AI Autofix Won't Clear Your Backlog: Patching Is a Capacity Problem
A 2026 preprint finds 94-100% of security queues are saturated. AI autofix adds patches but not review bandwidth. Plan capacity, not supply, to clear backlogs.
The archive · Page 2 of 6
Developer Tools
The economics, interop standards, and workflow tradeoffs reshaping how code gets written, reviewed, and shipped when AI agents share the editor with the engineer.
The archive
25–48 of 135 articles · Newest first
How Cursor Uses GPT-5: Where Your Prompts Actually Go
OpenAI is cutting off Cursor's model supply by Nov 12, 2026. This exposes the uncontracted data hop between your IDE and the lab, forcing a governance audit and fallback plan.
Knowledge Graph RAG: How Constrained Decoding Stops Hallucinated Terms
LLMs4OL 2026 results show post-hoc vocabulary filtering achieves 0.92 F1 but bans non-taxonomic relations. Learn how to manage the term-governance burden this creates.
Teaching Junior Developers When AI Writes the First Draft
TutorTrace data shows AI adoption metrics fail to measure junior skill. Use behavioral windows and guided help-seeking states to judge code review evidence instead of dash.
Diagnosing LLM Prompt Injection Detectors Before You Gate an Agent on Them
A new preprint shows 77% of prompt injection detector decisions flip on single-token removal. Probe your own traffic slices to separate calibration drift from exploitable gaps
Local Coding LLMs Hallucinate Packages: Slopsquatting Defenses Compared
Local coding LLMs hallucinate package names at rates up to 73% on adversarial prompts. A new preprint compares defense layers, showing that dependency safety must shift from a
Testing Cloud APIs Without a Cloud Account: LocalStack vs Emulator Synthesis
Compare LocalStack, Azurite, and CloudEmu for CI cloud testing. LocalStack now requires an auth token; Azurite covers only storage. Synthesis shifts fidelity risk from code to
PDF Parsers vs Math Formulas: Building RAG Over Scientific Papers
ICPR 2026 benchmark shows text similarity fails to detect formula corruption in PDFs. Use LLM-as-judge validation to gate RAG ingestion and prevent silent retrieval errors in
Node CLIs Running Local AI Models: Transformers.js v4 vs a Python Sidecar
Transformers.js v4 claims npm-native inference, but verified evidence favors Ollama or llama.cpp sidecars for offline operation and MoE model support in Node CLIs.
Training a Personal Coding Assistant: GPU Cost vs a Copilot Seat
Hugging Face's personal coding assistant post forces a make-vs-buy decision. We map the hybrid stack where fine-tuning clones conventions but fails on API knowledge, and why.
VCoT-Bench: Why AI Rust Verification Fails Merge Gates
VCoT-Bench shows frontier LLMs struggle with Rust verification chains. AI code needs compiler gates, property tests, and human review, not model judgment.
Rust GPU Offload: arXiv 2608.13759 Analysis for Rust Teams
arXiv 2608.13759 claims portable, safe Rust GPU offload. This analysis grades the preprint's claims on safety, speed, and portability to guide Rust teams on whether to adopt.
Cursor Origin vs GitHub: The Real Cost of Switching Repo Hosts
Cursor launched Origin, but git remotes do not carry CI pipelines, branch protections, or identity plumbing. Teams must inventory these hidden costs before switching repo.
Treat AI Autofix as Untrusted Input: Merge Gates and CI Scoping
Agent-authored fixes are untrusted input to production pipelines. This decision guide defines which autofix output may auto-merge and how to scope CI credentials to contain.
Kimi K3 Local Inference: Why 2.8T Parameters Break the Consumer RAM Floor
Kimi K3's 2.8 trillion parameters force a local API routing split. Consumer RAM cannot hold the weight footprint, making interactive workloads non viable and pushing.
Provenance as a CI Gate: Attributing Agent-Authorship in Code
Git credits the merger, not the model. F(AI)2R proposes a PROV-O provenance graph gated by CI to record agent authorship and human verification, preventing blame collapse in.
OHTTP CLI: Stateless Privacy for Agents vs VPN and Tor
Cloudflare's OHTTP protocol splits request identity from content across two parties. This CLI approach offers stateless privacy for agents, shifting key management burden to.
Fine-Tuning vs RAG for Internal APIs: StarCoder2 Constraints
StarCoder2's 4,096-token sliding attention limits RAG for internal APIs. Fine-tuning encodes proprietary signatures in weights but requires a permanent dataset curation loop.
Mellum2 Unverified: Why MoE Active Parameters Matter More Than Total Size
Mellum2 specs lack sources. DeepSeek-Coder-V2 proves MoE economics. Local teams must demand active parameter counts before deploying coding models.
PyPI Wheel Reproducibility: 15% Byte-Identical, 79% Source-Equivalent
Only 15.4% of PyPI wheels rebuild byte-identically from source. A new preprint measures 12,180 releases to expose the gap between pip-audit trust and actual source.
CHRONO-RESOLUTION: npm, PyPI, and crates.io lockfile drift measured at release points
CHRONO-RESOLUTION measures resolution drift across npm, PyPI, and crates.io at release points. Lockfiles are snapshots, not contracts. Teams must adopt per-ecosystem.
CLI-Tool-Bench: Why Patch Leaderboards Fail for 0-to-1 Code Generation
CLI-Tool-Bench reveals a 43.8% ceiling for 0-to-1 CLI generation across seven frontier LLMs. Patch leaderboards measure editing, not architecture. Teams must evaluate.
Grok CLI uploads entire workspace to GCS by default, independent of model reads
Wire-level analysis shows Grok CLI 0.2.93 uploads the entire workspace to GCS by default, regardless of model reads. The settings toggle fails to disable this side channel,.
Drizzle vs Prisma in 2026: Choosing a TypeScript ORM
The two most popular TypeScript ORMs split on abstraction and lock-in: Prisma's generated client and paid platform versus Drizzle's zero-dependency SQL builder.
