GitHub Copilot Dev Days is a global, community-led event series designed to help developers adopt AI-assisted coding in practical ways. Through live demonstrations, workshops, and hands-on exercises, the events support everyone from beginners to experienced Copilot users. GitHub encourages developers to attend local events or organize one for their own user group.
## Purpose and Audience
- Events address how AI is changing software planning, coding, reviewing, and delivery.
- They are open to professional developers, students, and anyone interested in improving their workflow.
- Beginners learn foundational tools and best practices.
- Advanced users can explore updated Copilot techniques and features.
## Event Content and Format
- Sessions include live demos, practical training, and interactive workshops.
- Topics may cover:
- GitHub Copilot CLI
- Copilot Cloud Agent
- Copilot in VS Code
- Visual Studio
- Other supported editors
- Hosts include GitHub Stars, Microsoft MVPs, GitHub Campus Experts, student ambassadors, and GitHub and Microsoft employees.
- A sample agenda includes:
- 30–45-minute introductory Copilot session
- 30–45-minute presentation from a local developer or community leader
- One-hour hands-on coding workshop
- Organizers can adapt event topics and formats to their local communities.
## Event Availability
- Events begin in March in cities around the world.
- Dates, topics, and formats vary by location, so attendees should review individual registration pages.
- Attendance also offers opportunities to meet local developers and receive food, swag, and community support.
- User groups interested in hosting an event can submit an organizer request form.
Developers interested in practical AI-assisted development should find a nearby GitHub Copilot Dev Day and register soon, as places are limited.
Netflix’s Ranker service used significant CPU for video serendipity scoring, which compares candidate-title embeddings with a member’s viewing history. The team reduced CPU usage by progressively replacing scalar dot products with batched computation, improving memory layout, reusing buffers, and investigating optimized matrix-multiplication libraries. The main lesson was that mathematical optimization alone is insufficient; allocation behavior, cache locality, SIMD support, and runtime overhead all matter.
## The Serendipity Scoring Hotspot
- Each candidate title and history item is represented by a vector embedding.
- The service computes cosine similarity between every candidate and every history item.
- It selects the maximum similarity and converts it into a novelty score:
- `serendipity = 1.0 - maxSimilarity`
- The original implementation performed `M × N` individual dot products, creating:
- Sequential computational work
- Repeated embedding lookups
- Scattered memory access
- Poor cache locality
- This logic consumed roughly 7.5% of CPU per Ranker node.
- Although 98% of requests contained one video, large batch requests represented about half of the total videos processed.
## Batching Similarity Computations
- The team reorganized the calculation as matrix multiplication:
- Candidate embeddings form an `M × D` matrix.
- History embeddings form an `N × D` matrix.
- Rows are normalized to unit length.
- Similarities are computed as `C = A × Bᵀ`.
- This replaces many separate dot products with one larger operation better suited to CPU-optimized kernels.
- The implementation added `batchEncode()` while preserving the existing `encode()` path for single-video requests.
## Why the First Batched Version Regressed
- Initial canary tests showed a 5% performance regression.
- The batched implementation created `double[][]` arrays for candidates, history, and results on every request.
- These allocations:
- Increased garbage-collection pressure
- Used non-contiguous memory
- Added pointer chasing and reduced cache efficiency
- The matrix multiplication itself was scalar Java code and did not exploit SIMD hardware.
- Batching therefore introduced overhead without delivering corresponding compute gains.
## Flat Buffers and Thread-Local Reuse
- The team replaced multidimensional arrays with flat `double[]` buffers in row-major order.
- Contiguous storage improved predictability and cache locality.
- A `ThreadLocal<BufferHolder>` was used to retain reusable candidate, history, and scratch buffers per thread.
- Buffers grow when necessary but do not shrink, avoiding repeated allocations while preventing cross-thread contention.
- This reduced GC pressure and made batch performance more stable.
## Evaluating BLAS
- BLAS appeared promising in isolated microbenchmarks but did not provide the expected production improvement.
- The default `netlib-java` configuration used F2J, a Java implementation rather than truly native BLAS.
- Native BLAS introduced setup costs and JNI transition overhead.
- Java’s row-major data layout also created an impedance mismatch with common BLAS expectations.
Cloudflare’s 2026 Threat Report argues that cyberattacks are shifting from brute-force intrusion toward high-trust exploitation. Attackers increasingly prioritize “Measure of Effectiveness” (MOE)—the greatest operational result for the least effort—using stolen tokens, AI, trusted cloud services, and social engineering rather than costly custom exploits. The report concludes that defenders must focus on identity, integrations, infrastructure resilience, and continuous monitoring of legitimate tools.
## Measure of Effectiveness (MOE)
- MOE measures the ratio between an attacker’s effort and the operational outcome.
- Threat actors favor:
- Stolen session tokens over expensive zero-day exploits.
- Reputation-based infrastructure such as LotX over custom servers.
- AI-assisted automation over manually written tooling.
- The most dangerous actors are those able to combine intelligence and technology into continuous, high-speed operations.
## Eight trends shaping the 2026 threat landscape
- **AI-driven attacker operations**
- Generative AI supports real-time network mapping, exploit development, and deepfake creation.
- Lower-skilled attackers can now conduct more sophisticated, high-impact campaigns.
- **State-sponsored infrastructure pre-positioning**
- Groups such as Salt Typhoon and Linen Typhoon are targeting North American telecommunications, government, commercial, and IT services.
- Their goal is to maintain access that can provide long-term geopolitical leverage.
- **Over-privileged SaaS integrations**
- Third-party APIs can expand a single compromise across hundreds of organizations.
- The GRUB1 breach of Salesloft demonstrates the risks created by excessive integration privileges.
- **Weaponized trusted cloud tools**
- Attackers use services such as Google Calendar, Dropbox, GitHub, Google Drive, Microsoft Teams, and Amazon S3 to conceal malicious activity.
- Legitimate enterprise traffic makes command-and-control communications harder to distinguish from normal use.
- **Deepfake-based insider placement**
- North Korean operators are using fraudulent identities and deepfakes to place remote IT workers inside Western companies.
- These operatives support espionage and illicit revenue generation.
- **Session-token theft**
- Infostealers such as LummaC2 harvest active authentication tokens.
- Attackers can then bypass multi-factor authentication and begin post-authentication activity.
- **Internal brand spoofing**
- Phishing-as-a-service tools exploit mail-relay blind spots where sender identity is not re-verified.
- This enables convincing impersonation messages to arrive directly in trusted user inboxes.
- **Hyper-volumetric DDoS attacks**
- Botnets such as Aisuru are generating increasingly large distributed denial-of-service attacks.
- The speed and scale of these attacks can overwhelm infrastructure before human responders can react.
## Living off legitimate cloud infrastructure
- Attackers increasingly avoid known malicious servers and instead use legitimate SaaS, IaaS, and PaaS platforms.
- Cloud services can be used to host payloads, redirect victims, deliver malware, or scale campaigns.
- Amazon SES and SendGrid, for example, can be abused for phishing and malware distribution.
- This “living off the land” approach—or “living off anything-as-a-service”—allows attackers to hide behind the reputation and normal traffic patterns of trusted providers.
- Cloud-resource abuse is evolving from opportunistic infrastructure misuse into a deliberate nation-state strategy.
Defenders should treat identity tokens, SaaS permissions, cloud activity, and trusted integrations as critical security boundaries. Organizations need least-privilege access, stronger token protection, continuous monitoring, automated DDoS mitigation, and detection that evaluates behavior—not just whether a service is legitimate.
Cloudflare’s Threat Intelligence Platform (TIP) is designed to turn massive volumes of security telemetry into actionable intelligence without relying on traditional ETL pipelines. Its sharded, SQLite-backed architecture uses Durable Objects and edge-based GraphQL to provide near-real-time analysis across millions of events. By combining automated telemetry with analyst investigations, the platform aims to help security teams understand threats and block them proactively.
## Motivation for Building the Platform
- Cloudflare began developing the TIP after launching Cloudforce One in 2022 and discovering that existing tools could not adequately track adversary infrastructure.
- The platform models the full threat lifecycle, connecting:
- Threat actors to malware
- Cases to indicators
- Events to broader campaigns
- It is designed for:
- Multiple datasets and tenants
- Group-based and tenant-to-tenant sharing
- Extensibility and edge-scale performance
- Visual analysis and automated response
- Cloudflare Workers allow the platform to evolve with the runtime and support features such as Smart Placement, higher CPU limits, and Hyperdrive.
## Beyond the SIEM
- The TIP complements rather than replaces a SIEM:
- SIEMs focus on real-time log aggregation and alerting.
- The TIP provides long-term retention, specialized threat schemas, and historical context.
- Analysts can enrich alerts with:
- Indicator history
- Known threat-actor associations
- Campaign relationships
- Risk scores and intelligence context
- Findings from analysts feed new indicators of compromise back into the platform.
- This feedback loop keeps intelligence current and helps organizations move from reactive investigation to proactive defense.
## Sharded Storage Without ETL Bottlenecks
- Cloudflare distributes Threat Events across many logical shards instead of using one centralized database.
- Each shard is a Durable Object with a private SQLite database, providing transactional consistency and avoiding a single database bottleneck.
- Cloudflare Queues handle asynchronous ingestion, helping absorb high-volume attack spikes.
- R2 stores data for long-term retention, while SQLite maintains a hot index for fast access.
- Because data is available directly in the platform’s operational store, complex ETL pipelines and synchronization delays are avoided.
## Parallel Queries at the Edge
- GraphQL runs in the same Worker-based system that powers the Threat Events platform, keeping data live from ingestion through querying.
- Queries are fanned out to relevant Durable Objects in parallel rather than executed against one large table.
- The platform first verifies permissions and excludes shards that cannot contain matching events, such as shards outside the requested date range.
- Results from multiple shards are aggregated with `Promise.all`, enabling low-latency searches across global datasets.
- Smart Placement positions query Workers near the Durable Objects they access, reducing tail latency.
Cloudflare’s approach combines edge-native storage, parallel execution, and analyst-driven enrichment to make threat intelligence both scalable and actionable. The practical goal is a unified system that explains not only what is malicious, but also why it matters and how to automatically prevent it.
Stripe is expanding Shared Payment Tokens (SPTs) to support more payment methods for agentic commerce. SPTs now cover Mastercard Agent Pay, Visa Intelligent Commerce, and BNPL options from Affirm and Klarna, allowing AI agents to make authorized purchases without accessing customers’ underlying payment credentials. Stripe says this makes it the first provider to combine agentic network and BNPL tokens through one payment primitive.
## Expanded Support for Agentic Payments
- Sellers interact only with SPTs; Stripe provisions and manages the underlying payment tokens.
- Businesses already processing payments through Stripe automatically gain access to these methods in agentic transactions.
- The new capabilities are already being used to process payments across supported AI agents.
## Network-Led Payments from Mastercard and Visa
- Mastercard and Visa issue secure agentic network tokens that let authorized AI agents initiate payments on a customer’s behalf.
- Stripe provisions a token based on the customer’s purchase intent and shares it with the agent.
- Agents can reuse the token across participating sellers and locations where Mastercard or Visa are accepted.
- Payment networks translate the token to the latest underlying card number, verify and authorize transactions, and support fraud and dispute management.
- Additional authorization data helps issuers make better provisioning and transaction decisions.
## Affirm and Klarna for Agentic Commerce
- Stripe is adding SPT support for Affirm and Klarna, enabling agents to offer installment payment options.
- BNPL transactions now exceed $300 billion globally, and Stripe reports up to a 14% revenue increase in BNPL-eligible sessions.
- When a customer chooses BNPL, Stripe displays the provider’s confirmation flow in the agent interface and securely passes seller credentials to the provider.
- The customer experience remains familiar while Stripe handles the integration details.
Stripe plans to add more payment methods to SPTs, broadening the range of payment options available to customers and AI agents.
Cloudy is Cloudflare’s LLM-powered explanation layer for Cloudflare One, translating complex security detections into clear, actionable guidance. It helps security teams understand why emails or SaaS findings were flagged and helps end users make better decisions in real time. Its integration with Phishnet aims to reduce unnecessary SOC submissions while preserving strong protection against genuine threats.
## Turning Complex Detections into Human Guidance
- Email and CASB systems analyze numerous signals, including sender reputation, authentication, links, infrastructure, behavior, misconfigurations, and exposed data.
- Traditional detections may correctly identify risk without clearly explaining the reasoning.
- Cloudy converts machine-learning outputs into concise explanations for both administrators and nontechnical users.
- For Email Security, it explains why messages are classified as Malicious, Suspicious, Spam, Bulk, or Spoof.
- For CASB, it is intended to clarify the risk and remediation path for SaaS findings.
## The Challenge for Email Users and SOC Teams
- Users increasingly serve as an additional defense layer against social engineering and impersonation attacks.
- Periodic security training and phishing simulations do not provide enough context when users encounter real messages.
- This creates two problems:
- Some users report nearly every questionable email, overwhelming SOC queues.
- Others interact with risky messages because no clear warning appears at the moment of decision.
- Excessive reporting creates backlogs and slows investigations of genuinely dangerous emails.
## Cloudy in Phishnet
- Cloudy will be integrated into the Phishnet reporting workflow for Microsoft.
- When users report a message, they will receive a simplified, plain-language explanation of the relevant security signals.
- The goal is to help users decide whether a message is truly suspicious and reduce unnecessary escalations.
- This allows SOC teams to focus on messages requiring investigation while making users more effective participants in security operations.
## How the Explanation Pipeline Works
- A Phishnet report triggers a Cloudflare Workers-based workflow.
- The workflow aggregates outputs from multiple detection models, including:
- Sender reputation
- Domain and infrastructure characteristics
- SPF, DKIM, and DMARC authentication results
- Link and content analysis
- Behavioral indicators
- Workers AI processes these structured signals using purpose-built prompts.
- The prompts generate a natural-language explanation rather than changing the original message classification.
- The experience is optimized for end users, avoiding overly technical terms such as ASNs, IP reputation, and raw authentication failures.
## Translating Technical Signals
- An SPF failure becomes: “This email failed a sender verification check.”
- A DKIM failure is explained as a failed message-integrity check that may indicate tampering.
- A DMARC failure indicates that the sender’s domain could not confirm the email’s legitimacy.
- These translations preserve the meaning of the underlying detections while making them understandable to nontechnical recipients.
Cloudy’s practical value is its ability to connect sophisticated security analysis with immediate human decision-making. Embedding understandable explanations directly into Phishnet should improve user judgment, reduce SOC noise, and make complex detections more actionable without altering the underlying security verdict.
Cloudflare argues that email security must move beyond reacting to user-reported phishing misses. LLMs can analyze millions of emails, reveal emerging threat patterns that traditional systems overlook, and guide specialized detection models before attacks become widespread. Its Sales Outreach phishing program reportedly reduced average daily reported misses by 20.4% from Q3 to Q4 2025, with a further two-thirds decline in Q1 2026.
## The Blind Spot in Reactive Defense
- Traditional systems improve mainly after users report messages that were incorrectly classified as clean.
- This feedback is valuable but inherently delayed: it reveals attacks that already succeeded.
- The authors compare this problem to Abraham Wald’s World War II aircraft analysis:
- Engineers studied bullet holes on returning planes.
- Wald identified the missing data—the damage on planes that never returned.
- Email security faces the same challenge because undetected threats are largely invisible.
## Mapping Threats with LLMs
- LLMs can interpret context, intent, urgency, deception, and other nuanced characteristics in natural-language emails.
- Cloudflare processes millions of unwanted messages daily, making manual classification and detailed threat mapping impractical.
- LLM-generated categories expose emerging patterns and persistent trends, including:
- `PrizeNotification`
- `SalesOutreach`
- These tags give analysts near-real-time, high-fidelity signals and reduce the need for manual investigation.
- The resulting intelligence helps Cloudflare create or retrain targeted machine-learning models before threats become widely visible through customer reports.
## Detecting Sales Outreach Phishing
- Sales Outreach phishing imitates legitimate B2B communication, using offers, special deals, or transactional requests to encourage malicious clicks or credential disclosure.
- After identifying it as a major threat category, Cloudflare used LLM tags to build a continuously growing corpus of relevant messages.
- Training data was grouped by linguistic and structural traits such as:
- Persuasive framing
- Manufactured urgency
- Transactional language
- Subtle social proof
- Feature extraction focused on sentiment and intent rather than static indicators.
- A specialized sentiment-analysis model was trained for Sales Outreach behavior instead of overloading a general phishing classifier.
## From Classification to Enforcement
- The specialized model produces a risk score based on how closely an email matches known Sales Outreach patterns.
- That score is combined with other signals, including:
- Sender reputation
- Link behavior
- Historical context
- Messages can then be allowed, quarantined, or blocked.
- LLMs serve as the discovery layer, identifying new language variants, while the specialized model provides fast, scalable enforcement.
- Newly detected examples continuously feed back into the pipeline as attackers change their tactics.
## Reported Results
- Cloudflare says the proactive approach reduced customer-reported Sales Outreach misses.
- Average daily submissions fell from 965 in Q3 2025 to 769 in Q4 2025.
- This represented a 20.4% quarterly reduction.
- The company reports that average daily submissions decreased by another two-thirds in Q1 2026.
- Fewer misses mean less analyst work, fewer interruptions for users, and fewer opportunities for phishing messages to reach inboxes.
Cloudflare’s approach recommends combining broad LLM-based threat discovery with narrowly focused detection models. This creates a proactive feedback loop that can identify and address emerging phishing techniques before relying on large volumes of user-reported failures.
Cloudflare CASB now lets customers remediate risky SaaS file-sharing directly from the Cloudflare One dashboard, rather than merely identifying problems. The initial release targets Microsoft 365 and Google Workspace, removing public, organization-wide, or external sharing without deleting files or changing ownership. Cloudflare concludes that durable, workflow-based execution makes remediation scalable, observable, and easier to operate.
## CASB as a Centralized SaaS Risk View
- CASB connects to services including Microsoft 365, Google Workspace, Slack, Salesforce, Box, GitHub, Jira, and Confluence through APIs.
- It provides:
- A consolidated view of misconfigurations, overshared files, and risky access.
- Continuous scanning as users collaborate and adopt new tools.
- Searchable and exportable findings for triage and reporting.
- Previously, fixing findings required using each application’s admin interface or submitting tickets to application owners.
## File-Sharing Remediation
- The new **Remove sharing** action can address:
- Public links that allow anyone to view or edit files.
- Company-wide sharing when only a few users need access.
- Sharing with external domains or personal accounts.
- Any of these risks involving files that match a DLP profile, such as customer records, credentials, or financial data.
- Remediation removes the risky sharing configuration only:
- Files are not deleted.
- Ownership is not changed.
- Progress and outcomes are tracked in CASB, while actions are recorded in Cloudflare One Admin logs and can be exported to a SIEM.
## Microsoft 365 and Google Workspace
- The initial integrations focus on business-critical documents stored in:
- OneDrive and SharePoint.
- Google Drive, including Docs, Sheets, and Slides.
- Common examples include temporary public editing links, company-wide documents forgotten after an event, and sensitive spreadsheets shared with contractors’ personal accounts.
- Teams can now resolve findings directly in CASB instead of exporting CSVs and relying on application owners to make changes.
## Durable Remediation Architecture
- Cloudflare designed the system for speed, resilience, and ease of use using:
- Workers
- Workflows
- Queues
- Workers KV
- Secrets Store
- Hyperdrive
- The process is:
- An API call sends a remediation job to a Worker.
- The Worker places it on a Queue.
- A second Worker starts a Workflow.
- Credentials are securely provided through Workers KV and Secrets Store.
- The Workflow gathers information and calls third-party APIs.
- Hyperdrive records the final result.
- Workflows’ native retries handle vendor API rate limits such as HTTP 429 responses, while built-in step logging shows retry activity.
- Load testing and early customer usage produced a median completion time of 48 seconds and a p90 of 72 seconds.
## Planned Expansion
- Cloudflare plans to add:
- Quarantine actions that move or isolate high-risk files.
- Custom Webhooks for ticketing, chat notifications, and external automation.
- Carefully scoped autoremediation policies.
- Custom CASB findings based on organization-specific patterns, data types, or access conditions.
Organizations using Microsoft 365 or Google Workspace can use CASB Remediation to turn detected sharing risks into tracked, auditable fixes. The planned quarantine, webhook, and automated-policy features could further position CASB as an active security control plane rather than a passive reporting tool.
FFmpeg is central to Meta’s media infrastructure, running tens of billions of times daily. Meta’s heavily modified internal fork became difficult to maintain as upstream FFmpeg evolved, so the company collaborated with the FFmpeg community to upstream key capabilities. Threaded multi-lane transcoding and real-time quality metrics now allow Meta to rely entirely on upstream FFmpeg for VOD and livestreaming.
## Moving Away from an Internal FFmpeg Fork
- Meta’s fork had diverged substantially from upstream while supporting specialized requirements.
- Maintaining both the fork and newer open-source FFmpeg versions created:
- Divergent feature sets
- Difficult rebases
- Increased regression risk
- Collaboration with FFmpeg developers, FFlabs, and VideoLAN enabled the needed functionality to be integrated upstream.
## More Efficient Multi-Lane Transcoding
- Meta creates multiple DASH encodings for each uploaded video, varying resolution, codec, framerate, and quality.
- Running separate FFmpeg processes wastes resources by repeatedly decoding the same source and starting multiple processes.
- A single FFmpeg command can decode once and send frames to multiple encoder instances.
- Earlier FFmpeg versions still processed those encoders serially for each frame.
- Improved parallel encoder threading, introduced from FFmpeg 6.0 and completed in FFmpeg 8.0, allows encoder instances to run concurrently.
- The change reduces compute overhead across Meta’s more than one billion daily video uploads.
## Real-Time Quality Metrics for Livestreaming
- Metrics such as PSNR, SSIM, and VMAF measure compression-related visual quality loss.
- Traditional FFmpeg workflows calculate these metrics after encoding, which is unsuitable for live video.
- Meta needed a decoder after each encoder to reconstruct compressed frames and compare them with the original frames during processing.
- FFmpeg’s “in-loop” decoding, available beginning in FFmpeg 7.0, enables real-time per-lane quality measurement within one command.
## Deciding What to Upstream
- Meta aims to upstream changes that provide broad value to FFmpeg users.
- Infrastructure-specific patches are kept internal when they cannot be reasonably tested or used by the wider community.
- Meta’s custom MSVP transcoding ASIC is integrated through FFmpeg’s standard hardware APIs, alongside NVIDIA, AMD, and Intel technologies.
- Because external developers cannot access MSVP hardware, Meta maintains and validates those internal patches itself.
## Continued Investment in FFmpeg
- Upstream improvements allowed Meta to retire its internal fork for all VOD and livestreaming pipelines.
- Standardized hardware interfaces make it easier to combine specialized ASICs with software-based encoding and decoding.
- Meta plans to continue contributing to FFmpeg to improve efficiency, reliability, codec support, and media experiences across the industry.
Meta’s experience demonstrates that upstreaming broadly useful infrastructure improvements can reduce long-term maintenance costs while strengthening the entire FFmpeg ecosystem.
The March 2, 2026 AWS Weekly Roundup focuses on AWS’s expanding AI ecosystem, including a major strategic partnership with OpenAI and new tools for production AI development. It also highlights services for video transformation, enterprise security, application isolation, and agentic workloads. The broader message is that AWS is moving AI from experimentation toward scalable, enterprise-ready operations.
## OpenAI and AWS Strategic Partnership
- Amazon will invest $50 billion in OpenAI:
- $15 billion initially.
- A further $35 billion subject to conditions.
- AWS and OpenAI are developing a Stateful Runtime Environment for OpenAI models through Amazon Bedrock.
- The environment allows applications to:
- Preserve context and prior work.
- Operate across tools and data sources.
- Access compute resources.
- AWS becomes OpenAI Frontier’s exclusive third-party cloud distribution provider for building and managing AI-agent teams.
- The companies are expanding their existing $38 billion agreement by another $100 billion over eight years.
- OpenAI plans to consume approximately 2 gigawatts of AWS Trainium capacity, including Trainium3 and Trainium4.
## Major AWS Product Launches
- **AWS Security Hub Extended**
- Provides integrated procurement and management for partner security products.
- Includes vendors such as CrowdStrike, Okta, Splunk, Zscaler, and others.
- Offers one AWS bill, pay-as-you-go pricing, unified Security Hub operations, and Level 1 support for Enterprise Support customers.
- **AWS Elemental Inference**
- Uses AI to transform live and on-demand video for mobile and social platforms.
- Automatically creates vertical video for TikTok, Instagram Reels, and YouTube Shorts.
- Extracts highlight clips with 6–10 seconds of latency.
- Early media customers reported at least 34% savings on AI-powered live video workflows.
- **MediaConvert Probe API**
- Provides free, rapid media metadata analysis without processing the video.
- Returns information such as codecs, pixel formats, and color spaces.
- **OpenAI-Compatible Projects API for Amazon Bedrock**
- Adds application-level isolation for generative AI workloads.
- Improves access control, cost tracking, and organizational observability through OpenAI-compatible APIs.
- **Amazon Location Service LLM Context**
- Provides curated context for AI agents through Kiro, Claude Code, and the open Agent Skills format.
- Helps developers implement location-aware features more accurately.
- **Open-Source EKS Node Monitoring Agent**
- Makes the agent’s implementation available for inspection, customization, and community contributions.
- **AWS AppConfig and New Relic Integration**
- Supports automated rollback through New Relic Workflow Automation.
- Aims to reduce deployment issue detection and remediation from minutes to seconds.
## Strands Labs and Additional AWS Resources
- AWS introduced **Strands Labs**, a separate organization for experimental agentic AI projects.
- Its initial projects are:
- Robots.
- Robots Sim.
- AI Functions.
- Other highlighted resources cover:
- Managing 6,000 AWS accounts with a three-person platform team.
- Building event-driven agents with Bedrock AgentCore and Knowledge Bases.
- Shifting complexity from application code into platform operations through account-per-tenant architectures.
## AWS Community Highlights
- A practical guide for running effective Kiro AI coding workshops.
- A comparison of traditional RAG using FAISS with GraphRAG using Neo4j to evaluate hallucination reduction in travel agents.
- New AWS CLI v2 output options, including structured error output and the `off` format.
## Upcoming Events
- **NVIDIA GTC 2026:** March 16–19 in San Jose, with AWS sessions, demos, and booths.
- **AWS Summits:** Paris on April 1, London on April 22, and Bengaluru on April 23–24.
- **AWS Community Days:** Events in Tokyo, Chennai, Slovakia, and Pune during March.
AWS’s latest announcements point toward a tightly integrated AI platform combining specialized hardware, managed agent infrastructure, enterprise security, and production-focused developer tools. Organizations evaluating AI adoption should watch these services closely, particularly Bedrock’s new stateful and application-isolation capabilities and Elemental Inference’s automated media workflows.
Meta is renewing its commitment to jemalloc, recognizing its long-term role in delivering reliable and efficient infrastructure alongside the Linux kernel and compilers. After acknowledging that short-term decisions created technical debt and slowed development, Meta has unarchived the original repository and begun rebuilding a long-term roadmap. The effort will focus on modernization, reduced maintenance, hardware adaptation, and closer collaboration with the open-source community.
## Why jemalloc Matters
- jemalloc is a high-performance memory allocator used as a foundational component of Meta’s software stack.
- It has adapted to changing hardware and workloads over time.
- Its impact is comparable to other core infrastructure components such as the Linux kernel and compilers.
## Reflecting on Technical Debt
- Meta says recent development gradually moved away from the rigorous engineering principles needed for foundational software.
- Some changes provided short-term benefits but introduced technical debt.
- That debt increased maintenance burdens and slowed future progress.
- Community feedback, including discussions with jemalloc founder Jason Evans, prompted Meta to reassess its stewardship.
## Renewed Development Priorities
- **Technical debt reduction:** Clean up, refactor, and improve the codebase to make jemalloc more efficient, reliable, and maintainable.
- **Huge-page allocation:** Continue improving the hugepage allocator (HPA) and its use of transparent hugepages (THP) to improve CPU efficiency.
- **Memory efficiency:** Optimize memory packing, caching, and purging mechanisms.
- **AArch64 support:** Improve out-of-the-box performance on ARM64 systems.
- **Hardware and workload adaptation:** Continue evolving jemalloc for current and emerging platforms.
## Open-Source Collaboration
- The original jemalloc repository has been unarchived.
- Meta intends to work with the open-source community on the project’s future.
- The company acknowledges that renewed trust must come through measurable improvements and sustained development.
- Community members are invited to provide feedback, contributions, and collaboration.
Meta’s practical next step is to demonstrate its renewed commitment through code cleanup, performance improvements, and transparent collaboration. The project’s long-term health will depend on consistent execution rather than statements alone.
GitHub Issues and Projects work together to organize tasks, bugs, ideas, and broader project goals. Issues capture individual pieces of work, while Projects provide visual planning and tracking through boards, views, workflows, and charts. The post introduces beginners to creating an issue, building a Kanban project, and managing progress collaboratively.
## Why Issues and Projects Matter
- Issues provide a shared space for tracking bugs, tasks, and ideas.
- Projects organize issues into a larger workflow for planning and prioritization.
- Using both tools helps teams coordinate work, communicate progress, and avoid missed tasks.
## Creating a GitHub Issue
- Open a repository and select the **Issues** tab, then click **New issue**.
- Add:
- A clear title.
- A detailed description explaining the expected behavior or required change.
- An assignee.
- Labels for classification.
- An issue type, such as a bug or task.
- A related project or milestone.
- After creation, team members can comment and collaborate.
- Typing `#` followed by an issue number creates a clickable link to another issue.
- Completed work can be marked by closing the issue.
## Creating a GitHub Project
- Open the repository’s **Projects** tab and click **New project**.
- Choose the **Kanban** template, name the project, disable bulk import, and create it.
- GitHub automatically provides columns, which can be customized.
- Multiple project tabs offer different ways to view and manage the same work.
## Managing and Customizing Projects
Project settings allow users to:
- Control access permissions.
- Create or modify custom fields.
- Rename the project and edit its description.
- Add a README.
- Copy the project board.
- Change project visibility.
### Insights and Charts
- The **Insights** section provides charts for analyzing project data.
- Charts can be customized through the **Configure** menu, including their layout and displayed information.
### Automated Workflows
- Built-in workflows can update item statuses automatically.
- Examples include:
- Setting new items to `todo`.
- Closing issues when their project status changes.
- Marking items as `Done` when an issue is closed.
### Project Status Updates
- The **Add status update** feature lets teams report project health and progress directly from the project view.
GitHub beginners can start with well-written issues and then connect them to a Kanban Project board. Custom fields, automated workflows, charts, and status updates make it easier to turn individual tasks into a transparent, trackable team workflow.
Figma’s Config 2026 speakers see AI as more than a productivity tool: it is expanding the scope of creative work, from software and music to fashion and manufacturing. Their perspectives emphasize human direction, participation, taste, and intention as AI accelerates experimentation. The central opportunity is to use AI to extend creative capacity without losing the distinctly human role of shaping meaning and purpose.
## AI as a New Creative Medium
- Holly Herndon describes software as one of the defining artistic mediums of the current era.
- AI enables studios to take on more complex projects, shifting creative roles toward orchestration.
- Herndon and Mat Dryhurst’s *Starmirror* treats AI models as collective, public endeavors:
- Visitors and local choirs contribute vocal data.
- The data will train a new AI choir.
- Participants engage with both the model’s inputs and outputs.
- The project demonstrates how creative work can keep humans actively involved rather than treating AI as an isolated generator.
## Connecting Digital Creativity to the Physical World
- Danit Peleg argues that AI will increasingly create tangible objects, not just digital designs.
- AI is likely to influence:
- Manufacturing
- Architecture
- Fashion
- Wearable textiles
- Peleg uses AI agents throughout her production pipeline, from initial concepts through fabrication.
- Figma Weave, created after Figma’s acquisition of Weavy, is intended to expand AI-native capabilities for:
- Image and video generation
- Animation and motion design
- VFX creation and editing
- These tools point toward workflows where digital concepts can move more directly into physical production.
## Creativity as Attention and Care
- Vicki Tan connects creativity with decision-making: both involve following questions and intuition despite uncertainty.
- She argues that creativity is not primarily originality or talent, but care, attention, and sustained engagement with an idea.
- Her interpretation of the French word *attendre*—to wait for or tend to—frames creativity as allowing meaning to emerge over time.
- Rather than constantly seeking something completely new, creators can begin by noticing what already feels personal, meaningful, or instinctively theirs.
## Rethinking Creative Work in 2026
- The featured speakers come from varied fields, including art, fashion, behavioral design, software strategy, and emerging technology.
- Their work challenges older assumptions about creativity and encourages experimentation with new processes.
- AI’s greatest value may lie in amplifying human judgment, participation, and creative intent rather than replacing them.
Creators should treat AI as an expandable medium and collaborator while preserving the human practices—attention, taste, participation, and purpose—that give creative work meaning.
State-of-the-art LLM agents can complete many scoped coding tasks, but fully autonomous software engineering remains difficult because real projects require long-term planning, persistent state, debugging, and end-to-end validation. Stripe evaluated this gap through a benchmark of realistic backend, frontend, database, and browser-based integration tasks. The results were stronger than expected: agents demonstrated substantial full-stack capability, but still struggled with ambiguity and the judgment required to distinguish genuine failures from bad test inputs.
## Building the Stripe Integration Benchmark
- Stripe created 11 environments based on real integration challenges, including Checkout migrations and Billing API modeling.
- Each environment included:
- A complete codebase, database, scripts, and test Stripe credentials.
- Deterministic graders using API calls, automated browser tests, or inspection of Stripe objects.
- A consistent agent harness with terminal, browser, and Stripe-specific search tools through MCP.
- Challenges were divided into:
- **Backend-only tasks:** SDK upgrades, API changes, and database migrations.
- **Full-stack tasks:** Coordinated server and client changes requiring browser verification.
- **Gym problem sets:** Focused exercises testing deep knowledge of features such as Checkout and subscriptions.
## Stronger-than-Expected Agent Performance
- The benchmark intentionally used fewer, harder tasks designed to expose weaknesses.
- Agents successfully:
- Navigated browser interfaces.
- Debugged live issues.
- Worked with underdocumented API behavior.
- Continued productively across long interactions, with top runs averaging 63 turns.
- Claude Opus 4.5 achieved a 92% average score across four full-stack tasks.
- GPT-5.2 achieved a 73% average score across two gym problem sets.
- In a migration from Card Element to Checkout, an agent completed and verified a test purchase using Link, despite no payment method being specified.
## Reverse-Engineering Checkout Configurations
- A Checkout gym task required agents to infer API parameters from 20 prebuilt Checkout UIs.
- Agents had to:
- Inspect products and quantities shown in each session.
- Locate matching product IDs through the Products API.
- Identify shipping costs, custom fields, tax settings, and other customizations.
- Translate those details into valid Checkout Session parameters.
- Agents provided more than 80% of the correct parameters.
- The best-performing agent recognized that one UI’s color options were hidden behind an interactive dropdown, explored the control, and included the missing values.
## Remaining Challenges with Ambiguity
- Agents struggled when evaluation situations required judgment rather than straightforward implementation.
- In SDK upgrade tasks, some agents supplied nonexistent Stripe data, received expected 400 errors, and treated those responses as evidence that their implementation was broken.
- This illustrates a broader limitation: successful autonomous engineering requires not only writing code, but also designing meaningful tests, interpreting failures correctly, and validating behavior against realistic system state.
The benchmark suggests that agents are increasingly capable of substantial Stripe integration work, including full-stack implementation and browser-based verification. However, reliable autonomy will require better handling of ambiguity, realistic test data, persistent project state, and rigorous end-to-end validation.
Cloudflare argues that a Zero Trust platform’s blank-slate flexibility can become an adoption barrier when customers must configure countless policies and security controls themselves. Project Helix addresses this by codifying Cloudflare experts’ best practices into automated Terraform templates, delivered through a simple web interface. The result is a faster, more consistent way to deploy a secure Cloudflare One baseline within minutes rather than hours.
## The complexity barrier of a blank slate
- Cloudflare One offers extensive capabilities across DNS protection, network security, Secure Web Gateway, TLS inspection, DLP, antivirus scanning, and Zero Trust Access.
- Tenants are generally provisioned with minimal defaults because enabling advanced protections immediately could disrupt existing traffic and applications.
- Customers must therefore manually activate numerous settings, policies, and routing changes.
- Some features require coordinated configuration:
- Enabling private application access by hostname requires both a platform setting and a specific CGNAT range in the client’s split-tunnel configuration.
- Traffic from applications such as Zoom may need to bypass Cloudflare and go directly to the Internet.
- Captive portal exceptions can be important for users connecting from hotels, airlines, and other public networks.
- Initial setup guides and scenario-based wizards helped, but customers using multiple scenarios still had to complete each workflow separately.
## Project Helix: Turning expertise into automation
- Cloudflare gathered deployment knowledge from Solutions Engineers, Professional Services Engineers, and partners.
- The team documented desired proof-of-concept and production outcomes, including:
- Baseline DNS, network, and HTTP security protections
- TLS inspection
- QUIC and HTTP/3 security
- Remote Browser Isolation for risky categories such as newly registered domains
- Visibility and controls for AI applications
- Tenant Control policies restricting users to approved SaaS instances
- Helix packages these recommendations in a repeatable, codified format that can be applied with a button click.
- This avoids relying on individually maintained documentation or the memory of experienced administrators.
## Problems with manual deployment
- Configuring the complete baseline on a new tenant can take several hours.
- Documentation must be continually updated as Cloudflare features and best practices change.
- Repetitive manual steps increase the risk of configuration errors and inconsistent deployments.
- Manual work also makes it harder for less experienced users to benefit from Cloudflare One’s full capabilities.
## Terraform, Workers, and ephemeral provisioning
- Helix uses scalable Terraform templates to define Cloudflare One settings, configuration snippets, and security policies.
- A web interface hosted on Cloudflare Workers accepts basic customer inputs and executes the Terraform configuration.
- Cloudflare Containers support the provisioning workflow.
- The process uses no persistent storage, reducing risks associated with retaining Terraform logs or authentication tokens.
- Within minutes, users can deploy an advanced baseline configuration and review additional recommended policies to enable.
## Layered security configuration
- Helix begins with DNS security policies that:
- Support corporate DNS for Zero Trust
- Block malicious or questionable categories before they resolve
- It then applies network policies to protect users across ports and protocols.
- The broader configuration also incorporates traffic-routing exceptions, application controls, and user-experience improvements such as captive portal handling.
Project Helix’s practical recommendation is to replace manual, blank-slate configuration with expert-designed, automated baselines. This lets customers adopt Cloudflare One’s advanced protections quickly while preserving the flexibility to customize policies for their own environments.
