Tom Smith

Tom Smith

@ctsmithiii.bsky.social

AI Content Strategist | LLM Training Expert | Solving Business Problems with AI | Former Google Bard Trainer | #GoHeels | #CBB | #CFB | #Chipotle

139 followers32 following1.2K posts

Tom Smith
@ctsmithiii.bsky.social

Coding agents spend most of their budget re-reading their own search results. Bito’s Governor does the research for the agent and routes each request by task. Privado cut cost per task 48%, from $4.12 to $2.14. I asked CEO Amar Goel how it works. coderlegion.com/32566/bitos-...

coderlegion.comBito's Governor Cut Privado's Coding Agent Costs 48% by Ending the Search LoopCoding agents cost more than they should, and the reason is easy to miss. Most of the bill isn't the work. It's the agent searching your codebase, then re-sending everything it found on every step. [B...
Tom Smith
@ctsmithiii.bsky.social

Reddit's r/opensource now bans projects that use, are made by, or built for AI, plus non-English posts. The Linux kernel took the opposite path: use any tool, understand your code, own what you ship. What DevOps teams should learn from the split: devops-hd5ff.sevalla.app/reddits-r-op... #AI #Linux

devops-hd5ff.sevalla.appReddit’s r/opensource AI Ban Targets the Wrong ProblemReddit’s largest open-source community is cracking down on AI-generated projects, prompting criticism over sweeping restrictions that could exclude legitimate developers. As Linux takes a different ap...
Tom Smith
@ctsmithiii.bsky.social

Mainframe change is slow because a few senior engineers hold the knowledge. IBM Z Atlas maps the full z/OS stack and helps teams prove a change is safe before production. IBM's Andy Bradfield explains how it works. coderlegion.com/32375/ibm-z-...

coderlegion.comIBM Z Atlas Uses AI to Prove Mainframe Changes Are Safe Before They Hit ProductionChanging a mainframe is slow for a reason. One middleware upgrade can touch dozens of applications. And the knowledge of how everything connects often lives in the heads of a few senior engineers, man...
Tom Smith
@ctsmithiii.bsky.social

Residency is where AI runs. Sovereignty is who controls it. F5's Ahmed Guetari explains how F5, NVIDIA, Telenor, and Indosat are putting identity, policy, and egress controls where AI agents can't bypass them. coderlegion.com/32586/data-r... #AgenticAI #AISecurity #SovereignAI #NVIDIA #Kubernetes

coderlegion.comData Residency Isn't Sovereignty: F5 and NVIDIA Add a Control Layer for AI AgentsEurope and Asia want AI they control. Governments and enterprises are pushing for models and infrastructure that run locally, under local rules. But putting GPUs in-country doesn't answer the harder q...
Tom Smith
@ctsmithiii.bsky.social

Oracle published its Fusion setup knowledge as AI skills in a public Git repo. Agents configure and test. People approve. At the keynote, the demo ended with an audit receipt for every action. Full write-up on CoderLegion. coderlegion.com/32584/oracle... #OracleAIWorld #AgenticAI #AIAgents #Git

coderlegion.comOracle's Fusion Setup Registry Puts Configuration in a Public Git Repo for AI Agents# Setting up an enterprise application is slow work, and much of it gets repeated. Teams work out which settings depend on which, put the steps in the right order, test the result, and then do it all ...
Tom Smith
@ctsmithiii.bsky.social

When I spoke with B. Donald Harris, a software architect with two decades in .NET, he said AI agents do “a lot of the heavy lifting” on his code. His answer to losing track of the reasoning behind it: HindSite. coderlegion.com/32458/what-a... #AIAgents #BuildInPublic

coderlegion.comWhat AI Coding Loses That Git History Can't Tell You — B Donald Harris**AI coding agents can generate code faster than ever—but can developers still explain why that code exists?** In this CoderLegion Developer Spotlight, software architect and founder **B Donald Harris...
Tom Smith
@ctsmithiii.bsky.social

Recursive just released Flint, an open-weight coding model that runs locally on a MacBook or RTX Spark. Your code stays on your machine and there are no API fees. The catch: it needs more guidance than big closed models. devops-hd5ff.sevalla.app/recursive-fl... #DevOps #AgenticAI

devops-hd5ff.sevalla.appRecursive Flint Puts a Fast Agentic Coding Model on Developers’ LaptopsRecursive has unveiled Flint, a 40-billion-parameter, open-weight coding model designed to run locally on developer hardware. Built with help from the company’s Eureka Machine research system, Flint p...
Tom Smith
@ctsmithiii.bsky.social

Formal verification took 20 person-years for one microkernel. Anthropic and Theorem used Claude to prove 123 open-source libraries won't crash on inputs under 64 MB, and found bugs that fuzzing missed. Fuzz tests may become your first specs. devops.com/claude-write...

devops.comClaude Writes 180 Million Lines of Proofs to Verify 123 Open Source LibrariesFormal verification has long been the gold standard for software correctness. It has also been too expensive for almost everyone. New research from Anthropic suggests that’s changing. Anthropic’s Fron...
Tom Smith
@ctsmithiii.bsky.social

This week: AI made a “theoretical” PHP bug exploitable in days. GitHub launched an npm firewall for CI runners & agents. AAIF added four projects, named two security gaps no standard covers yet. And Anthropic verified 123 open-source libraries w/ 180M lines of proof. coderlegion.com/32190/develo...

coderlegion.comDeveloper Weekly Briefing — October 23, 2026Three threads defined this week. Security researchers — now routinely assisted by AI — found critical bugs faster than maintainers could coordinate patches. Agentic AI standards solidified in meaningf...
Tom Smith
@ctsmithiii.bsky.social

HiddenLayer shows how a compromised LLM gateway can time your coding agent’s approval prompts, read its permission settings, and forge tool calls that steal secrets. Your trust boundary is bigger than the model. coderlegion.com/32043/hidden... #AIAgents #DevSecOps #AppSec

coderlegion.comHiddenLayer: A Hijacked LLM Gateway Can Turn Your Coding Agent's Own Permissions Against YouMost security talk about AI coding agents focuses on the model. Will it run a bad command? Can a poisoned README trick it? New research from HiddenLayer looks somewhere else: the plumbing between the ...
Tom Smith
@ctsmithiii.bsky.social

Straiker research: CyberCartel built a multi-agent attack system on Claude and Grok and aimed it at 400+ Latin American financial targets. It used the same tools developers use daily. Here's what that means for teams building agents. coderlegion.com/32054/cyberc... #AISecurity #AgenticAI

coderlegion.comCyberCartel Pointed Claude and Grok Agents at 400+ Banks. The Stack Looks Like Yours.A financial crime group active since 2012 just showed developers what their everyday agent stack looks like in the wrong hands. New research from Straiker shows how CyberCartel built a multi-agent att...
Tom Smith
@ctsmithiii.bsky.social

PHP shipped emergency fixes for PHP2Shell, two 9.2-rated flaws that trace back to PHP 5. On 8.2 or later? Patch and restart. On end-of-life PHP? It’s harder. PHP Foundation board member Matthew Weier O’Phinney explains what to do and how AI sped up the process. coderlegion.com/32048/php2sh...

coderlegion.comPHP2Shell: Two 9.2-Rated Flaws Reach Back to PHP 5. Here's the Plan for EOL TeamsPHP shipped emergency patches on October 21 for two critical flaws now known as PHP2Shell. Both are rated 9.2 under CVSS v4.0. Both can let an unauthenticated attacker run code on your server. The fix...
Tom Smith
@ctsmithiii.bsky.social

Install time is where npm attackers have done their best work this year. GitHub's package firewall, now in public preview, puts a policy check between the registry and your CI runners and AI agents. Cooldowns, malware checks, attestation checks, in one place. devops-hd5ff.sevalla.app/github-puts-...

devops-hd5ff.sevalla.appGitHub Puts a Firewall Between npm and Your CI RunnersGitHub’s new package firewall puts enterprise security policies between npm registries and the developers, CI runners and AI coding agents consuming packages. With malware detection, attestation check...
Tom Smith
@ctsmithiii.bsky.social

Factory-built AI data centers that deploy in 7 months by going where power is — not waiting for power to arrive. Talked with Mod42 CRO Valerie Crafton about how the modular model works and what adaptive reuse of industrial buildings looks like. coderlegion.com/31879/factor... #AIInfrastructure

coderlegion.comFactory-Built AI Data Centers: Mod42's Answer to the Power Problem*Valerie Crafton has spent more than 20 years on the owner side of hyperscale data center construction. As Chief Revenue Officer at Mod42, she's now asking a question the industry has largely avoided:...
Tom Smith
@ctsmithiii.bsky.social

Google Research released Harness², an open-source framework that tunes an AI agent's harness — prompts, tools, memory, guardrails — instead of the model. First-party tests show gains up to 11.5 points. The catch: more runs, more API cost and no sandbox by default. techstrong.ai/agentic-ai/g...

techstrong.aiGoogle Research Releases Harness² to Improve AI Agents Without Retraining ModelsBigger models aren't the only route to smarter AI agents. 🧠Google's open-source Harness² lets agents improve their own prompts, memory, tools and workflows—without retraining.Early gains reach 11.8 po...
Tom Smith
@ctsmithiii.bsky.social

AI agents can now reverse-engineer compiled software without source code. That opens a path to modernizing legacy systems. It also means your shipped code is easier to read than you think. Here's what DevOps teams should do about it: devops-hd5ff.sevalla.app/ai-agents-ca... #DevOps #AppSec

devops-hd5ff.sevalla.appAI Agents Can Now Take Software Apart. DevOps Teams Need a PlanAI-powered reverse engineering is making it easier to understand and rebuild software without source code. Tools such as REA and increasingly capable AI models create opportunities for legacy moderniz...
Tom Smith
@ctsmithiii.bsky.social

Microsoft Foundry's September update treats AI agents like production workloads. Routines put agents on a schedule. Tool Search loads tools on demand to cut token costs. Insights reads traces and proposes fixes for humans to test. devops-hd5ff.sevalla.app/microsoft-fo... #DevOps #AIAgents

devops-hd5ff.sevalla.appMicrosoft Foundry Puts AI Agents on a Schedule and Under WatchMicrosoft’s September Foundry updates focus on making AI agents production-ready with automated routines, lower token costs, trace-based insights and improved resilience. For DevOps teams, the changes...
Tom Smith
@ctsmithiii.bsky.social

GitHub made AI Scan for pull requests generally available. It flags vulnerabilities in PHP, Bash, Terraform, and Dockerfiles, which CodeQL doesn't cover. No Copilot license needed, but findings are advisory, and doesn't scan forked PRs. devops-hd5ff.sevalla.app/github-bring... #DevSecOps #GitHub

devops-hd5ff.sevalla.appGitHub Brings AI Security Scanning to Pull Requests CodeQL Can’t CoverGitHub’s AI Scan brings AI-powered vulnerability detection to pull requests involving languages, scripts and infrastructure files beyond CodeQL’s existing coverage. Paired with the general availabilit...
Tom Smith
@ctsmithiii.bsky.social

Dean Hall, the developer behind DayZ, just released Brutal, a C# framework for building games or engines. It's small by design and free for commercial use. The bigger lesson for DevOps teams: know who controls your tools and what to do if the terms change. devops-hd5ff.sevalla.app/dean-hall-op...

devops-hd5ff.sevalla.appDean Hall Open Sources Brutal to Give Game Studios a Way Out of Engine Lock-InDayZ creator Dean Hall has unveiled Brutal, a free C# framework designed to give game developers greater control over their technology and reduce dependence on commercial engines. Already used in proj...
Tom Smith
@ctsmithiii.bsky.social

When I spoke with Bryan MacLee, an oil and gas truck driver in Utah, he told me what he likes least about web development: “I love programming. I hate wiring APIs.” So he’s building a language where the compiler handles it. coderlegion.com/31246/the-tr... #Programming #BuildInPublic

coderlegion.comThe Truck Driver Building His Own Programming Language- Meet Bryan MacLee# Developer Spotlight: Meet Bryan MacLee — The Truck Driver Building His Own Programming Language 🚀 What if you worked long shifts in the oil and gas industry and spent your spare time building your o...
Tom Smith
@ctsmithiii.bsky.social

Figma: teams now write 17x more code but ship only 1.3x more releases. Its new code layers and Specs aim to give designers, developers, and AI agents the same context before anything hits the pipeline. Here's what DevOps teams should watch: devops-hd5ff.sevalla.app/figma-gives-... #DevOps #AIAgents

devops-hd5ff.sevalla.appFigma Gives AI Agents a Spec Sheet and Developers a Shared CanvasFigma introduces Specs, code layers and expanded MCP tools to connect AI agents, designers and developers while improving design-to-code workflows.
Tom Smith
@ctsmithiii.bsky.social

Anthropic hit 30,000 merges a day, and Git couldn’t keep up. So they built their own VCS. Plus: GitLab CVSS 10, GitHub push attribution, npm tightening supply chain trust. Developer Weekly Briefing Issue 020. coderlegion.com/31352/develo...

coderlegion.comDeveloper Weekly Briefing — October 16, 2026A week defined by two big ideas running in parallel: AI agents are breaking the infrastructure underneath them, and the security surface around developer workflows keeps growing. Both threads showed u...
Tom Smith
@ctsmithiii.bsky.social

Apple just upstreamed clang-ssaf-driver to LLVM. It analyzes a whole C++ project as it builds, then proposes rewrites, starting with bounds-safety fixes for raw pointers and arrays. Output is a patch plus SARIF. Expected in LLVM 24. devops.com/apple-brings...

devops.comApple Brings Whole-Program C++ Hardening to ClangApple has added a new tool to the upstream LLVM project that could change how teams harden large C++ codebases. The clang-ssaf-driver, merged into LLVM Git this week, analyzes an entire project as it ...
Tom Smith
@ctsmithiii.bsky.social

SpaceX's new X Subscription puts Grok, Cursor, and X Premium on one bill, from $8 to $200 a month. Cheaper on paper. But coding and chat now share one usage pool, and the switch is permanent. Here's what dev teams should check first. devops.com/one-bill-for...

devops.comOne Bill for Grok, Cursor, and X: What SpaceX’s Bundle Means for DevelopersSpaceX wants to be the single line item for your AI coding tool, your chatbot, and your social media account. On October 12, SpaceX Super Intelligence (SpaceXSI), the AI unit formerly known as xAI, in...
Tom Smith
@ctsmithiii.bsky.social

Claude agents just got easier to debug. Anthropic added OpenTelemetry trace export for the Messages API, Managed Agents, and SDKs. Traces follow GenAI conventions, so they work across providers in the tools you already run. devops.com/claude-platf... #DevOps #Observability

devops.comClaude Platform Now Sends Agent Traces Straight to Your Observability StackAnthropic is making it easier to see what Claude-based agents do in production. The company has added OpenTelemetry trace export to the Claude Platform. Developers can now send traces from the Message...
Tom Smith
@ctsmithiii.bsky.social

#Nvidia has open-sourced the full Run:ai platform as part of DSX AI Factory. Teams get GPU-aware scheduling, CUDA-native fractioning, and quota management for Kubernetes. Eight partners are already building on it. techstrong.ai/articles/nvi... #RunAI #OpenSource #Kubernetes

techstrong.aiNVIDIA Hands Run:ai to the Open Source CommunityNvidia open-sources its full Run:ai platform for DSX AI Factory, giving teams GPU scheduling, fractioning, and quota tools for Kubernetes.
Tom Smith
@ctsmithiii.bsky.social

At Info-Tech LIVE in June, someone said: “AI collapsed access to research. The value now is the advisory piece.” Today Infotech answered that with CIO Analytics. API-first. Live data. Analyst guidance grounded in what’s actually happening in your environment. coderlegion.com/31111/when-a...

coderlegion.comWhen AI Commoditizes Your Product, You Build a PlatformIn June, at Info-Tech LIVE in Las Vegas, I sat in a media roundtable with Infotech CEO Tom Zehren and founder Joel McLean while they talked about where the research and advisory industry was headed. O...
Tom Smith
@ctsmithiii.bsky.social

GitLab fixed 24 vulnerabilities in 19.4.2, 19.3.5, and 19.2.8, including a CVSS 10 CI/CD bug that allows unauthenticated remote code execution. Two more hit the Duo Agent Platform. It's the fourth critical release in about eight weeks. techstrong.ai/articles/git... #GitLab #DevSecOps #DevOps #CICD

techstrong.aiGitLab Fixes CVSS 10 Flaw in CI/CD Regex Engine, Plus 23 Other VulnerabilitiesGitLab patched 24 flaws in 19.4.2, 19.3.5 and 19.2.8, including a CVSS 10 CI/CD bug that allows unauthenticated code execution. Upgrade now.
Tom Smith
@ctsmithiii.bsky.social

GitHub's new App updates target over-privileged automation: create repos without admin rights, manage app installs without an admin's PAT, and roll out expiring tokens in stages. Practical least privilege for DevOps teams. devops.com/github-narro... #GitHub #DevOps

devops.comGitHub Narrows App Permissions to Pull Teams Off Classic PATsGitHub is giving DevOps teams more ways to limit an automation job to only the access it needs. A batch of GitHub Apps updates released Oct. 13 adds narrower permissions, relaxes a long-standing insta...
Tom Smith
@ctsmithiii.bsky.social

npm trusted publishing configurations now expire if they don't complete a publish within 48 hours. The goal: stop dormant trust in a repo name from surviving an ownership change. npm also now blocks publishing from issue_comment workflows. Details: devops.com/npm-puts-a-4... #npm #DevSecOps

devops.comnpm Puts a 48-Hour Clock on Unused Trusted Publishing ConfigurationsGitHub has added an expiration date to unused npm trusted publishing configurations. Any configuration that doesn’t complete a successful publish within 48 hours of creation now expires and can no lon...
Tom Smith
@ctsmithiii.bsky.social

Anthropic now merges 30,000+ code changes a day, up from 2,500 in May. Git couldn't keep up, so the company built its own server-first version control system. The bigger question for DevOps teams: what does CI mean when agents never stop shipping? devops.com/anthropic-bu... #DevOps #Git

devops.comAnthropic Builds Its Own Source Control After AI Agents Outgrow GitAnthropic has moved its internal monorepo off Git and onto a version control system it built from scratch. The reason is simple. Its AI agents now write code faster than Git-based infrastructure can h...

Tom Smith reposted

Ron Filipkowski
@ronfilipkowski.bsky.social

Trump and Musk are doing everything they can to try and force Ukraine to surrender to Putin while Musk spends over $300 million to try and buy the midterm elections to maintain total power. The American government under Republicans are on the side of evil. Vote them out.