Loading…
Topic
Open Source
568 posts about Open Source. Every summary links to the original.
- 568 posts
- 36 companies
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Newest first
Posts
One year later: Sovereign AI and the fight for choice
A year after arguing that AI sovereignty means choice, Cloudflare adds two European open models—EuroLLM and Apertus—to Workers AI, reflecting a year where access to frontier models became constrained and attacks using AI increased. EuroLLM supports 35 languages including all 24 EU official languages, many underserved by existing open models, and was trained on the MareNostrum 5 supercomputer. Apertus, Switzerland’s first fully open multilingual model, was trained on 15 trillion tokens across 1,500+ languages on the Alps supercomputer (10,000+ GH200 GPUs) and outperforms leading models on rare and regional languages. Cloudflare also launches hands-on workshops for government cyber agencies and critical infrastructure operators to build model-agnostic AI security defenses, starting in Singapore in October. The company open-sourced its own security harness that coordinates multiple AI models for vulnerability hunting, ensuring defenses remain operational even if access to one model is lost.
Introducing Forge: the open source pipeline for generating SDKs, CLIs, docs, and more
Cloudflare introduced Forge, an open source, pluggable generation pipeline for producing SDKs, CLIs, documentation, and other API surfaces from API definitions. Forge runs in CI on each team’s API repositories, linting every change and generating preview builds of the CLI, docs, and SDKs with only the changes highlighted, similar to Workers Previews. It supports OpenAPI as input and can chain transformers to produce outputs like Cap’n Web bindings, TanStack Query, or MCP servers, enabling generation of bindings from Workers to other APIs. Forge is designed to reduce coordination overhead across Cloudflare’s hundreds of services and repos, and to enable better API versioning without breaking existing clients or SDKs. It is available under the Apache 2.0 license and can be run for free, privately or publicly, and already generates the output required for the cf CLI.
EmDash 1.0: the stable CMS with a secure plugin registry
EmDash 1.0 is a stable, free, and open source content management system built on Astro, offering a production-tested admin for editors and agent-friendly workflows through an API, CLI, and built-in MCP server. Its decentralized plugin registry, built on AT Protocol, lets developers publish plugins without ceding ownership of their identity or releases to a central marketplace, while site owners can discover and install plugins directly. Cloudflare migrated its own blog to EmDash as part of its “Customer Zero” approach, handling millions of pageviews per week and spikes up to 5,000 RPS, which led to features like KV object caching and Hyperdrive database adapter. The project is MIT-licensed with over 175 contributors and translations into 25 languages, and it supports sandboxed plugins for security. EmDash separates the plugin from the catalog, allowing other services to index the same publications without requiring developers to start over.
NVIDIA Open Agent Safety Platform: A Reference for Continuous In-Silicon Agent Monitoring
The post compares early internet security—where browser sandboxing isolated pages—to the current need for trust layers in AI agents, citing incidents where agents escaped evaluation environments and misreported actions. NVIDIA introduces OpenShell, an open-source secure runtime that sandboxes each agent with kernel-level isolation and enforces verifiable policies defined by operators before and during execution. The platform follows five core principles, including out-of-band enforcement, controlling the path to the model as a kill switch, and scaling agent authority with reasoning visibility, to prevent agent drift. For hardware-level protection, NVIDIA Sentry extends monitoring into BlueField DPUs, which sit on the node’s only path to the model, providing continuous out-of-band observability and real-time policy enforcement at line speed. The architecture is optimized for NVIDIA Vera CPU and BlueField DPU systems, enabling fleet-wide agent security with full lineage tracking, and for existing Vera systems, enabling protections is just a software update.
Add Runtime Controls to AI Agents with NVIDIA OpenShell
AI agents with broad access to systems and data can cause failures like modifying production data or exposing secrets. NVIDIA OpenShell 0.1.0 is an open-source runtime that enforces permissions outside the agent workload using sandboxed execution, controlled service access, credential management, and formal policy analysis. It combines a Gateway for lifecycle management, a Supervisor that checks outbound requests against policy, and a Sandbox with kernel-level filesystem and process controls and no network path except through the supervisor. The supervisor inspects HTTP, GraphQL, and MCP traffic to allow reads while blocking writes on the same API, and real credentials are kept outside the agent workload and bound to authorized endpoints. OpenShell supports multi-tenant platforms, formal policy verification that can prove permissions remain within boundaries, and policy advisor for dynamic network changes, and is adopted by Cadence, Slack, and Gecko Robotics for chip design, enterprise automation, and physical AI.
Continuing to Move PHP Open Source Forward
Each year, PhpStorm selects five open-source projects to sponsor for a full year, providing financial support and raising awareness of open source in the PHP community. For this year, the chosen projects are PHPUnit, Lerd, static-php-cli, Composer, and Larabelles, selected from community suggestions based on their impact and need for financing. Sebastian Bergmann, creator and maintainer of PHPUnit, offers the most widely used testing suite for PHP. George Dumitrescu’s Lerd manages local PHP installations and servers, while Jerry Ma’s static-php-cli is used by FrankenPHP and Native PHP. PhpStorm continues its sponsorship of the PHP Foundation and encourages other organizations to contribute to open source, as every bit of support makes a substantial difference when added together.
Validate GPU Cluster Readiness Before AI Workloads Land
GPU clusters can pass standard health checks yet fail under real AI training workloads due to a single degraded GPU, network link, or misrouted traffic. NVIDIA Cluster Readiness Engine (NVCRE) is an open source Kubernetes controller that runs real distributed workloads across topology-aware node groups before production jobs land, measuring results and reporting which nodes failed each test. Its layered API uses Custom Resource Definitions for Certification, Workflow, and Job resources, attributing each failure to a specific node and category such as NCCL bandwidth or training goodput. The WorkloadRun API handles platform detection, NCCL settings, shared-memory volumes, and gang scheduling, so operators do not need to write those manifests by hand. NVCRE integrates with NVSentinel for passive telemetry and is available under Apache 2.0, with a roadmap for inference and automated lifecycle validation.
Manage Kubernetes Node Fleets with NodeWright
Managing Kubernetes node fleets, especially GPU nodes, is difficult because host-level changes can disrupt long-running training jobs, and traditional tools are not cluster-aware. NodeWright, an open-source Kubernetes-native package manager from NVIDIA, solves this by declaratively configuring and updating node operating systems while respecting PodDisruptionBudgets and non-interruptible workload labels. The operator orchestrates a sequence of cordon, wait, drain, apply, interrupt, and uncordon on each node, using container image packages that carry modifications such as kernel parameters, security agents, and verification scripts. It supports progressive rollouts across a fleet via DeploymentPolicy compartments with configurable disruption budgets and strategies like batch, canary, and rolling. NodeWright integrates with NVIDIA AI Cluster Runtime for validated configurations and is part of the DSX OS open-source portfolio, available under Apache 2.0.
100 Exercises to Learn Rust, Updated
The post announces a major update to the free JetBrains Academy course ‘100 Exercises to Learn Rust,’ which runs inside RustRover. The course teaches Rust through hands-on exercises building a ticket management system across eight chapters from ownership to futures, assuming fluency in another language. The update adds a rebuilt introduction, an FAQ, a final challenge turning the system into an async REST API by editing Cargo.toml and verifying with a requests.http file, visible test assertions, and a dev/release profile experiment. A ‘fast track’ lets experienced users skip to the final challenge to quickly see which areas need revisiting. The post advises using AI for explanations, not code generation, and turning off AI code completion during exercises to maximize learning from getting stuck and working out solutions.
Open-Sourcing Rebalancer: A Generic, High-Performance Library for Solving Assignment Problems
Meta has open-sourced Rebalancer, a generic library for solving assignment problems that has been used internally for over nine years. Rebalancer separates problem specification from solution, using a three-step approach with modeling constructs like dimensions, partitions, scopes, and utilization, and a high-level spec API for common objectives and constraints. Problems are translated into an expression graph, and Rebalancer offers two solving techniques: an optimal solver using mixed integer programming (MIP) with commercial or open-source solvers, and a local search solver that evaluates millions of moves per second for large-scale problems. The local search solver handles problems with over a million objects and 5k bins, with an average solve time of 171 seconds. Rebalancer is used for roughly 40 million assignment problems daily across Meta’s infrastructure, and the open-source release includes a debugging UI called Rebalancer Explorer. The accompanying paper was published at OSDI’24.
AI threat modeling shouldn't be a bottleneck, so we open sourced ours
The post announces the open-sourcing of agentic-threat-modeling, an AI-assisted threat-modeling module for Claude Code, Cursor, and Gemini CLI, built to address the bottleneck of security teams reviewing AI-generated code. It runs on Lola, an open source package manager for AI contexts, and profiles likely attackers, generates narrative attack scenarios grounded in actual code, and checks them against six structured threat modeling frameworks (STRIDE, PASTA, LINDDUN, attack trees, and more). The module ties every finding to a specific file and line of code, as shown in a real-world example against a file upload endpoint. It’s designed to produce structured output for AI-assisted triage, though that pipeline isn’t built yet. The team open sourced it because the problem isn’t unique to them, and it’s available in RedHatProductSecurity/agentic-threat-modeling and LobsterTrap/lola.
How agentic software development will change databases
AI agents are changing software development from a slow, linear process into rapid evolutionary experimentation, creating many small, ephemeral applications and databases. The post identifies three resulting database requirements: near-zero marginal cost with elastic growth, native branching for rapid variants, and open ecosystems that agents can use reliably. Lakebase addresses branching through O(1) metadata copy-on-write at the storage layer, so agents can branch production or test state without physical data copying and pay only for experiment compute. Its decoupled, serverless compute can scale in sub-second intervals and down to zero, while standard open Postgres page formats in cloud object storage keep data accessible to external engines and tools. Lakebase telemetry reports about 10 branches per project on average, some nested beyond 500 iterations, and roughly four times as many databases created by agents as by humans.
A skills library for every agent
The post introduces Notion’s skills library and Skills API, aimed at helping teams share organizational knowledge across AI agents and workflows. The library is designed for nontechnical and technical users, with collaborative editing, database organization, supporting files, permissions, suggested edits, version history, usage analytics, and controls over skill distribution. The API provides endpoints for loading skills in spec-compliant file formats, with examples including synchronization to GitHub, installation through Vercel’s Skills CLI, and uploads or edits through MCP tools. Notion says early customers and partners are already using the API across agents and tools, while an open-source starter kit supports Notion-to-GitHub synchronization. Vercel’s Skills CLI can install individual Notion skill pages or workspace plugins, using standards-compliant files without handling Notion-specific formats.
How we AI-updated 1,138 Error-code Docs Pages
Twilio used AI to update 1,138 error-code documentation pages over about 12 weeks, with a human reviewing every change. The team first scored roughly 2,692 pages with a deterministic script covering structure, content, and resources, then routed low-scoring pages to an LLM pipeline while sending borderline pages to human review. That pipeline used OpenAI's gpt-5.4 via the Responses API, generated full-file responses, sanitized them, converted them into git apply patches, linted results, and rejected any page whose code snippet fingerprint changed. Small-batch pull requests, tracking files, local-modification checks, and named reviewers limited duplicate work and kept approval in the workflow. Across about 27 pull requests from March to May 2026, the process marked 1,138 error codes complete, while the team acknowledged that human review was the quality bar and that future scaling would benefit from an automated evaluation harness and diff-based generation.
Why client SDK generation belongs in the open
Google describes partnering with Speakeasy to open-source the OpenAPI code-generation suite used for new SDKs for its Interactions, Agents, and Webhooks APIs. The change follows the May 2026 shutdown of a proprietary SDK-generation provider, which exposed platform risk while Google was preparing the Interactions API for general availability; migration prioritized avoiding breaking changes and preserving type definitions, strict error hierarchies, and streaming behavior. The AGPLv3 suite generates statically typed libraries for Python, TypeScript, Go, Java, C#, PHP, and Ruby, plus standalone agent-native CLI binaries and documentation MCP servers built from OpenAPI specifications and Markdown. Google says a deterministic generator paired with Antigravity AI agents now supports its pipeline across six targets, including three released SDKs, with roughly one engineer maintaining it, while generated code can remain under a chosen license such as MIT or Apache 2.0.
Migrating from closed to open source models, Together
The post presents a five-stage playbook for moving production workloads from closed-source models to open-source models: discover, evaluate, adapt, decide, and take the system to production. It argues that managed services, model-agnostic harnesses, gateways, and tooling can reduce migration complexity, potentially making the effort weeks to months rather than months to years. Discovery combines workload definition, relevant benchmark filtering, cost-per-task and runtime analysis, playground testing, and narrowing candidates to two or three models. Evaluation separates accuracy from performance and recommends replaying real traffic against explicit goals for cost, speed, and quality, while adaptation may involve prompts, inference settings, context, and the surrounding harness. The excerpt frames migration as iterative rather than assuming a model passes unchanged.
Measuring political bias in Claude
The post sets out an effort to make Claude politically even-handed: balanced, accurate, comprehensive, respectful, and reluctant to offer unsolicited political opinions or persuasion. It describes system-prompt guidance and reinforcement-learning-based character training, including traits that encourage neutral terminology, representation of competing perspectives, and restraint on sensitive political topics. For measurement, the Paired Prompts method compares responses to the same contentious issue framed from opposing ideological positions, scoring dimensions such as equal engagement and acknowledgment of opposing views; an automated version applies it to thousands of prompts across hundreds of stances. In the reported comparison, Claude Sonnet 4.5 was more even-handed than GPT-5 and Llama 4, and similar to Grok 4 and Gemini 2.5 Pro. The evaluation is open-sourced, with limitations including a focus on current US discourse and single-turn interactions.
Donating MCP to the Agentic AI Foundation
Anthropic is donating the Model Context Protocol (MCP) to the Agentic AI Foundation (AAIF), a directed fund under the Linux Foundation co-founded by Anthropic, Block, and OpenAI, with support from Google, Microsoft, AWS, Cloudflare, and Bloomberg. Introduced as an open standard for connecting AI applications to external systems, MCP now has more than 10,000 active public servers, adoption across major AI products, enterprise deployment support, and official SDKs with 97M+ monthly downloads across Python and TypeScript. The donation places MCP alongside Block’s goose and OpenAI’s AGENTS.md as AAIF founding projects, while its existing governance model remains unchanged. MCP also has a community-driven Registry, and the November 25th specification release added asynchronous operations, statelessness, server identity, and official extensions.
Join Us at the Zephyr Project Meetup in Amsterdam
The Zephyr community will meet in person at JetBrains Amsterdam on September 15, 2026, for a free evening focused on the open-source real-time operating system for resource-constrained and connected devices. The meetup brings together contributors, embedded developers, and others to exchange practical experience and discuss the ecosystem through talks on developer tooling, firmware testing, AI-assisted development, migration, and education. One session will show how AFL and the Renode simulator can fuzz Zephyr firmware without physical hardware, while another presents AI-assisted setup from environment configuration through compiling, flashing, and running an application on a board. The agenda also covers JetBrains’ collaboration with Zephyr and a migration from bare-metal and FreeRTOS code to a shared codebase targeting Renesas, STM32, and Nordic hardware. Registration is required, seats are limited, and presentations will be in English and Dutch.
Partnering with Mozilla on Firefox security
Anthropic describes a collaboration with Mozilla in which Claude Opus 4.6 discovered 22 previously unknown Firefox vulnerabilities over two weeks, including 14 that Mozilla classified as high severity. The work began with reproducing historical Firefox CVEs, then shifted to novel bugs in the current codebase, starting with the JavaScript engine and eventually scanning nearly 6,000 C++ files. Anthropic and Mozilla submitted 112 unique reports, while most issues were fixed in Firefox 148; Claude also produced working exploits for two vulnerabilities in a deliberately weakened test environment. The post says Claude is substantially better at finding and fixing vulnerabilities than exploiting them, but warns that this gap may narrow and recommends evidence-rich reports, task verifiers, and coordinated disclosure processes.
Related topics
All topics →Weekly digest
The best engineering reads, once a week.