SShortSingh.

Programming

0
ProgrammingDEV Community ·

AI Agent Accountability Gap: Can Teams Explain What Their Agents Already Did?

As AI coding assistants and autonomous agents gain the ability to execute commands, modify files, and access credentials, organizations face a critical accountability challenge beyond future-focused AI debates. The core problem is not simply logging activity but establishing causality — tracing which agent action led to which outcome under whose request and approval. Anthropic has noted that constant human approval prompts tend to fail due to approval fatigue, with users approving the vast majority of requests, making technical containment increasingly important. Experts argue that effective AI governance requires two layers: preventive controls that limit what an agent can do, and detective controls that preserve a clear record of what it actually did. Industry guidance from both Anthropic and OpenAI points to the same conclusion — teams need agent-aware telemetry and auditable decision trails before an incident occurs, not after.

0
ProgrammingDEV Community ·

Context Engineering Is a Real-Time Packing Problem, Not Just Prompt Writing

The term 'context engineering' has emerged to describe how developers manage what information goes into a language model's input on each call during an agent run. Unlike prompt engineering, which involves a one-time system prompt decision, context engineering requires actively choosing what to include or discard every turn under a strict token budget. A model's context window functions more like a cache than memory — content must continuously earn its place, and evicting the wrong information carries real costs. Research has also shown that stuffing the window with excess content can hurt retrieval accuracy, particularly when key facts end up buried in the middle of a long input. The core discipline is therefore a packing problem: deciding what fits, what gets dropped, and understanding the consequences of dropping the wrong thing mid-run.

0
ProgrammingDEV Community ·

Tokolaku Launches MCP Server to Connect AI Agents with WhatsApp Business API

Tokolaku, a WhatsApp business platform for Indonesian small and medium businesses, has launched a hosted Model Context Protocol (MCP) server that lets AI agents interact directly with WhatsApp Business accounts. Built on Meta's official WhatsApp Business Cloud API, the integration allows AI assistants such as Claude, ChatGPT, and Gemini to read inbox conversations, browse product listings, and check order statuses. Developers and businesses can connect any MCP-compatible client simply by entering the server URL, with authentication handled via OAuth 2.1 or an API key. Write operations such as sending messages require a secret API key, while read-only access is granted through a standard OAuth flow with short-lived, revocable tokens. The platform also supports conventional REST endpoints and official SDKs, positioning the MCP layer as a core feature rather than an experimental add-on.

0
ProgrammingHacker News ·

Astronomers Debate Nature of Webb Telescope's Mysterious 'Little Red Dots'

Astronomers are divided over the true nature of compact, red objects detected by the James Webb Space Telescope, dubbed 'little red dots.' Some researchers believe these objects are black holes, while others argue they could be a theoretical class of objects called black hole stars. The debate centers on interpreting the unusual light signatures and properties these objects display. Resolving the question has implications for understanding the early universe and the formation of massive cosmic structures.

0
ProgrammingDEV Community ·

Validate Address Data at Entry Point to Prevent Downstream System Errors

Incorrect or incomplete address data entered by users can quickly spread into billing, fulfillment, and mailing systems if not caught early. Experts recommend validating data as close to the point of entry as possible, rather than relying solely on batch cleanup processes that leave a window for errors to propagate. One effective approach uses real-time API-based validation, where a submitted address is checked and standardized before being saved to the database. This architecture keeps validation logic separate from core application code and supports use cases like ecommerce checkouts, CRM systems, and customer registration forms. Treating data quality as part of the application workflow — rather than an afterthought — reduces downstream cleanup and improves the reliability of connected systems over time.

0
ProgrammingDEV Community ·

IoT Botnets Still Exploit Open Telnet and Default Passwords a Decade After Mirai

China's National Network and Information Security Notification Centre issued a notice in August 2026 identifying five active cross-border botnet families — Mirai, CondiBot, Gafgyt, TBot, and SoftBot — all gaining initial access through Telnet or SSH brute force against factory-default credentials and unpatched older vulnerabilities. Internet scanning tools like ZoomEye show that a significant number of devices continue to expose Telnet on port 23 to the open internet, forming the recruitment pool these botnets rely on. Analysts note that raw counts of reachable Telnet services overstate actual vulnerable devices, as the figures include honeypots, reconfigured network equipment, and lab systems hosted in cloud environments. Three structural factors keep the problem persistent: devices outlive vendor support cycles, ownership and maintenance responsibilities are often unclear in small organisations, and remote-access interfaces enabled for convenience are rarely disabled post-setup. While newer botnets like Dysphoria have adopted advanced techniques such as blockchain-based command infrastructure to resist takedowns, the initial entry method has remained unchanged since the original Mirai outbreak in 2016.

0
ProgrammingDEV Community ·

APC Recommends 'model: inherit' to Keep AI Agent Definitions Portable

A design guideline for APC (a repository-owned context layer for AI agents) recommends using 'model: inherit' in agent definition files rather than hardcoding a specific AI model. The approach separates project knowledge — such as an agent's role, skills, and responsibilities — from operational details like provider accounts and available models, which can vary between contributors. When a model is set to 'inherit', the runtime resolves the actual model using its own configured defaults, rather than forcing every user who clones the repository to meet a potentially unavailable or unaffordable model requirement. Hardcoding a vendor-specific model is only advised when the task genuinely requires it, such as when a workflow depends on a model-specific capability agreed upon by the team. Project maintainers are encouraged to periodically audit agent files and replace incidental model choices with 'inherit', documenting any justified exceptions clearly.

0
ProgrammingDEV Community ·

Solana's 90% Rent Cut Leaves Millions of Old Accounts Holding Surplus Funds

Solana is reducing account storage costs by 90% across five phased steps, meaning accounts funded before each price reduction now hold more lamports than required for rent exemption. The byte price has already dropped from 6,960 to 5,080 lamports since September 2026, with three more reductions expected in the Agave 4.4 release. Account holders can reclaim the surplus without closing their accounts using program-specific withdrawal instructions, provided the account retains at least the current rent-exempt minimum. The recoverable amounts are modest per account — ranging from roughly 0.00039 SOL for a nonce account to 0.024 SOL for a vote account at the final step — but can become significant for wallets, validators, or programs managing thousands of accounts. Only accounts created before each price step are eligible; all newly created accounts are funded at the current lower rate and have no surplus to reclaim.

0
ProgrammingDEV Community ·

Solana Swaps SPL Token Program for Faster p-token at Epoch 971

On 13 May 2026, at the start of epoch 971, Solana activated SIMD-0266, silently replacing the bytecode of its classic SPL Token program with a new implementation called p-token while keeping the same program address and instruction set. The swap was carried out through a runtime feature gate that triggered once 95% of stake adopted it, copying a pre-deployed p-token binary into the existing program-data account. p-token is built on Pinocchio, a Solana development framework designed to eliminate allocator overhead and reduce compute-unit consumption per instruction. Because wallets, explorers, and decentralised exchanges interact with the same addresses, discriminators, and account layouts as before, no client-side code changes are required. The practical benefit is lower compute costs per token operation, which can improve transaction priority rankings and allow the per-account block compute budget to stretch further — though wallets with hard-coded compute limits will overpay until they re-simulate.

0
ProgrammingDEV Community ·

Why git blame credited a developer with 767 lines he never wrote

A developer discovered that git blame attributed 767 lines of JavaScript to him — code he never actually wrote. The file had arrived in his repository automatically via an upstream MIT-licensed project's auto-updater, and git simply recorded him as the committer when he synced the files. Running blame against the upstream origin revealed three actual contributors responsible for the code. The developer used the incident to highlight a key limitation of git blame: it records who last touched a line, not who originally authored it, and in fork-plus-auto-updater setups those are rarely the same person. He also noted that the upstream project never wired the validation module into any generation pipeline — that integration was his own addition, built on top of others' unrecognized work.

0
ProgrammingDEV Community ·

Solana Sets 1 SOL Minimum Stake Delegation After Stake Program Goes On-Chain

Solana activated version 5 of its stake program on mainnet on June 18, 2026, raising the minimum stake delegation from one lamport to 1 SOL under proposal SIMD-0490. The change was made possible because the stake program has been migrated from hardcoded validator code to an upgradeable on-chain BPF program, meaning staking rules can now be updated without requiring a full validator release. The new minimum applies only to new delegations, splits, and moves — existing sub-1-SOL delegations continue earning rewards but cannot be split or moved, only merged, deactivated, or withdrawn. The update targets a long-standing network inefficiency where tens of thousands of tiny stake accounts — from airdrops, test delegations, and split remainders — cost more to process than they earned. Users holding sub-1-SOL stake accounts are advised to merge accounts delegated to the same validator, withdraw inactive dust, or deactivate and consolidate their positions.

0
ProgrammingDEV Community ·

Solana Activates Fix for SOL Sent to Uncreated Accounts via SIMD-0312

A long-standing Solana issue allowed users to send SOL to an address before its on-chain account was created, which then blocked the account creation process entirely. The existing workaround required a three-step instruction sequence that most programs never implemented, leaving many users with stranded funds. Solana's SIMD-0312 proposal introduces a new system instruction, CreateAccountAllowPrefund, which creates an account even if the target address already holds a balance. The feature activated on Solana mainnet on 29 May 2026, during epoch 979. Exchanges, wallets, and dApps must adopt the new instruction in their software before stranded deposits can be recovered, but the fix makes doing so straightforward.

0
ProgrammingDEV Community ·

Solana Token-2022 Extensions Can Change Your Wallet Balance Without Any Transaction

Solana's Token-2022 standard includes two extensions — interest-bearing mints and scaled-UI-amount mints — that alter the displayed token balance over time without any on-chain transaction occurring. The raw integer stored in a user's token account never changes; only the formula applied at display time shifts, based on a compounding rate or a multiplier tied to the mint's configuration. Because the displayed amount is calculated against a node's live clock at query time, the same account can return different balances when queried seconds apart or from nodes with slightly differing clocks. Most portfolio trackers, tax tools, and blockchain explorers rely on archived data that strips out this extension logic, meaning they may show balances that never actually existed. Notably, interest rates on these mints can be negative, allowing a token's displayed balance to silently decline over time with no visible transfer or burn in transaction history.

0
ProgrammingDEV Community ·

Solana's Token-2022 Adds Pausable and Permissioned Burn Extensions to Mainnet

Solana's Token-2022 program has introduced two new extensions — Pausable and Permissioned Burn — now live on mainnet. Pausable allows a designated authority to freeze all transfers, mints, and burns on a token, a feature regulators and stablecoin issuers may require but one that also carries rug-pull risk if the authority is unaccountable. Permissioned Burn requires both the token holder and a burn authority to sign any burn instruction, preventing holders from unilaterally reducing supply — a safeguard for asset-backed tokens tied to real-world reserves. Older validator nodes or client libraries may display these extensions as 'unparseable,' meaning wallets relying on outdated software cannot identify what authorities are active on a given mint. Experts advise buyers to verify who holds these authorities before purchasing, since the technical mechanism for a compliance control and a malicious trap is identical.

0
ProgrammingDEV Community ·

Solana's SIMD-0500 Will Block Immutability for Programs Built on Old Bytecode

A forthcoming Solana network change, SIMD-0500, will prevent developers from making older programs immutable if their bytecode is not updated to the current v3 format. The rule, already present in validators as of September 2026 but not yet active on mainnet, causes the SetAuthority instruction to fail for programs running on SBPF versions v0, v1, or v2. This affects a wide range of projects from 2023–2024, including token launches, NFT collections, and small DeFi protocols, that intended to renounce upgrade authority but have not yet done so. To freeze such a program after the gate activates, developers must first rebuild it with a current toolchain, deploy the upgrade, and only then revoke authority — a three-transaction process rather than a single step. A separate but related change under SIMD-0431 also sets a minimum extension size of 10,240 bytes when growing a program-data account via ExtendProgram.

0
ProgrammingDEV Community ·

Solana's Confidential Transfer Kill Switch: How It Works and What It Costs

Solana's Token-2022 confidential transfers rely entirely on the ZK ElGamal proof program, a separate on-chain program that verifies zero-knowledge proofs for every confidential operation. Two validator feature gates exist to disable and re-enable this program, and both have already been used: a flaw in the verifier's Fiat-Shamir transcript discovered on June 10, 2025 triggered a disable at epoch 805, with the program restored at epoch 982 in June 2026 after audits. When the proof program is disabled, public token balances continue functioning normally, but confidential balances are frozen in place — holders cannot deposit, transfer, or even withdraw back to plain balances until the program is re-enabled. No state migration is required upon re-enablement, as the underlying ElGamal ciphertexts remain intact in accounts throughout the outage. Developers should also note that the older ZK Token Proof program still exists as an address but is a non-functional stub that silently returns success without verifying anything, meaning any tooling still referencing it provides no actual proof validation.

0
ProgrammingDEV Community ·

Same AI Model, Better Engineering: Backboard CLI Outscores Claude Code on Terminal-Bench

A team running Backboard CLI on Terminal-Bench 2.1 achieved a score of 85.4% using Claude Opus 4.8 via Amazon Bedrock, outperforming Claude Code's published score of 78.9% on the identical underlying model. The result suggests that the system architecture surrounding an AI model — including context management, tool selection, and failure handling — can significantly influence benchmark performance. Beyond accuracy, the Backboard run cost $280.72, roughly 49% less than the then-verified leaderboard leader, which scored 83.8% at a reported $552.67. The team argues this shifts the key question from which model performs best to which system delivers reliable results at sustainable cost. They also emphasize that well-engineered AI infrastructure should remain adaptable across models, reducing the need to rebuild entire stacks whenever a newer model emerges.

0
ProgrammingDEV Community ·

AI, Blockchain, and Surveillance Converge in a Growing Digital Rights Crisis

The rapid rise of AI and blockchain technology is intensifying global debates around cybersecurity, data ownership, and privacy rights. A cyberattack on crypto infrastructure firm Haruko exposed operational security vulnerabilities affecting 15 institutional clients, highlighting risks beyond blockchain's core cryptographic protections. Internal discussions among Microsoft employees and an ongoing New York Times lawsuit against OpenAI and Microsoft raise serious ethical and legal questions about whether AI training on scraped data constitutes large-scale intellectual property theft. Meanwhile, the U.S. Department of Homeland Security's predictive policing initiatives have drawn criticism over constitutional concerns related to algorithmic surveillance and civil liberties. Analysts argue these developments are not isolated incidents but reflect deeper structural challenges in how data is generated, owned, and governed in the digital age.

← NewerPage 1144 of 3221Older →