Writing · page 16 of 17

Older posts.

Sep 8, 2026

Open Weights in 2026: Chinese Labs Ship the Frontier, the Licenses Grew Clauses, and Brussels Started Enforcing

DeepSeek V4, Kimi K3, GLM-5.3, Qwen3.8 and Xiaomi's MiMo are the open frontier now; Meta went closed and came back; the licences quietly acquired revenue thresholds; the EU AI Office got its enforcement powers on 2 August. What I found when I read every licence file, with the Hugging Face API calls that check them.

16 min
Sep 8, 2026

Robot Foundation Models in 2026: 500,000 Hours of Human Video, 50-Step Action Chunks, and a Winning Score of 0.26

What vision-language-action models actually do, from π0's flow-matching action head to Gemini Robotics 2 and GR00T N1.7; who shipped humanoids (Unitree 5,500, AgiBot 15,000) and who didn't (Tesla, zero); the teleoperation behind the demos; and the benchmark numbers that say a home robot is not close. With a LeRobot dataset I loaded this morning.

14 min
Sep 8, 2026

Confidential Computing for AI in 2026: Apple Moved to Google's TEEs, a $1,000 Interposer Broke the Keys, and Firecracker Still Can't Do It

What a hardware enclave actually promises for an AI workload, what it costs (4 to 28% depending on what you measure), what broke it this year (TEE.fail, Battering RAM, WireTap), who runs inference in one (Apple, Google, Meta, a dozen startups) and who doesn't say (OpenAI, Anthropic). Plus the state of SEV-SNP, TDX and Arm CCA in the kernel, why my microVM platform cannot offer it yet, and the commands to verify an attestation yourself.

15 min
Sep 8, 2026

AI Found the Bugs: 23,000 Findings in a Month, a 3-Day Patch Mandate, and the End of curl's Bounty

From AIxCC's 18 real bugs in August 2025 to Project Glasswing's 23,019 findings by May 2026 and the first AI-written zero-day exploited in the wild. What the cyber reasoning systems, Big Sleep, Codex Security and Mythos Preview actually did, why bug bounties are drowning, why CISA now wants federal patches in three days, and a workflow for a small team that keeps the humans looking only at validated findings.

13 min
Sep 8, 2026

Agent Observability in 2026: The Spans Are Standard, the Standard Isn't Stable, and Nobody Reads the Logs

OpenTelemetry's GenAI conventions moved to their own repo in June and still carry the Development badge; every vendor from Datadog to Grafana ingests them anyway. I instrumented an agent loop with the official Python library, show the exact spans it emits, and go through what the 2026 eval papers say actually catches failures: pass^k, log inspection, and a step budget.

13 min
Sep 7, 2026

Stablecoins in 2026: $300B in Supply, 1% Real Payments, and Rails Being Rebuilt for Agents

GENIUS Act rules are still proposals, Visa settles $7B a year in USDC, Stripe launched its own chain, and x402 has 165 million transactions worth about $50 million. An infrastructure engineer separates the settlement layer that is real from the agent-payments layer that is mostly still a demo.

16 min
Sep 7, 2026

Quantum Hardware in 2026: Below Threshold, Not Yet Useful, and the Estimates That Fell 200x

Google is below the surface-code threshold, Quantinuum is public, IBM claims advantage three times in one day, and the qubit count needed to break RSA-2048 dropped from 20 million to under 100,000 on paper. What a systems engineer should take from all of it, with a runnable error-correction simulation.

15 min
Sep 7, 2026

No-Code Didn't Die. It Sold for 2.7x ARR While Its Replacement Raised at 27x

Airtable sold to Bending Spoons for about a quarter of its 2021 valuation on $480M of growing revenue. Lovable raised at $13.3B on $500M. Flowise archived itself and said why. What the 2026 numbers say about visual builders, prompt-to-app tools and agentic automation, and where every generated app still breaks.

13 min
Sep 7, 2026

LLM Inference in 2026: Prefill Is a Different Machine Now, and the KV Cache Has a Disk Tier

vLLM 0.28, SGLang on 400,000 GPUs, NVIDIA Dynamo 1.0 and llm-d in the CNCF all converged on the same architecture: split prefill from decode, route on cached prefixes, page the KV cache to CPU and SSD, and run MoE experts wide across a rack. What changed this year, with the papers, the flags, and the prices.

15 min
Sep 7, 2026

Who Is This Agent? Non-Human Identity in 2026, From the RFCs to the Breaches

Machines outnumber humans 109 to 1 in the enterprise directory, the OAuth working group has 70 drafts in flight, MCP just deprecated dynamic registration, and an agent with an over-scoped token deleted a production database in nine seconds. What actually standardised this year, what shipped, and the delegation chain I would build.

16 min
Sep 6, 2026

Seats Are Dying. What the 2026 SaaS Repricing Looks Like From the Compute Layer

A one-day 18% drop in Thomson Reuters, $1.50 per resolution at Zendesk, $15 per human at Microsoft, and a vibe-coding company at $500M run-rate with 200 people. The unit of software changed this year. Here is what it did to infrastructure.

13 min
Sep 6, 2026

Post-Quantum Migration in 2026: What's Done, What's Stuck, and What to Do This Quarter

Two-thirds of browser traffic to Cloudflare is already post-quantum. Your SSH is too. Your certificates are not, and won't be until 2027. A field guide for infrastructure engineers, with verified commands and hard deadlines.

13 min
Sep 6, 2026

The Worms Learned to Use Your AI Agent: A Year of npm Supply-Chain Attacks

From s1ngularity invoking Claude Code to hunt for wallets, to Shai-Hulud self-publishing across 500 packages, to IronWorm stealing AI API keys — the twelve months that changed how I install software.

13 min
Sep 6, 2026

Neuromorphic Computing in 2026: Real at Microwatts, Not for LLMs

Intel archived Lava and went quiet. BrainChip shipped production silicon. Sandia runs a billion neurons. An infrastructure engineer's honest read of where spiking hardware actually wins, with benchmark numbers and a runnable SNN.

12 min
Sep 6, 2026

MCP Security in 2026: The Protocol Got Hardened. The Ecosystem Didn't.

A year of MCP CVEs, a rewritten spec, an NSA guidance sheet and an OWASP Top 10 — what actually changed, what didn't, and the six controls I'd insist on before an MCP server touches production.

12 min