🔥 Top Story
Gusto Cofounder: An AI agent that runs payroll, HR, and benefits without waiting to be asked
Gusto's cofounder has outlined a vision for an AI agent that proactively handles payroll, HR, and benefits for small businesses without waiting for user instructions. Unlike traditional HR software that requires manual task initiation, this agent is designed to sense business context and act autonomously. The New Stack article frames this as an 'AI wingperson' concept — a principal working partner for small startups and businesses that lack dedicated HR staff. Target workflows include payroll cycle processing, employee onboarding, and benefits renewal, executed without human prompting. This positions AI not as a chatbot assistant but as an operational co-founder, representing a paradigm shift in HR tech. Gusto already operates as an established payroll and HR SaaS platform, giving it the proprietary data and workflow integration needed to train and ground such an agent. The article signals a broader industry move toward autonomous, proactive AI agents in business operations.
💡 Why it matters: Deploying autonomous agents in compliance-critical domains like payroll demands rigorous audit trails, rollback mechanisms, and least-privilege action boundaries — operational concerns that must be designed in from day one, not retrofitted.
🔗 Read more · The New Stack
Kubernetes & Cloud Native
Expanding CARE: Passing CKS can now extend your CKA certification
CNCF
CNCF expanded its CARE (Certification Advancement & Recertification Experience) program starting June 18, 2026, so that passing or recertifying the CKS (Certified Kubernetes Security Specialist) exam automatically updates the CKA (Certified Kubernetes Administrator) certification as well. Both certifications will share the same expiration date tied to the CKS exam, and the policy applies even if CKA has already expired. CNCF justified the change by noting that CKS passage demonstrates sustained CKA-level competency, since securing Kubernetes clusters requires deep administrative knowledge. The CARE program is designed to reduce unnecessary renewal friction and reward ongoing learning, with particular benefit for engineers on the Kubestronaut path who must maintain five active certifications. Practically, engineers can now keep both CKA and CKS current with a single exam.
💡 With CKS passage now automatically renewing CKA, platform engineering teams managing Kubernetes certification compliance can consolidate their renewal cycles around the CKS exam, reducing per-engineer recertification cost and scheduling overhead.
AI & ML
MosaicLeaks: Can your research agent keep a secret?
Hugging Face
ServiceNow researchers introduced MosaicLeaks, a benchmark for evaluating privacy leakage in deep research agents. It comprises 1,001 multi-hop research chains that simulate agents interleaving private enterprise documents with external web queries, measuring how much sensitive information leaks through observable search patterns — a threat model called the mosaic effect. Although individual queries appear benign, an attacker monitoring the query log collectively can reconstruct confidential enterprise facts without ever accessing the private documents. Experiments showed that simple prompt instructions to avoid leaking information provided minimal protection. Training for task accuracy alone worsened leakage, pushing answer leakage from 34.0% to 51.7%. The team's Privacy-Aware Deep Research (PA-DR) training method cut leakage to 9.9% while preserving 58.7% task success, nearly matching the accuracy gains without the privacy cost. The work demonstrates that an agent's external search behavior is itself an indirect data exfiltration channel.
💡 An agent's outbound search query patterns can serve as an indirect exfiltration channel for internal enterprise data, making query anonymization, log access controls, and outbound traffic auditing essential security controls when deploying research agents in production.
New usage analytics and updated spend controls for enterprises
OpenAI
OpenAI has launched new spend controls and usage analytics features for ChatGPT Enterprise, giving organizational administrators granular visibility into AI usage and the ability to set spending limits by department, team, or individual user. The update addresses a common pain point for large enterprises: as AI adoption scales, cost predictability and governance often lag behind deployment velocity. The new usage analytics dashboard surfaces which teams consume the most capacity and where costs concentrate, enabling more accurate ROI measurement. Spend controls allow organizations to cap consumption proactively rather than reacting to unexpected invoice spikes. OpenAI frames the release as enabling enterprises to scale AI deployment with confidence, reducing the administrative friction that slows broad rollouts. The announcement reflects a broader trend of AI vendors building the FinOps-style controls that enterprise procurement and finance teams require.
💡 With FinOps-style controls now built into enterprise AI platforms, operations teams should treat spend caps, usage alerts, and team-level quotas as first-class deployment configuration — not post-hoc cost controls applied after unexpected invoice spikes.
Improving health intelligence in ChatGPT
OpenAI
OpenAI has announced improvements to ChatGPT's health and wellness responses, powered by the GPT-5.5 Instant model. Key enhancements include stronger reasoning, improved context retention, clearer communication, and an evaluation methodology informed by practicing physicians. OpenAI has built a physician-reviewed evaluation framework to validate the accuracy and safety of health-related responses. The update reflects OpenAI's strategic direction to develop ChatGPT as a consumer-facing health information tool, with improved response quality for complex medical queries as the primary goal. Specific benchmark figures and clinical validation data were not accessible from the page, but physician-informed evaluation is explicitly stated as the core of the methodology.
💡 OpenAI's adoption of physician-informed evaluation for health responses signals a rising bar for AI output safety standards, and teams operating healthcare or medical SaaS products should treat domain-expert evaluation loops as a standard component of their LLM output pipeline.
Using AI to help physicians diagnose rare genetic diseases affecting children
OpenAI
An OpenAI reasoning model helped physicians identify 18 new diagnoses in previously unsolved cases of rare genetic diseases affecting children. The study applied the AI reasoning model to cases that had remained unresolved for years despite clinical evaluation. By correlating vast medical literature with patient symptom profiles, the model surfaced rare genetic conditions that clinicians had been unable to pinpoint. Rare genetic disease diagnosis traditionally takes years or even decades, leaving many patients without effective treatment. This research represents a concrete example of AI delivering measurable clinical value as a decision-support tool in real medical practice.
💡 The demonstrated diagnostic lift from a reasoning-class model in unsolved clinical cases signals that teams integrating LLM-assisted decision support into healthcare platforms should evaluate reasoning models — not generic chat LLMs — as the baseline for high-stakes inference workloads.
Beyond LoRA: Can you beat the most popular fine-tuning technique?
Hugging Face
A Hugging Face PEFT blog post benchmarks fine-tuning techniques beyond LoRA to assess whether alternatives can genuinely outperform it. On the MetaMathQA math reasoning benchmark, LoRA achieved 53.2% accuracy at 22.6 GB peak VRAM; BEFT scored lower at 32.9% but consumed less memory (20.2 GB), while Lily reached higher accuracy (54.9%) at the cost of greater memory (25.6 GB). In an image generation benchmark, OFT strictly dominated LoRA on both similarity score (0.708 vs 0.697) and memory efficiency (9.01 GB vs 9.97 GB). LoRA variants including DoRA, rs-LoRA, LoRA-FA, and GraLoRA were also evaluated. The authors conclude that 'LoRA is not a bad choice, but there are potentially better choices,' recommending practitioners test task-specific alternatives rather than defaulting to LoRA.
💡 The finding that OFT strictly dominates LoRA on image generation while alternatives trade accuracy for memory in text tasks means ML platform teams should treat fine-tuning technique selection as a first-class pipeline decision — with task-specific benchmarks — rather than hard-coding LoRA as the default in GPU-constrained training infrastructure.
Is it agentic enough? Benchmarking open models on your own tooling
Hugging Face
Hugging Face introduced 'agent-eval', a CLI benchmarking framework for evaluating how effectively open models use software libraries as agentic tools. Rather than measuring only final answer correctness, the framework tracks token consumption, latency, error rates, and behavioral markers to assess overall 'agent efficiency'. Models evaluated ranged from large models — Kimi-K2.6, GLM-5.1, MiniMax-M2.7 — to smaller ones such as Qwen3-4B and Qwen3-14B, tested against the transformers library provided in three tiers: bare (standard pip install), clone (full source), and skill (curated CLI documentation). The critical finding is that adding a CLI and Skill context improved larger models but harmed smaller ones: Qwen3-14B's classification accuracy collapsed from 100% to 0% when a Skill was introduced, as the model misinterpreted documentation as executable tools. The authors conclude that 'not all successes are equal' and that agent-optimized library design must be validated across model scales before deployment.
💡 The finding that identical Skill context can boost a large model while causing complete failure in a smaller one means that any agent pipeline change involving model substitution — including cost-driven downgrades to smaller models — must include context-design review and functional regression testing, not just accuracy benchmarking.
Cloud Updates
Scaling Ray Serve LLM on GKE: Performance without losing the developer experience
Google Cloud
Google Cloud announced significant performance improvements for LLM inference using Ray Serve on GKE, achieving 5x higher throughput and 8x lower latency compared to previous Ray Serve configurations, now approaching native vLLM performance levels. Three architectural optimizations drive these gains: first, HAProxy is integrated directly into Ray Serve to reduce internal routing overhead and prevent Python runtime saturation under heavy traffic. Second, a direct token streaming architecture decouples the request path from the return stream, routing tokens directly from model replicas to the proxy and bypassing the ingress router. Third, a new v2 Ray Executor backend for vLLM removes Ray from the data plane and enables asynchronous scheduling, unifying the code path with native vLLM executors. Benchmarks used a Gemma 4 E2B model on Google Cloud A4 VMs with NVIDIA HGX B200 hardware in an eight-replica configuration. The improvements are available from Ray 2.56 onward, with GKE's Ray Operator add-on providing automated horizontal scaling, monitoring, and fault tolerance.
💡 Teams running LLM serving on Ray Serve + GKE can achieve order-of-magnitude throughput and latency gains simply by upgrading to Ray 2.56 and enabling the HAProxy integration, direct token streaming, and v2 vLLM executor backend — delivering significantly higher serving density without additional hardware spend.
Scaling the Next Generation of Global Innovation: How Google Supports Top Startups Around the World
Google Cloud
Google has published ten-year results for its Google for Startups Accelerator program alongside new 2026 initiatives. Over the past decade the program has supported 2,011 startups across 88 countries through 144 cohorts, achieving a 93% portfolio survival rate, $46.3 billion in total funding raised, a combined portfolio valuation of $135.1 billion, and 305,900 jobs created. New 2026 programs include the Google DeepMind Accelerator in Europe focusing on AI-native robotics, an APAC track for biodiversity foundation models and ESG infrastructure, and a strategic re-entry into Japan. Applications are currently open for Southeast Asia, China, and an AI for Science accelerator, all maintaining an equity-free support model. A unified alumni network of over 1,750 startups and 3,000 founders across 90-plus countries is highlighted as a central asset.
💡 Because Google's accelerator offers architectural guidance and policy alignment rather than cloud credits alone, startups that engage at the infrastructure design stage gain vendor-aware technical choices from day one — with the trade-off of deepening Google Cloud dependency baked in early.
Agent Factory Recap: 100X engineering with AI agents in Google Antigravity 2.0
Google Cloud
In a Google Agent Factory episode, Rody Davis — one of Google's top agentic engineers — detailed Google Antigravity 2.0, an unbundled agent-first development platform comprising four composable components: Agent Manager, CLI, SDK, and IDE. The concept of '100X engineering' means amplifying individual engineer output by offloading repetitive low-value tasks to AI agents while focusing human effort on architecture and problem-solving. A central concept called 'Skills' acts as context cheat sheets — compressed documentation that gives agents accurate references without the latency of searching massive documentation at runtime. Code review practice shifts to a 'bonsai approach,' prioritizing architectural patterns and API contracts over line-by-line review of all agent-generated code. Antigravity 2.0 supports multi-agent parallelism where a single voice prompt can spawn parallel sub-agents handling frontend, backend, and deployment simultaneously.
💡 The shift from monolithic IDE tooling to an unbundled agent-first platform means CI/CD pipelines and dev environment standardization policies need revisiting, and that the quality of agent context ('Skills' design) — not raw model capability — becomes the new bottleneck for code quality at scale.
Choice, compliance, and collaboration: Europe’s path to open digital sovereignty
Google Cloud
The European Commission's Tech Sovereignty Package introduces a comprehensive regulatory and investment framework for European digital independence, including the Cloud and AI Development Act (CADA), the Industrial Accelerator Act, and Chips Act 2.0 with a €30 billion semiconductor R&D investment. The three pillars of digital sovereignty are compliance and control, interoperability to prevent vendor lock-in, and resilient data infrastructure. Google Cloud offers three tiers of sovereign cloud — standard public cloud with European data boundaries, independently operated regional services, and fully air-gapped solutions — supported by local partnerships with S3NS in France, Thales, Schwarz Group, and T-Systems in Germany, PSN in Italy, and others. S3NS has achieved SecNumCloud 3.2 certification, Europe's highest sovereignty regulatory bar, and customers can manage encryption keys outside Google infrastructure via Cloud External Key Manager. Google's policy recommendations include refining Union Assurance Levels beyond geographic criteria, software license mobility reform, and fast-tracking data center permitting.
💡 As the EU Tech Sovereignty Package moves beyond geographic data residency toward tiered technical controls — SecNumCloud, external key management, air-gapped deployments — cloud architects serving European public sector or processing EU data must revisit their key management strategy, regional partnership model, and egress cost policy as first-class compliance concerns.
DevOps & Infrastructure
MCP gets its missing enterprise authorization layer
The New Stack
Enterprises are rapidly adopting the Model Context Protocol (MCP) to connect AI agents to internal tools and data sources, but the protocol has lacked a robust enterprise authorization layer — a gap that is now being addressed. The New Stack article covers a solution that adds the missing authorization controls on top of MCP, enabling fine-grained access management for enterprise deployments. In enterprise settings, it is essential to define which agents can access which tools with what scope, using familiar mechanisms like OAuth or role-based access control. Without this layer, widespread MCP adoption creates real risks of data leakage and privilege escalation in agentic workflows. The article positions this authorization layer as a prerequisite for enterprise trust in MCP-based systems, not an optional add-on. As MCP gains traction as a de facto standard for AI agent integration, security and platform teams are under pressure to incorporate authorization from the design phase.
💡 Before standardizing on MCP as the backbone of your agentic infrastructure, define authorization scopes, token lifetimes, and audit logging at the protocol level — retrofitting these controls after adoption is significantly more costly than building them in from the start.
Cursor, GitLab and Zed agree GitHub is breaking. They disagree on how to rebuild it.
The New Stack
Cursor, GitLab, and Zed share the view that GitHub's current model is under strain in the AI coding agent era, though they diverge significantly on how to address it. The New Stack article covers these companies' differing visions for the future of developer collaboration infrastructure. Cursor centers its approach on editor-native agentic workflows; GitLab positions its integrated DevSecOps platform as the alternative; and Zed focuses on real-time multiplayer editing as a new collaboration layer. The article frames this as a broader rethinking of how pull requests, code review, and issue tracking should work when AI agents are active participants in development workflows, not just assistants. The discussion comes at a moment when GitHub's dominant position in the developer ecosystem is being actively challenged by AI-first tooling. Platform lock-in and workflow portability are emerging as key concerns for engineering teams.
💡 As AI agents become first-class participants in PR creation, code review, and issue triage, engineering teams should reassess single-platform dependence on GitHub and evaluate loosely coupled architectures that separate CI/CD, code collaboration, and agent orchestration concerns.
Neoclouds, sovereign AI and Postgres: The new operating model for regulated enterprises
The New Stack
Regulated enterprises are increasingly adopting neoclouds and sovereign AI infrastructure to handle growing AI inference workloads. Neoclouds are AI-optimized cloud providers built to meet regional and regulatory requirements, unlike hyperscalers, making them attractive for sectors such as finance, healthcare, and government where data sovereignty is critical. PostgreSQL is emerging as more than a transactional database in this model, serving as a unified data hub for AI pipelines by combining vector search with structured data storage. The article outlines a new operating model in which regulated enterprises move away from dependence on public hyperscalers and run AI on sovereign infrastructure. Balancing data residency and governance requirements with the performance demands of AI inference is identified as the central engineering challenge.
💡 When AI inference workloads must remain within regulated boundaries, MLOps pipelines built on hyperscaler-native services must be rearchitected for sovereign cloud compatibility, and Postgres-based vector stores offer a practical way to reduce vendor lock-in while meeting data residency requirements.
The database storage problem is solved. Here’s what comes next.
The New Stack
PostgreSQL has been regarded primarily as a transactional database throughout its 30-year history, but with the storage layer problem now addressed, the next challenge has shifted to data movement and interoperability. The article builds on the premise that tiered storage architectures — using NVMe for hot paths and S3 for cold data — are becoming established practice within the Postgres ecosystem. Attention now turns to standardizing data movement across diverse sources and achieving compatibility between formats and protocols across systems. The piece explores Postgres's evolution into a general-purpose data platform capable of handling AI, analytics, and OLTP workloads through a unified interface. Author Craig Kerstiens brings a practitioner perspective grounded in long-term involvement with the Postgres ecosystem.
💡 As Postgres evolves to consolidate transactional, vector, and analytics workloads on a single platform, teams should reassess whether separately operated OLAP and vector database stacks remain justified against the operational complexity they add.
Fable 5 ban: 4 open models responded before Anthropic could restore access
The New Stack
On June 12, 2026, the United States government ordered Anthropic to suspend access to Claude Fable 5 and Mythos 5 for all users. Before Anthropic could restore access, four open-weight models stepped in to handle requests during the outage window. The incident provided concrete evidence of the fragility of systems that depend on a single closed-source AI provider, and highlighted the practical resilience value of open-weight models. Author Janakiram MSV uses this case to examine the risks of closed-model dependency and the case for AI infrastructure diversity. The episode also illustrates how government regulatory intervention can disrupt an AI supply chain with immediate operational impact.
💡 This government-mandated suspension of a closed-source model demonstrates that AI pipelines built on a single proprietary provider carry uncontrollable availability risk, reinforcing the case for open-weight model fallbacks as part of any resilience architecture.
Your AI pipeline is broken, and your dashboards don’t know it
The New Stack
A critical RAG (Retrieval-Augmented Generation) pipeline serving a corporate client began hallucinating financial figures, yet monitoring dashboards raised no alerts. The incident is presented as a canonical example of how traditional observability tools — designed for deterministic systems — fail to detect failures in probabilistic AI systems. AI pipeline failures manifest as degraded output quality rather than service downtime, making them invisible to conventional uptime and latency metrics. The article enumerates silent pipeline-breakers including prompt changes, model version updates, and shifts in context window behavior. It argues for new debugging approaches and an output-quality-based observability framework specifically designed for AI systems.
💡 Because RAG pipeline hallucinations manifest as output quality degradation rather than service failures, conventional APM and uptime alerts cannot catch them — teams must build a dedicated AI observability layer using output sampling, golden-set comparison, or LLM-as-a-judge evaluation.
This digest was collected from RSS feeds and summarized by AI (Claude). See the original links for full details.