Evergreen Overview
Application architecture, developer workflow, tooling, and production patterns for building AI systems.
AI Engineering
Application architecture, developer workflow, tooling, and production patterns for building AI systems.
ai engineeringllm application developmentagent engineeringmcpdeveloper toolingai systems
What this page covers
- Core concepts for ai engineering
- Useful references, notes, and curated examples
- Practical links back to AI systems and operational risk
Why it matters
- It creates better language for technical and governance discussions
- It helps teams connect theory to deployed workflows
- It supports more repeatable review and decision-making
Who this page is for
- Researchers and builders working with AI systems
- Security and governance teams
- Leaders looking for current reference material
References
Current notes, events, and source material
These items are included because they add useful evidence, framing, implementation detail, or upcoming context for teams working in this area.
Now in preview: Find and fix software vulnerabilities with CodeMender
Google opened a preview of CodeMender, an AI code-security agent delivered through Gemini Enterprise Agent Platform and AI Threat Defense. It is designed to inspect code, identify and validate potentially exploitable defects, and produce targeted fixes, with Google’s specialized Gemini 3.5 Flash Cyber model initially restricted to governments and trusted partners.
Authenticate legitimate AI agent traffic with AWS WAF Bot Control
AWS provides a four-step technical guide to authenticating automated agents with Web Bot Authentication: deploy WAF Bot Control, sign requests with Ed25519 HTTP Message Signatures, write rules against verification labels, and monitor attempts through WAF logs and CloudWatch.
NVIDIA Forms 37-Member Open Secure AI Alliance and Open-Sources NOOA Framework
NVIDIA launched the Open Secure AI Alliance and contributed NOOA, an Apache-2.0 Python framework that represents agent state, capabilities, prompts, and typed contracts in classes with built-in testing and tracing. NVIDIA reports 86.8% on CyberGym L1 with GPT-5.5, blocked network access, and trajectory checks; the repository warns that generated Python can exfiltrate or delete data and that its AST and module filters are not a containment boundary.
The Wiz Red Agent is Now Generally Available
Wiz launched Red Agent for continuous application and API penetration testing. The vendor says it maps hidden APIs from client-side code, adapts tests to business logic, and safely validates exposed secrets; it describes preview findings involving SSRF-based credential theft, a passenger-data authorization bypass, and a paywall-bypass parameter. The examples and performance claims are vendor-reported, not independent benchmarks.
Introducing Gemini 3.6 Flash, 3.5 Flash-Lite, and 3.5 Flash Cyber
Google introduced Gemini 3.6 Flash for more efficient coding, knowledge work, multimodal tasks, and computer use; 3.5 Flash-Lite for high-throughput, low-latency agent workflows; and 3.5 Flash Cyber for vulnerability research inside CodeMender. Google reports lower token use for 3.6 Flash, about 350 output tokens per second for Flash-Lite, and enhanced CBRN and cyber-misuse safeguards.
Decoupled DiLoCo: A new frontier for resilient, distributed AI training
Google DeepMind’s Decoupled DiLoCo divides model training into asynchronous compute islands across data centers. Tests reported much lower wide-area bandwidth, better useful work during simulated failures, and comparable Gemma 4 benchmark performance.
Claude Mythos research prompts HAWK withdrawal and speeds a reduced-round AES attack
Anthropic reports that Claude Mythos Preview helped produce an end-to-end HAWK-256 key-recovery attack and a projected 200- to 800-fold speedup for an attack on seven-round AES-128. Public code targets only the small HAWK challenge parameter, while the AES result remains impractical and is projected from component tests. The HAWK team subsequently withdrew the candidate from NIST's process; no independent reproduction was public when reviewed.
Rethinking Scanning for the AI Era: Wiz’s Agentic Code Security System
Wiz proposes a three-tier application-security architecture: deterministic rules on every change, continuous AI reasoning across repositories and pull requests for logic and data-flow flaws, and expensive agentic pentesting only for high-value applications or risks. Code findings are prioritized with cloud, identity, exposure, deployment, and runtime context, while multiple specialized engines can be routed by task. The architecture and benefits are vendor-authored; AI SAST is in private preview and no independent outcome measures are supplied.
Introducing Gemma 4 12B: a unified, encoder-free multimodal model
Google introduced Gemma 4 12B, an Apache 2.0 model that accepts text, vision, and native audio without separate multimodal encoders. It targets local agentic workloads and can run on laptops with 16 GB of memory.
Researcher Says AI Helped Develop Linux Traffic-Control Race Into Root Exploit
STAR Labs researcher Lee Jia Jie reports using an unnamed AI assistant to identify and weaponize CVE-2026-53264, a Linux network-scheduler use-after-free race, into local root on a targeted CentOS Stream 9 kernel. The exploit needs a local foothold, unprivileged user namespaces, specific traffic-control options, and kernel-specific ROP offsets; upstream fixed the lifetime bug by deferring frees through RCU.
RufRoot: unauthenticated Ruflo MCP bridge enabled RCE and memory poisoning
Before Ruflo 3.16.3, its default Docker Compose deployment bound the MCP bridge to all interfaces without authentication. A reachable attacker could invoke the terminal tool, read model-provider keys and conversations, spawn agents, and poison persistent AgentDB patterns. Noma Labs verified the chain; the patch adds loopback binding, bearer authentication for public exposure, an opt-in terminal tool, authenticated MongoDB, tighter CORS and container defaults, and regression tests.
Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended
Hunt.io recovered 585 files and Hermes logs from an exposed staging server used against Thailand's Ministry of Finance. The evidence shows an operator who already had target knowledge and access running Hermes in unattended “YOLO” mode for repetitive post-exploitation enumeration, while also staging Hadoop exploitation scripts and a custom Hades implant; it does not show the agent finding the initial entry point or novel vulnerabilities.
TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development
Unit 42 analyzes TuxBot v3 Evolution, a roughly 70%-functional IoT botnet framework with code compiled for 17 architectures. Researchers found raw model reasoning, hallucinated cryptography, and other evidence of unreviewed LLM-generated code in the source.
Play video
Fine-Grained Authorization: The Missing Piece in Agentic AI Security - Shivay Lamba - NDC Sydney
Shivay Lamba explains how fine-grained, relationship-based authorization can enforce per-user and per-document access in RAG and agent pipelines. The talk uses OpenFGA and LangChain to demonstrate authorization inside retrieval flows, with patterns for multi-tenant isolation, vector-database integration, and auditable decisions rather than relying on retrieval filters or prompt instructions.
SharedRoot: Escaping the Claude Cowork Sandbox
Accomplish AI demonstrates SharedRoot, a Claude Cowork local-session escape in which an untrusted task reaches guest root through CVE-2026-46331 and then accesses the Mac host because the entire host filesystem is mounted read-write inside the VM. The durable failure is architectural—unprivileged user namespaces, reachable kernel modules, a permissive seccomp filter, an unhardened root broker, and an over-broad host mount—rather than the single kernel bug; Cowork now defaults to cloud execution.
Play video
HitchHacker's Guide to Building Secure Agents - Kenneth Yeung & Kasimir Schulz
Conference talk on secure AI agents, focusing on how tool use, identity, and execution boundaries change when assistants can act across systems.
Introducing computer use in Gemini 3.5 Flash
Google integrated computer use into Gemini 3.5 Flash so agents can act across browser, mobile, and desktop environments. Optional enterprise safeguards can require confirmation for sensitive actions or stop a task when indirect prompt injection is detected.
Introducing Gemini 3.5 Flash Cyber
Google introduces Gemini 3.5 Flash Cyber, a lightweight cybersecurity model to find and patch vulnerabilities.
ChatGPT Enterprise & Edu Codex release notes: May 2026
OpenAI’s Enterprise and Edu release notes describe Codex updates including goal mode, browser improvements, locked computer use, app-window context, admin analytics, and plugin sharing status.
Investing in multi-agent AI safety research
Google DeepMind and partners announce a $10M funding call for multi-agent safety research.
Gemma 4: Byte for byte, the most capable open models
Gemma 4: Our most intelligent open models to date, purpose-built for advanced reasoning and agentic workflows.
Play video
10 tips to level up your AI-assisted coding - Aleksander Stensby - NDC Copenhagen 2026
NDC Copenhagen 2026 talk on AI-assisted coding with Cursor and Claude Code, covering prompting, context engineering, testing, debugging, daily workflow integration, and MCP connections to developer tools.
Play video
How to Secure Agents using OAuth — Jared Hanson (Keycard, Passport.js)
AI Engineer session on How to Secure Agents using OAuth, presented by Jared Hanson (Keycard, Passport.js). It adds practical context for how teams are building and operating AI systems in production.
Play video
$1 AI Guardrails: The Unreasonable Effectiveness of Finetuned ModernBERTs — Diego Carpentero
AI Engineer session on $1 AI Guardrails: The Unreasonable Effectiveness of Finetuned ModernBERTs, presented by Diego Carpentero. It adds practical context for how teams are building and operating AI systems in production.