The Rise of AI Site Reliability Engineers – Can Autonomous Agents Handle Production Incidents
The role of Site Reliability Engineering is undergoing a major shift as AI-driven autonomous agents take on the responsibility of managing production incidents. While traditional automation simply executed static scripts, modern AI tools can read logs, spot anomalies, and actively reroute traffic or roll back deployments without human intervention. This capability drastically accelerates incident recovery and reduces alert fatigue, allowing minor outages to be fixed before users ever notice them. However, relying entirely on autonomous systems introduces hidden dangers to overall stability. AI agents lack the situational context and intuition required for messy, unprecedented failures, and their speed means a wrong decision can instantly cascade across an entire infrastructure. Moreover, these automated quick fixes can easily mask deeper underlying infrastructure problems that silently worsen over time until a massive failure occurs. Consequently, the future of system operations is not a fully human-free environment. Instead, human engineers are transitioning from frontline firefighters to strategic architects. Their new focus is on setting boundaries, designing guardrails, and managing the AI systems to ensure that automation acts safely and effectively when standard procedures inevitably fail.
Moving from organisational implementation to scaling of AI
As organizations rapidly adopt artificial intelligence, the next major hurdle is scaling that technology to achieve measurable impact, according to a recent global survey by BearingPoint. While many companies successfully launch small AI pilots to automate tasks and increase capacity, deeply integrating these solutions across the enterprise remains rare. Without proper planning, businesses risk falling into an "AI productivity trap," where new technology fails to improve financial performance or support sustainable growth. Moving from a pilot to widespread use requires strict attention to governance, regulatory compliance, data accountability, and adapting workforce structures to support new capabilities. The report highlights that organizations must balance the agility to experiment with the discipline required to build strong foundations for scaling. Interestingly, Irish organizations are particularly ambitious, prioritizing agentic AI and actively assessing their skills gaps, though they still face challenges in enterprise-wide rollout. Ultimately, successful AI scaling depends on connecting investment to clear financial goals and treating workforce strategy as an integral part of the AI roadmap, ensuring that technological capacity is converted into genuine, long-lasting organizational value.
Choosing QuePaxa, an unusual consensus algorithm
Cloudflare explains why it chose QuePaxa, a relatively new consensus algorithm, for Meerkat, its experimental distributed service for managing a global control plane. Traditional approaches such as Raft and Paxos often depend on a leader to coordinate decisions. They work well when networks are stable, but a slow, disconnected, or failed leader can stall the system while other machines detect the problem and elect a replacement. This becomes difficult across global networks, where latency and temporary connectivity problems are common. QuePaxa takes a different approach: its leader is optional, other machines can continue proposing decisions, and proposals cooperate rather than repeatedly blocking one another. Under good network conditions, the leader can still reach agreement quickly. When conditions deteriorate, the system may slow down but can continue processing requests without waiting for formal failure detection. Cloudflare says its Meerkat evaluations across widely distributed servers showed this behaviour in practice. The trade-off is maturity: QuePaxa has not been tested as extensively as established alternatives. Cloudflare is therefore using formal verification, simulation, and fault-injection testing as it develops the implementation further.
Measuring AI’s Unintended Consequences
As teams increasingly adopt AI to accelerate software development, measuring its unintended consequences becomes critical for long-term sustainability. While AI tools boost delivery speed, heavy reliance on them can generate complex code that humans struggle to understand, potentially causing developer burnout, vendor lock-in, and rising maintenance costs. The core metric to monitor these hidden costs is the "cost of change," which acts like a tax on every software update you make. To gauge this effectively, engineering leaders should track their value-add percentage—the ratio of time spent building new features versus non-value-add tasks like bug fixes and technical debt. While a certain baseline of maintenance is unavoidable, a declining value-add percentage indicates that AI-generated code is increasing organizational drag. Other helpful indicators include standard deployment metrics and individual AI token usage patterns. Because these data points are inherently noisy and can take months to reveal clear trends, organizations should supplement them with forward-looking maintenance models and scenario planning. Ultimately, relying on both data tracking and strategic models allows leaders to make informed judgments and protect their teams' capacity for meaningful work.
Building the infrastructure of consent for India’s digital economy
The growth of India’s digital economy depends on building a robust infrastructure of consent. At its core, the Data Empowerment and Protection Architecture (DEPA) forms the foundation of this ecosystem by changing how user data is managed and shared across sectors. Instead of keeping data locked in rigid, isolated systems, this framework places control back in the hands of the individual. Through a network of licensed account aggregators, users can securely share their financial or personal information with service providers they trust—and they can revoke that access at any time. This approach not only simplifies compliance for businesses but also builds deep trust with consumers by offering transparency and choice. By prioritizing privacy alongside progress, India is setting a global standard for digital rights. For businesses, adopting these transparent practices means better customer relationships and a streamlined approach to offering personalized services. Ultimately, building a secure, consent-based infrastructure ensures that innovation serves everyone fairly, turning data protection from a simple regulatory checklist into a fundamental driver of a thriving, inclusive digital economy.
The Cyber Resilience Act clock doesn’t stop for weekends
In a recent Help Net Security interview, Copla CEO Aurimas Bakas explores the demanding reality of the EU Cyber Resilience Act (CRA) and its stringent vulnerability reporting mandates. While many company boards fixate on the CE marking deadline of December 2027, they overlook that active vulnerability reporting obligations already took effect in September 2026. This timeline gap creates significant risk, as non-compliance carries massive penalties. To prepare, organizations must develop a comprehensive register of every product version currently running in customer environments, including legacy firmware. Bakas emphasizes that the 24-hour reporting clock begins the moment a company becomes aware of an exploited flaw. This makes it critical to define what “awareness” means internally and clearly designate who has the authority to initiate the countdown—even at 2 a.m. on a Sunday. He advises CISOs to contractually bind suppliers to strict reporting timeframes matching their regulatory requirements. Finally, conducting unannounced tabletop exercises on weekends can reveal whether a team can realistically execute a handover, verify their multi-factor authentication, and draft an early warning within the mandatory 24-hour window.
US Democrats prepare to scrutinize federal biometric surveillance
With Democrats set to take control of Congress, federal use of biometric surveillance and digital identity systems is about to face intense scrutiny. Lawmakers are preparing to investigate existing surveillance infrastructure, particularly within the Department of Homeland Security, focusing on facial recognition, mobile biometric identification, and the commercial data brokers that support these systems. However, they face a complicated reality. Billions of dollars in previously approved funding are already locked in for border security and immigration enforcement technologies, making it difficult to simply defund these programs. As a result, Congress is expected to lean heavily on its investigative powers to demand accountability and transparency from agencies and their private contractors. The core challenge will be determining which biometric applications are legitimate and establishing clear boundaries for their use. While some lawmakers advocate for strict moratoriums on facial recognition and new federal privacy laws to regulate how companies handle sensitive data, others recognize the need to modernize digital identity infrastructure to prevent fraud. The upcoming legislative session will likely focus on finding a balance between security needs and privacy protections.
/articles/ios-crash-sigbus-debugging-experiment/en/smallimage/ios-crash-sigbus-debugging-experiment-thumbnail-1793282827397.jpg)
The iOS Crash We Could Not Reproduce
Debugging intermittent production crashes in iOS applications can often be a frustrating experience, especially when the logs lack a clear stack trace and local testing fails to reproduce the issue. This scenario unfolded in a large-scale consumer app where a vague SIGBUS error tied to NSAttributedString appeared randomly, resisting all initial attempts to pinpoint the failing code. While early defensive fixes—such as tightening object ownership and updating concurrency patterns with async/await and MainActor—lowered the overall crash rate, they merely altered the timing of the defect rather than solving the underlying problem. The turning point occurred when a QA engineer managed to probabilistically reproduce the crash on a specific device, transforming speculative debugging into testable engineering work. This controlled fault isolation eventually revealed that HTML imports through NSAttributedString have a strict main-thread requirement, which is easily overlooked when the call is nested within asynchronous screen preparation. Ultimately, implementing a shared main-actor abstraction proved to be a much stronger and more reliable safeguard than expecting developers to remember a nuanced framework threading rule at every single call site.
Why does old access outlive the job?
Organizations consistently struggle with lingering access rights because granting permissions is fast and driven by clear business needs, while removing them is an overlooked administrative chore. When employees change roles, their new access is typically approved within hours so they can start working. However, their old permissions often remain active simply because no one takes ownership of revoking them. During routine security reviews, managers frequently rubber-stamp existing access levels because dashboards rarely show if the permissions are actually being used, and removing them might accidentally break a process. To fix this dangerous oversight without adding expensive new software, companies need to treat every internal job transfer as an offboarding event where old managers explicitly confirm what is no longer needed. Additionally, assigning clear expiration dates and named owners to all permissions prevents endless access creep. Finally, displaying the last login timestamp directly on security review screens makes it much easier for managers to confidently delete dormant accounts. By treating permission removal with the same urgency as granting it, organizations can dramatically shrink their security vulnerabilities.
eMudhra Revokes 8 More CAs It Previously Declared Unaffected by Key Compromise
The Python script responsible for eMudhra's October key compromise has now resulted in the revocation of eight additional intermediate certificate authorities (CAs), despite earlier claims that they were unaffected. According to the company's recent incident report, these eight CAs were revoked after an internal investigation revealed that their RSA keys were processed through the same flawed python script during a key ceremony in April 2025. Although the script did not shorten these RSA keys to a single byte—the critical error that compromised the original eight ECDSA keys—the private keys were still exposed in the memory of the ceremony computer. Because eMudhra cannot definitively prove that this handling met its own strict compliance standards or verify exactly how the key material was managed, the company was forced to revoke the CAs. These certificates were used for websites and code signing across various organizations. As a broader response, eMudhra is currently exiting the publicly trusted TLS certificate business, with major browsers like Microsoft, Google, and Apple scheduled to phase out trust in their remaining root certificates by late November.
/articles/agentic-ai-architecture-challenges-opportunities/en/smallimage/agentic-ai-architecture-challenges-opportunities-thumbnail-1793709540690.jpg)
