Hey {{first name | there}}. This week had a way of exposing the assumptions that quietly build up over time.

A contributor who still has access, an AI agent that follows the wrong instruction, and a setting you assumed hadn't changed all show how easy it is to rely on yesterday's assumptions.

It's a good reminder to revisit the things you've been trusting by default.

In today's roundup:

You will also find upcoming events, a podcast worth listening to, and curated job opportunities across the ecosystem.

Let’s dive in👇🏼

‘GitLost’ Flaw Lets Attackers Trick GitHub AI Agent Into Leaking Private Repos
Noma researchers found that a GitHub Agentic Workflows agent could be talked into copying private repo contents into a public comment. No stolen credentials, no code, just a public issue and the word "additionally."

Vercel acquires Better Auth to give AI agents their own identity
Vercel is acquiring Better Auth, whose team was already building a way for AI agents to hold scoped, revocable identities of their own, rather than borrowing the login of whoever deployed them.

OpenMandriva claims disgruntled admin trashed repos after community bust-up
OpenMandriva says a former contributor used admin access he still held to delete years of work and push a package that could have broken Gnome and Cosmic installs. He denies it was sabotage.

The Kubernetes Approach to AI-Assisted Maintainership Prioritises Human Accountability
Kubernetes formalized how AI fits into contributions: disclose any generative AI use in the PR, no AI-written commit messages, and a human maintainer makes the final call on every merge.

The code review bug hunt is dead. Here’s what developers get wrong
Engineers argue the real job of code review is spotting what you'll hate maintaining later, not finding bugs, which live in runtime states a human skimming a diff can't see. Tests catch those.

If you use Google, you’re training its AI. Here’s how to opt out.
A quiet June change means photos, files, and voice searches across Google Search, Lens, Maps, and Translate can be saved to train its AI. Opting out means unchecking "Save Media" yourself.

Announcing etcd v3.7.0
The datastore behind every Kubernetes cluster now streams large result sets in chunks and cuts control-plane CPU, but it drops legacy v2 components, so read the upgrade guide before rolling it out.

Speedier type checks in TypeScript 7.0 as first stable Go release ships
TypeScript's compiler was rebuilt in Go, and the payoff is full builds running 8 to 12 times faster. Microsoft type-checked VS Code's 2.3 million lines in 10.6 seconds, down from 125.

AWS Builder Center Now Offers Free Sandbox Environments
AWS now offers pre-provisioned sandbox accounts directly from eligible workshops, for 8 hours at a time, once a week. You can deploy, code, and experiment without your own account or fear of a surprise bill.

The only AI glossary you’ll need this year
TechCrunch's living glossary defines the AI vocabulary that fills every meeting now: LLMs, RAG, distillation, MoE, RAMageddon, in plain language, for the moments you'd rather not admit you're unsure.

How to ask for help from people who don't know you
Ever had to ask a stranger for help and felt that flicker of awkwardness about how even to start? This essay turns it into a skill you can practise, the kind you'll lean on all through your career and everyday life.

Mark your calendars!

Cloud & Platform Engineering

Software Engineering

Developer Communities & Open Source