cloudflare·Mar 11, 2026·3 min readCurated summary

AI Security for Apps is now generally available

Cloudflare’s AI Security for Apps is now generally available to help organizations discover, detect, and mitigate threats targeting AI-powered applications. The service protects AI endpoints through Cloudflare’s reverse proxy and integrates AI-specific signals with existing WAF controls. New GA features include free endpoint discovery for all customers, custom topic detection, and custom prompt extraction capabilities. ## Why AI Applications Create a New Attack Surface - Traditional applications follow predictable workflows, while AI applications accept natural-language input and produce probabilistic outputs. - Attackers can exploit models through: - Prompt injection - Sensitive information disclosure - PII exposure - Toxic or off-policy content - Unbounded resource consumption - Risks become more serious when AI agents can call tools to issue refunds, change accounts, apply discounts, or access customer data. - Organizations may struggle to maintain consistent safeguards as teams rapidly adopt new models and providers. ## AI Endpoint Discovery - AI Security for Apps automatically identifies LLM-powered endpoints across web properties, regardless of hosting location or model provider. - Discovery analyzes endpoint behavior rather than relying only on paths such as `/chat/completions`, since AI may also power search, valuation, and recommendation features. - Discovered endpoints appear under **Security → Web Assets** with the `cf-llm` label. - Discovery is now free for Cloudflare Free, Pro, and Business customers: - Free-plan discovery begins when users open the Discovery page. - Paid plans receive recurring background discovery. - Sufficient valid traffic is required to confidently identify AI-powered endpoints. ## Always-On AI Threat Detection - Prompts sent to discovered AI endpoints are evaluated by multiple detection modules. - Built-in protections cover: - Prompt injection - PII exposure and extraction - Sensitive or toxic topics - Detection results are attached as metadata and can be used in custom WAF rules. - Cloudflare intends to use its global network data to identify emerging attack patterns across millions of sites. ## Custom Topics and Prompt Extraction - Custom topics allow organizations to define their own sensitive categories, such as securities, patient data, or competitor products. - Each prompt and response receives a relevance score that can be logged, blocked, or handled through custom policies. - Custom prompt extraction identifies where prompts are located in request bodies, supporting formats such as: - `$.messages[*].content` - `$.requests[*].params.messages[*].content` - `$.property_description` - Standard formats from providers including OpenAI, Anthropic, Google Gemini, Mistral, Cohere, xAI, and DeepSeek are supported. - Unknown payload formats use a default-secure approach that scans the full request body, which may create false positives. - Cloudflare plans to support user-defined JSONPath expressions and automated prompt learning to improve accuracy. ## WAF-Based Mitigation - Organizations can block, log, or customize responses to detected threats using the existing Cloudflare WAF rule builder. - AI-specific signals can be combined with broader request data, including IP reputation, browser fingerprints, bot activity, and attack history. - This lets security teams distinguish isolated suspicious prompts from attacks associated with broader malicious behavior. ## Expanding Partnerships - IBM has selected Cloudflare to provide AI security for its cloud customers. - Cloudflare and Wiz are partnering to provide mutual customers with a unified view of AI security posture. - The service is being extended through Cloudflare’s broader security ecosystem. Organizations adopting AI agents should first inventory their AI endpoints, then apply detection and WAF policies tailored to their data, users, and business risks. Cloudflare’s unified approach is designed to provide a practical fail-safe as AI deployments expand.

Read original(opens in new tab)

Database DesignLarge Language ModelsCloudflareAi Security+4

cloudflare·Mar 10, 2026·3 min readCurated summary

Building a security overview dashboard for actionable insights

Cloudflare’s revamped Security Overview dashboard is designed to turn overwhelming security data into prioritized, actionable work. It combines ranked Security Action Items, security-tool status, and deep links into Security Analytics so teams can identify and investigate risks without switching between tools. Behind it is a checker-based system that processes more than 10 million insights daily through scheduled scans and real-time event handlers. ## From Visibility to Action - Security Action Items focus analysts on what needs to be fixed now rather than displaying every available event. - Issues are ranked by severity: - **Critical:** Immediate risks that could be exploited. - **Moderate:** Issues requiring attention to maintain security posture. - **Low:** Hardening recommendations and best-practice improvements. - Analysts can filter items by insight type, including suspicious activity and insecure configuration. ## Closing Configuration Gaps - The Detection Tools module shows whether Cloudflare protections are actively operating. - It highlights issues such as: - Security tools running in “Log Only” mode instead of blocking threats. - Shadow API discovery being disabled or unavailable. - This shifts the focus from whether a security feature exists to whether it is correctly configured and protecting traffic. ## Connected Investigation Workflows - Suspicious Activity cards appear both on the Security Overview and Security Analytics pages. - Selecting a card deep-links into Analytics with relevant filters already applied. - This removes repetitive navigation and filter recreation, helping teams investigate incidents faster. ## Checker-Based Insight Generation - Cloudflare generates and refreshes more than 10 million actionable insights each day. - Specialized microservices called **checkers** handle different areas, such as DNS, SSL certificates, and AI bot configurations. - Checkers can scale independently and operate through: - **Scheduled checks** for comprehensive configuration inspections. - **Real-time listeners** that respond immediately to control-plane events. ## Scheduled Checks and Insight Lifecycles - A scheduler distributes inspection tasks across checkers, such as scanning all DNS records for a zone. - A checker: - Receives a task. - Collects relevant assets and configurations. - Applies specialized validation rules. - Creates an insight when a configuration fails its required threshold. - Updates the insight timestamp if the issue persists. - Removes the insight once the issue is fixed. ## Real-Time Ruleset Handlers - Event handlers listen continuously for configuration changes. - For example, when a WAF ruleset is changed, a handler can immediately detect that it is enabled only in “Log Only” mode. - The handler determines that attacks are being recorded but not blocked, registers an insight, and displays it on the dashboard. - Once the configuration is secured, the insight is cleared automatically. The dashboard’s main benefit is its combination of prioritization, configuration awareness, and immediate investigation paths. By pairing scheduled validation with real-time detection, it helps security teams move from passive monitoring to faster, more proactive remediation.

Read original(opens in new tab)

Database DesignCloudflareMicroservicesSecurity Dashboard+3

grammarly·Mar 10, 2026·2 min readCurated summary

Superhuman Launches First-of-Its-Kind Agent-Specific Attribution With Grammarly Authorship Update

Superhuman is expanding Grammarly Authorship into its AI-native Docs workspace with agent-specific attribution and default-on tracking. The update records whether AI contributed to research, generation, or revision, while students retain control over whether reports are shared. The company argues that transparent authorship can help schools replace blanket AI bans and detection-based enforcement with more informed, responsible AI education. ## Agent-Specific Attribution - Authorship can now identify which Superhuman AI agents contributed to a document and how they were used. - It distinguishes among: - Research support - Content generation - Revision and feedback - This gives educators more context for evaluating the writing process rather than only the final submission. - Featured agents include: - **Reader Reactions:** Predicts audience responses and suggests improvements. - **Citation Finder:** Locates supporting or challenging sources and formats citations. - **Proofreader:** Improves clarity, flow, correctness, and stylistic consistency. - **Fact Checker:** Finds evidence that supports or disputes claims. ## Default-On Authorship in Docs - Authorship is now available by default in Superhuman Docs. - Students no longer need to manually activate tracking. - The system records human writing, AI-generated content, and AI-edited text as work progresses. - Students still control access: instructors cannot see a report unless the student chooses to share it. ## Supporting Academic Integrity - Authorship is intended to reduce reliance on potentially inaccurate AI-detection tools and false positives. - More than 5 million Authorship reports have been generated since its beta launch in October 2024. - Rowan-Cabarrus Community College reported a 96% reduction in academic integrity violations in one semester after adopting the tool. - The company says process visibility can help educators teach responsible AI use instead of focusing primarily on punishment or prohibition. ## Institutional Controls and Availability - Educational administrators can configure which AI agents are available to students and faculty. - Authorship is available in Docs at no additional cost and is also supported in: - Google Docs - Microsoft Word - Canvas - The feature is part of Superhuman’s broader effort to provide AI transparency wherever students write. Superhuman recommends using Authorship as a foundation for nuanced AI policies and process-based assessment. By showing how AI was used while preserving student choice over sharing, the tool aims to support both academic integrity and practical AI literacy.

Read original(opens in new tab)

Database DesignAIEducational TechnologyProductivity Tools+4

line·Mar 10, 2026·4 min readCurated summary

Journey Toward Perfect AI Guardrails

NeurIPS 2025 research shows that AI safety is moving beyond simple post-training alignment and output filtering toward system-level, modular defenses. New approaches intervene in reasoning, multimodal interpretation, policy enforcement, and continuous evaluation to balance safety with latency and usefulness. The central conclusion is that deployable AI requires adaptable guardrails designed for real-world systems, not isolated attack benchmarks. ## The Shift Toward Practical AI Safety - Guardrails protect AI services from harmful instructions, privacy leaks, confidential-data exposure, bias, prompt injection, and other failures. - NeurIPS 2025 reflects a broader shift: - From post-training safety tuning to intervention in reasoning mechanisms. - From text-only LLMs to VLMs, RAG systems, and reasoning models. - From laboratory attack scenarios to the practical balance between utility and safety. - The article focuses on guardrail frameworks, multimodal moderation, prompt injection and jailbreaks, hallucinations, and over-refusal. ## Modular Guardrail Frameworks **PRIME Guardrails: A General, Low-Latency Safety Framework for Generative AI** addresses the trade-off between rigorous safety checks and response latency through a modular architecture: - **Policy specification:** Declarative, human-readable rules separate policies from model parameters, allowing legal or policy teams to control behavior. - **Risk sensing and scoring:** Asynchronous detectors combine lexical rules, semantic similarity, and lightweight classifiers. Early exit blocks obvious attacks quickly while allowing domain-specific calibration. - **Intervention router:** A deterministic controller chooses whether to allow, rewrite, or reject an interaction based on policies and risk scores. - **Monitoring and memory:** Lightweight records preserve decisions and rejection reasons for predictability and auditing. - **Evaluation and evolution:** Red-team recipes and automated vulnerability testing help the system adapt to new attack methods. The framework supports defense in depth without running every expensive safety mechanism sequentially. Its modularity, auditing capabilities, and continuous-evaluation loop make it suitable for production environments. ## Turning Governance Policies into Code **Policy-as-Prompt: Turning AI Governance Rules into Guardrails for AI Agents** converts informal organizational materials into runtime-enforceable controls. - The framework analyzes sources such as PRDs, technical design documents, regulations, and source code. - It builds a **source-linked policy tree** connecting individual rules to their original documents. - The policies are compiled into lightweight prompt-based classifiers. - When an agent rejects a request, the system can trace the decision back to its legal or organizational basis. - The approach helps enforce: - Least-privilege access. - Data minimization. - Restrictions on out-of-scope tasks. - Protection against prompt injection. - It may be especially valuable in regulated industries such as finance and healthcare, where frequently changing policies create substantial technical debt. ## Multimodal Safety and VLM Reasoning Vision-language models create new safety challenges because harmful meaning can emerge from interactions between images and text. **GuardReasoner-VL: Safeguarding VLMs via Reinforced Reasoning** trains models to reason about combined modalities rather than classifying each input independently. - It addresses cases where harmless text obscures harmful visual content, such as an image of a bloodied knife paired with “cooking.” - Its GRPO-based training process includes: - **Safety-aware data concatenation** to create difficult examples containing hidden or mixed harmful content. - **Dynamic clipping** that encourages exploration early in training and tighter refinement later. - **Length-aware safety rewards** that reward concise conclusions supported by reasoning. - The method aims to detect subtle harms such as hate speech hidden in memes and visual metaphors. ## Hidden Vulnerabilities in Multimodal Training Data **VLMs can Aggregate Scattered Training Patches** demonstrates that filtering training images may not be sufficient. - A harmful image can be divided into individually innocuous patches and included in training. - A VLM may reconstruct the harmful concept by associating patches that share the same text label. - The paper calls this behavior **visual stitching**, related to cross-sample reasoning and inductive out-of-context reasoning. - Text labels such as “safe” or “unsafe” can help the model connect fragmented visual information and infer the original image-level meaning. - This suggests that safety evaluations must inspect not only final outputs but also: - Input-processing pipelines. - Cross-sample interactions. - Internal or latent representations. The available article ends while introducing research on distorted safety perception, so that section cannot be summarized further from the provided text. In practice, organizations should combine modular, low-latency enforcement with traceable policy management and multimodal evaluations that test hidden interactions—not just obvious harmful prompts or images.

Read original(opens in new tab)

Database DesignLarge Language ModelsMachine LearningGenerative AI+4

aws·Mar 9, 2026·3 min readCurated summary

AWS Weekly Roundup: Amazon Connect Health, Bedrock AgentCore Policy, GameDay Europe, and more (March 9, 2026) | Amazon Web Services

The March 9, 2026 AWS Weekly Roundup highlights AWS’s growing focus on agentic AI, healthcare automation, security, and developer productivity. Major updates include Amazon Connect Health, centralized policies for Bedrock agents, private AI assistants on Lightsail, and new tools for troubleshooting and durable Lambda workflows. The roundup also previews community events, including GameDay Europe, NVIDIA GTC, AWS Summits, and regional Community Days. ## Major AWS Product Launches - **Amazon Connect Health** is generally available with five healthcare-focused AI agents: - Patient verification - Appointment management - Patient insights - Ambient documentation - Medical coding - These capabilities are HIPAA-eligible and designed to integrate with existing clinical workflows within days. - **Bedrock AgentCore Policy** provides centralized, fine-grained controls for agent-to-tool interactions. - Policies can be written in natural language. - AWS converts them into Cedar, its open-source policy language. - Controls operate outside application code, supporting security and compliance teams. - **OpenClaw on Amazon Lightsail** enables deployment of private autonomous AI assistants. - Includes sandboxed sessions, security controls, HTTPS, and device-pairing authentication. - Uses Amazon Bedrock by default and supports Slack, Telegram, WhatsApp, and Discord integrations. ## Pricing, Cost Management, and Security - **VPC Encryption Controls** became a paid feature on March 1, 2026. - Monitor mode detects unencrypted traffic. - Enforce mode blocks traffic that does not meet encryption requirements. - Controls apply to traffic within and across VPCs in a region. - **Database Savings Plans** now cover Amazon OpenSearch Service and Amazon Neptune Analytics. - Customers can save up to 35% with a one-year commitment. - Savings apply across engine, instance family, size, and AWS Region. - **Amazon GameLift Servers DDoS Protection** adds a co-located relay network. - Client traffic is authenticated with access tokens. - Per-player traffic limits help mitigate attacks. - The feature adds no cost for GameLift Servers customers. ## Developer and Operations Improvements - **Elastic Beanstalk AI-powered environment analysis** sends events, health data, and logs to Amazon Bedrock when environments degrade. - It returns troubleshooting recommendations tailored to the affected environment. - AWS now allows **IAM roles to be created directly inside service workflows**, reducing the need to switch to the IAM console. Supported services include EC2, Lambda, EKS, ECS, Glue, and CloudFormation. - **Kiro’s new Lambda durable functions power** assists developers with long-running, multi-step applications and AI workflows. - It provides guidance on replay models, waits, concurrency, error handling, and deployment. ## AWS Community Projects - One community project demonstrates a persistent AI memory layer using **MCP, Amazon Bedrock, and a Chrome extension**, allowing agents to retain context across sessions and applications. - Another experimental application treats the AI model as the runtime, generating a complete interactive web application from a single prompt without a conventional codebase, framework, or persistent state. ## Community Events and AWS Activities - **AWS Community GameDay Europe** takes place March 17, offering team-based challenges using real AWS services. - AWS will participate in **NVIDIA GTC 2026** in San Jose from March 16–19, with sessions, demos, booths, and discounted passes. - Upcoming **AWS Summits** include Paris, London, and Bengaluru. - Upcoming **AWS Community Days** include events in Slovakia, Pune, and Mexico City. AWS’s latest announcements show a clear emphasis on practical AI agents, stronger governance, and automation across infrastructure and application development. Developers and cloud teams should review the new security and pricing changes while exploring the AI tools and upcoming hands-on community events.

Read original(opens in new tab)

Database DesignPostgreSQLAmazon BedrockAmazon Ec2+4

meta·Mar 9, 2026·3 min readCurated summary

How Advanced Browsing Protection Works in Messenger

Advanced Browsing Protection (ABP) extends Messenger’s Safe Browsing beyond on-device detection by checking links against a frequently updated database of millions of potentially malicious websites. Its central challenge is balancing effective URL matching with privacy: Messenger must identify unsafe links without revealing users’ exact queries or distributing the entire blocklist. ABP combines private information retrieval, cryptographic techniques, sharding, and client-side preprocessing to achieve this balance. ## Safe Browsing Within End-to-End Encryption - Messenger’s end-to-end encryption protects messages and calls, but it does not by itself protect users from malicious links. - Safe Browsing warns users when a link may lead to phishing, credential theft, or other harmful activity. - The standard feature uses on-device models. - Advanced Browsing Protection adds access to a continually updated watchlist containing millions of potentially malicious websites. ## Private Information Retrieval as the Foundation - Private information retrieval (PIR) allows a client to ask whether an item exists in a server-held database while revealing as little as possible about the query. - Sending the full database to each device is impractical because: - The database is large and frequently updated. - Exposing the complete list could help attackers evade detection. - Existing PIR approaches use oblivious pseudorandom functions (OPRFs) and divide the database into buckets or shards. - ABP had to address two limitations: - OPRFs are designed for exact matches, whereas URLs require prefix matching. - The client generally must identify which bucket to query, creating a privacy-versus-efficiency tradeoff. - More advanced lattice-based constructions may reduce the need for sharding, but they were not yet practical at ABP’s scale. ## Privacy-Preserving Prefix Matching for URLs - A database entry such as `example.com` should match a longer URL such as `example.com/a/b/index.html`. - Querying every prefix separately would work functionally: - `example.com` - `example.com/a` - `example.com/a/b` - `example.com/a/b/index.html` - However, each query can leak information about the original URL. If one query leaks `B` bits and there are `P` prefixes, the total leakage may reach `P × B` bits. - ABP instead groups URLs by domain so the client makes one bucket request and checks path prefixes within that bucket. - This reduces query leakage but creates uneven bucket sizes. - Domains such as link-shortening services may contain huge numbers of URLs, producing oversized buckets and potentially large padded responses. ## Preprocessing Rulesets to Balance Buckets - The server addresses bucket imbalance by generating a ruleset that tells clients how to process URLs before selecting a bucket. - Each rule maps an 8-byte hash prefix to a number of path segments that should be appended to the current URL before hashing again. - For example: - The client hashes `example.com`. - If the hash matches a ruleset entry, it appends specified path segments, such as `/a/b`. - It hashes the resulting URL again and repeats the process. - When no ruleset entry matches, the client uses the first two bytes of the final hash as the bucket identifier. - The server builds the ruleset iteratively: - It initially hashes URLs by domain. - It identifies the largest bucket. - It finds the most common domain in that bucket. - It adds rules that incorporate additional URL path segments to split the oversized bucket. - Clients receive the ruleset in advance and perform the same deterministic processing during lookups. ABP’s design demonstrates how privacy-preserving lookup can support real-world URL semantics without exposing users’ links. The combination of PIR, controlled sharding, prefix-aware processing, and adaptive rulesets allows Messenger to warn about malicious sites while limiting what the server learns about each user’s browsing query.

Read original(opens in new tab)

Database DesignEnd To End EncryptionPrivate Information RetrievalOblivious Pseudorandom Function+4

cloudflare·Mar 9, 2026·3 min readCurated summary

Fixing request smuggling vulnerabilities in Pingora OSS deployments

Pingora 0.8.0 fixes three HTTP/1.x request-smuggling vulnerabilities affecting standalone deployments used as Internet-facing ingress proxies. The flaws could let attackers bypass proxy security controls, desynchronize connections with backends, hijack other users’ sessions, or poison shared caches. Cloudflare’s own CDN was not affected, but Pingora users are urged to upgrade immediately. ## Scope and Impact - Vulnerabilities: - CVE-2026-2833 - CVE-2026-2835 - CVE-2026-2836 - Reported through Cloudflare’s bug bounty program in December 2025. - Affected deployments are standalone Pingora proxies exposed directly to the Internet. - Potential consequences included: - Bypassing ACL and WAF checks at the proxy layer. - Desynchronizing Pingora and backend HTTP connections. - Cross-user session or credential theft. - Cache poisoning when shared backends are used. - Cloudflare’s CDN was not vulnerable because Pingora is not used as its ingress proxy, and internal clients did not send pipelineable HTTP/1 requests to affected services. ## Premature Upgrade Without a `101` Response - Pingora treated a request containing an `Upgrade` header as an upgraded, pass-through connection immediately. - Under RFC 9110, the connection should switch protocols only after the backend returns `101 Switching Protocols`. - If the backend instead returned `200 OK`, Pingora could still forward subsequent bytes directly to the backend. - An attacker could pipeline a second, partial request—such as `/admin`—after the initial upgrade request. - This bypassed Pingora’s normal ACL or WAF processing and left Pingora and the backend disagreeing about request boundaries. - A later request from another user could complete the attacker’s partial request, causing the backend to return the attacker’s response to the wrong user. - Pingora 0.8.0 now enables pass-through mode only after receiving a valid `101` response. ## HTTP/1.0, Close-Delimited Bodies, and Transfer-Encoding - Another attack resembled a classic CL.TE desynchronization: - Pingora used `Content-Length` to determine the request body length. - The backend interpreted `Transfer-Encoding: chunked` and ended the body at the zero-length chunk. - The example combined: - HTTP/1.0 - `Connection: keep-alive` - Multiple transfer encodings - Both `Transfer-Encoding` and `Content-Length` - Pingora’s earlier transfer-encoding detection was too simplistic: - It only checked whether `Transfer-Encoding` contained “chunked.” - It assumed a single encoding or header. - HTTP specifications require the final transfer encoding to determine whether chunked framing applies, creating disagreement between Pingora and backend servers such as Node.js. - These differing interpretations of body boundaries enabled attackers to smuggle a second request through the proxy. ## Hardening and Recommendation Pingora 0.8.0 corrects the HTTP/1 framing and upgrade handling issues and adds defensive hardening. Operators running Pingora as an ingress proxy should upgrade as soon as possible and review whether their deployments expose HTTP/1 connections directly to untrusted clients.

Read original(opens in new tab)

Database DesignCloudflareNode.JsBug Bounty+3

cloudflare·Mar 9, 2026·3 min readCurated summary

Complexity is a choice. SASE migrations shouldn’t take years.

Cloudflare argues that SASE and zero trust migrations do not need to take years. Its partners, TachTech and Adapture, reportedly reduced deployments from around 18 months to four–six weeks by using Cloudflare One’s unified, cloud-native architecture. The post concludes that programmable security infrastructure can accelerate zero trust adoption while also enabling safer use of AI. ## Faster Zero Trust Deployments - Traditional Secure Web Gateway (SWG) and Zero Trust Network Access (ZTNA) migrations can take up to 18 months for large organizations. - TachTech reduced comparable Cloudflare One deployments to four–six weeks. - Cloudflare Access is presented as lightweight and largely “no-touch” after deployment, reducing ongoing operational effort. ## Why Legacy Migrations Stall - Legacy architectures often treat migration as hardware replacement rather than software transformation. - Complex service chaining creates a “trombone effect,” increasing latency and making troubleshooting difficult. - Cloudflare’s partners accelerate migrations through: - **Identity-first on-ramps:** Existing identity-provider groups define access policies instead of rebuilding network segments. - **Consolidated policy engines:** SWG and ZTNA policies are handled together, avoiding synchronization between separate products. - **Cloud-native connectors:** Tools such as `cloudflared` provide connectivity without opening inbound firewall ports. ## Scaling Quickly - Adapture expanded one Cloudflare Access deployment from 600 contractors to 5,000 users. - The company describes the expansion as seamless compared with the lengthy implementation cycles associated with legacy SASE platforms. - Cloudflare positions rapid elasticity as important for organizations whose workforce and security needs change quickly. ## A Programmable, Extensible Edge - Cloudflare One is described as software-defined and composable, allowing partners to adapt it to specialized environments. - TachTech supported Arch Linux developer workstations by extracting binaries from an Ubuntu `.deb` package and creating a custom `PKGBUILD`. - This approach preserved device-posture checks, including disk-encryption and firewall-status verification, without creating a security exception. ## Supporting Safe AI Adoption - Cloudflare says the Secure Web Gateway is evolving from simple URL filtering toward controlling data flows to large language models. - Its AI security capabilities include: - **Shadow AI visibility:** Identifying unauthorized AI tools in use across the organization. - **AI confidence scores:** Evaluating models based on standards such as SOC 2 and ISO 42001, as well as data-handling practices. - **DLP prompt protection:** Blocking sensitive source code, personally identifiable information, and financial data from being submitted to public AI services. - **LLM discovery:** Finding and labeling internet-exposed LLM endpoints to reveal the organization’s AI attack surface. - **Request validation:** Intended to defend AI applications against prompt injection and related attacks. Cloudflare’s central recommendation is to replace fragmented, hardware-oriented security deployments with a unified, programmable platform. Doing so can shorten zero trust migrations, simplify operations, preserve consistent security controls across unusual environments, and establish a faster foundation for responsible AI adoption.

Read original(opens in new tab)

Database DesignCloudflarePostgreSQLZero Trust+4

line·Mar 9, 2026·4 min readCurated summary

Building an Enterprise LLM Service Part

FAA achieves a 96.1% response rate by favoring simple, maintainable techniques over complex AI architectures. Its design choices were to use RAG instead of knowledge-focused fine-tuning, retrieve complete documents before cutting them into question-relevant sections, and rely on a basic ReAct agent loop rather than elaborate workflows or multiple agents. The article concludes that improving documentation is more valuable than adding complexity when unanswered questions mainly result from missing source material. ## RAG Instead of Fine-Tuning - Fine-tuning was rejected as the primary method for injecting enterprise knowledge. - Research cited in the article found that fine-tuning was highly effective for changing a model’s style—about 97% success—but achieved only about 11% accuracy when teaching new factual knowledge. - FAA’s experiment with approximately 40 examples showed that the model answered the exact training question correctly but failed when the wording changed slightly. - Maintaining larger fine-tuning datasets would require experts to create, verify, and continuously update training examples whenever product documentation changes. - RAG is better suited to frequently changing product information because only the source documents need to be updated. - Fine-tuning may still be useful for domain-specific terminology or reasoning patterns, but not for keeping FAA’s product knowledge current. ## Retrieving Whole Documents Instead of Pre-Chunking - Conventional RAG systems split documents into small chunks before embedding them, improving semantic search precision. - Pre-chunking can remove essential context, especially when references such as “this case” or “the following settings” are separated from the text they depend on. - FAA’s documents are generally short, well-structured, focused on one product and topic, making whole-document retrieval practical. - Instead of chunking before search, FAA embeds and retrieves complete documents, then splits them after the relevant document is known. - The post-split process has two stages: - Split the document by Markdown headers into meaningful sections. - Use a lightweight LLM to select only the sections relevant to the user’s question. - For a question about creating and deleting a VM, the main model might receive only the “VM creation” and “VM deletion” sections. - This extra filtering call remains inexpensive because the lightweight model outputs only section indexes rather than generating a full response. - The key advantage is that splitting happens after the system understands the question, preserving context while delivering only the necessary information. ## ReAct Instead of Complex Agent Workflows - FAA tested plan-and-execute workflows, in which the model first creates a multi-step plan and then carries it out. - Planning and replanning increased system complexity without producing a noticeable improvement in answer quality. - With well-designed tools and carefully filtered context, the model was able to determine tool order on its own. - FAA therefore uses ReAct: the model reasons, takes an action, observes the result, and decides what to do next. - This approach allowed the agent to handle troubleshooting questions without a separate planning layer. ## Rejecting Multi-Agent Architectures - The team also tested specialized agents, such as separate VM and Kubernetes experts. - Delegating questions and assembling the results required additional LLM calls, increasing response time from roughly 9 seconds to 14 seconds in one test. - Multi-agent routing performed poorly for cross-domain questions, such as moving data from a VM to object storage. - Specialists could miss information outside their assigned domain, whereas a single agent could maintain the complete context. - FAA therefore kept one agent with access to progressively disclosed tools and relevant documentation. ## Documentation as the Main Bottleneck - Analysis of unanswered questions showed that about 50% were caused by a documentation gap: no reference document existed. - Other failures were mostly temporary API issues or questions outside FAA’s intended scope. - This suggests the core retrieval and agent system performs well when documentation is available. - The team shares missing questions with product teams, whose updated documents are then re-embedded and incorporated into future evaluations. The practical recommendation is to start with the simplest architecture that fits the data: use RAG for changing knowledge, preserve document context during retrieval, and let a capable model operate through a ReAct loop. In enterprise systems, improving the underlying documentation may produce greater gains than adopting more sophisticated AI frameworks.

Read original(opens in new tab)

Database DesignKubernetesReactPostgreSQL+4

datadog·Mar 9, 2026·3 min readCurated summary

When an AI agent came knocking: Catching malicious contributions in Datadog’s open source repos

Datadog describes how AI-powered attackers targeted its open-source repositories through malicious issues, pull requests, and comments. The campaign, attributed to the “hackerbot-claw” agent, focused on weaknesses in GitHub Actions and LLM-powered workflows. Datadog’s LLM-based review system and layered CI security controls detected the activity and helped limit its impact, while prompting further hardening. ## Why Open-Source Repositories Attract Attackers - Public repositories are attractive targets because automated CI/CD pipelines often build and execute code from external contributions. - Common attack techniques include: - Injecting user-controlled values, such as PR titles, into workflow scripts. - Using indirect poisoned pipeline execution to introduce malicious dependencies or build instructions. - Abusing `pull_request_target` workflows, which may run untrusted code with elevated permissions. - Prompt-injecting LLM-powered GitHub Actions used for issue triage, labeling, or code assistance. - Attackers may also disguise malicious changes through: - Large or obfuscated diffs. - Invisible Unicode characters. - Malicious libraries. - Imposter commits that resemble legitimate dependency references. ## Datadog’s LLM-Based Contribution Detection - Datadog receives dozens of external PRs each week across projects such as the Agent, tracers, SDKs, Vector, chaos-controller, and Stratus Red Team. - Its BewAIre system monitors GitHub events and selects security-relevant activity, including PRs and pushes. - BewAIre: - Extracts, normalizes, and enriches code diffs. - Sends them through a two-stage LLM pipeline. - Classifies changes as benign or malicious. - Produces a structured explanation for each verdict. - Malicious verdicts are forwarded to Datadog Cloud SIEM, where detection rules create enriched signals for the Security Incident Response Team to investigate. ## Hardening CI and Development Workflows - Datadog reduces the potential impact of successful attacks through multiple preventive controls: - Its `dd-octo-sts-action` generates minimally scoped, short-lived GitHub credentials using OIDC. - Long-lived and overly broad personal access tokens and GitHub Apps are being replaced. - Unused GitHub Actions secrets are identified and removed across thousands of repositories. - Organization-wide controls enforce branch protection, mandatory PR approval, commit signing, and lower-privilege default `GITHUB_TOKEN` permissions. - Engineers are provided with documented best practices and secure “golden paths” for CI development. ## The Hackerbot-Claw Campaign - Modern AI models are increasingly capable of offensive security tasks, especially when given tools, feedback loops, and autonomy. - StepSecurity reported an AI agent attacking open-source CI systems on March 1. - Between February 27 and March 2, the actor: - Opened 16 pull requests. - Created two issues and eight comments. - Targeted nine repositories across six organizations. - The activity was later linked to the hackerbot-claw agent, whose GitHub account was removed. - Datadog’s investigation began after BewAIre alerted the team to a suspicious contribution in the newly public `datadog-iac-scanner` repository on February 27. ## Practical Takeaway Organizations that accept public contributions should combine automated, AI-assisted review with least-privilege credentials, strict workflow permissions, secret management, mandatory approvals, and human incident response. Detection alone is insufficient; CI pipelines should be designed so that a malicious contribution has limited access and minimal opportunity to compromise secrets or production systems.

Read original(opens in new tab)

Database DesignLarge Language ModelsCI/CDOpen Source+4

netflix·Mar 6, 2026·3 min readCurated summary

Scaling Global Storytelling: Modernizing Localization Analytics at Netflix

Netflix is modernizing its localization analytics to support more than 300 million members across 190+ countries and 50+ languages. Rapid growth created duplicated pipelines, inconsistent business logic, and siloed dashboards, making basic questions such as who produced a dub difficult to answer reliably. The company’s solution is to consolidate data foundations, improve usability, and centralize reusable business logic. ## The Challenge of Fragmented Localization Data - Localization metrics were historically built independently across different teams and workflows. - Determining who created a dub or subtitle required combining multiple sources with complex, frequently changing rules. - Duplicated logic led to: - Inconsistent reporting across tools - High maintenance costs when upstream systems changed - Siloed analytics and dashboards ## Auditing and Consolidating Analytics - Netflix audited more than 40 dashboards and tools for usage, quality, and code health. - The focus shifted from repeatedly fixing frontend visualizations to consolidating backend data pipelines. - Three legacy dashboards covering dubbing-partner operations, capacity, and finances are being unified around a shared data and backend layer. - This foundation can support multiple future frontend experiences instead of forcing each dashboard to maintain separate logic. ## Reducing User Experience Debt - Netflix defines “Not-So-Tech Debt” as stakeholder friction caused by confusing tools or weak analytical storytelling. - The Language Asset Consumption tool was redesigned to combine audio and text languages into a single consumption-language view. - This distinguishes: - Original-language viewing from localized consumption - Subtitle, dubbing, or combined preferences - Recurring member preferences for a given language - The result is more intuitive analysis aligned with real stakeholder questions. ## Centralizing Reusable Business Logic - Netflix is adopting a “write once, read many” architecture. - Shared tables, including a Language Asset Producer table, solve common questions in one centralized location. - The same trusted data can feed downstream domains such as Dub Quality and Translation Quality. - Updates to business rules propagate across the analytics ecosystem instead of requiring changes in multiple pipelines. ## Moving Toward Event-Level Analytics - Future work will analyze individual timed-text events rather than only complete language assets. - A generic model will capture details such as individual subtitle lines and reading speed. - Netflix plans to connect subtitle characteristics with member engagement. - These findings can improve style guidelines for subtitle linguists and ultimately enhance the localized viewing experience. Netflix’s recommendation is to treat analytics modernization as both a technical and product-quality effort: consolidate data foundations, centralize business logic, and design tools around how stakeholders actually make decisions. This creates more trustworthy reporting while enabling deeper analysis of how localization affects member enjoyment.

Read original(opens in new tab)

Database DesignPostgreSQLData ModelingData Pipelines+4

cloudflare·Mar 6, 2026·2 min readCurated summary

From the endpoint to the prompt: a unified data security vision in Cloudflare One

Cloudflare One presents data security as a unified problem spanning networks, SaaS applications, endpoints, and AI prompts. Its strategy is to follow data wherever it moves, combining visibility, policy controls, and enforcement rather than relying on siloed products. The latest updates extend this model from browser-based RDP clipboard controls to SaaS operation logging, endpoint DLP, and Microsoft 365 Copilot scanning. ### Browser-Based RDP Clipboard Controls - Administrators can control whether users copy or paste data between local devices and browser-based RDP sessions. - Policies can be directional and context-specific: - Allow copying into a remote session for productivity. - Block copying sensitive information out to unmanaged endpoints. - The feature is configured through Access Application Policies for browser-based RDP applications. - Granular controls aim to reduce risky workarounds such as screenshots, manual retyping, or use of unsanctioned tools. ### Operation-Level Visibility in SaaS Logs - Cloudflare’s operation-mapping process interprets HTTP request details as recognizable actions, such as `SendPrompt` in ChatGPT. - Related operations are grouped into higher-level Application Controls such as “Share” or “Upload.” - These mapped operations now appear automatically in log events for matching SaaS traffic. - Log details include both the application control and the specific operation, helping teams investigate activity and refine policies more quickly. ### Endpoint DLP for Data in Use - The Cloudflare One Client now provides Endpoint DLP enforcement, beginning with clipboard-based data movement. - This protects sensitive content after it leaves a browser or managed SaaS application and enters the operating system clipboard. - The feature addresses risks such as copying customer records or proprietary code into personal tools or unauthorized AI assistants. - Organizations can extend existing Gateway, DLP, CASB, and API-based controls without deploying a separate endpoint agent. ### Microsoft 365 Copilot Scanning - API CASB can now analyze Microsoft 365 Copilot activity for data-security risks. - Scanning covers Copilot chats and uploads that match configured DLP detection profiles. - Findings include contextual information such as referenced files, matching DLP profiles, and interaction metadata. - This extends Cloudflare’s existing API integrations for OpenAI ChatGPT, Anthropic Claude, and Google Gemini. Cloudflare’s recommendation is effectively to treat data movement as one continuous security problem: control access in transit, monitor activity in SaaS, enforce protections on endpoints, and inspect how data is used in AI prompts. Together, these capabilities are intended to keep policy attached to the data rather than limited to a particular application or product boundary.

Read original(opens in new tab)

Database DesignAi SecurityCloudflare OneSaas Security+4

line·Mar 6, 2026·3 min readCurated summary

On-Device Image Model Training for Mess

This post describes an on-device image captioning system for mobile messenger apps. Because autoregressive vision-language models took more than five seconds to generate captions, the team replaced them with a non-autoregressive decoder, reducing latency to roughly 200–400 ms. They then used LLM-based acceptance evaluation, caption re-generation, and multi-stage knowledge distillation to improve quality while keeping the model at 172 MB. ## Why Conventional Captioning Was Unsuitable - Models such as BLIP-2, MobileVLM, PaliGemma, and MiniCPM were too large or slow for mobile deployment. - BLIP-1 was selected as a practical baseline because of its smaller size and clear licensing, but still required more than five seconds after quantization. - Autoregressive decoding generates tokens sequentially, requiring one decoder pass per token. - On a Samsung Galaxy Fold 4, the initial model required about 142 ms per token, or approximately 2.8 seconds for 20 tokens. - Mobile UX required stable latency in the hundreds of milliseconds, including cold-start and variable-device conditions, so simple model compression was insufficient. ## Non-Autoregressive Caption Generation - The system predicts all caption tokens in parallel using a fixed set of learnable query tokens. - This changes the decoding cost from roughly O(T) for autoregressive generation to near O(1) through parallel processing. - The architecture consists of: - An image encoder reused from the previous system - Image embeddings injected as a prefix, following the ClipCap approach - A 66.4-million-parameter Transformer-based text decoder - Twenty learnable query tokens for short captions - Query-CTC loss addresses the alignment problem caused by predicting tokens simultaneously. - The resulting model generated captions in about 200 ms, achieving the required speed improvement. ## Speed Improved, but Caption Quality Declined - Standard metrics such as CIDEr and CLIPScore appeared acceptable. - Manual inspection revealed frequent: - Repeated words, such as “a desk with a computer on a desk” - Spelling errors, such as “a people ons” - Grammatical problems - Incomplete captions, such as “a” - These defects made the model unsuitable for direct use in a messaging product. ## LLM-Based Acceptance Evaluation - The team introduced an “accept ratio” based on GPT-4o mini judgments. - Captions were classified as either `accept` or `non-accept`. - The evaluation checked for: - Duplicate content - Errors - Clarity and grammatical correctness - This better reflected production usability than conventional image-captioning benchmarks. - The low acceptance rate confirmed that CIDEr and CLIPScore alone could not measure whether captions were appropriate for users. ## Data Quality and Knowledge Distillation - Analysis showed that the training data contained inconsistent and noisy captions: - A mixture of very short and overly long descriptions - Unnecessary OCR-like attempts to describe text in images - Uneven language quality - The smaller 66.4-million-parameter model also had less representational capacity than BLIP-1’s 110 million parameters. - Generating an entire sentence in one pass was especially difficult for the compact non-autoregressive model. - The training pipeline was redesigned as an iterative quality-improvement loop: - Train a baseline using the original data - Identify failures with LLM-based acceptance evaluation - Re-caption poor-quality training examples - Distill knowledge from a larger teacher model into the student model - Replace or refine rejected samples and repeat - Architectural scaling and metric optimization did not consistently improve acceptance rates, while re-captioning and knowledge distillation produced more meaningful gains. The practical recommendation is to design on-device captioning around the actual product experience: prioritize parallel decoding for latency, measure quality with production-oriented acceptance criteria, and use carefully curated data plus knowledge distillation to make compact models reliable.

Read original(opens in new tab)

Database DesignLarge Language ModelsKnowledge DistillationNon Autoregressive+3

toss·Mar 6, 2026·3 min readCurated summary

Foreign User Research: Why

Toss investigated why many foreign users struggle to use Korea’s financial services, even after signing up. Research showed that confusing identity verification, name formatting, and address entry often prevented users from completing registration, forcing them to visit bank branches for routine tasks. By redesigning the name-entry and authentication process, Toss increased the foreign-user verification completion rate by about 15% and eliminated the gap with Korean users. ## Investigating Foreign Users’ Financial Experiences - Foreigners often perceive Korea’s banking system as complex and difficult to navigate without assistance. - Toss wanted to make its “finance for everyone” vision include foreign residents. - The team suspected that several verification steps caused users to abandon registration: - Preparing a foreigner registration card - Mismatches in telecom-provider information - One-won account verification - Difficulties entering names and personal details ## Field Research with Blue-Collar Workers - The team focused especially on blue-collar foreign workers, whose financial habits were less understood than those of students or white-collar workers. - Initial attempts to arrange factory interviews failed, so researchers visited the Siheung Industrial Complex during lunch hours. - Street interviews were difficult because formal clothing, identification badges, and consent documents made passersby cautious. - A more casual approach helped the team conduct several interviews. - Researchers later visited a multicultural center in Pocheon, where they met foreign residents from different countries and with varying lengths of stay. ## Why Foreign Users Rely on Bank Branches - Mobile banking often felt like a complicated system that users could access only after repeated trial and error. - Many users abandoned the process before reaching any financial-service features. ### Name Entry and Identity Verification - Users were unsure how to format their names: - Where to place spaces - Whether to enter family names first - Whether to match their foreigner registration card, bank account, or telecom records - A name such as “BRAD PITT” might need to be entered in an unexpected format, such as “BR AD.” - Some users repeatedly failed verification because their name format differed across institutions. - One participant had never successfully completed online identity verification under their own name in eight years. - Error messages rarely explained the actual cause of failure. - After five or more failed attempts, users could no longer continue. ### Address Entry - Entering Korean addresses was another major barrier, especially for users unfamiliar with typing Korean. - Users tried postal codes, English addresses, and lot numbers, then searched through address lists. - Search results often displayed too many options, making the correct address difficult to locate. - Repeated unsuccessful searches led some users to abandon registration and visit an offline branch instead. ## Improving the Authentication Funnel - Research identified name entry and authentication as the primary causes of foreign-user drop-off. - Toss’s product team redesigned the name-input structure and authentication flow. - The changes increased the foreign-user authentication completion rate by approximately 15%. - The completion-rate gap between Korean and foreign users was ultimately eliminated. Toss’s research demonstrates that inclusive financial services require understanding users who are often overlooked. Removing small but fundamental barriers in registration and authentication can make digital banking accessible to a much broader population.

Read original(opens in new tab)

Database DesignUser ExperienceUser ResearchMobile App+4

gitlab·Mar 4, 2026·2 min readCurated summary

10 AI prompts to speed your team’s software delivery

AI-assisted coding can accelerate code production without accelerating delivery, because review, security, documentation, and planning often become the new bottlenecks. The post recommends applying AI across the full software lifecycle, using targeted prompts to reduce routine work and let teams focus on architecture, risk, and business decisions. ## Code Review as an Accelerator - AI can review merge requests (MRs) for: - Logical errors, edge cases, and potential bugs. - API changes, altered return types, schema modifications, and configuration changes that may break consumers. - Catching these issues before human review reduces repeated review cycles and helps prevent deployment-time rollbacks. ## Shifting Security Left - Security scan analysis can use AI to: - Distinguish real vulnerabilities from false positives. - Explain risks and recommend remediation. - Prioritize findings by severity and exploitability. - AI-assisted code reviews can identify injection flaws, authorization problems, data exposure, insecure dependencies, and cryptographic weaknesses before an MR is created. - This reduces security-team backlogs and limits late-stage developer/security rework. ## Keeping Documentation Current - AI can generate release notes from merged MRs, organizing changes into features, fixes, performance improvements, breaking changes, and deprecations. - It can also identify which README files, API references, architecture diagrams, and onboarding guides need updates after code changes. - Automating these checks helps prevent documentation drift without creating a separate manual task. ## Breaking Down Complex Planning - An AI planning prompt can decompose an epic into implementable issues by considering: - Technical dependencies. - Appropriate issue sizes. - Acceptance criteria. - Implementation order. - The goal is to replace lengthy planning meetings with an initial AI-generated breakdown followed by team review. The practical recommendation is to treat AI as a team workflow accelerator, not merely a code generator. Applying focused prompts to review, security, documentation, and planning can help prevent increased coding speed from creating larger downstream bottlenecks.

Read original(opens in new tab)

Database DesignMachine LearningPostgreSQLCode Review+4