There is a danger associated with growing up, of putting aside children’s books. We must be careful lest all we are left with is a world that is very much not alive, a natural world that is mere piles of stuff – stuff that people can use or not use, preserve or destroy, just as they want. When Lewis wrote about giants rising from the mountains of Mourne, it was a Romantic idea. There was nothing very practical about it. We weren’t yet aware of climate change; the natural world was not yet in crisis; species were not going extinct at the rate they are today. Now we need an idea of the natural world as something that has value and life of its own, quite independent of us. This would have been so obvious to people in the past that it would not have been worth stating, but 200 years after the Industrial Revolution our sight has become a little clouded.

🔗 Author Susanna Clarke: in defence of fantasy fiction

ICYMI

Original content published since last time.

• The Bottom Fell Out Of The Software Industry – Software Defined Talk #594 – “This week, we discuss AI yes/no deciders, the SaaS apocalypse, Bending Spoons, and Oxide’s funding.”

Related to your interests

• Six Principles, Five Patterns and a Named Human Accountable for Every AI Workflow – The same models and vendors produce radically different results from one organization to the next, so the differentiator is the operating system the technology lands in…so the CEO has to rebuild decision rights, accountability, skills and goals around them, starting with naming who is accountable for every AI-enabled workflow.
• Your agents need a platform – “Agents need a platform to keep them healthy and on-track.”
• Accenture Tells Employees They Can Now Spend Only $29 on Claude Per Month – There’s so much (more) shadow IT in the future of Accenture and other companies.
• Berkshire Hathaway invests further $330 million in Bending Spoons following $600 million IPO investment – Probably the most interesting tech PE firm there is.
• Ten of the most bizarre films and their posters
• Iosevka – A typeface for all your code needs. If you push the weight up enough, it looks OK for regular text too.
• MS Clipart Search – Find 90s era clipart.
• Soviet-Era Illustrations of J. R. R. Tolkien’s The Hobbit (1976)
• Dutch meat consumption continues to decline, with pork seeing biggest drop – “[A]verage person in the Netherlands ate around 33.7 kilograms of meat in 2025, compared with 34.4 kilograms a year earlier.”
• Postgres 19 delayed after AI reviewers find more bugs than humans can fix

Upcoming Talks

• DevOpsDays Istanbul 2026 – Istanbul, Turkey, October 24th, 2026. Keynote, title to come.
• VMware Explore on Tour 2026 London – London, UK, November 18th, 2026. “Build a Platform That Developers Want to Use”
• Cloud Native Denmark 2026 – Copenhagen, Denmark, November 19th, 2026. “What goblins and druids can teach us about enterprise AI”
• Build Stuff 2026 – Vilnius, Lithuania, December 2nd-4th, 2026. “What goblins and druids can teach us about enterprise AI”

Logoff

The format of this newsletter is a bit all over the map. Should it be a list of everything from my week of blogging and link reading, or just the stuff I haven’t posted yet? Who knows. I lean to the second, as actually blogging links as I find them is the more reliable “actually post it” workflow.

Meanwhile, it’s conference and travel season: that time before December, and after August. I’ve got travel each week in October.

Want to subscribe to this newsletter and get it in your email? Do that here. You’ll just get this type of link and post round-up, not everything posted on the weblog.

“Enterprise and consumer AI revenue will be insufficient to support profitable returns on all planned AI capital expenditures during this period,” said Gartner Senior Director Analyst Will Sommer. AI data center owners would need to generate $8.5 trillion in revenue through 2030 to cover announced capital spending, financing costs and expected investment returns, he said. “However, total enterprise and consumer AI revenue that can be attributed to AI data centers during this period is forecast to reach no more than $3.6 trillion.”

🔗 AI datacenter capex will far exceed forecast revenue through 2030

And so they decided to build the solution internally, forming a team, hiring new talent, and giving them access to the AI tools they needed. Six months and significant investment later, the internal team had produced basic prototypes. But it couldn’t manage what practitioners call the “last mile”: handling complex regulatory requirements, coordinating multiple AI agents, and making the tool reliable enough for everyday use. The bank eventually re-engaged the vendor, who deemed that it would take them more time to fix what the bank had built than it would for them to build out their original pilot from scratch—which is what the bank ended up hiring them to do.

🔗 Turn Vibe-Coded Prototypes Into Tools Your Company Can Actually Use

According to the cybersecurity professionals CSO spoke with, one of the biggest cybersecurity failures by the frontier AI labs is the lack of implementation of tried-and-true containment practices that stretch back to the 1990s, such as setting up secure sandboxes that would effectively bar agents from escaping their test environments.

These are things that we’ve been dealing with for years," Rob T. Lee, chief AI officer and chief of research at SANS Institute, tells CSO. “There’s no reason why every single time this happens, it’s, ‘Oops, we don’t know how they got out.’”

🔗 AI agents aren’t “going rogue.” Frontier labs are skipping security basics.

What is the diffusion gap? It’s the delta between what you can accomplish with models (ie how powerful they are) and how the average person uses models.

🔗 Unrealized potential in normie AI use

Related, from the ponders at Anthropic:

1. Anthropic staff expect much larger productivity gains from AI on the tasks it is well-suited for. Among US adults who use AI at work, 26% say a task takes a quarter of the time or less with AI, compared to 59% of Anthropic staff.
2. When it comes to their own job, over half of Anthropic staff expect AI to be able to do at least 80% of their current work by 2030, compared with 5% of US workers.

Human coordination grew rather than shrank. Median meeting time is up 20%, and 16% even for technical individual contributors. Agents showed up in nearly half of public Slack channels but layered on top of human communication instead of replacing it. Decisions made privately are invisible to agents, so the workplace pushes toward doing work in the open.

Summarized by AI.

🔗 Anthropic Studies Itself: Junior Tech Hires Fall From 27% to 9% as Agents Log 6x Human Hours and Attention Becomes the Bottleneck

UK government pilots cut legacy-system discovery from weeks to hours – five weeks to under a day for 33 Clojure apps, 15 days of manual regression testing to 30 minutes – and the real gain is that modernization work nobody could justify starting becomes cheap enough to plan. AI speeds up understanding the old system; it doesn’t replace the governance and engineering needed to change it.

Mostly summarized by AI.

🔗 UK GDS Pilots: AI Cuts Legacy-System Discovery From Weeks to Hours, but Only Amplifies Existing Delivery Capability

Bank of America recruited an additional 1,000 contractors to help patch all the vulnerabilities discovered by Anthropic’s Mythos model, the CEO said on Wednesday.

Brian Moynihan, chairman and CEO at BoA, said during the company’s Q3 earnings call that it spent “a couple of hundred million plus” in remediation costs related to Mythos, and the anti-money laundering (AML) orders issued this week.

🔗 Bank of America had to bring in 1,000 contractors to patch all the bugs Mythos identified

The trouble with standard templates is that everyone uses the defaults. Before you know it, everyone’s slides look the same. People ignore boring things, so there’s value in breaking that monotony.

🔗 Build your slide template

Geopolitical implications and polarisation are very much in people’s minds (inside and outside work). There is no avoiding discussions about the risks of relying on US inference providers, and the insularity of Europe regarding ownership of both core infrastructure and skilled resources is excruciatingly obvious to everyone even as they try to keep the business running.

🔗 11 Years at Microsoft

“I am just very reluctant to spend a lot of energy quantifying it because it winds up wasting a lot of people’s time inside the institution when we actually need to get them to focus on doing things… as much as important and dramatic and exciting as this theme is, it takes a long time to really do things that are visible at an institution of our size.”

Barnum also said that the $2 billion annual AI investment figure previously provided by Dimon was “not exactly right” and said the actual spend was around $700 million annually.”

Indeed. Does one measure the ROI of email or Excel?

🔗 JPMorgan: Quantifying AI benefits is “wasting time”

• Workday goes headless, opening its HR and finance data to outside AI agents – This would make hundreds of thousands of people’s lives better without having to even wakeup enterprise ROI meetings.
• Practitioner Voice – How to write technical stuff, or anything else instructive, that isn’t boring.
• IDC’s Worldwide and Regional Developer Forecast, 2026–2030 – Worldwide developer population projections expand from 44.8 million in 2026 to 53.3 million in 2030.
• IDC Survey Spotlight: How Is AI-Generated Code Share Changing Across Industry Verticals? – Survey findings indicate AI-generated code now accounts for 50% of production code across industry verticals, requiring agentic testing and governance to manage machine-generated volume.
• IDC Survey: Open Source Software Trends, 2Q26 – Roughly 70% of enterprise workloads run on open source software across every stage of the software development life cycle, establishing community and commercial OSS as production defaults rather than cost-cutting experiments.

The above are links for you, dear readers, that do not have their own post on the weblog. Filed from FRA.

Original: Patchmageddon: The race to patch software vulnerabilities before zero-day cyber-exploitations proliferate by Michael Cembalest, J.P. Morgan Eye on the Market, July 22, 2026. (PDF)

Summarized by AI.

Beyond Detection Engineering: Building Security Engineering at Scale AI is only as useful as the engineering foundation around it. If the data isn’t normalized or the documentation doesn’t exist, the model has little context to work from. Instead of asking, “What can AI do?” we started asking, “What engineering work can AI help us do faster?”

It became another engineering tool. It accelerated research, helped analyze coverage, identified gaps, and assisted with drafting detections that the team could make production ready.

Many organizations expected AI to create maturity. It does not. Without consistent telemetry, governance, validation, and engineering discipline, AI simply helps organizations move faster in the wrong direction.

AI didn’t change the job. It changed how much of the job we could spend doing the work that matters most.

🔗 Beyond Detection Engineering: Building Security Engineering at Scale

• Digital sovereignty: Federal government withdraws from AI partnership with Mistral and SAP – “The [German] federal government is withdrawing from the partnership with Mistral and SAP. The decision fuels doubts about Europe’s path to digital sovereignty.”
• Home Depot and Lowe’s share a common goal for their AI assistants, but their strategies diverge
• Cabinet recognizes: Cloud Act can collide with AVG and give access to Dutch healthcare data – [Translated:] Furthermore, there is no insight into American access to Dutch patient data. The US government can secretly request our healthcare data. The government does not know if Dutch care data has ever been requested. The lack of reports is certainly not proof that such requests do not take place.”
• Not enough nerds left Twitter, it’s still relevant – “Since that blog post, Federico Viticci and John Voorhees returned to X. Other people started posting to X who had never even posted to Twitter before, like Jensen Huang and Jeffrey Katzenberg. While I still believe X is doomed in the long run — closed, rudderless, and toxic to many — the AI community has held on to a remnant of the old Twitter, and in fact that community is growing, apparently immune to the decay of a platform that has no soul.”
• Tiny5 – “Tiny5 is a family of compact 5-pixel variable fonts that capture the essence of 1980s – 90s digital minimalism. Inspired by the graphing calculators and pocket gadgets of the era, they distill letterforms to their absolute essentials – proving that even at just five pixels tall, clarity, charm, and personality can thrive together.”
• PC Market Woes Continue: Shipments Fall 20.1% in Q3 2026 as Pull-In Hangover and Supply Constraints Bite – IDC – ”Worldwide PC shipments fell 20.1% year over year in Q3 2026 to 62.7 million units, according to preliminary results from IDC Research (IDC), the second consecutive decline and a deeper one than the 3.8% drop in Q2. ”
• Anime, etc., now completely normal, even for the olds – “A new NRG survey commissioned by anime streamer Crunchyroll found that in the United States, the percentage of consumers aged 13 to 54 who watch Japanese animation at least weekly increased to 41 percent this year, up from 39 percent. The percentage of daily watchers also increased to 21 percent from 13 percent in 2025. The idea that people age out of anime was rattled by the survey, with 58 percent of viewers aged 45 to 54 indicating that their fandom had intensified.”
• AI coding has made CI a bottleneck, so we reworked ours to keep up – “Some of our earliest gains required almost no optimization of CI itself. Moving our workloads off GitHub Actions to third-party runners with faster CPUs, higher-performance storage, and better cache infrastructure gave us faster machines to run the same pipeline on. In a like-for-like comparison of the two days either side of the switch, jobs ran 34% faster on average, with some workloads like tsc dropping 52%.”

The above are links for you, dear readers, that do not have their own post on the weblog.

At Dreamforce 2026, Salesforce spent a good chunk of its keynote telling customers they might never need to log into Salesforce again. That’s a remarkable message from a company whose web UI has been the center of its business for more than two decades, and it connects the two biggest takeaways I had from the event: Salesforce is flattening the personas it serves, and it is relinquishing control of the user interface. – Rachel at RedMonk

And:

Other software companies, they think their product is the UI. But that’s not what we think at Salesforce. At Salesforce, our product is the trust that all of you, our customers, put in us to hold your data. To hold your workflows, your business processes, your permissions, your security rules. That is the Salesforce product. – Patrick Stokes

🔗 Dreamforce 2026, RedMonk

Over six months of scanning some of the world’s most widely used open source projects, Anthropic’s models surfaced more than 29,000 candidate vulnerabilities. Its human review pipeline, which relies on six external security research firms to reproduce and triage findings, has worked through only about 6,000.

A disclosure dashboard puts some numbers behind the problem. As of October 2, outside security firms had confirmed 5,674 of the 6,123 findings they reviewed as valid, but only 516 vulnerabilities had been patched upstream.

🔗 Claude found 29,000 possible bugs in open source. Only 516 have been fixed.

But, forks take longer:

On predictors: custom patches matter most. Packages Google had patched took three times longer at the median than unpatched ones, and “Google-specific patches or customization” was also the single most-cited reason engineers gave for a slow update. Volume of external dependencies, package size, and upstream change velocity tracked effort as well, while package age and how heavily a package was used internally showed no consistent relationship.

The practical reading is that forking and patching is where the maintenance bill accrues, not consumption itself.

Summarized by AI.

🔗 Google Measures the Cost of Keeping Open Source Up to Date: Half of Updates Take Under 2 Hours, Custom Patches Triple the Median

If your employer has banned the use of AI, you should quit and find a company that is already going through an AI transformation.”

If your team is too busy doing their new job to experiment with AI, you’re preparing them to be replaced. Maybe you’re okay with this, but hopefully you’re not, because it should weigh heavily on you if you truly care about your team.

Sometime in the next six months, you’re going to have to start having some hard conversations about moving people on from your company. You should already be putting your employees on a vitality curve and ranking them. Naturally, competent employees who have been using AI will be ahead of competent engineers who haven’t.

🔗 if your team is too busy doing their ‘normal job’ to experiment with AI, you’re preparing them to be replaced

Right now, your washing machine is subject to more safety rules than AI. Every carton of milk that you see in the grocery store is subject to safety rules and inspection.

🔗 AI is less regulated than milk, Microsoft president says

ICYMI

Original content published since last time.

• Markdown for the Masses – Software Defined Talk #593 – “This week, we discuss Google Docs finally getting Markdown, Cloudflare’s CF CLI, Gartner’s agentic AI abandonment stat, and forward deployed engineers.”
• Animated Bedtime Stories, Telling Dummies What to Do, and Why Docker Lost, with Viktor Farcic – Software Defined Interviews #128 – “Viktor Farcic makes animated bedtime stories about tech history because he decided people should not have to look at his face. He also runs 20 to 50 agents at once, has them argue with each other, and reviews their work off a private YouTube channel in the morning.”

Related to your interests

• Beyond the Kubernetes complexity: Delivering an AI-Ready Platform Developers Love (Over Lunch) – What a proper platform looks like. You know, a PaaS.
• The Cloud Admin’s Path to Platform Engineering – A call to get VI admins interested in platform engineering: ”Your Challenge: if your platform team redesigned the infrastructure layer tomorrow, would anyone think to call you [a VI admin] first? What could you ship in the next 90 days to change that answer?”
• Is sandboxing sufficient to contain rogue agents? – “AI alignment isn’t really the problem here: labs just need better infrastructure.”
• VulnCheck: CVEs Up 45% in 1H-2026 but Exploitation Up Only 10%, and AI-Found Bugs Get Exploited at the Same 1.3% Rate as the Rest
• IBM and Red Hat patch 400-plus unknown Java flaws, open Clearinghouse for fix requests – Putting those 20,000 developers to work! A whole or bugs being found and fixed everywhere. Related: What Developer Teams Should Do Differently.
• Jevon’s Paradox, 70s Hollywood Edition – The editor became very important. So, like: what if same for AI?
• Apple Says It Will Further Lock Down MacOS in Response to Third-Party A.I. Agents – It’s probably a good idea, but it will be very annoying for the AI-crazed…like myself.
• Unspecified Full Disk Access Screw Tightening – Finer grained and more transparent access controls on MacOS (that have CLI options instead of just hard-enforced GUI modals) would be cool.
• Europe Needs 105,000 More Bike Mechanics by 2032 as Maintenance Barriers Keep 121 Million From Riding More
• Tom Cruise’s Digger has flopped spectacularly – but I think it is a misunderstood masterpiece – Seems like it’d be fun to watch. Related: ¯\_(ツ)\_/¯
• Scrambled Eggs ‘James Bond’ – “For FOUR individualists: 12 fresh eggs; Salt and pepper; 5-6 oz. of fresh butter.”

Upcoming Talks

• VMware Explore on Tour 2026 Frankfurt – Frankfurt, Germany, October 13th, 2026. “Build a Platform That Developers Want to Use”
• DevOpsDays Istanbul 2026 – Istanbul, Turkey, October 24th, 2026. Keynote, title to come.
• VMware Explore on Tour 2026 London – London, UK, November 18th, 2026. “Build a Platform That Developers Want to Use”
• Cloud Native Denmark 2026 – Copenhagen, Denmark, November 19th, 2026. “What goblins and druids can teach us about enterprise AI”
• Build Stuff 2026 – Vilnius, Lithuania, December 2nd-4th, 2026. “What goblins and druids can teach us about enterprise AI”

Want to subscribe to this newsletter and get it in your email? Do that here. You’ll just get this type of link and post round-up, not everything posted on the weblog.

Google has put forward the most complete enterprise agent design we have seen from a hyperscaler, with identity, policy, cost control, memory, and model choice designed in from the start. … Google Cloud announced the Gemini agent at its Gemini at Work 2026 event, describing it as a single, universal agent for work. Users assign it objectives rather than step-by-step instructions, and it answers questions, handles knowledge work, generates images and media, and writes and runs code from one interface and one API. The agent runs in the cloud with persistent memory and context, can be reached from web, mobile, desktop, the command line, Google Workspace, Microsoft 365, and Slack, and can operate headlessly inside third-party applications. It can spin up temporary sub-agents for multi-step jobs that run for hours or days, and it can create persistent coworker agents that receive their own Workspace accounts, including email addresses, calendars, and Drive storage.”

And:

Google says the agent routes each job to the model that fits best, drawing on its own Gemini models and Anthropic’s Claude models today, with OpenAI and open-weights models to follow. Governance features include cryptographically attested agent identities, role-based permissions, audit trails attributed to the agent, an Agent Sandbox with its own network boundary, and Agent Gateway, which enforces policy on all traffic in, out of, and between agents. Cost controls include smart routing between models and real-time spend caps set per project, with per-user caps to follow. Google also introduced industry specializations for financial services and legal, both in preview. The Gemini agent is in private preview, and Google expects general availability by the end of October 2026, starting in North America."

Also, good partnering scheme to extend outside of Google-world:

Google’s answer is to put the Gemini agent inside partners’ applications, including Salesforce, ServiceNow, SAP, and Slack, so those vendors keep control of their user experience and customer relationship. That is a shrewd pitch to SaaS vendors worried about agents stripping away their brand equity, and it sets Google apart, it argues, from rivals telling the market that SaaS is dead. It is a harder sell to Microsoft, which has a competing agent of its own, and it sits awkwardly alongside our point that coworker agents could erode the seat counts those same SaaS vendors depend on.

And, usage:

The company says nearly 90% of the Fortune 100 use Gemini Enterprise, and Futurum’s September 2026 survey found that 22% of 469 respondents currently use the Gemini Enterprise Agent Platform for AI application development and plan to continue, with a further 21% planning to evaluate or adopt it.

🔗 Google Gemini Agent Puts the Agent Ahead of the Model

Anthropic on Thursday unveiled OSS Scanner as an opt-in vulnerability scanner to help secure the open-source ecosystem using artificial intelligence (AI).

It’s an opt-in service informed by our experience using Claude to find vulnerabilities during Project Glasswing," Anthropic said. "Projects that join will receive thorough, periodic security scans by our strongest models at no cost.

And:

Anthropic also noted that the outputs of the scanner will be fully model-generated and do not require human review or triage, thereby facilitating faster and more frequent scanning. These reports are expected to be generated by its strongest models, including Claude Mythos.”

🔗 Anthropic Launches Free AI Vulnerability Scanner for Open-Source Projects

As seen at DevOpsDays Prague 2026.

For the more than 400 flaws, Lightwell engineers backported patches into the widely deployed versions of each library. Any fix that also applies upstream goes back to the open-source project under responsible disclosure protocols while Clearinghouse participants keep their embargo protections. Neither company has named the affected libraries.

Behind the fixes, engineers from both companies work alongside AI-assisted development workflows, and the builds run on Red Hat’s secure software supply chain infrastructure. Customers pull the patched packages from secured repositories that connect to their existing information technology processes, so nobody has to swap out security scanners or development pipelines to use them.

Putting those 20,000 developers to work! A whole or bugs being found and fixed everywhere. Related: “What Developer Teams Should Do Differently.”

🔗 IBM and Red Hat patch 400-plus unknown Java flaws, open Clearinghouse for fix requests – SiliconANGLE