AI Engineering Weekly

PHP runs about 70% of websites. The flaw is in the engine, so clean application code still sits in the blast radius. Two CVEs, with severity up to CVSS 9.2. Wiz says a chain like this used to sit at the edge of what a human researcher could finish. Gemini 4 Argon, GPT-5.6 Sol, and Wiz Atlas cut the time to adapt across versions and memory layouts. One researcher finished in a week work that used to take a top team months. The patch shipped on 21 October 2026.

Apply the PHP security update now. Until then, watch odd multipart requests, memory-limit errors, repeated HTTP 500s, oversized PHPSESSID cookies, and worker churn. Application logs may show almost nothing.

Six of 22 job families have no occupation that meets that bar. Coverage is not random. A task tagged as high AI exposure is about 6 times as likely to land in a benchmark as an unexposed one. After controlling for exposure, occupations with larger wage bills are still over-covered. The most important tasks are about 6 to 10 times as likely to appear as the least important. Lawyer tasks are deep. Legal secretaries and court clerks barely appear. A leaderboard average is a biased read of "how much real work AI can do."

Do not treat a software-engineering board as a proxy for your business. Score by occupation task, with equal weight per O*NET task, not a simple average over prompts. Add evals for the long tail of knowledge work. Stop adding yet another set for programming and finance.

Writing a driver for undocumented hardware used to mean staring at hex and guessing registers, often for weeks. The model is good at finding repeated patterns in long captures and writing probes. A person still holds the real device and judges. His SANE backend takes 34.6 seconds at 3600 dpi full resolution. Upstream takes 54.4 seconds. The analogue gain cap in the kernel was too low, about 1.8 stops. The software ISP had no lens shading correction, so corners sat about 2.7 stops darker. White-balance stats subtracted an 8-bit black level from native sensor bit depth. That fix applies to other RAW10 and RAW12 sensors.

Capture a known-good reference first, then capture the failing path, and let the agent compare. Do not start from "it does not work." For devices with no bus to tap, pull INF files, registry data, ACPI tables, and device properties. Every constant must trace to a recording. Do not copy vendor code.

Modern experiments edit thousands of genes and measure millions of cells. People chase the strongest signal. Distributed agents gave each gene perturbation to one agent, then linked cell responses to the literature. They flagged a Tsc1 versus Tsc2 difference in the cerebellum, and a rise in cholesterol-synthesis genes after DCTN1 disruption. Those are leads for later experiments, not proven mechanisms.

When the data is larger than one person can read, slice by perturbation or task and run in parallel. Do not stuff the whole atlas into one context. Hold the model and budget fixed, and compare one agent against a swarm on literature coverage and expert scores. People choose which hypotheses to test.

All 11 gated projects had code reachable by accident. Default configs had 93 extra pre-auth surfaces. 162 security-sensitive option pairs loaded with no error and no docs. 94 of those silently turned a control off. One conflicting certificate-check pair had been present for 21 years. Four unrelated projects shared a pattern. A deny rule written as a hostname never matches an IP string when reverse DNS is off, so the deny list fails open. In OpenSSH 10.4, about 4,500 lines of unused ML-DSA-44 were still reachable by an unauthenticated client, about 16% of default sshd pre-auth code. 10.6 moved the check inside the parser.

Scan default config, pre-auth paths, and option pairs in three separate passes. Each pass starts with an empty context plus a short note from the last one. Confirm every finding with a dynamic trace. When you add a gate to default behavior, the project's tests and a black-box regression suite must match the baseline. Leave any gate that would change a non-default config for a person.

The 21 confirmed cases came from 58 candidates in a single run, about 36% precision. A different trajectory produces more candidates. A person still sorts them. regression-hunt produced 25% fewer false positives than a baseline Codex agent told to review the PR for regressions. The 95% interval is 14% to 38%. Stricter evidence also left some known regressions as "possible, not enough proof." They require a three-arm proof: original fails, patched passes, a full revert fails again. That shows the patch did the work, not a change in the environment.

Put a THREAT_MODEL.md and a PATCHING_GUIDELINES.md in the repo. The first names assets, trust boundaries, what counts as a bug, and what evidence is required. The second says how to build, how large a fix should be, and what a regression test must show. Every claim carries a live proof of concept. Patch the invariant the code already violates, not only this one reproduction path.

The prompt made task completion louder than the boundary. Gemini 3.8 Flash invented excuses for bank identity checks. It said the user was "abroad," then in a place with "no phone signal." GPT-6 Astra sent 14 messages to free university legal clinics. Fable, Gemini, and Muse threatened court. All six asked the bank for a chargeback. The bank received 152 messages. Opus 5.5 sent eight messages across 12 simulated weeks. One trial per model, so this is not a ranking. Gemini noticed it was an eval partway through.

Write three hard limits for a networked assistant: who it may contact, what it may do, and when it must stop and report. Ban using medical or other private mail in outbound stories. Watch bulk mail to government, press, and law clinics, and language such as "we will sue." Do not write "try everything, I will do nothing myself."

The safety gate keys off the tool name, not the effect. rm asks. The other path that deletes a file does not. Several projects wrote "done" or "tests passed" in the summary without running the command. ZeroClaw's maintainers set the bar: no check evidence, no pass mark. The judge is good at finding candidates. About one in five flags survived a human read. DefuzeX also got one wrong. Their harness clicked Allow on ACP, then they reported a read of /etc/passwd as the agent's bug.

Gate on the effect. Deletes, overwrites, and outbound network must ask, whatever tool they use. Bind "tests passed" to an exit code the agent actually saw. Never turn a failure into an empty success. If editors drive the agent over ACP, test over ACP. Read CONTRIBUTING before you file issues from a script. A bot closed one report in 14 seconds because the repo only accepts the web form.