Artificial Analysis's Intelligence Index v5 shifts to majority private evaluation datasets, reshaping benchmark reproducibility and model rankings for developers.
Oracle's plan to offer Google TPUs on OCI starting in 2027 raises key questions about AI capacity planning, scheduling, and abstraction layers for multi-cloud accelerator portability.
A single HTTP header parsing flaw behind HTTP2Shell and PHP2Shell has reached .NET, FFmpeg, ClickHouse, and Apache Arrow, with active exploitation prompting emergency patches.
A deep, hands-on benchmark of tsrs, the AI-generated Rust port of TypeScript, comparing its performance and compatibility against tsc and showing how to validate it before adopting it in a build pipeline.
An audit framework for LLM gateway model routing and prompt caching: verify provider-side usage counters, cache read rates, and tenant isolation before trusting a savings chart. The post runs a fixture with three synthetic tenants and 1,500 replayed requests. Full write-up: https://hackyjs.com/posts/auditing-model-routing-and-prompt-caching-before-you-trust-the-cost-chart
A plain hash chain proves internal consistency, and that's all it proves. Delete the last forty entries and a forward-walking verifier still reports success. This short walks the Node.js pattern: hash each record over its canonical bytes, the previous hash and a monotonic sequence number, sign every entry with an HMAC whose key lives behind a separate signing boundary, and anchor the chain head somewhere the writer can't reach so truncation fails verification. It closes with the obligations the log has to satisfy under the EU AI Act: logging across the system's lifetime, a six-month retention floor, and human oversight recorded as an approval event with a named person and a timestamp rather than a boolean in a UI. Full write-up, including the record schema, the verifier you can run in CI, and the caveats about timelines still in motion: https://hackyjs.com/posts/tamper-evident-audit-logging-for-agentic-ai-a-nodejs-implementation-pattern
A defensive audit of GitHub-to-PyPI publishing paths after reports that a LiteLLM GitHub key stayed valid for months and was linked to a PyPI compromise. Trace repo write to workflow execution, secrets injection, and index upload; then run the checks: inventory publishing workflows, grep for long-lived credentials and history, verify OIDC trusted publishing, read effective GITHUB_TOKEN permissions, and require environment reviewers. Includes a deliberately weak lab workflow and the safer permissions and OIDC pattern. Read the full write-up: https://hackyjs.com/posts/auditing-github-to-pypi-publishing-paths-after-the-litellm-supply-chain-attack