Our point of view on shipping AI — page 6 of 9.
- AI Strategy6 min
To Block AI Bots, Longest Match Beats File Order
By Petru Popa ·Cloudflare's new Bot Preference Sync generates your robots.txt from the AI bot policy in your dashboard and prepends it to whatever your origin already serves. Prepending is not overriding, and the standard explains why a narrower Allow you wrote years ago still wins.
Read - AI Engineering6 min
Word Error Rate Fell 3.5 Points When Someone Fixed the Transcript
By Petru Popa ·Artificial Analysis hand-corrected 628 VoxPopuli clips and average model word error rate dropped 3.5 points with no retraining. A new set of probes explains the other half of that result: the models scoring best had learned to reproduce the errors.
Read - Dev Tools5 min
Write Access Decides Who Starts the Agent, Not Who It Hears
By Petru Popa ·GitHub shipped shared Copilot cloud agent sessions into Slack and Microsoft Teams in public preview. Only people with repository write access can trigger the agent, and guests cannot start or steer a session at all. But the docs also say the agent reads every message in the conversation. Those are two different boundaries, and only one of them is enforced.
Read - Dev Tools6 min
The OAuth Consent Screen Can Now Hand Back Less Than You Asked For
By Petru Popa ·Cloudflare added an optional_scopes field to third-party OAuth clients, so a user can clear individual permissions at the consent screen and the issued token carries only what survived. The announcement tells you to check the granted scope set. It does not say which field carries it, and neither does the client documentation. RFC 6749 does.
Read - Dev Tools5 min
The Mojo License Is Apache. The MAX SDK License Is Not.
By Petru Popa ·Modular put the Mojo compiler on GitHub under Apache 2.0 with LLVM exceptions. The same repository carries the Modular MAX Community License, whose terms are not the Apache terms and which never names the packages it governs. Nine merged pull requests across all of 2026 answers the other question a technical lead has.
Read - AI Engineering5 min
One NDCG Point for Twelve Times the Index
By Petru Popa ·Late interaction retrieval lands in Sentence Transformers 6.0 with a controlled benchmark behind it: same backbone, same data, one vector per token instead of one per document. The margin is about one NDCG point. The release notes show what that point costs in storage, and the model table shows which knob actually moves it.
Read - Dev Tools6 min
The Reviewable Unit Is the Pull Request, Not the Commit
By Petru Popa ·Wiz published research on an Actions script injection that leaked a Jira API token from a Snowflake runner. The pull request that introduced it carries a commit attributed to Copilot Autofix, and the diff removed the exact mitigation GitHub's own hardening page prescribes. The artifact cannot tell you which lines the model wrote — and that gap, not the model's error rate, is what your review process has to absorb.
Read - Dev Tools6 min
Your Refresh Token Is Now a Lock, Not a Secret
By Petru Popa ·OAuth apps on GitHub can now register up to ten redirect URIs and refresh short-lived tokens. The authorization docs add the part the changelog leaves out: refreshing invalidates the refresh token and the old access token together, which turns a copyable secret into something exactly one process may hold.
Read - AI Engineering6 min
LLM Evaluation Is Three Different Jobs
By Petru Popa ·Picking a model, catching a regression, and watching production are three different measurement problems that share one name. Teams get into trouble when the artifact from one gets used to answer another — and the LLM-as-judge shortcut has failure modes with numbers attached.
Read - AI Engineering6 min
LLM Observability Is Mostly a Schema Problem
By Petru Popa ·Buying a dashboard is the easy half. The hard half is whether your traces carry the fields you will need at two in the morning — and the standard that defines those fields is still marked as in development.
Read - AI Engineering6 min
Pick LLM Evaluation Metrics by What You Can Supply
By Petru Popa ·The usual taxonomy sorts metrics by how they work — n-gram, embedding, model judge. That axis is useless for choosing. Sort them instead by what reference data each one demands from you, because that is the constraint you actually have.
Read - AI Engineering6 min
LLM Testing Already Had a Playbook in 2020
By Petru Popa ·Teams treat testing a language model as a new discipline with no precedent. The methodology that fits it best was published in 2020, and the test type it names as most valuable is the one almost nobody writes.
Read