InfoWorld
-
Cursor removes malicious Claude Code extension after SSH backdoor attempt
A malicious version of Anthropic’s Claude Code extension distributed through the Cursor marketplace attempted to install a persistent Secure Shell (SSH) backdoor on developers’ machines, potentially giving attackers remote access to systems holding source code, credentials and other sensitive information. “Between about 2:27am PT and 1:35pm PT today, a…
-
How fixing our data infrastructure before it broke us gave back 6,200 engineering hours
Just about every CTO at a growth-stage company that I know is carrying an infrastructure problem they are quietly deciding not to look at. The system works, so the problem stays out of sight right up until something drags it into the open. That “something,” in our particular case, was a large UK-based bank. The new customer arrived with the expectation of…
-
Are AI certifications still worth it? What changed in 2026
Same question, a different answer Earlier this year, in Are AI certifications worth the investment? , I argued that AI certifications ranked among the highest-return investments an IT professional could make. Much of that case still holds. But the ground has shifted since I wrote that piece in February, and a responsible update has to say so plainly. Two of…
-
Seven egregious failures of modern web tech
The modern web is a miracle of engineering, but its history is littered with brilliant concepts that flamed out in execution. For every innovation that stuck the landing, there is a promising technology that fell on its face. Each of these failures offers an object lesson for us as software developers. New tech is kind of a compulsion. We love to gaze at…
-
GitHub bets on multi-agent software development with Copilot overhaul
GitHub is expanding Copilot beyond code generation and developer assistance, launching a redesigned Copilot app and a new Projects capability that enables teams to coordinate multiple AI agents, share context from tools and repositories, and manage software development workflows from a single platform. The updates to GitHub Copilot , announced at the…
-
Mistral open-sources AI model despite warning it could aid cyberattacks
A trillion-parameter AI model that its developer says could help attackers carry out real cyberattacks is now free to download, modify and run outside the developer’s control. Mistral AI released the open weights of Mistral Large 4, which it calls “Le Chonk,” on Thursday, weeks after putting the multimodal model into public preview. The Paris-based company…
-
AI agents are upending digital business processes
People have discovered AI agents running on cloud-based platforms, and suddenly, those agents are the answer to every bit of financial and operational friction in their lives. Move money from one bank account to another to chase a better interest rate. Pay bills automatically. Analyze spending patterns. Optimize subscriptions. Question fees. Move funds…
-
Simplifying .NET toolchain installs with dotnetup
If you’ve experimented with Rust , you already know how simple it is to get a basic toolchain in place, with the simple rustup command-line tool. The same tool works on Windows, macOS, and Linux, building a consistent environment that’s ready for you to pick up your favorite coding editor and start work. It’s a simple enough tool, and one that’s done much…
-
Gheist turns GitHub Actions into a secret extraction service
A threat actor dubbed Gheist is turning compromised GitHub accounts into credential-harvesting platforms. By planting malicious GitHub Actions workflows in private repositories, attackers can expose repository and environment secrets, then retrieve them through GitHub APIs before deleting evidence of the activity. Tracked since September 15 by Wiz Research…
-
Oracle adds native Snowflake service to OCI to ease data integration
Oracle on Tuesday said it has partnered with Snowflake to make the latter’s AI Data Cloud available as a native service on Oracle Cloud Infrastructure (OCI). The partnership, announced at Oracle’s ongoing AI World conference, aims to help enterprises reduce data movement between the two platforms and the associated costs while accelerating analytics and AI…
-
Six elements of resilient AI orchestration platforms
While many organizations are in early AI agent rollouts, research suggests that more will scale to greater numbers of agents and assistants in the coming year. An August 2026 report states that 66% of enterprises are likely to invest in digital workers in the next 12 months. It reports that the top requirements for these agents include demonstrated…
-
Eight reasons you are better than coding agents
Last week I wrote about how coding agents are better developers than humans . I’ll stand by that — the current agents can write code better, faster, longer, and with far less complaining than we humans can. But that doesn’t make humans unnecessary — quite the contrary. Humans still play a vital role in the process of building software. Here are eight…
-
Attackers compromised 42 GitHub repositories by using files too large to be searched
A security research firm reported Monday that it had identified breaches of 42 third-party GitHub repositories in which attackers had deployed payload blobs large enough “to evade the GitHub search and API paths normally used to find this kind of compromise.” The report from JFrog Security Research said the victimized repositories contained execution hooks…
-
Python jettisons the native JIT, at least for now
The experimental just-in-time compiler, or JIT, for CPython will be removed after its maintainers missed deadlines for its formalization set by the Python Steering Council. According to reporting at LWN.net , the move comes after the council formally paused work on the JIT in June 2026 until it approved a Python Enhancement Proposal, or PEP, that described…
-
OpenAI bets on AI economics with lower-cost GPT-6.1 Terra
OpenAI has launched GPT-6.1 Terra, a new reasoning model that it says delivers near-frontier performance on visual reasoning, professional task execution, and computer-use benchmarks without the premium price tag. Replacing GPT-5.6 Terra, the model is aimed at organizations seeking better accuracy and automation capabilities for large-scale operational…
-
Alibaba AI model tried to send data to Beijing server, Cohere says
An Alibaba AI model generated an unexpected command to upload data to a Beijing-region cloud storage service during a cybersecurity evaluation, rival developer Cohere said, raising concerns about the security of AI agents with access to enterprise systems. The model, Qwen3.8-Flash-Next, was being tested using Microsoft’s CTI-REALM cybersecurity benchmark…
-
Oracle pushes AI deeper into enterprise workflows with Fusion Companion
Oracle is adding a new orchestration layer to its Fusion Cloud Applications suite to help enterprises automate business workflows, coordinate AI agents, and execute tasks across applications with less manual intervention. The new layer, named Fusion Companion, will allow enterprise users to initiate business tasks through external AI assistants such as…
-
When GraphQL earns its place in an enterprise application, and when it doesn’t
The value of GraphQL emerges for a specific type of enterprise screen, one that brings together highly interdependent data across multiple sources. In all other cases, there is a price to pay, which is bound to come out after you have already made the decision. I build internal access-governance applications, with React front ends that talk to both REST and…
-
Robot eyeballs make open source more valuable
“Bug-free, secure code is now attainable” is a nice idea . It just happens to be wrong. That ambitious statement was one of more than 80 replies to Eric Raymond’s optimistic take on AI-assisted vulnerability discoveries. Because the corpus of human-written code is finite, Raymond argues, so are its defects. With “a million friendly robots” to help fix them…
-
Digital sovereignty as a design requirement
Digital sovereignty has moved from a policy discussion to a practical enterprise cloud computing problem. For years, most organizations treated public cloud as a location-flexible utility. They placed workloads where performance, price, managed services, and availability looked best. Data residency requirements existed, of course, but they were often…
-
Oracle adds a semantic layer to ground AI agents in the business context
Oracle is expanding its Autonomous AI Lakehouse with a Business Semantic Layer designed to give AI agents a consistent understanding of enterprise data, a move aimed at improving the accuracy of AI-generated insights and helping organizations scale agentic applications across business functions. To ground AI agents in business context, the Business Semantic…
-
How malicious downloads can trick AI coding agents into compromising themselves
Malicious instruction files planted in a computer’s Downloads folder can trick AI coding agents into executing harmful code or exposing authentication tokens, Forever Security said after blocking an attempted attack on a customer’s machine and demonstrating similar techniques against OpenAI’s Codex and Anthropic’s Claude Code. In its research report, the…
-
Your npm install was safe. What happens when the package runs?
For years, one of the first questions we asked about a suspicious npm package was whether it ran a pre-install or postinstall script. Those hooks can execute before a developer has written a line of code that uses the dependency. Blocking them is a sensible defense. It prevents a particular kind of package from running just because someone installed it. But…
-
How to make enterprise APIs agent-ready
Enterprises spent the last decade building API programs. A large organization now runs thousands of internal APIs, each with a spec, owner, authentication scheme, and access policies enforced at a gateway. As agents move into production, those APIs are the obvious source of the context agents need: customer records, order status, inventory, pricing, and…
-
Stop building agents that can’t change models
No one can predict which AI provider will win the next benchmark cycle. The smarter approach is to build an architecture that can adapt as models change. One with a stable contract between agents and models, tools and state that exist outside any single provider, and evaluations that make each model change a measurable decision. The goal isn’t to avoid…
-
OpenClaw creator spent $10 million on AI tokens last month
OpenClaw, the AI digital assistant, is looking to establish itself as an essential tool for users — but if it is as profligate in its use of tokens as its creator, Pete Steinberger, then users could be in for some huge usage bills. Steinberger, now working for OpenAI , spent $10 million on AI tokens there last month, he told Cloudflare CEO Dane Knecht at…
-
Google targets AI agents’ idle-time costs with new compute service
As enterprises scale AI agents, Google is betting that idle infrastructure costs could become a major barrier to adoption. To address that challenge, the company on Thursday launched Agent Compute Engine, a service that suspends inactive agents and restores them on demand while preserving their execution state. AI agents often spend long periods waiting for…
-
CA shutdown puts Java, containers, and security appliances in the certificate crosshairs
A certificate authority’s decision to abandon the global SSL/TLS market is exposing a weakness many organizations rarely examine: their dependence on complex PKI trust chains. Following the compromise of private keys behind eight of its intermediate certificate authorities, eMudhra is exiting the global SSL/TLS certificate business and is offering customers…
-
Don’t assume resilience from your cloud provider
The recent Google Cloud incident in London is the kind of event that should force enterprises to rethink what cloud resilience really means. Google said the disruption was caused by a “power event” affecting London-based data centers in its europe-west2 region. The issue appeared early in the day and affected cloud services that many organizations depend…
-
When resilience is out of your control
The recent Google Cloud incident in London is the kind of event that should force enterprises to rethink what cloud resilience really means. Google said the disruption was caused by a “power event” affecting London-based data centers in its europe-west2 region. The issue appeared early in the day and affected cloud services that many organizations depend…
