The PHP security incident is now (almost) old news. The timeline looks something like this: In late August, Wiz Research discovered two serious remote code execution vulnerabilities in PHP called PHP2Shell. They reported the vulnerabilities to the PHP team on August 24, which started working on fixes on September 21. Amazon apparently detected PHP2Shell in […]

The following article was originally published on James Shore’s Successful Software blog and is being republished here with the author’s permission. Software development has emerged as the biggest beneficiary of AI automation. One CIO I talked to recently, with 170 people in his organization, measured a 2.1x increase in productivity from AI. That productivity came […]

The following article originally appeared on The Arize Blog and is being republished here with the author’s permission. Every time you think you’ve just got the hang of this AI thing, another thing gets declared “dead.” This week, it’s agent harnesses. Back in ancient history, aka June, I wrote a piece called “Frameworks are dying, […]

Spend a week with almost any infrastructure team in 2026 and you’ll see one AI subscription producing five very different results. One engineer opens 40 pull requests before lunch across repositories they haven’t touched in a year. Another ships a Terraform change they couldn’t explain in a code review. A third hasn’t opened the tool […]

Created by Claude with light editing by Tim O’Reilly Raffi Krikorian, Mozilla’s CTO, joined Tim O’Reilly at our recent AI Codecon to talk about open source AI. Mozilla, of course, is the nonprofit that helped to define the open source revolution back in the late 1990s. Though its Firefox web browser was superseded as the […]

The following article originally appeared on the Vanishing Gradients Substack and is being republished here with the authors’ permission. Stripe’s Minions turn engineering requests into candidate pull requests. Ramp’s Inspect puts coding agents to work in the background, with tools to check their changes. Warp Factories takes work from tickets and chat through agents, checks, […]

If you’re an instructor for the O’Reilly live training platform, you’ve got to be prepared for the unexpected. As a developer I think we all can understand the situation when a demo (you know, the one that you’ve tested a thousand times on your machine) easily decides on its own to go wrong while being […]

Artificial intelligence has changed cybersecurity permanently. While OpenAI’s inadvertent attack on Hugging Face brought AI-generated attacks to everyone’s attention, AI has been on security professionals’ radar for a long time. AI makes attacks possible at a scale that was hard to imagine a few years ago. Newly discovered zero-days can be exploited almost immediately. Deepfakes […]

In my work with G7–G12 students at Force Academy, a research initiative in Chongqing, I sometimes take a project that appears to be finished and give another student responsibility for using, checking, or modifying it. The handoff is a test of understanding: Can the work still make sense when its creator is no longer there […]

This summer, I built a small experiment called ContextCue. The idea came from something I kept seeing during my internship. The engineers around me were using AI everywhere in the software development process. GitHub Copilot and Claude models helped with specs, code, reviews, and tests. The team also maintained reusable skills that taught coding agents […]

In my previous article, I argued that agentic development needs enough specification to make correctness checkable. A quick prompt can get implementation started quickly, but someone still has to decide whether the result does what we wanted. I left a fairly practical question unanswered, though. Once the agent has written the code, how should we […]

The following article originally appeared on Addy Osmani’s Elevate blog and is being republished here with the author’s permission. For much of human history, we’ve evaluated code quality via code review: Someone reads what you wrote and makes sure it’s clean, thoughtful, fast, understandable, and tests well. For agents, that approach doesn’t scale well; there’s […]

I use AI for writing all the time. But not because it’s good at writing. In fact, just the opposite is true. AI is so reliably bad at writing that I’ve actually taken advantage of that, and made its bad writing an integral part of my writing process. I’ve written a lot of books and […]

In my previous Radar article, “Architectural Guardrails for AI-Generated Code,” I argued that AI coding agents need a layer that can hold architectural decisions in a structured corpus, retrieve the relevant ones, put them into the agent’s context before it writes code, and enforce explicit constraints with reproducible checks. Testing that model exposed two distinctions […]

The following article originally appeared on the Agentic AI Foundation blog and is being reposted here with the author’s permission. Websites are designed for people. We can look at a page and quickly understand where to enter information or which control will complete an action. AI agents don’t see or use the web the same […]

On a recent episode of This Week in AI, we discussed that the number of nonhumans on the internet is greater than humans, 144 to 1. It’s an estimate, and the order of magnitude is more important than the number itself. What matters is what a ratio anywhere in that range does to a security […]

Artificial intelligence systems are difficult to reproduce because their behavior depends on nondeterministic models and on data, configurations, policies, and external services that continue to change. But exact reproducibility is not always what operators, investigators, or auditors need. They often need something different: historical reconstructability. The central claim is that reconstructability is a system property […]

This is the final post in a four-part series about post-training. If you missed them, check out part 1, part 2, and part 3. Time to get your hands dirty! I’ll take you through implementing the key pieces of the classic ChatGPT pipeline: SFT, then reward model training, then PPO. The goal isn’t to reproduce […]

The following article was originally published on the Agentic AI Foundation blog site and is being republished here with the author’s permission. A customer asks your company’s AI agent to update the shipping address on account 123. The agent relies on a support ticket with a typo and updates account 132 instead. The customer relationship […]

The following article originally appeared on Duncan Davidson’s blog and is being republished here with the author’s permission. Decision records give coding agents durable project context—as long as they don’t turn every decision into a courtroom transcript. Architectural Decision Records (ADRs) help human teams establish rules and carry context forward in software projects. They capture […]