🔥 Top Story
Secure AI agents with HashiCorp Boundary
IBM's Krishnan Ramachandran described how HashiCorp Boundary can govern the infrastructure access of AI agents used in enterprise IT operations. The example agent uses watsonx and Granite models to interpret natural-language operational requests such as log investigation or system health checks, and the agent itself was designed and implemented with IBM Bob, an agentic development partner. Rather than granting the agent direct access to systems, Boundary evaluates the authenticated user's identity, permissions, and target access policies before establishing a connection. Vault stores or generates target credentials, including short-lived dynamic credentials, and least-privilege grants restrict network access to only the Linux targets required. Boundary emits audit events for authenticated requests, session activity, and administrative operations, and authorized administrators can cancel an active session.
💡 Why it matters: Keeping agents behind identity-checked session brokering and short-lived credentials, instead of issuing them standing infrastructure accounts, preserves an auditable and revocable access boundary as agent automation grows.
🔗 Read more · HashiCorp
Kubernetes & Cloud Native
Building a single-pane NOC dashboard for Amazon EKS with Amazon CloudWatch
AWS Containers
AWS introduced a reference architecture for building an operational NOC dashboard for Amazon EKS clusters using Amazon CloudWatch. The pattern pairs PromQL queries from the CloudWatch Observability EKS add-on (v6.4.0-eksbuild.1) with golden signals collected through CloudWatch Application Signals. The builder generates a 35-widget executive NOC along with three dedicated drilldown dashboards covering infrastructure, application health, and incident triage. To prevent silent multi-cluster metric pollution and misleading averages, every PromQL query enforces cluster-scoped selectors while headline availability and latency metrics are weighted by request volume. Missing counter metrics are explicitly filled using or vector(0) and backed by freshness alarms on absent_over_time(kube_node_info[15m]) to distinguish healthy zero-state workloads from broken telemetry pipelines.
💡 Enforcing explicit zero-filling on PromQL counters coupled with telemetry freshness alarms prevents silent monitoring blind spots during Kubernetes production outages.
Which hat am I wearing right now?
CNCF
CNCF Ambassador Mario Fahlandt published an article addressing the challenge of maintaining neutrality in corporate-backed open-source contributions. Citing a 2023 Google Open Source Programs Office survey where 82% of contributors reported working on open source during paid company time, the author highlights the inevitability of structural conflicts of interest. Contributors frequently juggle overlapping roles as maintainers, working group members, and corporate representatives. Fahlandt advises engineering leads and contributors to explicitly declare which "hat" they are wearing during architectural debates and governance decisions to preserve transparency. Ultimately, the article stresses that contributors must prioritize community health and project integrity over employer priorities when interests diverge.
💡 Platform teams adopting open-source infrastructure must scrutinize vendor neutrality and governance structures to mitigate single-vendor bias and supply chain dependency risks.
The operations gap between deploying an application and running it forever
AWS Containers
AWS introduced the Cluster Mode deployment model for AWS Elastic Beanstalk, extending the managed service contract to multi-container application portfolios. The new model accepts workloads as raw source code (such as Java WAR, .NET Core, Python, or PHP), Dockerfiles, or pre-built container images from Amazon ECR. By adopting a shared cluster infrastructure across an entire portfolio, organizations eliminate per-application operational silos and improve infrastructure resource efficiency. The platform provides managed rollouts with automated rollbacks to the last known-good version if health checks fail, alongside automated OS and runtime security patching. Cluster Mode is available across all commercial AWS Regions where Elastic Beanstalk is supported with no additional service fee beyond the underlying AWS resources consumed.
💡 Cluster Mode allows organizations without dedicated platform engineering teams to run multi-tenant container workloads with automated patching and rollbacks on managed AWS infrastructure.
Spotlight on SIG Apps
Kubernetes
In an official spotlight interview, Kubernetes SIG Apps Co-Chairs Janet Kuo (Google) and Maciej Szulik (Red Hat) discussed the evolution and priorities of the core workloads ecosystem. SIG Apps manages key controllers including Deployments, StatefulSets, DaemonSets, Jobs, and CronJobs, and is shifting focus back to serving workloads to improve high-scale rollout performance. To address operational pain points where flaky nodes cause stuck DaemonSet rollouts that require manual midnight intervention, the group is establishing a cross-functional Node Lifecycle Working Group with SIG Node and SIG Autoscaling. For AI workloads, subprojects like JobSet and LeaderWorkerSet (LWS) provide coordinated all-or-nothing failure handling and checkpoint recovery across distributed GPU clusters. The SIG is also reviving KEP-4443 for Kubernetes 1.38, which adds an optional Name field to PodFailurePolicyRule so higher-level controllers can differentiate failure causes in JobFailed conditions.
💡 Cross-SIG efforts on node lifecycle handling and subprojects like JobSet bring gang-scheduling and resilient group failure recovery directly to mission-critical AI workloads on Kubernetes.
Implement per-pod image pull permissions with ECR repository policies on Amazon EKS
AWS Containers
AWS demonstrated how to isolate Amazon ECR image pull permissions at the individual pod level on multi-tenant Amazon EKS clusters using Kubernetes KEP 4412 and ECR repository deny policies. Historically, kubelet defaulted to the node IAM role for container image pulls, granting every pod on a node shared access to all accessible ECR repositories across teams. Starting with EKS 1.35, the ecr-credential-provider supports KEP 4412 by consuming projected pod ServiceAccount tokens configured via tokenAttributes in CredentialProviderConfig. When a ServiceAccount specifies an eks.amazonaws.com/ecr-role-arn annotation, the provider assumes the designated team IAM role, while ECR repository policies enforce explicit Deny rules against unauthorized principals. System pods without role annotations, such as CoreDNS and VPC CNI, seamlessly fall back to the baseline node IAM role to maintain essential cluster networking.
💡 Enforcing per-pod ECR pull permissions via projected ServiceAccount tokens closes a major security gap in multi-tenant Kubernetes clusters without requiring complex admission controllers or node segregation.
Meet the Ecosystem: Partners and Customers at WeAreDevelopers with Docker
Docker
Docker published the customer and partner session roster for its Docker Pavilion at the WeAreDevelopers World Congress North America, held September 23–25, 2026, in San Jose. The showcase highlights Docker's strategy to provide a secure foundation for containing, curating, and governing autonomous AI agent workloads across diverse toolchains. In customer sessions on September 24, Colton Shaw from Spectro Cloud demonstrates versioned cluster profiles for running local inference and agent workloads at the edge without cloud connectivity. Alan Torrance from J.P. Morgan Payments presents an open-source Docker Compose setup running client and OpenAPI mock servers in two containers without requiring API keys. A joint panel featuring Docker, Spectro Cloud, and J.P. Morgan explores shifting enterprise focus from token consumption to operational ownership, while partner talks from Palo Alto Networks, Datadog, Chainloop, and Sonar demo live agent monitoring, signed audit trails, and sandboxed code verification.
💡 Container sandboxing and signed provenance records are emerging as fundamental platform engineering requirements for isolating autonomous AI agents and governing non-human credential access.
From attendee badge to speaker badge: My first KubeCon at KubeCon + CloudNativeCon India 2026
CNCF
Shreyas Mocherla, a software engineer at Nirmata and CNCF Kubestronaut, shared his retrospective on attending his first KubeCon + CloudNativeCon India 2026 in Mumbai as a speaker. He co-presented a technical session with his father, Janakiram MSV, demonstrating how to turn NVIDIA DGX Spark hardware into a self-hosted AI cluster. The talk walked through deploying Kubernetes on bare metal, exposing GPUs to AI workloads, and using Dynamic Resource Allocation (DRA) for flexible hardware scheduling. Mocherla also detailed his journey of becoming the youngest Golden Kubestronaut in India by completing every CNCF certification using community resources and KodeKloud hands-on labs. During the event, he networked with prominent cloud-native figures including Saiyam Pathak and KodeKloud founder Mumshad Mannambeth, highlighting the immense value of informal hallway tracks. He concluded by encouraging early-career engineers to overcome hesitation and actively submit conference presentation proposals to open-source events.
💡 Adopting Kubernetes Dynamic Resource Allocation for heterogeneous GPU scheduling alongside hands-on certification training provides a structured foundation for operating cost-effective on-premises AI clusters.
Risky identities continue to plague cloud infrastructures
Sysdig
Sysdig's 2026 Cloud-Native Security and Usage Report reveals that cloud-native identity and access management (IAM) remains persistently misconfigured across modern environments. While 24% of organizations maintain identities across multiple cloud service providers (CSPs), an average of 67% of human user identities are flagged as risky due to excessive permissions, long periods of inactivity, and missing multi-factor authentication. However, human users make up less than 3% of all identities, while machine identities—spanning microservices, Infrastructure-as-Code pipelines, and AI agents—account for 97.2% of managed identities. Alarmingly, roughly 40% of these machine identities maintain high-risk postures, including admin or edit privileges, user-managed keys, or persistent inactivity. To defend the cloud perimeter, the report recommends dynamic least-privilege enforcement, automated removal of unused permissions, and replacing long-lived static credentials with short-lived, just-in-time access.
💡 With machine identities comprising over 97% of cloud estates, platform teams must shift from static IAM policies to automated, just-in-time credential rotation to prevent credential compromise at scale.
AI & ML
How to Use NVIDIA Warp and MjWarp to Accelerate Robotics Simulation and Learning Workflows
Hugging Face
NVIDIA engineers published a technical guide detailing how MuJoCo Warp (MJWarp) scales robotics simulation from CPU-bound runs into high-throughput GPU environments using NVIDIA Warp. MJWarp compiles MuJoCo physics into batched CUDA kernels, allowing developers to execute existing MJCF models across thousands of parallel instances without reauthoring assets. Using an SO-101 robotic arm pick-and-place task as a reference, the authors demonstrate scaling up to 2,048 simultaneous environments while managing contact and constraint buffer allocations such as nconmax and njmax. The workflow leverages CUDA Graph capture through wp.ScopedCapture to eliminate repeated kernel launch overhead, alongside strict GPU synchronization for benchmarking wall-clock throughput. The architecture integrates with downstream reinforcement learning platforms including mjlab, MuJoCo Playground, and the upcoming Newton solver for Isaac Lab.
💡 Shifting physics simulations to batched GPU kernels with CUDA Graph capture drastically lowers the compute cost of reinforcement learning by maximizing aggregate sample throughput over per-step latency.
Google Beam expands with new regions, partners, and customers
Google AI
Google announced the global expansion of its immersive telepresence system, Google Beam, deploying units across six countries including the United States, Canada, the United Kingdom, France, Germany, and Japan. Delivered in collaboration with flagship hardware partner HP as HP Dimension with Google Beam, the hardware is backed by 18 channel deployment partners and integrates natively with Google Meet and Zoom. An eight-week internal study at Google revealed that teams using Beam experienced a 50 percent increase in connection, 33 percent clearer feedback comprehension, and a 21 percent reduction in follow-up meetings. Enterprise clients including Bain and Company, Netflix, and Capital Group have adopted the hardware for remote recruitment and executive collaboration. Google also partnered with flexible workspace provider Industrious to make bookable Beam suites accessible starting in October across cities including Atlanta, Chicago, New York City, and Palo Alto.
💡 Expanding dedicated telepresence hardware across distributed corporate offices requires infrastructure teams to plan deterministic QoS and high-bandwidth network peering for low-latency spatial video streams.
Two years of OpenAI Academy
OpenAI
OpenAI marked the two-year anniversary of the OpenAI Academy, an initiative launched in September 2024 to deliver practical AI literacy across diverse communities. Over the past two years, it has hosted more than 250 events, and more than four million people have engaged with Academy content. The program has broadened from developers and mission-driven organizations to educators, small business owners, nonprofit leaders, veterans, and college students. Its formats have grown to include self-paced courses, practical guides, in-person workshops, and large multi-site events called AI Skills Jams. To celebrate the milestone, OpenAI unveiled a pilot for the OpenAI Academy Community Trainer Program to foster decentralized AI training. Under this initiative, partner organizations nominate trainers who complete formal facilitation training and evaluations before independently hosting workshops in their local schools, civic organizations, and small businesses.
💡 Scaling internal AI enablement through vetted local trainers, rather than a central team alone, is a practical way to spread adoption without losing consistency.
OpenAI extends cyber access to Ukraine for civilian defense
OpenAI
OpenAI announced that it is granting the Government of Ukraine access to its Daybreak cybersecurity initiative to defend critical civilian infrastructure. Announced during the UN General Assembly on September 23, 2026, by Ukrainian Consul General Dmytro Kushneruk and OpenAI Head of National Security Policy Sasha Baker, the collaboration partners directly with Ukraine's Ministry of Digital Transformation. Ukraine's computer emergency response team (CERT-UA) handled nearly 6,000 cyber incidents in 2025 targeting essential sectors, including energy, healthcare, and telecommunications. The Daybreak program provides verified defenders with advanced AI capabilities to inspect legacy software, analyze suspicious activity, validate zero-day vulnerabilities, and accelerate patch testing. This deployment aims to significantly compress incident response and mitigation cycles for critical public services facing persistent nation-state cyberattacks.
💡 Leveraging AI-assisted security tooling for legacy codebase inspection and vulnerability triage can significantly compress the patching lifecycle across mission-critical infrastructure clusters.
Sam Altman’s remarks at the United Nations Security Council
OpenAI
OpenAI CEO Sam Altman addressed the United Nations Security Council on September 23, 2026, during its inaugural formal session dedicated to AI safety risks. Altman participated alongside AI industry leaders and researchers, including Anthropic CEO Dario Amodei, Hugging Face co-founder Clément Delangue, and Yoshua Bengio. Altman cautioned that humanity risks losing control of its future without rigorous oversight as frontier models rapidly advance. He argued that governance over transformational AI cannot remain confined to private labs in San Francisco, urging democratic oversight by accountable governments. Specifically, Altman advocated for international standards to evaluate frontier capabilities, mandatory rapid incident reporting protocols, and dedicated communication channels linking governments and infrastructure operators.
💡 Emerging international regulatory frameworks and mandatory AI incident reporting will require infrastructure teams to build strict governance, observability, and audit controls into automated AI workflows.
How UK AISI and EvalEval Are Making Benchmark Results Reproducible
Hugging Face
The UK AI Security Institute (AISI) and the EvalEval Coalition announced a collaboration to share transparent, reproducible AI evaluation data using the Every Eval Ever (EEE) schema and Hugging Face Evaluation Cards. Originating from a joint workshop at NeurIPS 2025, this initiative builds upon AISI's OptStop efficiency tooling and HiBayES hierarchical Bayesian modeling to establish standardized reporting for AI benchmarks. The initial data release accompanies AISI's paper, 'How Inference Compute Shapes Frontier LLM Evaluation,' examining how inference-time compute scaling and protocols affect capabilities. The dataset covers six frontier models—Claude Opus 4, 4.5, and 4.6 alongside GPT-5, 5.2, and 5.4—across five primary benchmarks (HealthBench, FrontierMath, Humanity's Last Exam, SWE-Bench Pro, Terminal-Bench 2.0) and two cybersecurity evaluations (Cyber CTFs, The Last Ones). By publishing full transcript-level execution traces and configuration environments, the project enables practitioners to systematically audit and verify benchmark claims across diverse runtime setups.
💡 Standardizing benchmark telemetry and transcript-level configurations through frameworks like EEE is critical for enterprise teams to objectively validate LLM performance against varying inference-time compute budgets.
Transformers now runs llama.cpp quants
Hugging Face
Hugging Face introduced native support for running GGUF quantized models directly within the PyTorch transformers ecosystem. By passing the gguf_file parameter to from_pretrained, developers can load Hub-hosted GGUF checkpoints using familiar transformers workflows without third-party wrappers. The implementation leverages llama.cpp's underlying ggml kernels via the kernels library and Apple Silicon Metal acceleration (ggml-org/ggml-attn), focusing initially on the Qwen3.5 architecture where Unsloth's Qwen3.5-4B shrinks from an 8.42 GB BF16 baseline to 2.74 GB in Q4_K_M. The release also includes transformers serve, which exposes an OpenAI-compatible endpoint at localhost:8000/v1 featuring reasoning toggles for local desktop clients like Jan and Pi. Benchmarks on an Apple M2 Max MacBook Pro running PyTorch 2.12.1 demonstrated throughput close to llama-bench (build 5f55650a7), and the integration supports fine-tuning via GgufConfig(dequantize=True).
💡 Native GGUF execution in transformers bridges local llama.cpp performance with the PyTorch research ecosystem, lowering compute and memory costs for on-premises edge inference and custom model fine-tuning.
Cloud Updates
A guide to speeding up your video processing with AlphaEvolve
Google Cloud
Google Cloud and partner DoIt published a technical study on accelerating real-time video streaming pipelines using AlphaEvolve, an autonomous closed-loop evolutionary optimization framework. In real-time video processing, developers must operate within strict frame budgets of 33.3 milliseconds at 30 frames per second and 16.6 milliseconds at 60 fps to ingest camera frames, run neural segmentation, and composite shaders. AlphaEvolve employs a split-loop architecture that decouples cloud-based code generation using Gemini ensembles from local customer-managed compilation and latency evaluation on native macOS hardware. To prevent evolutionary candidate code from gaming benchmarks by skipping blur rendering, the evaluator enforces a two-tier quality gate requiring mean Structural Similarity Index (SSIM) above 0.98 and worst-frame SSIM above 0.95. Guided by these visual constraints, the system autonomously converged on cross-frame temporal mask caching while measuring performance against physical hardware floors.
💡 Decoupling cloud-based LLM mutation loops from native hardware evaluation harnesses enables autonomous performance optimization without sacrificing output fidelity.
GKE becomes more elastic: Scale to zero, save costs, and keep workloads responsive
Google Cloud
Google Cloud introduced native scale-to-zero functionality in Google Kubernetes Engine (GKE) 1.37, enabling sporadic and event-driven workloads to scale down completely without third-party tools. The native integration replaces complex KEDA configurations that previously required custom operators and extensive YAML manifests across large enterprise clusters. Built around Kubernetes KEP-2021 for minReplicas zero support, the feature introduces the AutoscalingMetric CRD to stream signals directly from Google Cloud Monitoring and Managed Service for Prometheus into the HorizontalPodAutoscaler. To mitigate the typical 60-to-90-second cold-start latency associated with on-demand node provisioning, GKE added pooled Capacity Buffers. This pooling mechanism combines an active warm capacity buffer shared across hundreds of idle deployments with an economical standby buffer to sustain immediate responsiveness under sudden traffic spikes.
💡 Native scale-to-zero coupled with shared capacity buffers eliminates idle infrastructure spend for sporadic workloads while mitigating Kubernetes cold-start provisioning delays.
Scale your own way, using HPA with built-in support for PromQL metrics queries in GKE
Google Cloud
Google Cloud introduced preview support for native PromQL metric queries within Google Kubernetes Engine (GKE) Horizontal Pod Autoscaler (HPA). Previously, scaling workloads on Prometheus or Cloud Monitoring metrics required maintaining external adapters such as the Stackdriver Custom Metrics Adapter, creating operational and IAM overhead. The new integration extends the AutoscalingMetric custom resource to route metrics directly from Google Managed Service for Prometheus (GMP) to the HPA, dropping metric reading latency to 5 seconds. The underlying controller runs on the GKE control plane and only provisions system pods on worker nodes when PromQL queries are actively configured, preventing idle resource consumption. Google plans to expand support to self-hosted Prometheus deployments upon reaching general availability.
💡 Eliminating external custom metric adapter pods and complex IAM mappings reduces cluster management overhead while minimizing failure points and latency in critical autoscaling loops.
Bringing enterprise Linux to the robotics frontier: ROS2 adds Red Hat Enterprise Linux as a tier-1 supported platform
Red Hat
Red Hat authors Kelly Switt and Jeffrey "Jefro" Osier-Mixon announced that Robot Operating System 2 (ROS2) has added Red Hat Enterprise Linux (RHEL) as a tier-1 supported platform. Achieving tier-1 status ensures that RHEL receives continuous packaging, automated testing pipelines, and priority bug fixes from the ROS2 community. This milestone brings enterprise lifecycle stability and strict security compliance to physical computing and autonomous robotics workloads. The integration simplifies edge deployments by unifying driver support for specialized hardware accelerators, including GPUs and NPUs. Robotics engineering teams can now operate critical industrial automation software on a hardened Linux foundation with consistent kernel-to-edge governance.
💡 Designating RHEL as a tier-1 ROS2 platform enables infrastructure teams to extend enterprise security baselines, long-term support lifecycles, and hardware acceleration directly to autonomous edge nodes.
Unify VMs and containers with Everpure Cloud on Azure Red Hat OpenShift
Red Hat
Red Hat announced the integration of Everpure Cloud with Microsoft Azure Red Hat OpenShift (ARO) to unify data management across legacy virtual machines and containerized applications. This offering removes operational barriers between VM silos and cloud-native workloads by enabling unified infrastructure provisioning directly within the Azure Portal. Everpure's intelligent storage engine leverages thin provisioning and data reduction techniques to cut cloud storage expenditures by up to 40%. The solution qualifies for the Microsoft Azure Consumption Commitment (MACC) and Azure Hybrid Benefit while providing 24/7 joint support from Red Hat and Microsoft. Resilience is reinforced through Portworx-driven automated disaster recovery, immutable snapshots, and namespace-scoped isolation policies.
💡 Unifying storage management for legacy VMs and containers on Azure Red Hat OpenShift reduces cloud storage overhead by up to 40% while delivering consistent snapshot-based disaster recovery.
The playbook behind Red Hat’s most successful OpenShift deployments
Red Hat
Siamak Sadeghianfar, Senior Manager of OpenShift Product Management at Red Hat, published a 4-stage cloud-native adoption playbook designed to overcome common platform scaling pitfalls. The article highlights an enterprise anti-pattern where teams celebrate initial cluster setup, only to find the same five migrated apps running a year later while operations drowns in manual support. Sadeghianfar argues that treating cluster provisioning as the finish line ignores the organizational enablement required for sustainable platform engineering. The playbook outlines a phased framework guiding organizations from initial containerization to developer self-service, automated operational guardrails, and long-term business optimization. This systematic approach ensures platform teams empower developers without becoming bottlenecks to organizational velocity.
💡 Treating cluster provisioning as a foundation rather than a completion milestone is essential for platform teams to scale developer self-service and prevent operational stagnation.
We just shipped support for the ugliest part of HTTP: Vary
Cloudflare
Cloudflare announced native support for the HTTP Vary response header within Cache Rules across all plan tiers, manageable through the dashboard, Rulesets API, and Terraform. This allows Cloudflare edge caches to respect content negotiation headers, ensuring that different representations for the same URL—such as HTML versus JSON via Accept, or localized pages via Accept-Language—are correctly served to clients. To prevent cache key explosion from endless header permutations, Cache Rules allows users to configure three distinct actions per header: normalize, passthrough, and bypass. By defining normalized boundaries, such as whitelisting specific media types or languages (e.g., en, fr, de), caches can reliably group equivalent client requests while maintaining high cache hit ratios. Unlike static Custom Cache Keys that append dimensions to every response regardless of origin behavior, Vary support is response-driven and applies only when origin servers explicitly declare varying representations.
💡 Edge-level Vary normalization prevents CDN cache key explosion during HTTP content negotiation, allowing multi-format endpoints to maintain high cache hit rates without overloading origin servers.
Introducing Worker Previews: Isolated preview environments for every change your agent makes
Cloudflare
Cloudflare launched Worker Previews to provide isolated, production-like test environments for every change created by developers and autonomous AI agents. The feature assigns each Git branch an independent URL, configuration, state storage, and observability pipeline to enable safe parallel testing without impacting production traffic. Teams deploy previews using the npx wrangler preview command, inheriting base configuration from main while retaining the flexibility to override specific environment variables, secrets, or database bindings. Stateful components including Durable Objects and Containers are strictly isolated per branch, keeping session data, memory allocations, and schema migrations scoped to the individual preview. Preview URLs update continuously on every git push and can be mapped to custom domains, ensuring that authentication providers, session cookies, CORS headers, and OAuth callbacks operate identically to production. This granular feedback loop enables a complete Agent Development Lifecycle by allowing agents to inspect runtime traces, diagnose failures, and verify fixes prior to merging code.
💡 Branch-level isolation covering both configuration and stateful Durable Objects provides the necessary sandboxing for autonomous AI agents to test and verify atomic changes without destabilizing production workloads.
DevOps & Infrastructure
Q.ANT gives away the software for its light-powered AI chips in a CUDA-style bet on developers
The New Stack
Stuttgart-based startup Q.ANT has open-sourced its software development kit, the Q.ANT Native Computing Toolkit, on GitHub under a commercially permissive license. The toolkit supports Python and C, featuring a desktop simulator that allows developers to test algorithms without requiring physical photonic hardware or proprietary drivers. Q.ANT processors execute mathematical operations using light-wave functions analogous to cosines, aiming to reduce parameter sizes and power consumption compared to digital silicon. While second-generation chips are currently running at research sites like the Leibniz Supercomputing Centre near Munich, general access will open in the coming months via German cloud host IONOS or on-site appliances. Following a 62-million-euro funding round in July 2025, Q.ANT is emulating NVIDIA's CUDA playbook by distributing open developer tooling ahead of broader hardware availability.
💡 While optical computing promises significant energy reductions for large-scale inference workloads, infrastructure teams must evaluate simulator fidelity and driver maturity before considering hybrid photonic hardware deployments.
“Impressive level of openness”: Xiaomi goes way beyond the usual open-weight playbook with MiMo-V2.6
The New Stack
Xiaomi unveiled its MiMo-V2.6 reasoning models after livestreaming production reinforcement learning metrics on a public dashboard over five days starting September 15. The disclosed RL compute costs totaled approximately 3.5 million dollars, comprising 854,044 dollars for MiMo-V2.6-Flash and 2,620,670 dollars for the larger Pro model. Led by former DeepSeek researcher Fuli Luo, the team released the model weights under a permissive MIT license alongside a 9-billion-parameter Qwen-based baseline and a technical report. Xiaomi also committed to open-sourcing its end-to-end training framework and more than 7,000 task environments covering software engineering and vulnerability reproduction. Industry figures including Hugging Face Chief Science Officer Thomas Wolf highlighted that sharing verifiable-reward training environments provides unprecedented transparency for open-source agentic AI research.
💡 The release of transparent reinforcement learning costs and verifiable task environments establishes an empirical baseline for cloud architects estimating custom enterprise reasoning model pipelines.
A third option is emerging in the fight over AI and your data
The New Stack
VAST Data co-founder Jeff Denworth introduced DataEnclave, a security solution designed to resolve the mutual IP standoff between enterprise data privacy and proprietary model weights. While enterprises refuse to expose sensitive business data to external API providers, frontier AI labs equally resist deploying unencrypted weights directly onto customer hardware. DataEnclave leverages NVIDIA Confidential Computing hardware enclaves to execute proprietary models securely without exposing data or model weights in either direction. Built atop VAST Data's AI OS storage foundation, the architecture addresses enterprise security concerns heightened by the late 2025 surge in agentic tools and token usage. The platform is currently in early access as it progresses toward general availability for enterprise deployments.
💡 Hardware-based confidential computing enclaves allow security engineers to run proprietary frontier models against sensitive internal datasets without risking weights exfiltration or data leakage.
Rendering huge pull requests in the GitHub Copilot app
GitHub
GitHub re-engineered the diff surface in the GitHub Copilot app to maintain smooth scrolling on extreme pull requests, benchmarking performance against an open-source change containing 2,200 files, one million lines, and over 400 comments. While code diffs scale efficiently using fixed-height virtualized rows, dynamic review threads with markdown formatting, image loads, and expandable sections disrupt predictable layout arithmetic. The engineering team resolved this by separating rendering into two distinct geometry domains: an immutable prefix-summed array for code lines and an independent dynamic block index keyed by content fingerprints. Rather than allowing ResizeObserver callbacks to trigger unbounded reflow loops, measurements run via an idle-gated scheduler restricted to candidates within approximately 2,400 pixels of the viewport. Scroll anchoring was rewritten to anchor by block identity rather than pixel offsets, ensuring viewports stay stable as asynchronous comments render.
💡 Decoupling deterministic row arithmetic from dynamic component geometry via viewport-bounded measurement schedulers eliminates layout thrashing in large-scale virtualized web interfaces.
Developers want more efficient software. Here’s what over 1000 GitHub users told us they need.
GitHub
GitHub published research conducted with the Yale Program on Climate Change Communication (YPCCC) surveying 1,039 developers regarding software compute efficiency. The study revealed that 80% of surveyed developers desire tooling to write more energy-efficient code, while nearly 75% want mechanisms to measure the environmental impact of their software and pipelines. Additionally, 71% of respondents voiced concern over the environmental costs of AI workloads, specifically noting power draw, water consumption, and carbon emissions. Three-quarters of participants affirmed that employers must actively take steps to minimize their operational carbon footprint. Author Paull Young emphasized that while engineering appetite for curbing wasted compute is substantial, teams remain bottlenecked by a lack of standardized metrics and actionable profiling guidance.
💡 Incorporating carbon and compute efficiency telemetry into CI/CD pipelines allows engineering teams to optimize cloud runtime costs while addressing enterprise sustainability benchmarks.
Dropbox CTO Ali Dasdan on moving from AI adoption to transformation
Dropbox
Dropbox CTO Ali Dasdan and Senior Director of Engineering Productivity Uma Namasivayam shared organizational learnings from scaling generative AI across company-wide engineering workflows. Approximately 70% of Dropbox's code is now generated using AI, aligning closely with benchmark figures recently published by Uber. To facilitate this transformation, Dropbox developed Nova, an internal platform that executes and validates coding agents within standard developer environments. According to internal benchmarks of comparable codebases, Dropbox achieved PR throughput in the top 5% while maintaining change failure rates at the 75th percentile. Notably, their token consumption ranks among the lowest in their peer cohort, demonstrating that optimizing end-to-end workflow validation yields higher engineering output without unbounded API expenditures.
💡 Maximizing ROI from coding agents requires pairing generation models with robust internal validation platforms to scale pull request throughput without inflating token spend or deployment failure rates.
연 300시간을 아낀 AI 상담 서비스
토스
Toss Bank Product Designer Hye-mi Kim detailed the development and iteration of an AI consultation service for jeonse rental loans in collaboration with ML and operations teams. Despite comprehensive on-screen documentation, anxious applicants frequently overwhelmed customer support with simple policy questions, creating review delays. An initial launch featuring a generic prompt banner and open text box saw negligible traction. The team redesigned the interface by analyzing call center logs to suggest context-aware prompt chips at each stage of the loan funnel, including questions about interest rate caps and approval timelines. This data-driven interface adjustment increased AI adoption fivefold on intro screens and twofold during review phases, reducing monthly phone inquiries by 550 calls and saving 300 support hours annually.
💡 Exposing context-specific query suggestions based on operational support data significantly outperforms open-ended text inputs in driving conversational AI adoption and deflecting manual support volume.
Terraform provider for Google Cloud 8.0 now generally available
HashiCorp
HashiCorp announced the general availability of the Terraform provider for Google Cloud version 8.0. This major release introduces expanded infrastructure discovery workflows, including list resources capabilities that allow engineers to query remote GCP objects without triggering full plan or apply cycles. Provider defaults have been updated to reflect modern Google Cloud best practices and improve schema alignment with upstream APIs. The release also removes legacy configurations and attributes associated with retired Google Cloud services, delivering more predictable execution plans. HashiCorp advises operators to migrate to the latest 7.x release to clear deprecation warnings before executing breaking upgrades against the 8.0 specification.
💡 Platform engineers should audit deprecated GCP resources on provider 7.x before upgrading to 8.0, leveraging the new list-based infrastructure discovery to accelerate IaC drift detection.
Teaching a 9B model to investigate production alerts
Datadog
Datadog fine-tuned the open-weight Qwen3.5-9B model into a specialized change attribution agent for Bits Investigation using an evaluation set of 187 internal production incidents. While the teacher model GLM-5.3 reached a Recall@5 of 0.63 at an API cost of $0.06 per investigation, the fine-tuned student model achieved 0.55 Recall@5, delivering 87% of the teacher's recall at roughly 5% of the cost ($0.003 per investigation). Serving costs were calculated on AWS p4d.24xlarge instances running an NVIDIA A100 40GB GPU ($1.74 per GPU-hour) with a throughput of 280 output tokens per second and roughly 1,700 output tokens per run. The fine-tuned model outperformed Datadog's production rule-based baseline (0.46 Recall@5 at $0.003) while avoiding prohibitive frontier model costs such as Opus 5.0 at $0.32 per investigation. Fine-tuning also eliminated the base model's tendency to exhaust its turn or context limits in 25% of runs, shifting investigative calls toward logs, spans, and metrics (averaging 8.3 evidence calls vs. 4.7).
💡 Self-hosting task-specialized 9B-class models on private GPU infrastructure provides an economically viable alternative to expensive frontier LLM APIs for high-volume production incident investigation.
Find answers in your logs faster with Datadog’s Tap to Parse
Datadog
Datadog announced the general availability of Tap to Parse, an AI-assisted capability that extracts structured, searchable fields from unstructured log messages without requiring manual regex or Grok pattern authoring. The tool analyzes sample logs to identify stable syntactic patterns versus variable values, generating previewable parsing rules with a single click. In Log Explorer, engineers can immediately extract values like payment providers, durations, and error codes as session-scoped calculated fields during active incident investigations. In Log Pipelines, the generated Grok parser can be saved at ingestion time to enrich all future matching logs automatically. Additionally, Tap to Parse is available upon request in Observability Pipelines to structure custom log streams before they leave the local environment for downstream destinations.
💡 Automating log parsing rule generation eliminates manual regex authoring during incident triage and accelerates attribute standardization across ingestion and observability pipelines.
Configure RUM SDKs remotely from Datadog
Datadog
Datadog introduced RUM Remote Configuration, allowing teams to update frontend Real User Monitoring SDK parameters directly from the Datadog UI without releasing code or waiting for app store reviews. Supported across web browsers, iOS, and Android, the capability requires adding a single remote configuration ID to the existing RUM SDK initialization snippet. Platform teams can dynamically adjust settings such as Session Replay sampling rates, distributed trace sampling rates, method-level profiling frequency, privacy controls, and custom event tracking. For mobile teams, this removes the multi-week lag associated with app store approvals and user upgrade cycles, allowing immediate increases in telemetry collection during active regressions. Published configurations take effect automatically the next time the client SDK initializes without overwriting local configurations until explicitly published.
💡 Remotely toggling client telemetry sampling rates decouples observability granularity from mobile release cycles, enabling immediate deep profiling during incidents while protecting telemetry budgets.
GitLab Critical Patch Release: 19.4.1, 19.3.3, 19.2.7
GitLab
GitLab released critical patch versions 19.4.1, 19.3.3, and 19.2.7 for both Community Edition (CE) and Enterprise Edition (EE) on September 23, 2026. The update addresses two critical CVSS 9.9 vulnerabilities, CVE-2026-89078 (double free) and CVE-2026-93577 (integer overflow), both of which allow authenticated users to execute arbitrary code via specially crafted regular expressions in CI/CD configurations. Additionally, the release patches CVE-2026-84739 (CVSS 8.7), a cross-site scripting issue in the merge request diff viewer caused by improper path component sanitization. Other resolved flaws include an authorization bypass in the Duo AI job troubleshooting tool that leaked debug-mode CI/CD variables (CVE-2026-92470, CVSS 7.7) and an MCP API scope enforcement flaw (CVE-2026-92874). While GitLab.com is already patched and GitLab Dedicated requires no action, operators of self-managed GitLab instances are strongly urged to upgrade immediately.
💡 Self-managed GitLab instances should be updated immediately to mitigate severe remote code execution risks embedded in CI/CD pipeline regex parsing engines.
개인화 추천을 위한 랭킹 모델 개발기
카카오
Kakao published its engineering journey of replacing legacy demographic segment-based recommendations with a personalized deep learning ranking system built on individual user behavior histories. To eliminate video length bias in regression labels, the team implemented Root-Log Transformed Watch time (RLTW = √(ln(1 + watch_length))). While initial architectures using DCNv2 suffered performance instability whenever underlying Two-Tower embeddings were retrained, Kakao settled on a GDCN (Gated Deep & Cross Network, rank=32) coupled with a 3-expert Mixture of Experts (MoE) structure to effectively balance interactions across divergent light and heavy user segments. The serving pipeline orchestrates retrieval, filtering, initial ranking, GPU-based main ranking, and re-ranking, operating on 300 candidates after 20,000-user offline tuning proved that scaling to 900 candidates added only +0.90%p to VTR while incurring latency penalties. Across feature sets spanning user, item, author, and user-author interactions over 1-day, 7-day, and 30-day windows, user-creator interaction emerged with the highest feature importance, ultimately delivering a +10%p increase in Valid View-Through Rate (VTR) and a +53.7% boost in daily recommendation diversity.
💡 Combining feature-gated networks with Mixture of Experts provides robust ranking inference across sparse cold-user segments while bounding inference latency through empirical candidate pool sizing.
방해하지 않고, 눈에 띌 수 있을까
토스
Hyunji Kim, a visual designer at Toss Bank, shared the design process that increased both the click-through rate (CTR) and conversion rate (CVR) of the Asset Management Report by three times. Previously placed as a static banner below the account balance on the home screen, the report yielded only a 2% CTR due to visual competition between existing account data and new recommendations on the same layer. To resolve this without disrupting users, the team introduced a floating card structure inspired by web tooltips, placing recommendations on a distinct layer while styling it with corner smoothing and translucent textures to avoid looking like popup ads. The card shrinks upon scrolling to minimize friction, and features an entrance animation with decoupled translate and scale timings for natural deceleration and subtle rebound. In subsequent A/B testing, an interactive presentation variant only saw a 1.1x CTR bump, whereas the structural floating card achieved a 3x increase in both CTR and CVR.
💡 Decoupling contextual recommendations from core operational interfaces into responsive floating layers can drastically improve conversion metrics without degrading core application workflows.
So I asked my agent instead…
Snyk
Snyk introduced the Evo MCP server, enabling developers and security engineers to query enterprise AI assets and security violations directly from AI agent harnesses. Hosted as a remote HTTP server (https://evo.snyk.io/mcp), it connects seamlessly to clients like Cursor and Claude Code without requiring local filesystem permissions. The server maps discovered AI assets across both code repositories and individual developer laptops, categorizing models, agents, MCP servers, and skills by vendor, country of origin, license type, and self-hostability. Users can interrogate specific security risks, such as filtering skills scoring 500 or higher for insecure credential handling, to validate governance policies against live inventory. Furthermore, by chaining with a ticketing MCP server, agents can group open violations by team or repository and automatically generate remediation tickets.
💡 Exposing enterprise AI asset inventories and vulnerability scores via remote MCP endpoints allows organizations to enforce agent security policies and automate remediation ticketing directly within developer workflows.
쉼 없이 도는 테스트, 사람이 어디까지 돌봐야 할까요? - 토스닥터(Toss Doctor)
토스
Toss detailed the architecture of Toss Doctor V2, an automated mobile E2E testing framework that forms the basis of its internal Toss Checker system. In V2, engineers specify scenarios using Gherkin syntax (Given-When-Then), which the /codegen command compiles into test execution code using an LLM integrated with Appium MCP. To control token costs, UI element discovery follows a three-stage escalation: lightweight screenshot element lists, full XML tree inspection, and finally human escalation. When unexpected banners or sharing tooltips obstruct execution, the SmartFinder skill dismisses blockers and logs successful recoveries in JSONL, while strictly prohibiting fuzzy matching on verification (then) steps to prevent cascading false positives. For recoverable failures identified by /diagnosis, the /recovery loop autonomously runs through an E-1 to E-5 pipeline—reproducing the issue, correcting locators (such as updating an ImageView to a TextView via live Appium inspection), retesting, and recording findings in lessons.md.
💡 Integrating live Appium MCP inspection with multi-stage LLM error recovery in mobile CI pipelines drastically mitigates test flakiness while preventing false positives on assertions.
How to design GitLab for enterprise scale
GitLab
GitLab published an enterprise architecture guide outlining strategic decisions for scaling platforms to support thousands of developers and pipelines. Organizations must align operational requirements and recovery targets (RTO/RPO) across three deployment models: multi-tenant GitLab.com, single-tenant AWS-managed GitLab Dedicated with geo-failover, or GitLab Self-Managed utilizing reference architectures and GitLab Geo active-passive replication. The guide stresses sizing runner fleets based on empirical workload demand—job volume, concurrency peaks, and specialized compute needs—rather than developer headcount, while choosing between instance, group, or project runner scopes and executors like Kubernetes or Docker Autoscaler. High availability, disaster recovery, and backups must be structured as distinct layers rather than single-point solutions. Additionally, platform teams should decouple queued duration from execution duration to distinguish compute capacity constraints from pipeline, cache, or monorepo data transfer bottlenecks.
💡 Decoupling job queue latency from execution durations while right-sizing runner executor pools prevents platform scheduling bottlenecks across enterprise monorepo pipelines.
How GitLab reduced code-per-agentic-flow ratio by 45%
GitLab
GitLab engineers Mikolaj Wawrzyniak and Alexander Chueshev detailed how introducing the Flow Registry framework into the GitLab Duo Agent Platform reduced the code-per-agentic-flow ratio by 45%. Early agent implementations—including the Software Development Flow, Duo Agentic Chat, Convert to GitLab CI/CD Flow, and Developer Flow—relied on ad-hoc LangGraph structures exceeding 450 lines of Python each, resulting in tightly coupled state and fragile graph-wide test suites. To restore scalability, the team created Flow Registry, an abstraction layer that compiles declarative YAML configurations into robust LangGraph execution graphs. The architecture rests on three pillars: reusable components (such as AgentComponent and human-in-the-loop checkpoints), routers, and a shared state model. This separation of AI primitives from low-level graph orchestration eliminated repetitive boilerplate while preserving backward compatibility for foundational and customer-authored flows.
💡 Abstracting agent graph orchestration into declarative YAML component registries cuts codebase maintenance overhead by nearly half while isolating model integration logic from runtime state handling.
New trends in global card fraud: How 3D Secure and regional mandates are affecting risk
Stripe
Stripe published an empirical analysis of billions of transactions processed between January 2022 and March 2026, highlighting the global impact of regional 3D Secure (3DS) mandates on card fraud. By Q1 2026, the Asia-Pacific region achieved the lowest card fraud rate globally, driven by Malaysia's 74% fraud reduction following strict app-based authentication mandates and Japan's April 2025 3DS rollout which cut disputes by over 30%. In Europe, Strong Customer Authentication (SCA) pushed fraud down 21% overall—with France down 40% and the UK down 27%—though Spain and Portugal saw fraud rise continuously due to SMS OTP vulnerabilities and smishing. Conversely, Latin America maintained the highest fraud rates in 2025—160% above EMEA and 151% above APAC—compounded by cash-heavy ecosystems, asymmetric dispute burdens, and local regulatory demands like Mexico's SAT permanent audit access. In response, Stripe expanded Radar across bank debits, stablecoins, and digital wallets, reporting that AI-optimized 3DS triggers reduce fraud by 7.67% while delivering a 1.20% conversion lift in SCA regions.
💡 Expanding multi-region payment infrastructure requires phasing out SMS OTP in favor of app-based 3DS and adaptive fraud detection to satisfy localized compliance while preventing cross-border fraud spikes.
Grafana Alerting: Scale alert routing without scaling complexity using multiple notification policies
Grafana
Grafana Labs announced the General Availability of Multiple Notification Policies in Grafana-managed alerting with the release of Grafana 13.2. Previously constrained by Prometheus Alertmanager's single global policy tree, growing organizations faced configuration complexity, broad blast radiuses, and coarse access permissions whenever modifying alert routes. With Grafana 13.2, teams can split routing into independent, named policy trees structured around teams (e.g., payments, platform), services, domains, or environments. Alert rules can be assigned directly to a designated policy while unassigned rules fall back to the default tree, enabling incremental adoption. Each policy functions as an isolated resource that can be provisioned and managed independently via the Grafana UI, API, or Terraform without disrupting other routing states, backed by granular policy-level RBAC to delegate ownership safely.
💡 Decomposing monolithic Alertmanager trees into independently provisioned, RBAC-scoped notification policies enables platform teams to safely delegate alert routing ownership via Terraform without organizational blast radiuses.
This digest was collected from RSS feeds and summarized by AI (Claude). See the original links for full details.