Skip to content

Four Signals

Agentic insights for modern tech teams

I Ran 157 Agent Plans Against a Real LLM. The Problem Wasn't Execution. It Was Planning.
AI/ML / dev.to

I Ran 157 Agent Plans Against a Real LLM. The Problem Wasn't Execution. It Was Planning.

After running 157 agent plans against a real LLM, the core failure mode wasn't execution but planning — agents produce plausible-looking plans that miss critical dependencies or ordering constraints, leading to state corruption. The author built PlannerCritic, a system that treats plans like pull requests: a separate LLM critic reviews the planner's output, deterministic gates check ordering and rollback coverage, and the loop either converges on a safe plan or escalates to a human with a minimal question. This mirrors research showing self-correction fails when models can't independently verify their own output.

Why it matters

For engineers building agentic systems, this shifts the optimization priority from tool-calling and orchestration to plan quality — a layer most teams skip, leading to brittle agents that fail after mutating state.
Google’s AI coding agent just escaped its own IDE
AI/ML / thenewstack.io

Google’s AI coding agent just escaped its own IDE

Google expanded Antigravity, its AI coding agent, beyond its standalone IDE into extensions for VS Code, JetBrains, Visual Studio, and Zed, letting developers delegate multi-step engineering tasks from a side panel. The extensions use a single account across environments and integrate with Gemini Enterprise subscriptions, but token consumption is steep—a nontrivial task can burn 150,000–200,000 tokens, and multi-agent handoffs add more, risking rapid quota depletion under a pooled monthly allowance metered via a rolling seven-day window. Enterprise teams get IAM, VPC Service Controls, and regional data boundaries, with admin controls for spending caps and pay-as-you-go fallback, but individual user-level quota management is still pending.
Malicious Rust crate Arrayref runs a build-time payload
AI/ML / safedep.io

Malicious Rust crate Arrayref runs a build-time payload

A compromised release of the popular Rust crate `arrayref` (v0.3.10) on crates.io added a dependency on a typosquatted crate `proc-macro1`, whose build script downloads and executes a remote binary at compile time. The attacker yanked older `arrayref` versions to push developers toward the malicious release, and the crate's 245 million all-time downloads place it as a transitive dependency in GUI frameworks like egui and iced. The crates.io team removed the malicious versions, but the `droundy` account and upstream repos remain unavailable.
Your Memory API Is Lying to Your Agent
AI/ML / dev.to

Your Memory API Is Lying to Your Agent

AI agents relying on memory APIs that return flat ranked lists of semantically similar records are vulnerable to temporal and relational blind spots: the API may return a superseded fact (e.g., 'PostgreSQL is the production database') alongside a newer one ('MongoDB'), but because the interface discards the relationship between records—which fact governed when, which superseded which—the agent cannot distinguish current truth from historical truth. While bitemporal modeling (SQL:2011 application-time tables) solves this at the storage layer by preserving validity windows, most retrieval interfaces still flatten that structure into a ranked list, throwing away the edges that encode whether a record is superseded, corrected, or jurisdiction-specific. The core insight, attributed to Edward Izgorodin, is that 'a ranked list has nowhere to put an edge,' meaning the abstraction itself is insufficient for agentic memory that must represent what the system currently knows versus what it previously knew.
Languages / 00f.net

Why compiling Rust to WebAssembly is slow

Compiling Rust to WebAssembly with debug info (debug = 2) can be 40x slower than without, as demonstrated by a 40-line reproducer that takes 50 seconds with debug info vs 1.5 seconds without. The root cause is an LLVM bug in the Register Stackify pass for WebAssembly's stack machine: moving instructions to optimize operand stack usage also moves DBG_VALUE records, but the pass rescanning and duplicating records for each moved definition creates quadratic complexity. The fix for clang is incomplete for Rust's wasm target, and the default dev profile's debug = 2 alias triggers this for all wasm builds.
S3 Compatibility Doesn't Guarantee S3-Level Security
Cloud / infoq.com

S3 Compatibility Doesn't Guarantee S3-Level Security

Security researchers at Wiz audited six neocloud S3-compatible services (Nebius, Crusoe, Vultr, Lambda Labs, Cloudflare R2, DigitalOcean) and found critical gaps versus AWS S3, including missing Block Public Access controls, non-standard access key formats that evade GitHub secret scanning, and inconsistent IAM semantics. One tested service deleted the entire bucket on a `delete-bucket-policy` call, highlighting that API compatibility does not imply security parity. The report warns that teams relying on S3 clones cannot assume AWS-level least-privilege protections and must explicitly audit each provider's behavior.
The /sdp endpoint that trusted its callers: fixing a memory-amplification DoS in py-libp2p
Languages / dev.to

The /sdp endpoint that trusted its callers: fixing a memory-amplification DoS in py-libp2p

A memory-amplification DoS vulnerability in py-libp2p's /sdp endpoint allowed unauthenticated callers to send unbounded HTTP bodies and headers, causing the server to buffer attacker-controlled data with no upper limit before any handshake. The fix caps the SDP body at 32 KiB, rejects oversized requests with a 413 status in ~0.3 ms, and limits header lines, reducing peak RSS from over 2 GB to 61 MB under a 1 GiB malicious payload. The issue was caught during a code review of a WebRTC-Direct transport PR, not via production monitoring.
Debian just proposed banning AI code. Here’s why it matters for open source developers & maintainers.
AI/ML / thenewstack.io

Debian just proposed banning AI code. Here’s why it matters for open source developers & maintainers.

Debian's general resolution proposes banning LLM-assisted contributions to preserve its stability-focused culture, citing risks of deskilling and maintainer burnout. Seven counter-proposals range from conditional AI use to a climate-based rejection, but the core debate is about provenance labeling—a 'formatting dispute with a manifesto' per analyst Joe Phillips. The ban would apply to direct Debian code, packaging, and docs, but not upstream projects, highlighting a tension between AI efficiency and community apprenticeship.
A benchmark is only as good as the model you use to grade it
AI/ML / dev.to

A benchmark is only as good as the model you use to grade it

A developer built a pytest harness to benchmark five LLMs (local Llama, GPT, DeepSeek, two Claude models) on cost, speed, and quality, spending ~$0.21 total. Initial results showed all paid models tied on quality (0.92–0.97 range), with the cheapest fastest model matching expensive ones, but the ranking was unstable across runs. The critical flaw: the quality judge was the local Llama model—itself a contestant—and re-grading with a paid judge flipped pass rates, revealing the benchmark's grading model is the real bottleneck.
Your agent isn't reckless. It just can't see the blast radius.
AI/ML / dev.to

Your agent isn't reckless. It just can't see the blast radius.

Claude Code's `PreToolUse` hook lets you deny dangerous commands like `git push --force origin main` before execution, and the agent reads the denial reason to self-correct. The author found that a short list of guardrails—covering credential leaks, destructive git operations, and environment file reads—scales better than reviewing every agent output. Each denial becomes a teaching moment because the agent acts on the explanation, not just the block.