IDEAS, DECISIONS & LESSONS

Journal

Notes on AI, architecture and building useful products.

48 articles

07 Sep 2026 · 6 min read

ai-agents

GitSpawn: How a Git Config Setting Turns Your AI Coding Agent Into an Attacker

A single Git performance setting, core.fsmonitor, lets a malicious repository run arbitrary code the moment an AI coding agent looks at it — before you've typed a prompt or clicked 'trust this folder.' A Tech Lead's breakdown of the exploit and the fix.

04 Sep 2026 · 4 min read

agents

Palo Alto Paid $500M for a 2-Year-Old AI Helpdesk Startup — Here's the Architecture Bet Behind It

Console went from a $6.2M seed to a $500M acquisition by Palo Alto Networks in about two years, automating IT help desk tickets with AI agents. A Tech Lead's breakdown of what made an agentic ITSM layer worth that price, and how to evaluate whether your own ticket queue is a good target for the same pattern.

03 Sep 2026 · 5 min read

Gemini 3.8 Flash Cyber: When the Vulnerability Scanner Also Writes the Patch

Google split Gemini 3.8 Flash into a general workhorse and a gated Cyber variant that finds vulnerabilities and writes patches autonomously. A Tech Lead's take on what changes when the same model does discovery and remediation — and why the patch review step just became your real bottleneck.

26 Aug 2026 · 4 min read

ai-agents

Docker Sandboxes in GitHub Actions: Finally, a Real Answer to 'What If the Agent Goes Rogue in CI'

Docker shipped microVM-isolated sandboxes that plug directly into GitHub Agentic Workflows, giving AI coding agents a full private Docker daemon and sudo without touching your runner's secrets or host. Here's the architecture, a working YAML example, and where the rough edges still are.

21 Aug 2026 · 5 min read

ai-agents

GitHub's Scaling Crisis: What 17 Million AI Agent PRs a Month Actually Breaks

GitHub's August 17 outage postmortem reveals commit volume doubled in four months, with AI coding agents now generating 17M PRs/month. A capacity-planning breakdown for teams running agent fleets against shared git infrastructure.

18 Aug 2026 · 5 min read

agentic coding

Six AI Coding Agent Incidents in One Month: A Containment Checklist for Tech Leads

Cursor's CVSS 9.8 RCE, AWS Kiro rewriting its own MCP config, a wiped Supabase production database, a private-repo leak via GitHub Agentic Workflows — August 2026's incident roundup, distilled into what to actually change in your team's agent permissions.

18 Aug 2026 · 5 min read

agentic coding

Wiz's AI Agent Found a Vulnerability GitHub Copilot Missed. Here's What That Actually Means

Wiz's autonomous Red Agent found a real, exploitable CI/CD vulnerability in a Snowflake repo — one that human review plus Copilot Autofix had already passed. A technical lead's take on the AI-versus-AI security shift, and why it changes your review checklist.

10 Aug 2026 · 5 min read

aws

Why Your 30GB GPU Container Image Takes Minutes to Pull — Even on a 100Gbps Link

AWS EKS engineers published the real root cause of slow CUDA/PyTorch image pulls on Aug 10, 2026: it's serialization, not bandwidth. Two containerd fixes now shipping in EKS Auto Mode — chunked range-request downloads and concurrent layer unpacking.

28 Jul 2026 · 6 min read

Cloud Agent Sandboxes: How AWS, Google, Azure, and Cloudflare Handle Isolated Code Execution

All four major clouds shipped agent code sandboxes in the same quarter. Four isolation architectures, four trade-off profiles. Here's the technical comparison and decision framework for Tech Leads picking the right sandbox for their AI stack.