Our point of view on shipping AI — page 4 of 5.
- AI Engineering5 min
Seven Times the Weights, 1.2 Times the Compute
By Petru Popa ·Mistral's new open-weights moderation model is measured against GPT-OSS-Safeguard-20B. That baseline holds 21B parameters but runs 3.6B per token, so the seven-fold size gap is a memory ratio, not a compute one — and the win rate flips depending on whether your guard filters input or output.
Read - AI Engineering6 min
The 43x You Accept for the 0.66x
By Petru Popa ·Cloudflare published @cloudflare/computer, an agent runtime that routes work between isolates and containers. Its own performance doc says the filesystem beats real disk on metadata and runs up to 43x slower on bulk bytes. That ratio, not the container bill, is the adoption question.
Read - AI Engineering6 min
The CPU Serving Speedup You Won't Measure
By Petru Popa ·vLLM reports up to 6.2x throughput on Arm CPUs. The baseline is code from before the first Arm wheel shipped, and the fastest configuration is a quantization pipeline rather than a flag. What that changes for capacity planning this quarter.
Read - AI Engineering6 min
Your Eval Sandbox Is a Sentence in the Prompt
By Petru Popa ·Anthropic reviewed 141,006 cyber-evaluation runs and found six that reached real systems. Reading the reference harness for one of the benchmarks it names shows the isolation was never enforced anywhere except the prompt.
Read - Dev Tools6 min
npm Revoked the Skeleton Key, Not the Publish Key
By Petru Popa ·npm's 2FA-bypass tokens can no longer take over an account, but they can still publish until January 2027. The migration npm recommends does not exist yet for self-hosted runners — and the docs, not the changelog, are where that is written down.
Read - Dev Tools5 min
The Version Pin That Stopped Protecting You
By Petru Popa ·GitHub Models is gone: playground, catalog, inference API, BYOK. The migration is not a version bump. Two of the three major tags on the official Action still resolve to code that calls the retired endpoint, and the replacement needs a CLI install and a personal access token the old workflow never had.
Read - Dev Tools6 min
A Patch Release With a Major Version Inside
By Petru Popa ·CodeQL 2.26.1 is billed as improved analysis accuracy. The pack changelogs behind it record a breaking change in C/C++, undocumented changes in Python and C#, and alert counts that move in both directions on code nobody touched.
Read - AI Engineering5 min
The Config Field Was an Interpreter
By Petru Popa ·A four-and-a-half-day intrusion started with a dataset config field that got rendered by a template engine. The bug is ordinary. What it reached afterwards is the part worth reading twice.
Read - Dev Tools5 min
Approval Gates for Code You Didn't Write
By Petru Popa ·GitHub shipped five small changes in a day — workflow approval, malware advisories, a Copilot app policy, managed settings, and agent telemetry. Read together, they say something about who is expected to do the governance work.
Read - AI Engineering6 min
A Faster Encoder, If Your Inputs Are Long Enough
By Petru Popa ·Two new encoder models claim a 3.7x speedup over ModernBERT-base on CPU at long context. The speed claim describes a narrow regime, and the license on the model repository caps commercial use at $10 million in annual revenue — which settles the decision for any company above that line before the crossover point matters.
Read - AI Engineering2 min
From PoC to Production: The AI Gap Nobody Budgets For
By Petru Popa ·The proof-of-concept worked. Now comes the 80% no one scoped: evaluation, integration, monitoring, and cost. A practical checklist for getting AI into production.
Read - AI Strategy2 min
Buy, Build, or Fine-Tune? A Decision Guide for Enterprise AI
By Petru Popa ·Not every AI problem deserves a custom model — and not every one is solved by an off-the-shelf API. A simple framework for choosing between buy, build with RAG, and fine-tune.
Read