Loading…
Latest reads
Every post, summarised
Grounded summaries of engineering blogs, newest first. Each links to the original.
- 4,671 posts
- 20 companies
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Latest posts
When the sensor starts thinking: SnortML, agentic AI, and the evolving architecture of intrusion detection
Classic intrusion detection signatures suffer from an exposure window between zero-day discovery and rule distribution, leaving slight exploit variations unflagged. Cisco Talos addressed this by embedding SnortML into Snort 3 to perform local, sub-millisecond machine learning inference alongside signature checks. SnortML employs an LSTM preceded by a byte-embedding layer and XNNPACK acceleration to score URI queries and POST bodies for vulnerabilities like SQL injection, XSS, and command injection. Running both detection mechanisms concurrently provides independent error profiles and boosts detection confidence when both fire. The broader defense landscape is shifting toward connecting these packet-level ML detectors with agentic AI pipelines and supervised feedback loops.
OpenAI and Databricks at DAIS 2026: Making enterprise AI real
At Data + AI Summit 2026, Databricks and OpenAI presented a partnership centered on combining OpenAI’s frontier models and agents with Databricks’ enterprise context and control. The post describes GPT models and Codex running natively on Databricks, with Unity AI Gateway governing interactions, budgets, routing, auditing, and visibility, while Agent Tools provide governed enterprise data access through MCPs. Examples include OpenAI’s marketing data foundation on Databricks, which cut storage costs by $400,000 per month, and a Hertz application built in 11 business days with GPT-5.5 and Databricks that lifted lead conversion from 60–65% to 75–80%. The sessions argue that deployment, security, evaluation, monitoring, context, and sharing comprise most of the work around enterprise agents. A joint virtual event scheduled for August will address shipping agentic applications at scale, including a Stellantis case study.
98% faster queries, 50% lower cloud costs: Verihubs’ journey from Postgres to ClickHouse
Verihubs rebuilt its data warehouse after a Postgres-based, daily-batch pipeline became slow, unreliable, and difficult to correct when late vendor callbacks required backfills. The new architecture uses Kafka, Kafka Connect, and Debezium for real-time ingestion into ClickHouse, with MergeTree for append-only logs and ReplacingMergeTree for datasets updated through change data capture. Materialized views create daily and monthly rollups, projections accelerate existing query patterns, and Dagster handles complex detection workflows that can notify Slack. The migration, completed in about six months, reduced query times from 20–30 minutes to two or three seconds on datasets up to 18 million rows, representing as much as 98% faster queries and 50% lower infrastructure costs. Verihubs says the resulting real-time OLAP system gives finance and operations fresher data for traffic analysis, reconciliation, performance reporting, and invoicing.
How to price serverless GPUs
Modal’s engineering blog presents a cost model comparing serverless and reserved GPU pricing for AI workloads, centered on the peak-to-average demand ratio. Serverless GPUs charge only for usage, while reserved GPUs require long-term contracts for fixed capacity, often achieving under 30% utilization. The model shows that when the peak-to-average ratio exceeds the reservation discount rate (typically 2-5x), serverless GPUs become cheaper despite higher base rates, with real workloads like inference and training having ratios of 5-10x, making serverless an obvious cost win. An interactive tool allows teams to estimate costs using preset workloads or custom traffic patterns, defaulting to current B200 GPU rates on Modal and hyperscaler reservations. The post discusses model limitations, including assumptions of perfect prediction and instant allocation, and notes that serverless also reduces engineering costs through faster development and reduced dev/prod skew, while mixed strategies can combine baseline reservations with serverless bursting for high peak-to-average bursts.
CFOs and the new economics of AI
AI spending has moved from experimental pilots into a recurring operating expense, reaching $1.5 trillion globally in 2025, while only 39% of organizations in a cited McKinsey study could trace AI investment to enterprise-level EBIT impact. The launch introduces the Cursor CFO Council, a quarterly forum for finance leaders that will develop shared frameworks for AI productivity, returns on intelligence, model allocation, and cost management. Analyses using Cursor data found higher token usage associated with higher median year-over-year revenue growth, while usage rose after model improvements, especially for high-complexity work. Yet adoption and benefits are concentrated: p99 developers produced 46x more AI-assisted lines per day than median active users, and agent-request costs varied nearly ninefold across model families. With usage-based pricing making intelligence a less predictable variable cost, the council will meet beginning in August to advance measurable and efficient AI economics.
18 Social Media Holidays to Celebrate This August
The post presents 18 August holidays that brands can use to plan social media content and connect with their online communities. Dates range from World Wide Web Day and Respect for Parents Day on August 1 to National Dog Day and National Women’s Equality Day on August 26. Each entry supplies a hashtag, a short description of the occasion, and a content suggestion, including polls, infographics, employee stories, charitable spotlights, recipes, jokes, and photographic timelines. The themes span digital history, family, books, relaxation, youth, wildlife, finance, visual storytelling, humanitarian action, entrepreneurship, and equality, with recommendations tailored to community participation or organizational initiatives and campaigns. It closes by positioning the list as a way to support Q3 goals and directing readers to a 2026 Social Media Holiday Calendar.
We terminated a TPU mid-training and it recovered in seconds: Introduction to elastic training with MaxText
Distributed training on multiple TPU machines normally fails as a whole when one worker disappears: collective communication times out, processes exit, and the job restarts from a checkpoint. The article demonstrates elastic training with JAX, MaxText, PathwayS, Orbax, and Cloud TPUs on GKE, using a single CPU-side controller that remains alive while TPU workers execute compiled programs. A Pathways elastic_retry wrapper catches the failure, cleans up partial state, restores the last viable checkpoint, and re-enters the training function without relaunching the workload; the demo returned to training in under two minutes, with no JobSet restarts, after losing 88 steps. It also contrasts pause-and-resume with replica resize, explains direct checkpoint persistence through ENABLE_PATHWAYS_PERSISTENCE=1, and describes planned snapshot-based recovery from host memory.
How to Build and List Secure Cross App Access (XAA) Connections on Okta Integration Network (OIN)
Cross App Access (XAA) provides an identity framework for securing token-based communication when software or AI agents access external ecosystems through trusted identity providers. It replaces long-lived API keys and hardcoded secrets with real-time identity propagation, while allowing enterprises to control connected apps, requested scopes, and user access. The guide explains prerequisites for requesting and resource apps, including OIDC or SAML SSO, authorization-server support, protected resources, scopes, an Okta Integrator Free Plan org, and tested workflows. It then describes token exchange testing: requesting apps obtain an ID token and mint an ID-JAG, while resource apps validate the ID-JAG and issue a scoped access token. To seek OIN listing and XAA enablement, applicants submit SSO integration details, metadata, testing evidence, and a questionnaire to Okta.
Introducing AI dashboard and workflow generation in ClickStack
ClickStack now supports AI-generated dashboards and linked investigative workflows from natural-language prompts, targeting the effort required to understand telemetry, write queries, choose visualizations, and iterate. Rather than asking an LLM to return a finished artifact, ClickStack uses an AI Notebook with the same MCP tools available to external agents, where queries, visualizations, findings, and reasoning are captured in a persistent, editable investigation. The system explores telemetry, validates assumptions, assembles dashboards, and can connect overview and service-level dashboards through dashboard actions; generated charts remain editable. The same MCP server exposes these capabilities to agents such as Claude, Cursor, and Codex, so users can create, refine, and extend dashboards through one toolchain.
Claude's extended thinking
Claude 3.7 Sonnet introduces extended thinking, letting users toggle deeper reasoning and developers set a thinking budget. The same model spends additional computation on sequential reasoning, while agent training supports iterative function calls, computer use, and open-ended tasks. The post examines visible thought processes, noting benefits for trust and research but also limitations around faithfulness, safety, and jailbreak risk; it therefore treats the feature as a research preview. Reported examples include stronger OSWorld performance, playing Pokémon Red through tens of thousands of interactions and progressing through three Gym Leaders, plus logarithmic math gains as thinking tokens increase. Safety work includes encrypted thoughts for some harmful content and computer-use prompt-injection mitigations that raise prevention from 74% to 88%.
Announcing Anthropic's Responsible Scaling Policy
Anthropic announces its Responsible Scaling Policy (RSP), a set of technical and organizational protocols for managing catastrophic risks from increasingly capable AI systems, including deliberate misuse and autonomous behavior contrary to designers’ intent. The policy introduces AI Safety Levels (ASL), loosely modeled on biosafety levels, with requirements for safety, security, and operations increasing alongside a model’s potential for catastrophic risk; current LLMs, including Claude, are described as ASL-2. ASL-3 would require unusually strong security and no deployment when adversarial testing by world-class red-teamers finds meaningful catastrophic misuse risk, while ASL-4 measures remain unwritten and may depend on unresolved interpretability research. Approved by Anthropic’s board, the RSP is presented as an initial, revisable framework that may temporarily pause scaling when safety procedures cannot keep pace, while incentivizing solutions needed for further development and leaving current Claude uses and product availability unchanged.
More details on Fable 5’s cyber safeguards and our jailbreak framework
Claude Fable 5 has been redeployed globally, accompanied by additional detail about its cybersecurity safety classifiers and a proposed AI jailbreak severity framework. The classifiers distinguish prohibited use, high-risk dual use, low-risk dual use, and benign use, with intended responses ranging from blocking to allowing with monitoring; the model uses a larger safety margin than previous models, accepting more false positives to increase protection against harmful outcomes. Other safeguards include access controls, model safety training, and offline monitoring, while a HackerOne program invites researchers to submit potential cyber jailbreaks. The draft framework measures capability gain against the available baseline and illustrates scoring with Log4Shell cases, where severity changes as discoverability and existing tools change.
Enabling Cross App Access for SAML-Based Resource Apps
Cross App Access (XAA) lets applications using existing SAML federation obtain API access without migrating to OpenID Connect (OIDC). An agent presents a short-lived Identity Assertion Authorization Grant (ID-JAG), which the resource authorization server validates, resolves to a user, and exchanges for its own access token; SAML processing remains upstream. For SAML identity resolution, implementations must validate the saml-nameid sub_id and match issuer, NameID, and sp_name_qualifier rather than relying on NameID alone. The guide recommends binding iss to a registered SAML connection before verifying the JWT against that connection’s JWKS, then checking typ, aud, and client_id and applying local scope policy. It also walks through Okta configuration and xaa.dev checks that redeem the ID-JAG, call the API, and export conformance results.
ClickHouse Release 26.6
ClickHouse 26.6 is a release marking the 10-year anniversary of ClickHouse becoming open source, with 56 new features, 79 performance optimizations, and 366 bug fixes. Hypothetical skip indexes let users evaluate set indexes in a session without building them; on a 487.24-million-row UK property dataset, the example estimated skip ratios of 77.0% at granularity 128 and 92.2% at granularity 1. The release overhauls dependencies between refreshable materialized views, addressing schedule drift that could make dependent stages lag or miss a refresh cycle. It also introduces experimental continuous queries, the aiEmbed function, embedding quantization to 8 bits and below, and workload-level memory reservations.
Migrating Counter Service storage: Design choices and learnings
Grab’s Counter Service supports time-windowed fraud queries at tens of thousands of QPS and about a billion requests per day, but an infrastructure review prompted migration from a wide-column database to Aerospike. The team first separated Rust business logic from storage, then added an enum-dispatched facade with Single, WithShadow, and WithSplit modes so traffic could be compared and shifted without downtime. They also redesigned the writer path around Aerospike, including a map-based schema and a single atomic increment, while testing index placement and reverting from an NVMe-backed primary index after hot-key p99 spikes. Production p99 read latency improved by roughly 50%, disk usage fell from about 3 TB to 1 TB, and per-node cost dropped 45–50%; the rollout reported zero downtime and no data-integrity issues.
Hardware-Rooted AI Security That Won’t Slow You Down
NVIDIA Confidential Computing secures enterprise data, proprietary model weights, and the model itself during active AI inference. The architecture integrates silicon-level private signing keys fused during manufacturing, encrypted multi-GPU NVLink, and remote attestation through the NVIDIA Remote Attestation Service alongside CPU Trusted Execution Environments. To mitigate overhead from secure work submission latency and encrypted host-to-device transfers, software optimizations incorporate CC-safe autotuner timing in FlashInfer, asynchronous copy workers in SGLang, and piecewise CUDA graph replay. Benchmarks on an HGX B300 system running the Qwen 3.5 397B-A17B model at FP8 precision show inference performance reaches up to 98% of non-confidential baselines across tested concurrency levels.
Presto® on Apache Kafka® At Uber Scale
Uber connected Presto and Apache Kafka to provide lightweight, interactive SQL queries over Kafka topics for ad-hoc analysis of real-time data. The work addresses operational requests such as checking whether an order UUID appears in a service’s input or output streams, where streaming processors are poorly suited to historical point lookups and real-time OLAP requires onboarding and dedicated resources. The enhanced connector discovers Kafka clusters, topics, and schemas on demand, supports multiple Kafka clusters, caches metadata, enforces _timestamp or _partition_offset filters, and uses a shared Kafka client ID with broker quotas to control consumption. After rollout, example lookups returned within a few seconds, daily usage reached 6,000 queries, and the teams reported improved productivity, while concurrent queries may take longer under quota control.
Building Zone Failure Resilience in Apache Pinot™ at Uber
Uber describes how it made Apache Pinot clusters resilient to zone failures while preserving query and ingestion availability for Tier-0 use cases. It maps Uber’s virtual resource isolation group IDs to Pinot server pools, uses pool-based instance assignment with replica-group segment assignment, and requires at least as many isolation groups as the table’s replication factor. During migration, automated pool registration, configuration backfills, granular APIs, selective rebalancing, and rollback support were used across more than 400 Tier 0-1 clusters and thousands of tables. An internal drill found that one remaining replica continued serving traffic without query degradation after a zone went down, while isolation-group-based claim and release policies enabled parallel restarts and sequential rollouts with baking time.
Introducing uFowarder: The Consumer Proxy for Kafka Async Queuing
Uber introduces uForwarder, an open-source Consumer Proxy for Kafka Async Queue workloads, after deploying a push-based system across more than 1,000 consumer services. The proxy fetches messages through Kafka’s binary protocol, sends them individually to consumer services over gRPC, collects status codes and processing results, and commits offsets when safe. Production challenges included head-of-line blocking from messages that fail before reaching handlers, growing hardware costs, external data sources that are not ready when events arrive, and requirements for production/non-production and zone isolation. The implemented solutions include context-aware routing through message and gRPC headers, active blocking detection and mitigation, hardware-efficiency improvements, and DelayProcessManager, which pauses only delayed partitions and guarantees at-least delay rather than exact timing. The project is open source, with planned work on consumer-lag handling and direct Protobuf support.
The 3 questions to answer to take AI from experimentation to impact
The post argues that enterprises moving AI from experimentation to impact should answer three questions: whether employees and governance are ready, whether tools are accessible, and whether workers have the capabilities to use them. It recommends secure, governed AI agents that let employees experiment safely, apply consistent oversight across workloads, and build skills without compromising business security; the text notes that fewer than half of companies have formal governance for autonomous workloads. AI should appear inside natural workflows, including single chat interfaces and embedded intelligence dashboards, with access to company data, automated identity management, consistent governance, and business logic across engagements. Finally, agents should provide contextually accurate, actionable intelligence and automation, challenge users’ thinking, suggest next steps, and take action rather than only answer questions.
Top topics
- Architecture834
- Performance816
- LLMs660
- Machine Learning622
- Open Source563
- AI Agents553
- AI470
- Developer Experience448
Weekly digest
The best engineering reads, once a week.