AI-Written Rust Code Compiles Fast But Leaves Hidden Engineering Debt, Study Warns

·1 views

A Rust engineer named Erik-Jan van de Wal reported on August 5, 2026, that AI-assisted coding in Rust often reaches a successful build by relying on shortcuts like excessive cloning, unsafe trait implementations, and unchecked unwrap calls rather than sound ownership and concurrency reasoning. He found that token costs and roughly 15 additional hours of cleanup made the AI-assisted approach about twice as expensive as writing the code himself. The broader concern is that compiled, passing code is being counted as completed work while verification gaps, architectural issues, and operational risks go untracked. To address this, the author proposes an Agent Assurance Profile (AAP), a protocol that requires generated code to be backed by inspectable evidence and explicit residual judgments before it is considered review-ready. AAP does not replace senior engineering review but aims to ensure that plausible-looking agentic output is not accepted as proof of correctness.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Dev team cuts Quarkus CI pipeline time from 11 minutes to 5 minutes without paid tools

A development team running a Quarkus monorepo on GitHub Actions free-tier runners reduced their CI pipeline duration from 9–11 minutes down to approximately 5 minutes 20 seconds. The gains were achieved without self-hosted runners, larger GitHub runners, or paid caching services. Investigation revealed the bottleneck was not dependency downloads or Maven compilation, but duplicated Quarkus work such as repeated augmentation, redundant application boots, and unnecessary infrastructure startup. The team deliberately avoided splitting integration tests into per-service matrix jobs, as doing so would have multiplied fixed setup costs across each parallel cell. Instead, optimisations focused on eliminating duplicated work within existing jobs while keeping the overall job count small.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Run a Local LLM on Apple Silicon Using MLX or llama.cpp

Mac users with M1 through M4 chips can run large language models entirely on-device using two leading tools: Apple's MLX framework and the community-built llama.cpp engine. MLX is installable as a Python package and can load a 4-bit quantized 3B model in minutes, requiring no API keys or cloud connectivity. The two tools differ in scope — MLX is optimized for Apple's unified memory architecture, while llama.cpp supports a broader range of hardware including Linux and Windows systems. Both frameworks support quantized model formats and offer OpenAI-compatible server modes for application development. Running models locally eliminates per-token costs and keeps user prompts private, with the setup working fully offline.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

npm Supply Chain Attacks Expose Gap in Artifact-Level Dependency Auditing

When a compromised npm package is reported, teams often check their current dependency tree — but this can miss vulnerable versions that existed only briefly during a past build. The Keyv-related package compromise, disclosed by Aikido on August 4, illustrated how a malicious release can spread and be patched before most teams finish assessing their exposure. The core challenge is that modern CI pipelines, lockfile updates, and Docker caching mean a clean scan today says little about what an artifact built yesterday actually contained. Experts argue the useful unit of analysis is not the current repository state but a specific artifact tied to a specific build and its resolved package set. A proposed approach involves accepting lockfiles, build timestamps, artifact digests, and CI logs to reconstruct past builds and classify exposure as confirmed, possible, or unknown — with human review required before any remediation action.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

10 Warning Signs Your Windows PC May Be Compromised and How to Spot Them

Windows users can detect potential security threats by monitoring unusual system activity such as unknown processes in Task Manager, unexpected CPU or RAM spikes, and new startup programs added without user knowledge. Suspicious PowerShell executions, unrecognized USB connections, and sudden changes to Windows Defender settings are also red flags worth investigating. Many legitimate Windows tools like Task Manager and Event Viewer exist for this purpose, but most users do not check them regularly enough to catch threats early. A lightweight monitoring tool called SysPulse has been developed to address this gap by offering real-time process tracking, executable path visibility, and Telegram-based security alerts. The goal is not to replace antivirus software but to give users greater visibility into what is happening on their systems at any given time.

0 comments Read more at DEV Community