SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

AI Trust Network Ekurhive Wipes Production Data After Test Suite Bug Exposed Live Database

0
·1 views

Ekurhive, a trust network for AI agents that opened to external nodes five days ago, discovered this week that two pytest test files had written directly to its live production database during a verification run. The bug stemmed from setup_module() hooks executing before isolation fixtures, allowing test code to create connections, run trust recalculations, and reset real node scores undetected. An audit revealed the damage ran deeper: backup data believed to be genuine historical records turned out to contain accumulated test fixtures from a recurring variant of the same bug, making authentic early relay history unrecoverable. Rather than restore polluted data, the team wiped all activity tables clean and rebuilt safeguards at the database level, including a dedicated Postgres role with no production access and a wrapper script enforcing test credentials before the application starts. Ekurhive remains open to outside agents and framed the disclosure as consistent with its core principle that trust must be grounded in verifiable real-world outcomes.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Database Isolation Levels Explained: Why the ANSI SQL-92 Standard Falls Short

In multi-user database systems, concurrent transactions can produce anomalies such as dirty reads, phantom reads, lost updates, and write skew, which corrupt data consistency. To manage these risks, databases offer isolation levels — configurable settings that trade off data safety against performance. The ANSI SQL-92 standard defines four classic isolation levels: Read Uncommitted, Read Committed, Repeatable Read, and Serializable. However, this widely taught standard is considered incomplete, as it omits critical anomalies like lost updates, read skew, and write skew. As a result, some databases that advertise full Serializable isolation actually only implement Snapshot Isolation, potentially leaving applications exposed to subtle data integrity failures.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

MCP C# SDK 2.0.0: Why Pinning Protocol Version 2026-07-28 Matters for Stateless Apps

The MCP C# SDK 2.0.0 defaults to the 2026-07-28 protocol but automatically falls back to older versions when connecting to stateful servers, which can silently change the wire contract. The 2026-07-28 specification eliminates the initialize handshake and HTTP sessions, allowing clients to send per-request capabilities via server/discover. When fallback occurs, health checks may stay green while code built on stateless or modern-only assumptions runs under legacy session rules. Developers can enforce a minimum protocol version by setting the ProtocolVersion field in McpClientOptions, causing connections to fail rather than silently downgrade. Inspecting both NegotiatedProtocolVersion and SessionId after connecting is recommended to make any compatibility fallback visible in logs.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Why a HIPAA-compliant edge system chose gRPC over Unix sockets instead of HTTP

A developer building PhotonicOps, an offline telemetry and hardware-triage system for clinical silicon photonic biosensors, faced a key architectural decision on a single-host Apple Silicon edge deployment. The system ingests optical resonance data at 10,000 samples per second and must pass batches of sensor frames from a Go ingestion engine to a Python DSP pipeline without any cloud API calls, due to HIPAA compliance requirements. The core transport question was whether to use plain HTTP on a loopback port or gRPC over a Unix socket for that one internal process-to-process hop. Three concrete, code-level reasons drove the choice away from HTTP: native client-streaming support in gRPC, a strict sub-10ms per-frame processing budget, and the overhead costs of reconstructing similar functionality manually over HTTP/1.1. The article focuses on the reasoning behind the losing option rather than simply advocating for gRPC, framing the tradeoff analysis as the transferable insight for engineers facing similar decisions.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Study of 5,388 repos finds AI-authored code merges faster at median, but 25% pay real review cost

A scan of 5,388 public repositories covering 444,225 merged pull requests found that the median repo experiences no extra review burden from AI-attributed code, with attributed work merging in roughly half the time of non-attributed work. However, the top quartile of repositories did show a measurable review cost, with time-to-merge running at least 1.18 times longer for AI-attributed pull requests. Attribution was determined strictly from commit-level markers such as co-author tags and agent bot accounts, not inferred from code style or timing. The researcher behind the study disclosed a commercial interest in the scanning tool used, while noting the findings actually work against a simpler sales narrative. Key caveats include that inline AI completions leave no repository trace, meaning detected figures represent a floor, and causation between agent use and review time cannot be established.

0 comments Read more at DEV Community
AI Trust Network Ekurhive Wipes Production Data After Test Suite Bug Exposed Live Database · ShortSingh