Skip to content

Four Signals

Agentic insights for modern tech teams

We wanted to use Baseten for inference. We ended up with admin access to Baseten GitHub repos - Strix
AI/ML / strix.ai

We got admin access to Baseten's production GitHub

Strix's autonomous hacking agent discovered a live GitHub personal access token with admin and push access to Baseten's production repositories, including their main product repo and GitOps infrastructure, by scanning a publicly accessible Harbor container registry. The token, dating from March 2023 and still active in July 2026, was found without any credentials by enumerating subdomains and pulling anonymous image layers. Baseten's security team rotated the token within a day of disclosure, but the incident demonstrates how exposed container registries can leak critical infrastructure credentials.

Why it matters

For a Solutions Architect focused on cloud infrastructure and security, this shows that even billion-dollar AI infrastructure companies can have critical credential exposure through misconfigured container registries, underscoring the need for regular black-box scanning and registry access controls in your own deployments.
Lyft Moves Streaming Fleet to Apache Flink Kubernetes Operator
Cloud / infoq.com

Lyft Moves Streaming Fleet to Apache Flink Kubernetes Operator

Lyft migrated hundreds of production Flink jobs from a homegrown Kubernetes operator to the Apache Flink Kubernetes Operator, gaining last-state upgrades, in-place autoscaling, and resource autotuning. The legacy operator's savepoint-trigger lacked retry logic and idempotency, causing deploy failures on large-state jobs, and its single memory knob wasted resources. Lyft adopted the open-source operator's BlueGreen deployment CRD (shipped in v1.14.0), contributed an upstream fix for a configuration-rename bug, and upgraded to Flink 1.19 to enable in-place scaling and the KinesisStreamsSource for autoscaler backlog metrics.
Four Iceberg Tools, Three Agent Frameworks: What Ports, and What Doesn't
AI/ML / dev.to

Four Iceberg Tools, Three Agent Frameworks: What Ports, and What Doesn't

A data agent built with Google ADK, AWS Strands, and Microsoft Agent Framework runs identically against five Apache Iceberg catalogs, but speed varies 3.72x at the median (3.33s vs 12.36s) and per-cloud storage wiring requires distinct configurations for OneLake, Glue, or S3 Tables, while the framework itself adds a smaller cost — e.g., Strands on Gemini was 1.52x slower than ADK. All three agents produced the same answers because PyIceberg scan filters and snapshot references operate consistently across catalogs.
Cloud / cncf.io

Running OpenBao on Kubernetes with a CloudNativePG PostgreSQL backend

This article discusses deploying OpenBao, the Linux Foundation's open-source fork of HashiCorp Vault, on Kubernetes with a CloudNativePG PostgreSQL backend. It likely covers the benefits of using a self-healing, vendor-lock-in-free secrets management approach for Kubernetes infrastructure, including setup steps and operational best practices.
Fifteen years of the same click: what the agent era keeps rediscovering about distributed systems
DevTools / dev.to

Fifteen years of the same click: what the agent era keeps rediscovering about distributed systems

A seasoned architect reflects on fifteen years of systems design, observing that the emerging agent era keeps rediscovering distributed systems problems—like idempotency, race conditions, and transaction boundaries—that were already solved in microservices. The core insight: teams often spend a day re-deriving known patterns (e.g., database uniqueness constraints for deduplication, transactional outbox for reliable delivery) instead of recognizing them upfront. The article specifically warns against treating webhook retries, concurrent event processing, and state reconciliation as novel problems when battle-tested database-level mechanisms already exist.
Ubuntu 26.10 completes transition to Rust-based coreutils
Languages / omgubuntu.co.uk

Ubuntu 26.10 completes transition to Rust-based coreutils

Ubuntu 26.10 'Stonking Stingray' completes the transition to Rust-based coreutils, with cp, mv, and rm—previously held back on GNU versions in 26.04 LTS due to TOCTOU (time-of-check to time-of-use) security bugs—now migrated after upstream fixes. Canonical, which donates €40k/year to the Trifecta Tech Foundation, began 'oxidising' the distro in 2025 and made Rust sudo the default in 25.10; the uutils migration offers no functional changes but eliminates memory-safety bugs at compile time. Ubuntu also plans to adopt the foundation's Rust-based NTP rewrite as the default time sync client by 27.10.
Java 27 Delivers Post-Quantum Cryptography, Future Language Innovation, Helidon 27, JavaFX 27
Languages / infoq.com

Java 27 Delivers Post-Quantum Cryptography, Future Language Innovation, Helidon 27, JavaFX 27

Java 27 ships nine JEPs, prioritizing post-quantum cryptography with JEP 527 (Hybrid Key Exchange for TLS 1.3). The release also makes G1 the default GC everywhere (JEP 523) and enables Compact Object Headers by default (JEP 534) for reduced memory overhead. Structured Concurrency (7th preview) and the Vector API (12th incubator) continue their slow maturation toward eventual standardization.
Clean tech startup Fluxnium found a way to tap 50,000 years’ worth of nuclear fuel
Startup / techcrunch.com

Clean tech startup Fluxnium found a way to tap 50,000 years’ worth of nuclear fuel

Fluxnium emerged from stealth with a $7M seed round, licensing DoE-developed polymer-fiber chemistry to extract uranium from seawater at costs competitive with land-based mines. The startup's key innovation increased fiber surface area, reducing extraction cost from $200+/lb toward market parity, targeting a structurally short uranium supply as US nuclear capacity aims to triple by 2050. With 4 billion metric tons dissolved in the ocean—enough for 50,000 years—the approach avoids tailings waste and geopolitically concentrated supply from Kazakhstan, Russia, and Namibia.
Shopify Drops React Native for Swift and Kotlin as AI Changes Cross-Platform Development Tradeoffs
AI/ML / infoq.com

Shopify Drops React Native for Swift and Kotlin as AI Changes Cross-Platform Development Tradeoffs

Shopify is abandoning React Native for its flagship apps, rewriting them in Swift and Kotlin after AI coding agents made native development cost-competitive. A six-engineer team rebuilt the Shop app in 12 weeks using declarative UI frameworks SwiftUI and Jetpack Compose, achieving 23% faster iOS cold startup, 50% faster Android startup, 10x fewer crashes, and 75% faster Android build times. The pivot was driven by avoiding React Native's New Architecture refactor and capitalizing on AI models that now effectively guide platform-native code generation while preserving platform idioms.
AWS agents will suggest your new flights. Code decides what gets booked.
AI/ML / thenewstack.io

AWS agents will suggest your new flights. Code decides what gets booked.

AWS published a Step Functions pattern that uses Amazon Bedrock AgentCore agents to propose flight rebooking itineraries but reserves all reservation changes and payments for deterministic code validation. The pattern explicitly enforces that "agents propose, deterministic code validates," wrapping each agent's non-deterministic output in Step Functions steps that prevent direct actions like writing reservations or issuing payments. AWS advocates this separation as a safer architecture for high-stakes workflows, and separately highlighted Bedrock's Code Interpreter as essential infrastructure for agentic reasoning in a case study with Abnormal AI.