Tech News

Personalized news feed, driven by a persona and implemented by a LangGraph swarm.

Long-horizon agents and durable execution

Long-horizon agents automate complex tasks spanning days or weeks, involving multiple interactions with people and external systems. Durable execution is an emerging pattern where the runtime records each step's result, enabling recovery from crashes, network failures, and real-world anomalies by replaying the program and skipping completed steps. This approach fundamentally changes the economics of previously uneconomical work, such as patient onboarding or deal closure across departments.

Why it matters

For a solutions architect focused on AI agent orchestration and platform engineering, durable execution provides a critical reliability pattern for productionizing multi-step agents that interact with fallible external systems and humans over extended periods.

AI/ML / infoq.com

Google Finds that Technical Debt Can Derail Coding Agents Through "Agent Distraction"

Google researchers found that stale technical debt—like outdated TODO comments, obsolete bug references, and lagging documentation—causes AI coding agents to waste tokens and time on unrequested side-quests, a phenomenon they call 'agent distraction.' Analyzing distributed traces from thousands of engineers and hundreds of millions of agent steps, they discovered that 13% of sessions exposed agents to inline TODO/FIXME references, leading to unprompted detours in 6% of cases, with 41% targeting already-closed tickets and 57% causing scope creep on unrelated open bugs. These detours added 70% more steps, 77% more tokens, and 105% more wait time per session, prompting Google to deploy scanner agents that cleaned thousands of obsolete references with over 95% human reviewer acceptance.

AI/ML / arstechnica.com

Grok Build coding agent leaks oodles of confidential info, some belonging to SpaceXSI

Grok Build, the vibe-coding agent from SpaceXSI, leaks sensitive data from thousands of users through enumerable share URLs, a design flaw that undermines access randomization. Claroc research reveals exposed data includes internal SpaceXSI sales plans, Tesla employee scorecards, and medical exams from a Peruvian construction firm, among other proprietary information from Fortune 500 companies and defense contractors. SpaceXSI only began removing its own 24 exposed apps after Ars Technica inquired, leaving other users' data still accessible at time of publication.

AI/ML / dev.to

Stop Trusting npm Scans: Run Untrusted Packages in an Isolated AWS Sandbox

RepoPilot, a Strands agent on Amazon Bedrock, originally used five static analysis tools to assess npm package safety by reading READMEs and manifests. Adding a single `run_in_sandbox` tool that executes `npm install` inside a disposable AWS CodeBuild container and scans the real build log for supply-chain attacks (like `curl | bash` postinstall hooks) catches threats invisible to static scanners. The sandbox runs untrusted code in AWS, never on the developer's laptop, addressing the 19,500 malicious package versions detected in a single quarter.

Languages / infoq.com

Angular's TypeScript 7-Powered Compiler Enters Beta with Rust-Based Preprocessor

Angular's new compiler beta, ngp, rewrites its analysis stage in Rust using the Oxc toolchain to decouple from TypeScript's Go-based rewrite, which removed the ts.Transformer API. Benchmarks show 2x-3x cold build speedups and memory halved to 1.4 GB on a 1,714-component project. The compiler runs in three stages—Rust frontend, TypeScript template compiler, and a downstream emitter—with production use blocked until TypeScript 7.1 restores the compiler API.

Colorful FORGE lettering beside an ink-and-wash painting of an artisan forging glowing metal.

Languages / forge-blog.github.io

Memory Safety Bugs in Rust Standard Library

Microsoft's FORGE Lab discovered memory safety bugs in Rust's standard library (std and core) using Hyenas, an AI-powered vulnerability scanner. The bugs stem from three recurring patterns of misplaced trust in unsafe code: trusting code not to panic, trusting user-provided implementations, and trusting the underlying system. These findings show that even safe Rust can trigger undefined behavior when underlying unsafe code breaks its safety contract, challenging Rust's core memory safety guarantees.

General / vulncheck.com

Tracking Anthropic-discovered vulnerabilities

Seven months into Project Glasswing, VulnCheck has tracked 442 CVEs attributable to Anthropic, representing 0.5% of all CVEs published this year, with only two exploited in the wild. Anthropic's ledger reports 37,966 findings but only 217 fixes, and its claimed 94.2% true positive rate is undermined by 1,654 duplicates and 419 withdrawn findings. The OSS Scanner shifts validation to maintainers, with curl rejecting 19 of 34 published reports as non-vulnerabilities, further questioning Anthropic's accuracy claims.

Cloud / infoq.com

Cloudflare Makes Basin Serverless Analytics Generally Available

Cloudflare made Basin, a serverless analytics platform built on Apache Iceberg and R2 Object Storage, generally available. It combines data ingestion, SQL transformations, and distributed queries with no egress fees, targeting teams that need open-format analytics without managing infrastructure. Basin competes with AWS's DuckDB-in-Aurora and Google's BigQuery by emphasizing data portability across engines like DuckDB, Snowflake, and Spark.

AI/ML / infoq.com

Presentation: Batch Intelligence at Scale: Cost-Efficient Multi-Agent LLM Workflows with Built-In Resilience

Walmart Global Tech deployed multi-agent LLM workflows across 4,700 stores for nightly batch inventory forecasting, using MCP grounding and loop agents to handle schema violations, cross-department data mismatches, and network drops. By shifting from provisioned throughput units (PTUs) to pay-as-you-go inference, they slashed cloud costs from over $100k to $10k per month while maintaining resilience at scale.

AI/ML / techcrunch.com

OpenAI, Anthropic face new oversight as New York’s AI safety law takes effect

New York's RAISE Act takes effect January 2027, requiring frontier AI developers with over $500M annual revenue to register, publish safety frameworks, report critical incidents within 72 hours, and issue transparency reports. The newly formed Office of DIGIT will enforce penalties up to $1M per violation, while the $55M New York Center for AI Responsibility and Research at SUNY Binghamton independently evaluates advanced AI systems. California's SB 53 and Illinois' SB 315 impose similar mandates with varying incident-reporting timelines and audit requirements.