Posts

Making software extensible software in the age of LLMs is a product-boundary decision before it is a runtime decision. Keep a small, accountable core; put the long tail of one-user requests on an extension point; and give untrusted extension code a narrow capability instead of a credential. The sandbox you choose matters less than the boundary you draw. That is the short version of the argument Jeremy Morrell published on 2026-08-18 in “Extensible software in the age of LLMs”, which reached the Hacker News front page at 177 points and 88 comments the next day (HN item 49363668). This guide turns that essay into a decision process: when to expose an extension point, what to hand it, which isolation primitive fits, and when the answer is that you should not build one at all. ...

The AI autofix supply chain attack that reached Snowflake’s internal Jira did not require a poisoned dependency, a malicious model, or an AI-authored backdoor. It required two ordinary lines of GitHub Actions YAML: an issue title interpolated into a shell run: block, and an if: guard that evaluated to true for every user on the internet. What Actually Happened at Snowflake: June 18 to June 23, 2026 On 2026-06-18, pull request #1218 merged into snowflakedb/snowflake-connector-net. Its title reads as routine maintenance: “SNOW-2069227 : Update jira workflows”. The merge commit is 4a1b8ce, and the diff touches two files for +98/-128 lines across four commits. One of those files, .github/workflows/jira_issue.yml, became a remote code execution primitive for anyone with a GitHub account. ...

CopilotKit OpenBot is an MIT-licensed, self-hosted platform where each AI coworker runs in its own container with its own Chromium browser, its own persistent logins, and where every action is decided against a fail-closed policy — and audited — before it can happen. As of 30 September 2026 it has 5,737 GitHub stars, 762 forks and 33 contributors. This is a second, deliberately different look at the same product. Our first OpenBot review covered the “a computer per coworker” model in September. This one answers the questions that review left open: which of the four products called OpenBot you actually want, what one browser per coworker costs you operationally, and — the part most coverage gets wrong — which hardening in OpenBot is enforced by the software versus which is merely documented and left off. ...

open-doc is an MIT-licensed, React-first document framework (@open-document/core) in which a coding agent writes each report as React components while the framework owns the paper: A4/B4/A3 page geometry, self-filling contents, page numbers, DOM-measured auto-pagination, layout diagnostics, and headless PDF/HTML/PNG/SVG export. It is genuinely early — 78 GitHub stars, one human contributor and 487 npm downloads last month (2026-09-30). That gap is the whole story. If you are evaluating it, you are not choosing between a finished product and a finished product — you are deciding whether a well-argued, correctly-scoped design is worth reading end to end and trialling in an existing React/TypeScript shop. ...

Rutis is a Rust reimplementation of the Cordis five-pillar plugin kernel — plugin, fiber, typed service registry, four-semantics event bus, and dependency-driven reload — with a deliberately minimal coding agent layered on top. If you arrived searching for a “rust agent framework,” the honest answer is that rutis is an agent kernel: the lifecycle machinery is the product, the agent is a sample. That distinction decides everything about whether you should try it. Rutis does not compete with Rig or AutoAgents on agent features — no multi-agent orchestration, no tool sandbox, no guardrails, exactly two built-in tools. What it offers instead is loadable, unloadable capability plugins with automatic dependency-driven eviction, backed by an unusually rigorous parity audit against upstream Cordis. The verdict below is trial for plugin hosts, hold for agent builders. ...

The ZCode GLM coding agent silently uploaded user Git history: client version 3.12.3 packaged each logged-in user’s whole workspace, encrypted it with an RSA key supplied by Z.ai’s own server, and POSTed the archive straight to Alibaba Cloud OSS. No consent prompt. No policy disclosure. No working opt-out. The short version of the verdict, before the detail: this was not inference-context transmission, the ordinary and largely unavoidable process of sending code to a model so it can reason about it. It was unattended whole-repository exfiltration, of a repository the user never selected, encrypted with a key the user can never use — which is also why the vendor’s “we deleted it” assurance is not falsifiable from outside. The full timeline runs from a subscriber noticing 700MB of disk growth on 2026-09-17 to an Apache-2.0 source drop on 2026-09-21 and a follow-up client release on 2026-09-23. ...

The harness matters roughly as much as the model. Under identical conditions, harness choice moves coding-agent Pass@1 by 27.4 percentage points and model choice by 29.4 points, while the same model under a minimal versus full adapter swings from 19.1% to 73.4%. The question is no longer whether harness design matters — it is which component buys what, for which model, at which context budget. What a coding agent harness actually is (and what it is not) A coding agent is a model plus a harness. That framing is now standard, but the term itself is overloaded. Martin Fowler’s harness engineering article (Boeckeler, 2 April 2026) narrows it to two bounded contexts: the built-in harness that ships inside a coding agent (its context assembly, tool exposure, and execution loop) and the outer harness a team builds around that agent (instructions, linters, tests, review gates, CI rules). ...

Google’s open agentic orchestrator, AX (Agent Executor), is an Apache-2.0 declarative control plane for AI agents: you declare a Task, a Workspace and a Model, and a distributed runtime provisions an isolated sandbox, runs it, and can suspend and resume it. It is infrastructure under your agent framework, not a framework itself. That one sentence is the difference between understanding AX and misreading it. Most coverage in late September 2026 described it as “Google’s new agent framework” and then argued about features it was never designed to have. The co-creator of the project, Jaana Dogan, answered that framing directly on Hacker News: “AX is a layer that is closer to job orchestration… It’s NOT an agentic framework.” ...

Microsoft’s copilot runtime rust port moved roughly 430,000 lines of production TypeScript to 832,378 lines of production Rust in about 14.5 weeks, across 128 pull requests merged continuously into main, for roughly $120,000 in attributed token spend. A single Distinguished Engineer, Stephen Toub, drove the control loop while AI agents wrote most of the code. That is the headline. The more useful story is in the mechanics: how the team kept main shippable the whole time, why a 136.3-billion-token bill landed at $120K instead of seven figures, which of the performance numbers survive scrutiny, and what the dozens of shipped-then-fixed regressions teach anyone planning an agentic migration of their own. ...

AI coding code quality management means instrumenting the delivery system, not blaming the assistant. DORA’s 2025 survey found 59% of practitioners perceive AI improving code quality while GitClear measured 81% more code duplication and a collapse in refactoring. When perception and measurement diverge that far, quality did not drop — your management system stopped being able to see it. That gap is the whole subject of this guide. It covers what actually changes inside an AI-assisted diff, which gates belong before a human reviewer, the five signals worth tracking with defensible thresholds, and how to pay down the debt you have already shipped without pausing delivery. ...