Search the archive

TEMPO 3.1 RELEASE: NEW FEATURES FOR KAFKA, TRACEQL METRICS UPDATES, TRACE REDACTION, AND MORE

Tempo 3.1 adds community-contributed improvements for Kafka ingestion, including TLS support and options to reduce data transfer costs.

WHY KUBERNETES RBAC MISCONFIGURATIONS ARE THE EASIEST PRIVILEGE ESCALATION YOU'LL EVER FIND

Recurring Kubernetes RBAC mistakes, cluster-admin bound to service accounts, wildcard permissions, over-broad secrets access, and stale bindings that never expire, drive most cluster compromises rather than novel vulnerabilities.

REDUCING THE COGNITIVE LOAD OF AI CHANGES

Unfamiliar abstraction names in AI-generated code add mental translation work during review.

INTRODUCING CF: THE AGENTIC CLI FOR THE ENTIRE CLOUDFLARE API

Cloudflare has introduced cf, a new command-line interface that allows agents to access over 3,000 operations across the entire Cloudflare API. Wrangler previously supported around 280 commands, and agent usage of that tool reached 48% last week. cf uses a unified API generation pipeline to standardize commands and defaults to JSON output for agents. Cloudflare will provide maintenance support for Wrangler for 18 months after the beta ends.

SELF-DRIVING INFRASTRUCTURE WITH PULUMI AND JEV

TypeSafe AI opened early access to Jev, a model that uses decision-making primitives to help apps manage infrastructure. Pulumi built GeoDeploy, an open-source tool that uses Jev to automatically compare prices and provision Kubernetes clusters across AWS, Azure, and Google Cloud.

BEYOND KUBERNETES AT MODAL: HOW TO SCALE 1 MILLION CONCURRENT SANDBOXES IN SECONDS

Modal engineers rebuilt their sandbox platform to support millions of concurrent sandboxes by replacing Kubernetes-style centralized coordination with distributed worker state and parallel scheduling. The redesign created one million sandboxes in under 60 seconds with sub-half-second startup times, prompting talk that infrastructure is splitting into separate coordination and execution planes.

HOW UBER PROTECTS AGAINST RETRY STORMS

Uber added error ownership to its shared service-mesh infrastructure, so upstream services can distinguish failures they caused from errors merely propagated from deeper dependencies. During a major outage, the mechanism prevented an estimated 9.5 million unnecessary retry requests and reduced the maximum retry-storm radius across user-facing APIs from as high as 25 hops to 3.

BIGQUERY TO CLICKHOUSE AT 15M CALL MINUTES A DAY: WHAT BROKE, WHAT WE FIXED, AND HOW WE CUT COSTS 6X

Bolna migrated analytics from BigQuery to ClickHouse, moved expensive CDC deduplication into materialized views, and fixed missing TOASTed JSONB values with REPLICA IDENTITY FULL. Reducing intermediate application writes cut replication traffic, with Bolna reporting roughly 6× lower analytics costs and data availability improving from 5–15 minutes to 1–2 minutes after calls ended.

enterprise scale →

PAGEINDEX

PageIndex replaces vector indexes with a hierarchical tree index that allows LLMs to reason through documents like a human expert. The tool achieved 98.7% accuracy on FinanceBench, outperforming vector-based RAG.

OPENSHELL

OpenShell is an Apache-2.0 runtime for running autonomous agents inside isolated sandboxes with kernel-enforced filesystem, syscall, and network policies. Credentials are injected only for approved endpoints, while proposed policy changes are formally checked before they are applied. The platform also supports Kubernetes deployment, GPUs, and Python, TypeScript, Go, and Rust SDKs.

WHAT DEPENDENCY MOCKING SOFTWARE NEEDS TO HANDLE IN A CLOUD NATIVE ARCHITECTURE

Traditional dependency mocking tools break down in cloud native architectures where services deploy independently and drift goes undetected. Effective tools need deployment event awareness, behavior captured from real traffic rather than specs, automatic handling of non-deterministic fields, and cross-service diff visibility, with eBPF-based traffic capture cited as one approach.

CAN YOUR POSTGRES SURVIVE A BAD QUERY?

Postgres memory limits such as work_mem apply per execution node and per worker rather than per query, allowing seemingly ordinary queries to consume many times the configured amount of memory. Recursive queries can be even more dangerous because some executor hash tables cannot spill to disk, creating workloads that can exhaust memory despite conservative configuration.

TERRAFORM PROVIDER FOR GOOGLE CLOUD 8.0 NOW GENERALLY AVAILABLE

HashiCorp released version 8.0 of the Terraform provider for Google Cloud, a major update that changes the default load balancing scheme, removes resources tied to retired services like Notebooks and IAP OAuth Admin, and converts several list attributes to sets for more predictable plans.

DYNAMIC AI DISCOVERY & RUNTIME SECURITY FOR AGENTCORE

Harness integrated its AI posture management and firewall with Amazon Bedrock AgentCore Gateway, automatically inventorying agents, tools, and resources operating in AWS environments.

LAKEBASE SEARCH: STATE-OF-THE-ART FULL TEXT AND VECTOR SEARCH FOR POSTGRES

Lakebase Postgres now offers generally available search capabilities on AWS and Azure through two new extensions, lakebase_vector and lakebase_text.

questions for the Agentic Enterprise.

ALIBABA OPEN SOURCES OPENCODEREVIEW FOR AI-ASSISTED CODE REVIEW

Alibaba has open-sourced OpenCodeReview, an Apache-2.0 code review tool that combines deterministic file and rule matching with AI analysis to flag issues like null pointers and SQL injection. It matches Claude Code's precision using roughly one-ninth the tokens in tests, though outside reviewers found recall as low as 20 percent.

AMAZON CLOUDWATCH OMNI: AI-FIRST OBSERVABILITY FOR AGENTS AND APPLICATIONS

AWS has launched CloudWatch Omni, an AI-powered observability experience that combines OpenTelemetry with CloudWatch's scale to unify telemetry across accounts, regions, and other clouds into one team-organized workspace. It offers natural language querying, automatic dependency mapping, and a dedicated agent observability workflow spanning frameworks like LangGraph, CrewAI, and the Vercel AI SDK.

TRADING A CLOUD IDENTITY FOR YOUR OWN: WORKLOAD ATTESTATION ON MANAGED COMPUTE

Netflix engineers developed a method to bridge AWS IAM roles with internal identities for Apache Spark workloads on Amazon EMR. The system maps each Data Project identity to a dedicated IAM role, allowing a control plane to sign metadata that an identity service verifies against a cloud proof of possession. This approach ensures that workloads running on managed compute obtain valid certificates from the internal PKI, called Metatron, without relying on the workload's own account of itself.

IMPROVING SITE PERFORMANCE BY SHIPPING MORE CSS

GitHub migrated github.com from CSS-in-JS to CSS Modules to remove client- and server-side styling overhead at scale. The migration cut Primer server-side rendering time by 55%, reduced component initialization time by 25%, and later improved SSR by up to 22% on some pages while thousands of sx usages were gradually replaced through feature flags, visual regression tests, codemods, and staged rollouts.

A TYPE STRONGER THAN THE SUM OF ITS COMPONENTS

Rust APIs can encode stronger invariants by turning individual enum variants into dedicated types instead of accepting broader string or path values. Wrapping std::path::Component variants in types such as NormalComponent and ParentDirComponent lets the compiler enforce properties like safe path joins and prevents callers from passing values containing .., absolute paths, or other invalid components.

Enterprise AI Summit livestream. Save your spot →

SCRIPTC

scriptc compiles TypeScript and JavaScript to native executables, WebAssembly modules, and other outputs including C and LLVM IR. It uses the TypeScript compiler for parsing and type checking, and static builds include a small native runtime without a JavaScript engine.

OPENRIG

OpenRig is a multi-agent harness that manages Claude Code and Codex as a unified team within tmux sessions. It defines agent teams in YAML and includes starter configurations like a four-seat conveyor, a product-team with seven seats, and a secrets-manager example that runs a HashiCorp Vault instance. The tool requires Node.js and integrates a local daemon, CLI, terminal UI, and MCP server. Users should read the documentation about system changes before installing, as OpenRig writes hooks, trust settings, and provider integrations during setup.

MAXIMIZING APACHE SPARK AVAILABILITY: MITIGATING COMPUTE STOCKOUTS WITH FLEXIBLE VMS AND OTHER BEST PRACTICES

Google's Managed Service for Apache Spark now supports flexible VMs, letting clusters rank multiple acceptable machine families and storage types so provisioning automatically falls back during regional capacity stockouts rather than failing. Google recommends pairing ranked configurations with AutoZone routing, autoscaling, and regional fallbacks for resilience.

HOW CLOUDFLARE ADDRESSED A CROSS-TENANT DATA EXPOSURE VULNERABILITY IN CONTAINERS

Security researcher Oren Yomtov reported a vulnerability in Cloudflare Containers that allowed residual data recovery from storage blocks used by other customers on the same host. The issue stemmed from a configuration setting that skipped zeroing newly allocated blocks, potentially exposing directory structures, database pages, and application data. Cloudflare has remediated the vulnerability across its fleet and found no evidence of malicious exploitation.

Skip the egress fees →

BUN REWRITES 535K LINES OF ZIG INTO RUST IN FOUR MONTHS, ELIMINATES NUMEROUS MEMORY LEAKS

Bun's creator rewrote the JavaScript runtime's 535,000-line Zig codebase into Rust in four months using AI-orchestrated implementer, reviewer, and fixer agents at a cost of $165,000 in tokens.

INTRODUCING ENHANCED CUSTOM EVENT BUSES IN AMAZON EVENTBRIDGE FOR ENTERPRISE-SCALE EVENT-DRIVEN APPLICATIONS

AWS has announced an enhanced custom event bus for Amazon EventBridge that organizations can share across all accounts.

WRONG, NOT BROKEN

Traditional observability can show that an AI agent is fast, available, and error-free while missing whether its output is actually correct.

YOU DESERVE BETTER CI. START WITH OUR 30-DAY TRIAL. KICK THE TIRES →

SCALE YOUR AI WORKLOADS FASTER AND MORE EFFICIENTLY WITH GKE POD SNAPSHOTS

Google Kubernetes Engine adds Pod snapshots, capturing a workload's running CPU and GPU memory state to restore it on demand, cutting AI inference startup by up to 89 percent and loading a 70B parameter model in 37 seconds. Codeway's Retake cut startup to eight seconds using the feature.

CLOUDFLARE INTRODUCES THE AGENT DEVELOPMENT STACK LIFECYCLE TO REPLACE TRADITIONAL SDLC

Cloudflare introduced an Agent Development Lifecycle to replace traditional software pipelines with autonomous, event-driven systems for AI coding agents, built on its Workflows product and a new @cloudflare/ci tool. It adds OpenTelemetry-based observability and an Agent Access Model that issues short-lived, capability-limited credentials to prevent lateral movement.

BETTER PROMPT CACHING FOR GPT-6

OpenAI launched an improved prompt caching system for the GPT-6 family that delivers higher cache hit rates by default. Developers get discounts of up to 90% on cached input tokens when the system reuses shared prefixes within a 30-minute window. New tools include a Prompt Caching Dashboard to track hit rates and a diagnostics tool to investigate unexpected misses. Developers can also prewarm the cache to reduce latency or adjust reasoning effort between responses without breaking cache.

TEACHING A 9B MODEL TO INVESTIGATE PRODUCTION ALERTS

Datadog fine-tuned Qwen3.5-9B on traces from a larger teacher model to automate change attribution during incident investigations. The specialized student model achieved 87% of the teacher's recall while reducing inference costs by roughly 20 times to $0.003 per investigation. A single 40 GB A100 GPU can support approximately 100,000 of these investigations per week.

AI NOW: TECH WORKERS INQUIRY

AI systems increasingly depend on hidden layers of human labor, including data labeling, content moderation, model evaluation, and other forms of contract work that shape how models behave. Making those labor relationships visible helps explain where AI systems get their capabilities, how failures are caught, and which costs are shifted onto workers outside the companies building the models.

went down during the big launch. Build without limits with Azure

HARNESS-SDK

Strands Agents is a new open-source SDK for building AI agents in Python and TypeScript. It offers a "harness" with benchmarked defaults for models and memory, or developers can use the underlying SDK to write their own agent loops. The toolkit includes support for tools, structured output, and model providers such as Amazon Bedrock, Anthropic, and OpenAI.

MODEL OPTIMIZER

NVIDIA has open sourced its Model Optimizer library, which offers techniques like quantization, pruning, and distillation to accelerate deep learning models. The tool supports inputs from Hugging Face, PyTorch, or ONNX and exports optimized checkpoints for deployment frameworks like TensorRT-LLM and vLLM. Users can install the stable release via PyPI or use NVIDIA container images with the software pre-installed.

GLOBAL AI ROUTING WITH <1% OVERHEAD ON MULTI-CLUSTER GKE INFERENCE GATEWAY

Google's multi-cluster GKE Inference Gateway pools globally distributed accelerator capacity behind a single endpoint, routing LLM traffic based on live KV-cache utilization rather than round-robin. A 17,000-node benchmark across three regions showed near-linear throughput scaling with less than 1 percent routing overhead and a 99.9 percent success rate.