A CVE About AI Agent Permissions Made Me Re-Check What Our Own Agent Could Touch

·4 views

Earlier this month, a critical vulnerability showed up in GitLab's AI Gateway — CVE-2026-90970, CVSS 9.9, letting a logged-in user with agent platform access run commands on the gateway itself. I read the advisory the way most people probably did: nodded, thought "glad that's not us," and moved on. Then I actually thought about our own setup for about ten more seconds, and the "glad that's not us" feeling evaporated. We'd wired an internal AI agent into our infra for the usual reasons — it could read logs, query our internal APIs, open PRs, restart a flaky worker, that kind of thing. It talked

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

The ten-year battery that would not make five

A water meter is installed once. After that nobody opens it again, and the battery decides how long the product lasts. If it runs out early, no update fixes it: someone has to drive out to every meter. We designed one with a ten-year target. Ultrasonic measurement, a report at least four times a day — one version over LoRaWAN, another over GPRS — and a single D-size lithium thionyl chloride cell of about 19 Ah.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Critical-entity error rate: the metric WER can't see

Part 2 of the CAFA-IVR series. In part 1, WER scored "peas" and a ten-thousand-dollar mis-transfer as the same error. This post is about the machinery for telling them apart. The errors that break IVR tasks don't distribute evenly across the vocabulary. They cluster in a tiny governed set: amounts, dates, account numbers, yes/no decisions, negation, cancel/confirm actions.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Using MCP for procurement research: keep the evidence attached

I build BidSkim, a service that matches UK suppliers to public-sector contracts. One useful way to work with procurement data is to query it through an AI assistant. The difficult part is keeping the evidence visible when the assistant turns a structured record into a confident sentence. A contract ending in six months is a reason to investigate. It does not prove that the buyer will run a new tender on that date.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

What audio quality does YouTube actually stream? (and how to spot a fake 320kbps MP3)

Disclosure: I run YT320MP3, a free YouTube to MP3 converter. Everything below applies to any converter, including mine, and you can check it yourself with free tools. Almost every YouTube to MP3 site advertises "320kbps". It sounds like a quality promise. It is really a setting on the output file — and the output can never be better than what YouTube sends.

0 comments Read more at DEV Community