Aikido Security acquires Root for $70M to patch open-source vulnerabilities in place

·1 views

Aikido Security announced on June 30 that it has acquired Root, a company specializing in patching open-source vulnerabilities directly into existing dependency versions without requiring a full upgrade. The deal is valued at $70 million, and Root's technology will be integrated into a new Aikido product targeting software development pipelines. The approach addresses a common problem where upstream security fixes are only available in newer versions that introduce breaking changes, leaving many teams unable to remediate known CVEs. However, the method raises supply chain trust concerns, as the patched artifacts no longer match what upstream registries originally published, complicating provenance tracking and SBOM accuracy. Security experts advise teams to demand clear answers on artifact signing, attestation, and auditability before adopting the technology.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer builds auditable AI cost-modeling pipeline to find cheapest quality-adjusted LLM

A developer behind the Hermes Agent framework built an automated pipeline to answer real cost questions faced by AI agent builders, frustrated by inaccurate online advice. The system uses research agents to pull live, cited token prices and benchmarks, then runs all calculations through an exact-rational math kernel to avoid floating-point errors or LLM-generated arithmetic mistakes. Tested across eight cost scenarios, the pipeline ranked open-weight models by blended cost divided by agentic quality score, with DeepSeek V3.2 via OpenRouter emerging as the top value at roughly $1.49 per quality unit. DeepSeek V4 Flash on Fireworks was flagged as a potentially cheaper alternative pending further quality testing. The full methodology and dataset have been published in a public repository so results can be independently reproduced.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Five patterns engineers use to make AI agents reliable in production

A software developer writing for DEV Community has outlined five tool-calling design patterns that distinguish production-ready AI agents from demo-grade ones. Standard tutorials rarely address failure scenarios such as tool timeouts, infinite loops, duplicate calls, or models generating fabricated responses after errors. Among the recommended patterns are enforcing a hard tool-call budget per turn to prevent runaway API costs and implementing deduplication logic to stop models from invoking the same tool repeatedly with identical arguments. The author notes these are not edge cases but routine conditions any deployed agent will encounter. Code examples using Anthropic's Claude API are provided to illustrate each pattern in practice.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Context Rot: Why AI Agents Perform Worse as Conversations Grow Longer

A phenomenon called 'context rot' causes AI agents to degrade in performance as conversation history accumulates, producing contradictions and ignoring earlier instructions. This occurs because language models treat the entire context window as working memory, with no true persistent recall between calls. Key causes include recency bias in transformer attention, instruction dilution from conversational examples, stale reasoning from outdated facts, and token budget pressure near context limits. Developers can detect context rot by testing instruction-following compliance at increasing conversation lengths, typically seeing failure beyond 10–15 turns. Proposed fixes include rolling context windows with compressed summaries of earlier turns to preserve signal while discarding noise.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer shares three-stage validation layer to prevent AI agent output failures

A software developer writing for DEV Community has outlined a recurring flaw in AI agent codebases where model responses are trusted without validation, causing runtime errors on edge cases. The core issue is that large language models like Claude and GPT-4 can hallucinate data structure rather than just content, returning null or semantically incorrect values even when using structured output modes. The author argues that schema-enforced JSON alone is insufficient because it validates types but not semantics, and many LLM workflows still rely on free-text parsing. To address this, the developer proposes a parse-validate-classify pipeline implemented in TypeScript using the Zod library, which forces calling code to explicitly handle both success and failure outcomes. The approach is presented as a practical safeguard applicable to any multi-step or tool-calling AI agent architecture.

0 comments Read more at DEV Community