WebAssembly sandbox blocked file access but left memory and CPU unbounded

A security review of afmpeg, a Go library using FFmpeg compiled to WebAssembly, found that while the sandbox correctly isolated file system and network access, it placed no limits on memory usage or execution time. A crafted media file declaring extreme video dimensions could push the WebAssembly guest to consume up to 4 GB of host memory, potentially triggering an out-of-memory kill on the host process. Separately, a pathological decode loop with no timeout could lock the runtime indefinitely, acting as a silent wedge rather than an outright crash. The developer addressed both issues in a single commit, setting a default 512 MB memory ceiling and a one-hour execution timeout, each overridable by the caller. The fix also establishes a policy that sandbox protections are enabled by default, so users who never consult hardening documentation still receive the safeguards.

Microsoft Adds Preview Tool to Migrate Azure Data Factory Pipelines to Fabric

Microsoft has introduced a built-in preview feature inside Azure Data Factory (ADF) that allows data engineers to migrate ADF pipelines into Fabric Data Factory. The tool, labeled 'Migrate to Fabric (Preview)', is not a one-click migration — it begins with a read-only readiness scan that categorizes pipelines as Ready, Needs Review, Coming Soon, or Not Compatible. Mounting a factory in Fabric creates a snapshot of the ADF structure without copying pipelines or altering the original setup; actual migration only occurs when explicitly triggered. Azure Data Factory has no announced deprecation date and can continue running alongside Fabric during and after the transition. Microsoft recommends that teams starting new pipelines with existing Fabric capacity build directly in Fabric, while those with large ADF estates should plan a phased migration rather than an immediate full rebuild.

Dev Builds Rust Compiler to Turn Code Graphs Into Precise Security Templates

A mechanical-engineer-turned-cybersecurity developer has open-sourced cpg-nuclei-compiler (v1.0.0), a Rust-native tool that converts Code Property Graphs (CPGs) into syntactically accurate Nuclei YAML security templates. The project addresses a core problem in AI-driven security testing, where language models frequently hallucinate schema parameters, misuse CLI flags, and mutate application state without cleanup. The compiler decouples high-level AI reasoning from low-level code generation, using Rust to compute taint graphs and produce templates in milliseconds with near-zero errors. An isolated Docker harness then verifies each template by generating True Positive and True Negative reachability proofs before any pull request is submitted. The approach was validated on a live CVE (CVE-2024-51483) in ProjectDiscovery's official template repository, where the tool standardized a clean lifecycle that left no orphaned database artifacts.

Three Common Pitfalls When Installing a Plugin Into OpenClaw's Agent Gateway

A developer documented three distinct failures encountered while integrating a custom plugin into OpenClaw, an MIT-licensed npm-distributed agent runtime built by steipete and vincentkoc. The first issue arose because OpenClaw's plugin loader refused to load code from WSL's DrvFs mount, which exposes Windows filesystem paths as world-writable (mode 777), a deliberate security measure requiring the plugin to be moved to a native ext4 filesystem with restricted permissions. The second problem was that a loose TypeScript file registered via config could be discovered but would never activate at gateway startup without a proper manifest declaring 'activation: { onStartup: true }', a distinction the CLI surfaces through separate commands. The third failure occurred during installation, when OpenClaw's '--link' install command immediately calls the plugin's register function, exposing a malformed hook matcher argument — an object shape instead of the required array of tool names — as a hard runtime error. Each issue reflected a sensible enforcement by OpenClaw rather than a bug, and resolving all three required using the framework's official scaffold command and reading its generated manifest structure carefully.

Developer Finds Silent Test Flaw in Reversibility Plugin for Agent File Writes

A developer building a reversibility plugin called gx for OpenClaw's before_tool_call hook discovered that initial tests were passing for the wrong reason. The test only verified that a file contained the correct content after a write, which would be true whether gx acted or not, since OpenClaw's native write tool would also complete the write independently. The real fix involved checking the file's contents before the native tool ran, confirming gx had already applied the change first — a check that would fail if the plugin were merely a passive logger. The developer also highlighted the importance of distinguishing an 'Unknown' verdict, meaning the membrane was unreachable, from a deliberate 'Deny', noting that collapsing the two would mask instrumentation failures. This distinction proved useful early on when a misconfigured CLI caused gx to fail silently, which the Unknown state correctly surfaced rather than hiding as a false denial.

Developer finds same silent-failure bug three times in a fortnight across unrelated systems

A software developer discovered that a recurring logic error across three separate systems was collapsing an 'untestable' or 'unknown' state into a binary pass/fail result, masking the true cause of failures. In one case, a Rust project's CI pipeline showed red for 13 days not because code was broken, but because billing issues prevented jobs from ever running — yet the tooling displayed both outcomes identically. A second incident involved a conversation-archive checker where short text probes under 12 characters were silently counted as missing records, causing 18 out of 65 items to be falsely flagged. The developer argues the fix is straightforward: always track three states — hit, miss, and untestable — rather than forcing unknowns into one of two available buckets. A third example, involving a monitoring script the developer had personally mislabelled in their own notes, underscored that even stored verdicts can become stale and misleading over time.

How Relabeling Old Tasks Inflated a Project's Progress Bar by 23 Points Overnight

A developer tracking a Rust project noticed their progress ledger jumped from 29.5% to 52.4% complete in a single day without any new features being shipped. Of the 24 items marked done, 22 were simply relabeled after four audit passes confirmed that existing test coverage across 481 files was already complete. The incident highlighted a flaw in single-axis progress trackers, where administrative verification and genuine new delivery produce identical dashboard movements. Compounding the problem, a parallel tracking system had independently added seven new items and built its own denominator of 112 tasks, leaving two conflicting completion percentages unreconciled. The author argues that progress systems should distinguish between confirming old work and completing new work before the first relabeling pass occurs.

Developer finds test suite missed 1,029 lines due to tests built only on clean inputs

A software developer discovered that a security guard script meant to prevent cross-project file access was blind to 1,029 of 6,309 monitored lines, including 824 executable ones, despite three tests staying green for months. The flaw went undetected because all three tests used only clean, violation-free inputs, meaning a broken detector and a working one produced identical results. The core mistake, the developer explains, is building test suites solely from negative cases — files that should return no violations — which cannot distinguish a functioning rule from a completely blind one. The fix requires every detector test to include both a case that must trigger a finding and one that must not, ensuring neither a permissive nor a blind rule can silently pass. The developer also recommends validating tests against synthetic inputs and previous broken versions of the detector to confirm the new tests genuinely discriminate between correct and faulty behaviour.

PM Modi Calls for Public Role in Water Conservation at Jal Utsav

Prime Minister Narendra Modi stressed that water conservation must go beyond government efforts alone. Speaking at the Jal Utsav initiative, he highlighted the need for broader public involvement in addressing water challenges. Modi emphasized that citizen participation is key to transforming conservation into a lasting grassroots movement. The event also explored the use of AI and drew on best practices from various Indian states.

Meta Encourages Staff to Try Hatch AI Agent While Easing Usage Pressure

Meta is promoting its latest AI agent, called Hatch, to employees as part of its ongoing push to advance artificial intelligence internally. The company is encouraging workers to experiment with the tool, which is described as its most sophisticated AI project to date. However, Meta has simultaneously stepped back from applying heavy pressure on employees to meet AI usage targets, a practice previously associated with so-called tokenmaxxing. The shift suggests the company is balancing enthusiasm for AI adoption with a less coercive approach toward its workforce.

Belgian PM arrives in India for 3-day official visit

PHP Internals Tackles Non-ASCII Identifiers, PEAR Deprecation, and Base-Function Errors

In the week of September 2, 2026, PHP internals saw active discussion on three fronts. Luca Rodenhäuser proposed restricting non-ASCII identifiers in PHP after scanning 5,000 Packagist packages revealed over 1,400 such identifiers, mostly in the math-php library, prompting him to split his proposal into diagnostic, well-formedness, and conformance rules. Nick Sdot advanced an RFC to remove PHP's official endorsement of PEAR, citing the package repository as largely broken, spam-ridden, and unmaintained, with only one independent package — Net_SMTP — still actively maintained. Sjoerd Langkemper announced plans to call a vote on making base-conversion functions like octdec and hexdec throw a ValueError on invalid input, framing it as a procedural formality following earlier consensus. Tim Düsterhus pushed back, arguing these functions are commonly used with untrusted input and that throwing from the Error hierarchy — not intended to be caught — would be a poor design choice.

ITC's big bet makes this stock lose its happy space

US urges G20 to allow AI training on creators' work

Engineer Discovers AI Voice Selection System Was Penalizing Candidates for a Non-Issue

A developer built an automated system to score and rank AI voice model candidates using metrics like Whisper transcription match rate, speech rate, and jitter. The system rejected candidates whose generated audio contained hallucinations — fabricated words appended to short sentences by the diffusion TTS engine used during corpus creation. Further investigation revealed that these hallucinations were a quirk of the voice-generation pipeline and did not appear in the final trained models that users actually hear. When probe sentences were lengthened to eliminate hallucinations, top-ranked candidates changed, exposing that the metric was measuring process behavior rather than actual voice quality. The engineer concluded that the scoring system had been filtering out candidates based on a manufacturing defect that was both fixable and absent from the shipped product.

Go grandmaster Shin defeats AI KataGo with a two-stone handicap

Article URL: https://www.kedglobal.com/artificial-intelligence/newsView/ked202607210007 Comments URL: https://news.ycombinator.com/item?id=49544762 Points: 53 # Comments: 9

Refiners face mounting crude disruptions from Gulf

PCB Chief Naqvi Defends Sweeping Test Squad Overhaul After England Series Defeat

Pakistan Cricket Board Chairman Mohsin Naqvi has defended major changes to the Test squad and coaching staff following Pakistan's 2-0 series loss to England. Seven players were dropped from the squad while five uncapped players were brought in as part of the reshuffle. Mike Hesson and Ashley Noffke were appointed to new coaching roles amid the transition. Naqvi dismissed criticism from former players and fans, describing the decisions as essential for the team's future. He also pointed to improvements in Pakistan's white-ball cricket as evidence of progress under his leadership.

AI Crawlers Read a Site 10,000 Times But Sent Only 2 Human Visitors

A WordPress site called davaonline.net, running a plugin designed to track AI crawler activity rather than human traffic, recorded 13,306 AI crawler requests over 30 days, of which 10,202 targeted actual content pages. Despite this heavy machine-side activity, conventional analytics showed just two human referrals from AI sources — one from ChatGPT and one from DuckDuckGo. The plugin categorises requests by purpose, distinguishing between training data collection, search indexing, and live user-query fetches, with the latter reaching 1,902 requests — a 3,558% increase over the prior 30-day period. The data illustrates a growing disconnect: AI systems are actively retrieving and using web content to answer user questions in real time, but those answers are delivered without routing the user back to the source page. The findings suggest that standard web analytics, which measure human visits, may increasingly undercount how often a site's content is actually being read and used.

GitHub Trending Sept 2026: Lightweight, Local AI Tools Dominate Developer Charts

GitHub's trending repositories for the week of September 3, 2026, are dominated by AI projects focused on portability, efficiency, and independence from large cloud infrastructure. DeepSeek Harness, a TypeScript-based plugin framework, lets developers build modular AI pipelines on top of DeepSeek models without rigid architectural constraints. Colibri, a zero-dependency pure-C engine, enables frontier Mixture-of-Experts models to run on consumer hardware by streaming only the relevant model segments from disk. Ponytail takes a minimalist approach to AI coding agents, guiding developers to avoid writing unnecessary code rather than generating boilerplate. Grok-Build, released by Elon Musk's xAI, offers a fullscreen, mouse-interactive terminal interface for developers working intensively with Grok models.