download while decoding camera video on the fly. The agent can decide which episodes to keep and when to retrain, while the same Robot object records and streams data; deployment changes the robot mode keyword from simulation to real. The default simulation path runs with a mock policy that produces a valid dataset but not a useful one, while hardware, bucket, and training paths require additional dependencies.
What’s new in the ClickHouse Grafana plugin
ClickHouse’s Grafana plugin has shipped a set of changes aimed at making common observability tasks—finding log lines, narrowing to services, and detecting deployments—faster without requiring SQL. Version 4.20 adds single-table configuration and compact query mode, where users search logs, apply type-aware filters, review query history, and see or edit generated ClickHouse SQL. Investigation can proceed by clicking through collapsible OpenTelemetry Resource, Scope, and Log attributes, filtering values or selected message text, while dashboards can discover Map keys and values across tables. The release also includes interactive Logs Explorer, Traces Explorer, and per-service OpenTelemetry dashboards, plus guided variable and annotation editors that generate editable SQL for distinct values and change markers such as deployments and rollbacks. Additional changes cover schema-introspection caching, trace-ID lookup, Grafana 13 compatibility, SQL validation, backend OpenTelemetry instrumentation, and forwarding Grafana identity to ClickHouse; compact mode initially remains limited to single-table data sources.
Track generative AI costs with Amazon Bedrock inference profiles
When multiple departments share a single foundation model in Amazon Bedrock under one IAM role, usage aggregates into one billing line item, complicating department-level chargebacks and budget tracking. This issue can be resolved by deploying Amazon Bedrock application inference profiles wrapped around the shared foundation model and tagging each profile for cost allocation. The application layer determines the user department during authentication and passes the corresponding inference profile ARN as the model identifier. Once the designated cost allocation tag is activated in the AWS Billing and Cost Management console, usage separates into per-department line items in AWS Cost Explorer. This method incurs standard per-token model rates without extra charges for cost attribution.
Recovery strategies to meet data residency requirements
Organizations operating under data residency requirements must balance jurisdictional compliance with disaster recovery objectives for critical workloads on AWS. In locations served by a single Region or facing multi-Region constraints, three architectural patterns offer distinct trade-offs between regulatory adherence and operational complexity. The cryptographic boundary approach replicates encrypted data to another AWS Region while restricting decryption access using AWS Key Management Service policies. The data boundary pattern deploys AWS Outposts on-premises within the source country while relying on an external parent Region control plane. Finally, strict local autonomy boundaries retain data and control planes entirely in-country through on-premises systems or multi-cloud lifeboats, requiring rigorous end-to-end continuous testing.
Top topics
- Architecture834
- Performance815
- LLMs659
- Machine Learning621
- Open Source563
- AI Agents553
- AI469
- Developer Experience448
Weekly digest
The best engineering reads, once a week.