Search the archive

SOURCEBOT

Sourcebot is a self-hosted tool designed to help users understand their codebase through features like complex question answering, code search, and navigation across multiple repositories.

CORSAIR

Corsair is a unified integration layer for agents, allowing secure connections to various applications while maintaining control over permissions and actions. It implements different approval modes for interactions, making sure that sensitive operations, such as sending emails or making API calls, require user confirmation.

SHATTERING THE DREAM - WHEN A JOB OFFER BECOMES A ZERO-DAY ATTACK

The Operation Dream Job campaign, linked to the Lazarus group, is targeting the defense sector worldwide by distributing modified PDF viewers that execute malicious payloads when opened. The attackers exploit zero-day vulnerabilities, including CVE-2026-68820, to deploy advanced malware like the Troy backdoor and FudModule rootkit, while using compromised web servers for command-and-control operations.

STOLEN THOUGHTS

This paper shows that encrypted chain-of-thought traces returned by OpenAI, Anthropic, and Google APIs can be replayed into weaker, jailbroken sibling models to recover the stronger model's hidden reasoning in plaintext. The authors also decoded 315,320 reasoning blocks from public agent trajectories and found 704 distinct privacy artifacts, including API keys, passwords, access tokens, and PII, showing that these supposedly hidden traces can create a serious data-leak surface.

WHY GO IS AN IDEAL LANGUAGE FOR AI-ASSISTED SOFTWARE ENGINEERING

The Go programming language is an ideal choice for AI-assisted software engineering, as it prioritizes code readability, maintainability, and a cohesive platform that supports both human and AI collaboration through its design principles.

A SHELL EXCLAMATION MARK IS NOT FOR YELLING. BE LAZY

Event designators in shell commands allow users to save time and avoid repetition by referencing and modifying previous commands and their arguments without the need for excessive keystrokes.

I PUT GITHUB COPILOT BEHIND A MITM PROXY. HERE'S WHAT I FOUND

Analyzing GitHub Copilot's network traffic reveals its mechanisms for context processing, user interaction logging, and implications for privacy and data management.

JOINING CURSOR

After over five years at PlanetScale, Fatih Arslan is leaving to join Cursor, driven by a passion for developer tooling and the innovative potential of Cloud Agents.

* Register for the webinar

* Learn more

Save your spot

CNCF ANNOUNCES GRADUATION OF CLOUD NATIVE BUILDPACKS, ADVANCING THE STANDARD FOR CONTAINER BUILDS

The Cloud Native Computing Foundation has graduated Cloud Native Buildpacks, an open source project that builds OCI-compliant container images directly from application source code. The project was jointly created by Pivotal and Heroku in January 2018 and joined the CNCF later that year. It now has 535 contributors across 164 organizations, with adopters including DigitalOcean, GitLab, Google, and Bloomberg, where the project powers AI infrastructure. To reach graduation, the project completed a third-party security review with Quarkslab and the Open Source Technology Improvement Fund, and received an OpenSSF Best Practices passing badge.

CLOUDFLARE DDOS THREAT REPORT H1 2026: 1 TBPS ATTACKS SOAR AS DNS FLOODS AND GEOPOLITICAL TENSIONS DRIVE A NEW WAVE

Cloudflare mitigated 23.2 million network-layer and 29.64 trillion HTTP DDoS requests in the first half of 2026, according to the company's 25th DDoS Threat Report. April was the peak month, hitting 6.46 trillion requests and 165 petabytes of volume, with activity declining afterward following Operation PowerOFF, a 21-country action that took down 53 domains and targeted over 75,000 DDoS-for-hire users. Network-layer attacks exceeding 1 terabit per second rose more than six-fold from Q1 to Q2, with Cloudflare recording 805 such attacks in the second quarter alone. Brazil overtook the United States as the top source country for DDoS traffic, accounting for 14.9% of mitigated requests versus 13.4% for the US.

THE HIDDEN COST OF HOMEGROWN IAC

Homegrown infrastructure-as-code systems offer flexibility and low initial costs but often create hidden expenses through maintenance, scaling challenges, governance gaps, and drift management. Prebuilt IaC orchestration platforms typically provide lower total ownership costs, except for small-scale or highly restricted environments.

HOW WE IMPROVED APM JAVA STARTUP BY ENCODING A PREFIX TRIE AS A JVM CONSTANT

Datadog's APM team cut class-matching overhead during Java startup by 30% over four years, with one key technique being a prefix trie encoded as a JVM string constant called ClassNameTrie.

REVIEWING CODE IS A SKILL

Code review can improve through deliberate practice, with experienced reviewers learning to spot bugs, design problems, hidden assumptions, and operational risks that automated checks or LLM reviews can miss. Strong reviews draw on system history, invariants, failure modes, and organizational context, making code review useful not only for defect detection but also for knowledge transfer, maintaining norms, and understanding changes.

Get started securing agent access

PAPERCLIP

Paperclip is an open-source Node.js server and React UI that orchestrates teams of AI agents to run a business. It supports agents like Claude Code, Codex, Cursor, and Gemini, giving each one roles, budgets, reporting lines, and permissions.

CODE-GRAPH-RAG

Code-Graph-RAG is an open source tool that parses multi-language codebases using Tree-sitter, stores the resulting structure as a knowledge graph in Memgraph, and lets users query and edit code in plain English. It supports Python, TypeScript, JavaScript, Rust, Go, Java, C, C++, C#, PHP, Lua, Dart, and several others. The tool runs as an MCP server, allowing Claude Code and other MCP clients to query and edit codebases directly.

FIND, ANALYZE, AND COLLABORATE ON USER SESSIONS IN DATADOG SESSION REPLAY

Datadog Session Replay consolidates session discovery, AI-powered summaries, friction analysis, and timestamped collaboration into one workspace. Teams can quickly identify relevant sessions, jump to key moments, share context through anchored comments, and coordinate troubleshooting and UX improvements from a shared source of evidence.

UNVEILING GOOD AND BAD BEHAVIORS ON THE AGENTIC INTERNET

Cloudflare is advancing bot management by evaluating continuous behavior and trust rather than relying on static human-versus-bot checks, recognizing hybrid human-agent sessions and legitimate automation. Precursor provides session-wide behavioral detection, while upcoming Adaptive Intelligence and advanced mitigations will enable self-adjusting detection and more nuanced bot controls.

AWS IAM IDENTITY CENTER SUPPORTS ONE-CLICK MULTI-REGION OPTION FOR NEW ORGANIZATION INSTANCES

AWS IAM Identity Center now offers one-click multi-Region configuration for new organization instances, automatically creating a multi-Region KMS key and replicating the instance to another Region for improved resilience.

BEYOND THE BOT BLOCK: HOW FASTLY AND EXPERIAN ARE TURNING AI AGENT TRAFFIC INTO REVENUE

Fastly has joined the Experian Agent Trust ecosystem to help enterprises verify, authorize, and monetize legitimate AI agents at the network edge.

INTRODUCING FILE TYPE: A NATIVE COLUMN TYPE FOR MULTIMODAL DATA

Databricks is launching a beta of FILE type, a new column type that stores unstructured data like videos, images, and documents as native columns in lakehouse tables.

EXPLORE MERCURY SPEND

SOME SIMPLE ECONOMICS OF OPEN VERSUS CLOSED AI

The debate between open vs. closed AI models revolves around innovation's direction rather than its level, with open models fostering broad experimentation and closed models maintaining control. Open models encourage widespread tech adoption and specialization, leveraging lower costs and complementary asset synergies.

GLOBAL NEW UNICORN COUNTS IN THE FIRST HALF OF 2026 HAVE ALREADY SURPASSED 2025'S TOTALS

In the first half of 2026, 195 companies became unicorns, surpassing the entire 2025 total. Robotics and AI sectors led this surge, while notable companies like China-based DeepSeek and Seychelles-based OKX reached valuations of $50 billion and $25 billion, respectively. The US and China were dominant, with fast-follow funding rounds rapidly increasing valuations, particularly in AI and semiconductor startups.

PARALLEL VS. SERIAL

Serial processing is better for tasks that must be completed in a specific order and best performed by the CPU. Parallel processing is better for tasks that can be divided into many parts and done simultaneously and is best performed by a GPU. Many problems benefit from the fusion of both approaches, where the main problem is broken into many smaller independent problems solved in parallel. The solutions of the smaller problems can then be integrated serially to create the complete solution.

HOW TO ACTUALLY SELL A PRODUCT (FULL GUIDE)

Organic marketing works best when founders define one specific buyer, study their language and communities, then design content packaging around behavior. Test hooks and formats, read retention signals, repurpose winning ideas by platform, and automate repetitive research and packaging.

THE LEAD INVESTOR PROBLEM

A founder can fill a calendar with investor meetings and still have no round. "Interested," "keep us posted," and "we could participate" sound positive, but none means an investor will set the terms, anchor the valuation, do the deepest diligence, or give everyone else a deadline. A lead does those jobs. Keep likely leads separate from likely followers, then ask directly whether each fund would actually set the terms. Ten more meetings with followers still leave the lead column empty.

PREVENTING CHURN IN SET-AND-FORGET PRODUCTS

Backups and monitoring can be working perfectly even when nobody logs in. One company with hundreds of thousands of customers searched its first 30 days of human activity for something that predicted who would still pay 12, 18, or 24 months later. It found nothing. The integration was doing the work, so the useful signals were whether data was still moving, volume was falling, or errors were rising. A cancellation may arrive months after the product stopped working, which means the real churn date happened much earlier.

opportunities.

GOOGLE ADS & GOOGLE ANALYTICS GAIN NEW AI FEATURES

Google has introduced new AI Overviews, new AI data dashboard tools, and a new benchmarking AI feature to Google Ads and Google Analytics. The changes are aimed at simplifying users' workflows and expediting their path to business growth. A video of each new feature in action is available in the article.

GROK BOT

Grok Bot provides a team of AI agents, each with their own computer, that can perform real work inside tools and apps, 24/7. Bots can sign in to tools and work across apps, inboxes, and more. The agents can finish jobs end-to-end, and only report back when something needs human approval. They remember conversations, learn how users like to get things done, and get sharper the more you work together.

DOCUMENTING EVERYTHING WE'VE LEARNED IN DEEL'S WILD RIDE

Deel grew from zero to $1.5B ARR in seven years. It has been EBITDA-profitable for three consecutive years now. This post looks at how the company got here and where it is going. It covers what most people get wrong about growth, the lightbulb moments that changed how the company operates, how Deel changed as it grew to a 7,000-people remote operation, the impact AI will have on Deel's next growth curve, and more.

ROBOTICS STARTUPS HAVE RAISED $23B SO FAR IN 2026

Robotics startups have secured $23 billion in funding in 2026. This surge highlights increased investor interest and potential growth in the robotics sector.

WE SPEND $45,000 ON DOING MORE WEIRD EVERY MONTH

PostHog sets aside $45,000 every month for marketing ideas that may fail. Anyone can pitch one in Slack, and a two- or three-person "Council of Weird" scores the cost, effort, and whether people actually want to make it. Some bets did almost nothing. Billboards got zero comments, Easter eggs were found by about three people, and a documentary got 2,000 views. Most startups can steal the setup for far less money by fixing what they are willing to lose each month and judging several experiments together.

BUILDING A DIVERSIFIED STARTUP PORTFOLIO

Diversifying startup investments by sector, stage, and geography can mitigate risks associated with market volatility. Sector diversification helps balance industry-specific cycles, while stage diversification mixes potential high-reward early-stage investments with more stable later-stage companies. Geographic diversification protects against regional economic fluctuations, though it can be challenging to access international deals.

INSIDE AN APPLIED AI COMPANY

Applied AI companies sell completed work - their agents run end-to-end workflows, and they own the outcome.

THE ADVANTAGES YOU HAVE VS THE ADVANTAGES YOU NEED

Traditional SWOT analysis falls short when market-required strengths aren't existing strengths.

A WINNER IN EVERY CATEGORY

Rubrik is growing 46%, twice CrowdStrike's 23%, but CrowdStrike trades at more than three times the revenue multiple because investors still see it as the category winner.

HOW TO MAKE PEOPLE CARE ABOUT YOUR STARTUP

Founders should identify their archetype to tailor their communication strategy effectively.

NVIDIA'S $500B BET TO MAKE AI COMPUTE WALL STREET'S NEXT ASSET CLASS

Nvidia announced financing platforms with Apollo, BlackRock, Blackstone, Brookfield, Goldman Sachs, and KKR, aiming to raise over $500 billion in outside capital for AI "factories," the data centers that train and run AI models, with Jensen Huang pitching this compute as a durable, reusable "investable asset class." The core problem is that these are non-binding MOUs, not signed deals, and the entire pitch hinges on residual value, what the hardware is actually worth if the paying customer walks away, since Huang's own evidence for durability (rising H100 rental rates) proves current earnings, not resale value.

CHINA AI CHIP DESIGNER MOORE THREADS PLANS HONG KONG LISTING

Chinese AI accelerator firm Moore Threads, founded by former NVIDIA executives, filed for a Hong Kong listing to raise capital for global R&D. As Nvidia faces strict US export bans, Moore Threads is positioning itself alongside Huawei and Cambricon to capture China's domestic AI datacenter hardware market.