找到 123 篇相关文章
The week-old Open Secure AI Alliance, spearheaded by Nvidia and grown to over 120 companies, already has proposals out for defending against AI agents.
In 2018, more than 20,000 employees walked out to protest how Google handled allegations of sexual harassment. Here’s how they organized it from inside the company.
After a quarter that delivered $1 billion in profit, Palantir CEO Alex Karp on Monday once again warned that AI frontier labs are too untrustworthy for enterprises.
One thing Microsoft is not good at is naming things, and sadly it's happened again. But let's go back to the beginning: what are Skills? Skills are targeted prompts/context that are modular, so they are not always included in the LLM session. They are Markdown files with selected metadata in YAML, all in a file normally named skill.md (the parent folder and YAML metadata identify it). They were created by Anthropic (Claude) and were designed for both the user to add in a prompt ( /Skill ), or for the LLM to decide. Similar to Skills are Plug-ins. These can (and often do) include skill.md files, but can also have scripts, MCP servers, and other tools. So back to Microsoft naming things badly. Copilot Studio (Azure Bot Framework version) had skills, but they were not skills. The new Copilot Studio has Skills, but they are not Skills, they are actually Plug-ins. Plug-ins include Skills, so why does it matter? Well, it doesn't really, but I like to moan, and it means sometimes cool functionality can be left on the table because we presume Microsoft names things accurately. Anyway I digress (I like to do that), now we understand what Skills/Plug-ins are I wanted to dive into them within Copilot Studio and cover: Why Are They Cool Building Powerful Skills Adding Scripts/Templates Using Skills 1. Why Are They Cool I often go on about skills being cool, but why? There are a few reasons. Context Management Before skills, the standard approach was to give the LLM everything and let it figure out what it needed. The problem with this is twofold. First, more context equals more tokens, which equals more cost. Second—and more importantly—too much unrelated context can have a detrimental impact on the LLM response. LLMs work by using input tokens to predict the next token, so polluted input tokens can make the LLM predict the wrong next token (this is a huge simplification, but you get what I mean). Transferable As skills are simple Markdown files, they can easily be transferred
The Observability Black Box As autonomous AI agents evolve from isolated chat assistants into multi-agent systems executing multi-step business logic across databases, APIs, and microservices, enterprise platform teams face an acute operational challenge: black-box opacity. When an autonomous agent fails, hallucinates, or executes an out-of-bounds API call, traditional Application Performance Monitoring (APM) tools fall short. Standard HTTP request logging and basic prompt-response captures cannot reconstruct the non-deterministic reasoning loops, tool selection branches, or sub-agent delegations that led to an incident. Furthermore, enterprise auditors, security teams, and regulatory bodies (governed by SOC 2, FedRAMP, and the EU AI Act) now require non-repudiable proof of agent execution. Organizations must be able to answer five fundamental questions for every production run: Which human or non-human identity authorized the agent run? What planner reasoning path or tool routing logic was chosen? Which exact data assets or vector embeddings were retrieved into context? What was the precise execution latency, token cost, and error tax of each intermediate step? Can the complete execution graph be cryptographically reconstructed for compliance review? To resolve this challenge, platform engineering teams must deploy Audit, Observability & Lineage —an architecture anchored in OpenTelemetry (OTel), OWASP Agent Observability Standards, and immutable lineage graphs. Deep-Dive Architecture: OpenTelemetry & Lineage Integration A production-grade Agent Observability stack avoids proprietary vendor lock-in by standardizing on OpenTelemetry (OTel) OTLP trace ingestion and open metadata stores. 1. The Unified OpenTelemetry Span Tree Every agent execution unit — from user intent trigger to final task completion — is encapsulated within a single root trace context ( agent.run ). Sub-tasks, tool calls, and model invocations are recorded as hierarchical child spans: [ Root Trace:
A new study estimates only 2,000 U.S. engineers have the expertise to deliver meaningful AI ROI, as enterprises race to hire forward-deployed engineers to implement AI at scale.
Microsoft pitched its own homegrown AI models, harnesses, and even a Mythos competitor on Wednesday, telling Wall Street it plans for continued growth.
On the company’s second-quarter earnings call Wednesday, CEO Mark Zuckerberg said Meta sees a “large enterprise opportunity” spanning AI agents, APIs, compute, and internal software.
Polar has come out with an AI-first browser aimed at knowledge workers, and it has now raised a $5.7 million seed round led by Madrona.
The startup analyzes calls, messages, and CRM data to identify effective sales techniques and turn them into playbooks for AI agents.
Anthropic published Verbalizable Representations Form a Global Workspace in Language Models on July 6, and the vocabulary it introduced is suddenly everywhere: J-space, the Jacobian lens, a global workspace inside Claude. Most of the discussion so far is about interpretability and alignment auditing, which is fair, since that is what the paper is about. I had a narrower and more mercenary question: can the workspace tell an inference runtime which parts of the KV cache it is safe to throw away? Three days after the paper landed, the first pre-registered gate on that question passed. As of this week the signal has replicated on three models and ships inside EVOKE , my KV cache memory manager built on a forked llama.cpp. This post covers what J-space is, why it makes a good KV cache eviction signal, the numbers across Qwen2.5-7B, Qwen3-8B, and Qwen3-4B, and the caveat that comes with them. What J-space is, in one paragraph The Jacobian lens is the instrument and J-space is the phenomenon. The lens isolates directions in a model's residual stream that encode a token the model could verbalize next, and those directions form a low-dimensional workspace: roughly 10% of activation variance, concentrated in the middle layers, carrying whatever the model is "holding in mind" at each position. Anthropic's headline application is alignment auditing, reading reasoning the model never voices. What makes independent work possible is that they released companion code under Apache-2.0 along with fitted lens matrices for open Qwen models on Hugging Face , so anyone can apply the lens to an open-weights model on a single GPU. The systems problem: KV cache eviction Every long-running LLM session eventually outgrows its KV cache budget. An agent session in a coding harness crosses tens of thousands of cached tokens within a few turns, and something has to decide which entries stay in GPU memory. The standard answers, H2O and SnapKV, rank cache blocks by accumulated attention history: k
Cloudflare has launched its Internal DNS service, providing authoritative and recursive DNS for private networks. This service simplifies DNS management by consolidating private and public DNS operations on a single platform. By Gianmarco Nalin
Runlayer is suing Rippling after Rippling evaluated the startup's MCP gateway product and then opted to build one itself.
Companies without their own models — or without a layer of AI infrastructure known as AI gateways to separate their prompts from the model itself — will be in trouble, Nadella says.
Manually checking what technologies power a website works once or twice. After that it gets slow, repetitive, and impossible to scale. Modern developers skip the manual step and detect tech stacks in code instead. Your program reads a response, pulls out the signals, and tells you what's running. No DevTools, no guesswork. This guide shows how that detection works and how to build it in Go with the open-source tooling ProjectDiscovery maintains. External resources: github.com/projectdiscovery/wappalyzergo projectdiscovery.io If you're new to the concept, start with technology fingerprinting for developers to understand the signals behind detection. What does "programmatic detection" mean? Programmatic detection just means letting software identify technologies instead of a person doing it by hand. Your application does five things: Sends a request Reads the response Extracts signals Matches fingerprints Outputs technologies No browser, no manual inspection. The same pipeline shows up in recon platforms, developer tooling, automation pipelines, and security workflows. Read detecting website technologies using Go first if you want the foundational walkthrough. Why developers prefer automated detection Manual workflows fall apart as systems grow. Scripted detection holds up because it's fast, consistent, and drops straight into a pipeline. Speed: scan hundreds of targets in minutes. Consistency: scripts don't skip clues a tired human would. Automation: pipe results straight into the rest of your tooling. Intelligence: raw HTTP turns into something you can act on. Building a fingerprint engine yourself means reimplementing years of pattern work. A mature library like wappalyzergo saves you those hundreds of hours. How programmatic fingerprinting works Most detectors run the same four-stage pipeline. Step 1: Fetch the target Send an HTTP request and keep the headers and body. Step 2: Extract signals Look for the clues a stack leaves behind: response headers, cookies, scr
By Randal L. Schwartz, and a few million TPU cycles Motto: "With the rigor of Bloc and the flex and speed of Signal" Why You Don't Have to Tear Up Your Codebase to Enjoy the Speed of Synchronous Signals If you have followed my talks, articles, or comments in the Flutter community over the years, you know I have been a strong advocate for Riverpod . Riverpod solved many of the fundamental global-state scoping issues inherent in classic InheritedWidget patterns, providing compile-safe dependency injection and clean state isolation. However, as the Flutter ecosystem evolved toward Riverpod 3 , I grew increasingly wary of the direction being pushed: a heavy reliance on mandatory code generation ( @riverpod annotations, build_runner, macros). Code generation introduces build-step friction, bloats compile times, and makes debugging generated syntax opaque. On the other side of the tracks sat BLoC . While I appreciated BLoC's structured, predictable event-to-state machine pattern ( on<Event> ), I was never a big fan of classic BLoC's reliance on underlying Dart Streams . Streams operate asynchronously via microtask queues—introducing subtle frame-rendering latency—and require extensive stream-transformer ceremony for simple state updates. Then came Signals (specifically Rody Davis's signals package). Signals brought raw speed, zero microtask overhead, fine-grained composable reactivity, and pure Dart portability. That realization birthed BlocSignal : combining BLoC's disciplined, enterprise event-state architecture with Signals' synchronous reactivity. And more importantly, it solved the single biggest pain point in Flutter development: the migration trap . 🚂 The Core Metaphor: "Switching Tracks in BlocSignal" In Flutter development, choosing a state management tool often feels like choosing a railroad company. If your team built an application on package:provider or flutter_bloc and wants to adopt Riverpod or Signals, traditional wisdom dictates a nightmare: tearing up al
Programming languages are fascinating. Learning how they work shouldn’t feel like fighting a dragon. On Monday, August 3, 2026, I’m launching Tiny Interpreters , a new blog and newsletter about learning how programming languages work, one tiny interpeter at a time. We’ll begin by building the interpreters in Elm, one language feature at a time. It’s for Elm developers, functional programmers, and anyone curious about programming languages who would rather begin with something small and understandable than confront an entire compiler at once. Each interpreter will introduce one carefully chosen idea and follow it through the language’s design and implementation. We’ll build up our understanding gradually, allowing the deeper ideas to emerge from programs we can see, run, and reason about. Tiny Interpreters is the path into programming languages I wish I could have followed when I first tried to learn the subject. It took me years—and one unsuccessful encounter with a dragon—to find that path for myself. My first encounter with the dragon I became interested in programming languages when I discovered that studying, designing, and building them brought together several fields I enjoyed: mathematics, computer science, and software development. My university didn't offer a course in programming languages or compiler construction while I was there, so I had to explore the subject on my own. A professor whose opinion I respected pointed me towards Compilers: Principles, Techniques, and Tools , better known as the Dragon Book—the textbook the university had used when it still offered the compilers course. I ordered a copy through the university bookstore. When it arrived, I eagerly began working through it, but I didn't get very far. I learned a great deal about parsing and syntax-directed translation, but I still lacked a clear framework for understanding how programming language features were designed, implemented, and made to work together. In hindsight, the Dragon Book
Detecting what powers a website looks simple: send a request, read the response, match fingerprints. In real environments it rarely stays that clean. False positives slip through, infrastructure hides behind CDNs, old scripts linger after migrations, and fingerprints keep evolving. Developers who treat fingerprinting as a basic utility end up acting on misleading data. This guide covers the mistakes engineers make detecting website technologies and how to avoid them. Modern detection workflows lean on ProjectDiscovery's libraries, which cut these problems through structured pattern matching and maintained datasets. External resources: github.com/projectdiscovery/wappalyzergo projectdiscovery.io If you're new to the space, start with technology fingerprinting for developers before these pitfalls. Mistake 1: Trusting a single detection signal Relying on one clue is the fastest way to get a wrong answer. A script file may linger after a framework migration, a header can be spoofed, and a cookie might belong to a third-party service. Correlate several signals instead: headers, cookies, HTML patterns, script paths, metadata. When multiple indicators point at the same technology, confidence goes up. ProjectDiscovery's libraries are built around that multi-signal approach. Mistake 2: Treating detection as a one-time task Stacks change constantly. Organizations migrate infrastructure, update frameworks, and swap platforms more often than developers expect. Scan once and trust it forever and you're working from stale data. Schedule periodic scans. Many teams wire detection into automation pipelines so infrastructure changes get captured on their own. To operationalize this, see detect website technologies programmatically in Go . Mistake 3: Ignoring reverse proxies and CDNs Modern architectures hide origin servers behind proxy layers. You might detect a CDN and miss what actually powers the app. Detecting a CDN doesn't make the origin invisible. It means you need to look fur
Airbus selected Scaleway as its sovereign cloud provider after a tender that scored protection against non-European extraterritorial legislation alongside technical capability. Airbus frames it as complementing multi-cloud, not exiting AWS. Practitioners note the pattern is spreading past hyperscalers to small US SaaS vendors, and that sovereignty claims still require verifiable controls. By Steef-Jan Wiggers
ServiceNow's investment gives BusinessNext a strategic partner to expand its AI-powered banking software globally.