Loading…
Latest reads
Every post, summarised
Grounded summaries of engineering blogs, newest first. Each links to the original.
- 4,671 posts
- 20 companies
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Latest posts
What’s new in the ClickHouse Grafana plugin
ClickHouse’s Grafana plugin has shipped a set of changes aimed at making common observability tasks—finding log lines, narrowing to services, and detecting deployments—faster without requiring SQL. Version 4.20 adds single-table configuration and compact query mode, where users search logs, apply type-aware filters, review query history, and see or edit generated ClickHouse SQL. Investigation can proceed by clicking through collapsible OpenTelemetry Resource, Scope, and Log attributes, filtering values or selected message text, while dashboards can discover Map keys and values across tables. The release also includes interactive Logs Explorer, Traces Explorer, and per-service OpenTelemetry dashboards, plus guided variable and annotation editors that generate editable SQL for distinct values and change markers such as deployments and rollbacks. Additional changes cover schema-introspection caching, trace-ID lookup, Grafana 13 compatibility, SQL validation, backend OpenTelemetry instrumentation, and forwarding Grafana identity to ClickHouse; compact mode initially remains limited to single-table data sources.
Track generative AI costs with Amazon Bedrock inference profiles
When multiple departments share a single foundation model in Amazon Bedrock under one IAM role, usage aggregates into one billing line item, complicating department-level chargebacks and budget tracking. This issue can be resolved by deploying Amazon Bedrock application inference profiles wrapped around the shared foundation model and tagging each profile for cost allocation. The application layer determines the user department during authentication and passes the corresponding inference profile ARN as the model identifier. Once the designated cost allocation tag is activated in the AWS Billing and Cost Management console, usage separates into per-department line items in AWS Cost Explorer. This method incurs standard per-token model rates without extra charges for cost attribution.
Recovery strategies to meet data residency requirements
Organizations operating under data residency requirements must balance jurisdictional compliance with disaster recovery objectives for critical workloads on AWS. In locations served by a single Region or facing multi-Region constraints, three architectural patterns offer distinct trade-offs between regulatory adherence and operational complexity. The cryptographic boundary approach replicates encrypted data to another AWS Region while restricting decryption access using AWS Key Management Service policies. The data boundary pattern deploys AWS Outposts on-premises within the source country while relying on an external parent Region control plane. Finally, strict local autonomy boundaries retain data and control planes entirely in-country through on-premises systems or multi-cloud lifeboats, requiring rigorous end-to-end continuous testing.
Certificate Transparency Monitoring is now generally available
Cloudflare announced the general availability of Certificate Transparency Monitoring alongside a filtering mechanism to eliminate noisy alert emails. Previously, the monitoring system alerted domain owners for all Certificate Transparency log entries, including routine, automated renewals for Universal SSL, Advanced Certificate Manager, and backup certificates. Because the alerting flow and certificate ordering service operated independently, existing identifiers like TBSCertificate hashes arrived too late to verify pre-certificates. To resolve this race condition, the ordering service now computes an SHA-256 hash of the DER-encoded SubjectPublicKeyInfo structure at key generation. When the alerting service discovers a log entry, it recomputes this hash to verify ownership against the ordering database, suppressing alerts for Cloudflare-managed certificates while preserving alerts for external or unexpected issuances.
ClickStack and Hud bring runtime intelligence to AI-powered development
ClickHouse and Hud announce an integration that combines ClickStack’s service-level observability with Hud’s function-level runtime forensics for AI-assisted software development. As coding agents generate more code, the post identifies the central challenge as assessing production risk, detecting regressions, and giving engineers enough context to fix them. Teams connect the ClickStack and Hud MCP servers to a single coding agent, while shared trace IDs correlate OpenTelemetry traces and logs with Hud’s function-level metrics and forensic data; Hud’s Runtime Code Sensor requires no manual instrumentation and runs with low overhead in production. The resulting workflows support pre-deployment risk assessment against production behavior, release monitoring, auto-triage and auto-fix, and rollback or code-level remediation when issues arise.
Cloud agents start 3x faster with builds
Cursor introduces builds for Cloud Agents, continuously prepared copies of development environments that replace just-in-time machine boot, repository cloning, dependency installation, and install-script execution. Builds run by default every hour; successful builds become the starting point for future agents, which fork warm live machines rather than restoring environments from disk. The post reports 10x faster internal environment boot times and 3x faster time to first token, while customers cite quick starts and uninterrupted automated runs when builds fail. If a dependency bump or Docker build breaks installation, the failed build stays inactive and sessions continue from the last successful version while debugging proceeds. The Cloud Agents dashboard exposes build status, logs, captured commit SHAs, and run-to-build links, while a git-state threshold and Cursor Cloud MCP support oversight; setup requires moving preparable work into install and reserving fresh services for start.
Cursor earns AIUC-1 certification for agent security and reliability
Cursor announces that it has earned AIUC-1 certification after an independent review of its organizational controls and agent behavior. AIUC-1 combines an organizational-controls audit with adversarial product testing, translating the NIST AI Risk Management Framework, MITRE ATLAS, and OWASP’s agentic threat taxonomy into requirements for live AI systems. Schellman reviewed documented controls and AI governance practices, while evaluators tested IDE and cloud agents in a representative enterprise configuration across several thousand scenarios and two rounds. Testing covered rules, hooks, Auto-review, model-level safeguards, secrets protection, secure code generation, MCP security, identity and permissions, and potentially destructive actions. Cursor says its safeguards held in benign and adversarial conditions, with certification requiring quarterly testing and an annual full audit as AIUC-1 evolves.
Automated agent triage with Agent Tracing and Claude Routines
Evaluating Sentry's AI agent Seer previously required manually querying evaluation data and parsing raw JSON traces to find tool failures, latency spikes, and hallucinations. To automate this triage, the team deployed a daily Claude Routine connected to Sentry using a Model Context Protocol server. Each morning, the routine analyzes hundreds of overnight agent conversations, reviews aggregate error metrics, samples failed and successful conversation spans, and inspects the agent codebase for context. Claude evaluates whether final decisions match underlying reasoning and creates Linear tickets for newly discovered issues. This daily automated analysis accelerated the feedback loop, allowing engineers to identify efficiency issues like repeated malformed repository queries and deploy same-day fixes.
Why Enterprise Intelligence Needs Purpose-Built AI
Enterprise intelligence requires more than the plausible answers produced by general-purpose LLMs: it needs accurate insights from vast real-world brand data, supported by statistics, governance, and domain expertise. LLMs can hallucinate, miss context, produce inconsistent answers, and rely on limited, non-randomly sampled sources, making them unsuitable as the sole basis for high-stakes decisions. The article argues for matching technologies to tasks, using statistical models for quantitative problems such as social and online-news Reach, specialized classifiers for other tasks, and generative AI to synthesize model outputs. At enterprise scale, crisis and reputation use cases also demand near-real-time speed, consistency, predictability, explainability, auditability, monitoring, and bias testing. LLMs still have a role, including as orchestrators grounded in high-quality data, workflows, specialized models, and rigorous evaluation; the proposed future combines varied models rather than choosing between LLMs and traditional AI.
Reducing Text2SQL latency with parameterized query templates
In Text2SQL systems, generating SQL on the fly with frontier foundation models can cause response times of 25 to 30 seconds due to 60,000-token prompts and model latency. To solve this without degrading accuracy, an intelligent caching layer was built using parameterized SQL query templates paired with question embeddings. When an incoming question matches a cached template via semantic search above a confidence threshold, named entity recognition extracts values to populate template placeholders, bypassing the initial SQL generation step. In production, this approach reached a 60% cache hit rate after two weeks, cutting per-hit token consumption by roughly 90% and reducing overall latency by 80% to under 5 seconds.
Adobe Firefly: Simplified observability with Amazon Managed Prometheus
Adobe Firefly powers generative creative features using a large-scale GPU training infrastructure hosted on Amazon Elastic Kubernetes Service. As workloads scaled to thousands of nodes and GPUs, Adobe's self-managed Prometheus setup struggled with query latency across high-cardinality telemetry data. To resolve these performance bottlenecks, the team moved two million critical time series metrics to Amazon Managed Service for Prometheus while using managed scrapers alongside their existing infrastructure. This setup accelerated query response times by more than 28x over 24-hour windows, reducing query execution times to approximately ten seconds. Additionally, the migration expanded practical monitoring windows from six hours to 24 hours, giving teams reliable visibility across long-running distributed training jobs.
MongoDB for the Agentic Era: Built for Developers and AI Agents
MongoDB has launched the Atlas Managed MCP Server, a fully hosted service that lets AI coding tools connect to Atlas data without manual infrastructure setup. The server uses OAuth 2.1 to replace shared service accounts with individual user delegation, so agents act with the developer’s own permissions and every action is auditable. Developers can connect via one-click OAuth consent in tools like Claude Code, Codex, Cursor, Grok Build, and Devin AI, with no connection strings or credentials to manage. Admins can enforce read-only mode, configure token lifetimes, and revoke access from the Atlas UI or Admin API. The announcement also includes Atlas App Connections, native connectors for frontier AI tools, and an integration with Vercel v0, aiming to close the gap between prototype and production.
Closing the Gap Between Agentic Promise and Impact with Industry Leading Retrieval
McKinsey projects AI agents will generate $2.9 trillion annually; a WRITER survey finds 97% of executives have deployed agents, yet only 29% see significant ROI due to data accuracy issues. MongoDB announced capabilities embedding benchmark-leading retrieval directly into its operational database, closing the gap between agentic promise and impact. Automated Embedding in MongoDB Atlas powered by Voyage AI, now GA, uses the top-ranked Voyage 4 model family for accurate retrieval without separate pipelines, as demonstrated by MedINT. The Atlas Embedding and Reranking API and voyage-code-4 model, designed for agentic coding retrieval, extend accurate retrieval to any stack and coding agent workloads at low cost. $vectorSearch in Atlas Stream Processing enables agents to retrieve accurate data in motion, and a joint MongoDB-Temporal reference architecture provides a forkable starting point for durable execution on live data.
Cloud Agents Start 3x Faster with Builds
Cursor’s Cloud Agents now use Builds, ready-to-use copies of a development environment prepared in the background. These environments include cloned repositories, installed dependencies, and completed install commands, allowing agents to start without repeating setup each session. Cursor refreshes environments regularly, keeps warm copies, and activates only successful builds; internally, environments boot 10x faster and time to first token is 3x faster. If a commit or dependency update breaks a build, the last successful build remains active, while users receive a notification and can debug in the background. Builds can be inspected in the Cloud Agents dashboard, where logs, commit SHAs, statuses, and agent run associations are available, with tools for agents to inspect or manage them.
HeyGen x Google Cloud: Bringing Avatar IV to TPUs
HeyGen and Google Cloud ported Avatar IV, an 18B-plus-parameter diffusion stack for streamed talking-head video, to an eight-chip Trillium (v6e) host. The pipeline uses two diffusion transformers and a VAE decoder, with FSDP weight sharding and Ulysses sequence parallelism across the mesh, and runs through torchax, JAX, XLA, and shape-specific Pallas kernels. Optimization targeted exposed all-to-all collectives, frame-misaligned sparse-attention blocks, serial softmax work, layout copies, scheduler choices, and custom-kernel cost estimates; changes were measured per video chunk against output-quality gates. The resulting pipeline was 1.86× faster than the first working TPU version, comparable in performance to the 8×H100 production setup and up to 25% more cost efficient per generated-video minute, while shipped changes preserved byte-identical output or passed defined similarity review.
Introducing Credentio: Open Source C++ Library for C2PA Content Credentials from Google
Google introduces Credentio, an open-source C++ library for local validation of C2PA Content Credentials, initially supporting specification versions 2.2 and 2.4. The library is the code used by nearly 40 conformant C2PA-enabled Google products to process tens of billions of generated images, videos, audio files, and documents across many formats. Its API keeps validation inside the developer’s application, avoiding media transmission while providing immediate verdicts, privacy, and zero bandwidth overhead; it is also designed to maintain a small memory footprint for assets ranging from images to multi-gigabyte videos. Credentio parses manifests, assertions, digital signatures, and claims, accepts official or custom trust lists, and reports verification statuses and integrity errors, while planned work includes generating and embedding Content Credentials.
What We Learned by Reproducing 2,200 papers from ICML
An ICML 2026 reproduction hackathon examined whether coding agents could audit research at conference scale, amid 23,918 submissions and 6,352 accepted papers. From July 15 to August 2, 1,221 participants published 6,816 Trackio logbooks covering 2,226 papers and 35,908 claims; an open-weights GLM-5.2 judge assigned per-claim verdicts, while participants used cloud jobs and toy reproductions when full experiments were impossible. At least one claim was independently verified in 51% of examined papers, including 266 fully reproduced papers, while 23% had a falsified or contested claim and 242 papers produced opposing verdicts across teams. Adversarial re-checks confirmed issues including a paging-theorem error, a reverse-versus-forward-KL mismatch, and padded evaluation tokens, but also caught false falsifications, leading to the conclusion that agents expand auditing capacity while humans remain necessary to steer experiments and assess cases such as image quality.
Databricks Network Configuration delivery to Tens of Millions of Serverless VMs
Databricks’ serverless platform launches tens of millions of VMs daily, and each VM needs network configuration before serving customer workloads. The original design synchronously aggregated data from multiple upstream services on the cluster-creation critical path, producing 5,000-ms p99 RPC latency and availability bottlenecks as request volume reached billions per day. The replacement uses change events through a message queue, asynchronous per-workspace recomputation, partition-local snapshots, and periodic reconciliation to recover from missed events. The serving path now performs a single snapshot-store read without upstream calls, while events carry workspace and resource identifiers rather than customer data. After rollout, p99 RPC latency fell to 125 ms, server success rate rose to 99.99%, upstream call volume dropped 86%, and the legacy synchronous framework was deprecated.
How Agentforce-Powered AI Security Workflows Accelerate Incident Response
Salesforce engineers expanded Security Center from a basic conversational interface into an Agentforce-powered stateful investigations platform for incident response. Managing enterprise security incidents required handling long-running lifecycles, disparate telemetry formats, and finite LLM context windows that risk reasoning pocket collapse. To prevent overflowing context limits, the architecture partitions telemetry into contextual segments and uses AI-driven summarization pipelines before feeding data to the agent. Because non-deterministic LLM outputs break traditional deterministic testing, the team implemented AI-driven evaluation pipelines using simulated customer interactions to evaluate response behavior rather than exact wording. Ongoing work focuses on grounding public foundation models with curated, Salesforce-owned security knowledge to improve platform-specific remediation guidance.
Serve Qwen3.8-2.4T-A95B, a 2.4T-Parameter Model, with Configurable Reasoning on NVIDIA GB300 NVL72
Alibaba’s Qwen3.8-2.4T-A95B (Qwen3.8-Max) is an open-weight 2.4T-parameter model with 95B activated per token, designed for reasoning and agentic workloads. Its fine-grained mixture-of-experts architecture combines full and linear attention, supporting context of up to one million tokens and output lengths up to 128K while using bounded recurrent state in linear-attention layers. NVIDIA describes multinode serving on the 72-GPU GB300 NVL72, where a 130 TB/s NVLink domain supports expert communication; in FP8, the model reportedly exceeds 4K tokens per second per GPU and 350 tokens per second per user without additional tuning. Developers can control reasoning depth with low, high, or xhigh modes, choose SGLang, vLLM, NVIDIA Dynamo, or NIM for serving, and use NeMo AutoModel for full SFT or LoRA post-training.
Top topics
- Architecture834
- Performance816
- LLMs660
- Machine Learning622
- Open Source563
- AI Agents553
- AI470
- Developer Experience448
Weekly digest
The best engineering reads, once a week.