How Velo Workspaces Runs AI Agents Safely on Apple Silicon Without GPU Penalty

·1 views

Running autonomous AI coding agents on a primary macOS machine poses serious security risks, including file tampering, dependency injection, and credential theft via prompt attacks. The conventional fix—sandboxing agents inside a Linux VM—fails on Apple Silicon because Apple's Virtualization.framework blocks GPU passthrough, causing inference speeds to drop by over 80%. Velo Workspaces addresses this by splitting responsibilities: the AI inference engine (Ollama or Apple MLX) runs natively on macOS with full Metal GPU access, while the agent framework executes inside an isolated Ubuntu Linux guest. Communication between the host and the VM travels over VirtIO-vsock memory buffers, keeping latency in the single-digit millisecond range without a traditional network stack. This architecture lets developers maintain strong security isolation without sacrificing the hardware acceleration that makes large language model inference practical on Apple Silicon.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How to Port a CPU Conjugate Gradient Solver to CUDA: A Step-by-Step Guide

A developer has published a detailed walkthrough on migrating HPCCG, a Conjugate Gradient mini-application from the Mantevo project, from CPU to GPU using CUDA. Rather than a full rewrite, the approach is incremental: profiling the CPU code first, then moving the most expensive operations to the GPU one at a time. On a one-million-row test problem, sparse matrix-vector multiplication (SpMV) consumed over 83% of total CPU runtime, making it the clear first target for GPU offloading. The tutorial also ports the same code to Kokkos, enabling a direct comparison between hand-written CUDA and a performance-portable programming model. All intermediate code and commits are publicly available on GitHub, allowing readers to reproduce each porting stage independently.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

BurpSqueezer compresses Burp Suite traffic dumps for LLM-ready AI analysis

A developer has released BurpSqueezer, an open-source tool that compresses large Burp Suite HTTP traffic captures into compact Markdown reports optimized for AI processing. The tool reduced a 26.7 MB traffic dump to just 35 KB — a 745-fold compression — making it feasible to feed real penetration testing data into large language models that enforce file size limits. BurpSqueezer filters out irrelevant traffic such as CDN requests and maps relationships between API endpoints to preserve meaningful structure. The tool is designed for large, complex HTTP datasets and does not perform any active testing or send requests itself — it only processes already-captured, authorized traffic. The project is available on GitHub and its creator is seeking feedback from web security and API penetration testers.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Security scanner finds critical flaws in 9 of 13 popular AI app starter repos

A developer built a static analysis tool called vibecheck and ran it against 13 popular open-source AI app starter repositories on September 16, 2026, to identify common production-breaking security patterns. Only 4 of the 13 repos scanned clean, while the remaining 9 produced 101 findings, including 50 classified as critical. The most widespread issue, unauthenticated API routes, appeared in 6 repositories, followed by client-exposed secrets and unsafe HTML rendering, each found in 5 repos. The scanner is deterministic, requires no external dependencies, and ran on unmodified default branches of each repository. The author notes that none of the flagged issues are obscure vulnerabilities — they are routine oversights, such as deferred authentication and hardcoded credentials, that AI code generators tend to leave unaddressed.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Slowdown Rejected by US and China as Industry Keeps Shipping New Tools

A brief consensus among Dario Amodei, Sam Altman, and Elon Musk calling for slower frontier AI development collapsed within days after both the US and Chinese governments rejected the idea. President Trump dismissed AI safety concerns as a hoax on Truth Social, while China's Foreign Ministry called the proposal a Cold War-era tactic disguised as safety advocacy. Despite the debate, major AI products continued to launch, including Apple's rebuilt Siri — capable of on-screen reading and cross-app actions — and new models from Salesforce, Meta, and a Chinese open-weight research lab. On the safety front, Microsoft published a draft AI code of conduct requiring its models to remain shutdownable and prohibiting self-editing of reasoning logs, while a report revealed real-world misuse including AI-assisted weapons guidance development in Yemen and a multinational disinformation-for-hire operation. Wall Street signaled where it sees the near-term risk, driving cybersecurity stocks up double digits on concerns that AI-enabled hacking poses a more immediate threat than existential scenarios.

0 comments Read more at DEV Community