CodeIsGo.com

Personal AI agents are changing which chips power artificial intelligence. The rapid adoption of Meta’s Muse and the launch of OpenAI’s Dots are putting central processing units back at the center of AI infrastructure, creating new opportunities for AMD and Intel after years of GPU-dominated growth.

Generative AI initially pushed GPUs to the forefront because large language models require substantial parallel computing power for training and inference. Nvidia became the primary beneficiary of that shift. Agentic AI introduces a different workload. Persistent agents may operate for hours or days, navigating applications, managing files, executing code, and completing multi-step workflows inside virtual computers. GPUs still handle AI inference, but CPUs manage much of the surrounding operating environment. As industry analysts describe, GPUs handle much of the “thinking,” while CPUs execute the workflows. That difference could reshape infrastructure spending.

Meta’s Muse and OpenAI’s Dots reportedly operate inside virtual machines using AMD EPYC processors. Some EPYC chips offer as many as 192 cores, allowing cloud providers to divide servers across multiple agent instances. The shift has helped renew interest in traditional CPU leaders; AMD shares rose roughly 32% over the past month, while Intel gained about 21%, according to CNBC. AMD’s data center revenue more than doubled to $6.7 billion during the quarter ending in June, representing nearly 60% of total company sales. The company expects the broader CPU market to reach approximately $220 billion by 2030.

GPUs are not becoming less important. Agents still depend on accelerators for model inference, but agentic systems increasingly require both types of hardware: GPUs for AI computation and CPUs for running applications, operating systems, tools, and long-running workflows. Nvidia is responding as well, with its Vera CPU targeting agentic workloads, putting the company into more direct competition with AMD, Intel, and Arm-based processors. The result could be a broader AI hardware market where infrastructure advantage comes from supporting the entire agent stack rather than supplying one type of processor. Good read!

Google faces allegations of clearing over 300 hectares of forest in Finland for new data centers without completing required environmental assessments, raising questions about regulatory compliance and ecological impact amid the AI infrastructure buildout. By Victor Tangermann.

Google is under scrutiny for clearing more than 300 hectares of forest in northern Finland to make way for two new data center sites. According to Finnish newspaper Kaleva, the logging began months before the conclusion of mandatory environmental assessments, a process the Finnish Nature Conservation Association describes as either gross incompetence or gross disregard for national legislation. Satellite imagery confirms four separate sites were cleared.

Google maintains that its actions comply with the country’s Forestry Act and that extensive environmental evaluations were completed. However, the conservation group has petitioned regulators to suspend construction activities until assessments are finalized. The felled forest serves as a critical ecological corridor, enabling animal movement between habitats, and local bird species may have been affected.

This case underscores the environmental tension embedded in the global AI infrastructure buildout. As companies race to deploy data centers to support expanding AI workloads, the physical footprint of these facilities - land use, deforestation, and energy consumption - collides with local regulatory frameworks and ecological preservation goals. The Finnish incident highlights how rapid deployment timelines can outpace compliance procedures, creating legal and reputational risk for major tech investors.

The incident also reflects a broader strategic tension: a $15 billion investment in the region signals Google’s commitment to expanding its cloud capacity, yet the method of execution risks undermining that investment through regulatory delays or public backlash. Near-term, engineering teams may face project delays or rework if construction is halted. Longer-term, the industry may need to integrate environmental impact assessments earlier in the data center planning cycle to avoid such conflicts.

Leadership question: At what point does the urgency of AI infrastructure deployment require a formal reevaluation of environmental compliance protocols to protect both investment capital and ecological assets? Nice one!

A 1,000-year-old Scottish castle faces demolition for a £5 billion hyperscale data centre. This draft examines the engineering trade-offs, heritage constraints, and operational realities for practitioners facing similar siting decisions. By Alasdair Ferguson.

In Auchtertool, Fife, a 1,000-year-old castle sits in the path of a proposed £5 billion, 600MW hyperscale data centre. Historic Environment Scotland (HES) refused protected status for Hallyards Castle, citing that planning proposals were “at an advanced stage.” Residents argue the listing application arrived shortly after ILI Group’s initial planning-in-principle submission, suggesting the process was rushed. For engineers, the core tension is between the massive compute capacity required for modern AI workloads and the immutable constraints of site history.

The technical narrative is clear: ILI Group plans a 600MW facility, a significant draw on the local grid. The developer claims the castle will be “fully excavated and recorded by qualified archaeologists” before demolition, with stonework dismantled and reused in a publicly accessible setting. This is not preservation by stasis, but a managed archaeological extraction. Practitioners must ask whether the resulting data centre’s operational lifespan justifies the permanent loss of a medieval bishop’s residence. The source notes HES acknowledged the castle is “of national importance,” yet chose non-designation.

Operational constraints are significant. The proximity of a 25-hectare industrial facility to 200 homes raises standard zoning and environmental impact questions, yet the source indicates a detailed Environmental Impact Assessment (EIA) has not yet been submitted. For a working engineer, the decision hinges on whether the AI service’s performance gains outweigh the reputational and regulatory risk of building on a protected site. The recent 12-month MSP pause on data centre decisions in Scotland further complicates timelines, though HES stated the pause “does not alter the development proposals,” which remain “at an advanced stage.”

Running model-generated code requires strict isolation. This analysis explores how Kubernetes namespaces, gVisor, and admission policies create a secure boundary for untrusted scripts. By DevToCash Team.

When an ops agent requests a run_script tool to compute metrics or diff configurations, the architectural risk shifts from logic errors to system compromise. Executing model-generated code within the agent’s own pod exposes API keys, ServiceAccount tokens, and internal network access. The solution is not better prompting, but rigorous platform isolation. The primary boundary is a dedicated Kubernetes namespace containing no secrets or privileged accounts, ensuring that even if code escapes, there is nothing to steal. This namespace enforces resource quotas, acting as backpressure against runaway loops by limiting concurrent pods and total job executions. By DevToCash Team.

The second boundary is the kernel. Standard containers share the host kernel, making them vulnerable to kernel exploits. By assigning the gvisor RuntimeClass, the system interposes a user-space kernel between the script and the host, mitigating kernel-level attacks. However, isolation fails if network access remains. A default-deny NetworkPolicy, including DNS, prevents exfiltration. This requires a CNI that strictly enforces policies, as a misconfigured network layer renders the sandbox ineffective.

A critical architectural decision is enforcing these boundaries via ValidatingAdmissionPolicy. Without this, a refactor of the executor template could silently drop the runtimeClassName or mount secrets, downgrading security. The policy mandates the sandbox shape, rejecting non-compliant pods at the API server level. This creates a fail-closed system where security is a platform constraint, not just application logic.

The trade-off is latency and compatibility. Pod scheduling and sandbox startup introduce seconds of delay, and syscall-heavy code runs slower under gVisor. Furthermore, the output remains untrusted; a script processing malicious logs can inject commands back into the model via stdout. Teams must resolve whether their latency budget supports ephemeral jobs or if they need warm pools, and ensure that any action taken on script output is gated by human approval, treating the result as potentially hostile input. Good read!

A new experimental framework enables automated, in-memory validation of Azure Bicep templates within CI/CD pipelines, closing a critical gap in Infrastructure as Code testing. A practical proof of concept showing how to use the experimental Bicep testing framework with Pester to validate Azure Monitor log alert resources and automate assertions in CI/CD pipelines. By Stanislav Zhelyazkov.

The landscape of Infrastructure as Code (IaC) testing has shifted with the release of an experimental Bicep testing framework by Anthony Martin of the Azure deployments team. This development addresses a significant limitation in previous snapshot-based validation methods, which lacked native pipeline integration. By leveraging the JSON-RPC interface, the framework generates resource snapshots in memory without invoking the Bicep CLI for each test, significantly reducing overhead and preventing the clutter of temporary JSON files. This mechanism allows engineers to reuse existing snapshots and validate complex Azure Monitor log alert resources directly within their CI/CD workflows.

The technical implementation, demonstrated by Stanislav Zhelyazkov, integrates seamlessly with Pester, the PowerShell testing framework. Using helper scripts like Demo.Common.ps1, developers can establish a testing session and generate snapshots for multiple Bicep parameter files. The framework supports assertions on specific resource properties, such as verifying that log alerts omit evaluation cadence fields when unnecessary or correctly apply system-assigned identities. This approach ensures that code changes altering expected resource configurations trigger immediate test failures, providing clear feedback before deployment.

Integration into GitHub Actions is straightforward, with workflows configured to execute Pester tests and publish results as checks. This visibility ensures that IaC changes are validated with the same rigor as application code. However, a key caveat remains: the framework currently lacks code coverage support for Bicep templates, and testing against actual deployments introduces substantial complexity and cost due to the need for multiple resource instances. As the framework matures, the community’s focus will likely shift toward bridging the gap between static snapshot validation and dynamic deployment testing, potentially requiring new tooling beyond Pester to achieve comprehensive coverage. Good read!

The article begins by noting that both DevOps and DevSecOps aim to accelerate and stabilize software delivery, but they diverge in how security is handled. DevOps establishes a culture of shared responsibility between developers and operations, employing CI/CD, automation, infrastructure as code, containers/Kubernetes, and monitoring to achieve speed with stability. DevSecOps builds on this foundation by treating security as an integral, continuous activity rather than a discrete gate at the end of the lifecycle. By Atul Sharma.

The main ideas mentioned:

• DevOps emphasizes speed and collaboration via CI/CD, automation, IaC, containers, and monitoring.
• DevSecOps extends DevOps by integrating automated security testing (SAST, DAST, SCA) throughout the pipeline.
• Security is shifted left: vulnerabilities are caught early in code, dependencies, container images, and IaC before deployment.
• DevSecOps also addresses supply‑chain risks, secrets management, and continuous threat monitoring.
• Common adoption challenges include alert fatigue, false positives, tool‑induced latency, skill gaps, and legacy system complexity.
• Successful implementation needs appropriate tooling, clear ownership, pragmatic policies, and actionable developer feedback.
• Valuable DevSecOps skills span version control, CI/CD design, cloud platforms, Docker/Kubernetes, IaC, app/API security, scanning techniques, secrets/IAM, vulnerability management, observability, and supply‑chain awareness.

Real‑world examples demonstrate how a DevSecOps pipeline can block a vulnerable dependency during a build or catch a misconfigured cloud storage bucket before deployment, preventing costly post‑release fixes. The piece also details challenges: excessive alerts, false positives, performance impacts, limited security knowledge among developers, ambiguous ownership, entrenched secrets, legacy system constraints, and vague risk‑acceptance policies.

Overcoming these requires suitable tooling, clear role definitions, practical security policies, and developer‑friendly feedback. Finally, it outlines the interdisciplinary skill set valuable for DevSecOps engineers, emphasizing understanding how version control, CI/CD, cloud, containers, IaC, application/API security, scanning techniques, secrets/IAM, vulnerability management, observability, and supply‑chain security interact. Good read!

Author demonstrates how a self-hosted stack using Qwen3-Coder-Next, llama.cpp, and Tailscale offers a viable, cost-controlled alternative to cloud-based coding agents. By Brad Westness.

Brad Westness has deployed a private coding agent on a Bazzite desktop, leveraging Qwen3-Coder-Next, llama.cpp, Podman, Open WebUI, and Tailscale. This setup addresses a growing friction point in developer workflows: the recurring cost and privacy concerns of cloud-hosted large language models (LLMs). By running inference locally, Westness eliminates per-token billing and ensures that source code and private documents remain within the local network. The project highlights a shift where open-weight models are becoming sufficiently capable for routine coding tasks, reserving frontier models for complex, high-stakes engineering.

The technical implementation relies on specific optimizations to fit the model onto consumer-grade hardware. Westness uses an NVIDIA GeForce RTX 4060 Ti with 16 GB of VRAM, employing llama.cpp’s --n-cpu-moe 44 flag to offload Mixture-of-Experts (MoE) weights to system RAM. This compromise allows the larger model to run alongside its context cache, while --split-mode layer prepares the configuration for future multi-GPU scaling. The stack is containerized via Podman Quadlets for reproducibility and isolated through Tailscale, which provides secure, private network access from remote work machines without exposing the service to the public internet. FlashAttention (-fa on) and batch size tuning (-b 2048) further optimize memory traffic and prompt ingestion speed.

This experiment underscores a broader economic argument: while frontier models dominate in capability, local inference democratizes access to agentic tools. Small teams, schools, and individual developers can avoid unpredictable API bills and vendor lock-in. The model’s aliasing feature (--alias qwen-coder) allows for backend updates without disrupting client configurations, adding operational stability. As hardware costs drop and model efficiency improves, the barrier to entry for private AI infrastructure continues to lower. Nice one!

Birgitta Böckeler’s recent evaluation of local models for agentic coding reveals that while hardware constraints remain the primary bottleneck, specific configurations like Qwen3.6 35B MoE offer a viable, albeit messy, alternative to cloud-based assistants. By Birgitta Böckeler.

Birgitta Böckeler’s recent assessment of local large language models (LLMs) for software development challenges the assumption that local execution is currently impractical for serious coding tasks. After a month of testing on Apple M3 Max and M5 Pro hardware, Böckeler found that while local models lag significantly behind cloud-based giants in overall capability, they have crossed a threshold of utility for specific workflows. The primary editorial question is not whether local models are better, but whether they are viable enough to justify the complexity of local setup for developers seeking privacy or cost savings.

The technical reality is governed by strict hardware constraints. RAM remains the core bottleneck; model weights must fit into VRAM, limiting viable models to the 15–25GB range with context windows capped at 64K. While response speeds have improved dramatically, particularly with 4-bit quantization on Apple Silicon, the quality of outcomes remains inconsistent. Böckeler notes that reasoning capabilities, often enabled by default, can be counterproductive, causing smaller models to enter endless loops. Disabling reasoning often resulted in faster, and occasionally better, performance.

A critical friction point for agentic coding is tool calling. Local models frequently fail to emit structured syntax that matches harness schemas, such as the discrepancy between old_text in Pi and oldString in OpenCode. While models can often self-correct, this unreliability makes them less suitable for fully autonomous agents compared to human-in-the-loop chat interfaces. Despite these hurdles, Böckeler identifies Qwen3.6 35B MoE as the current sweet spot, offering the best balance of capability, speed, and RAM footprint.

Engineers should watch for improvements in tool-calling reliability and the emergence of more standardized harness integrations. For now, local models are best viewed as a specialized tool for privacy-conscious or offline workflows, rather than a plug-and-play replacement for cloud assistants. Excellent read!

Martin Kleppmann argues that Europe’s heavy reliance on US cloud providers creates significant geopolitical vulnerability, proposing multi-cloud strategies, the AT Protocol (Authenticated Transfer Protocol), and local-first software as technical mitigations. By Martin Kleppmann.

Martin Kleppmann highlights a critical dependency: European cloud providers hold only about 15% of the local market, while AWS, Azure, and Google Cloud control roughly 70%. This concentration creates a geopolitical risk, illustrated by recent tensions involving Greenland and potential trade sanctions that could abruptly lock European entities out of US services. Kleppmann cites the International Criminal Court’s experience, where sanctions led to the disconnection of Microsoft-hosted email accounts, demonstrating that access is not guaranteed. While Microsoft denies suspending services, the incident underscores the fragility of centralized, jurisdiction-bound infrastructure.

The talk main points:

• Europe’s cloud dependency creates geopolitical vulnerability.
• Multi-cloud, atproto, and local-first software reduce vendor lock-in.
• Credible exit mechanisms preserve user agency during provider failures.
• Interoperability shifts power dynamics away from centralized providers.

To mitigate these risks, Kleppmann advocates for three technical strategies: multi-cloud deployment, the AT Protocol (atproto), and local-first software. Multi-cloud reduces single-vendor dependency. The AT Protocol, a decentralized social media framework, emphasizes “credible exit,” allowing users to switch providers without losing their identity, social graph, or data. This design ensures that even if a provider fails or is sanctioned, users retain agency. Local-first software further decouples data from centralized servers, storing it on user devices to ensure continuity regardless of backend availability.

These approaches share a common goal: commoditization and interoperability to reduce lock-in. By enabling easy switching between providers, organizations can shield themselves from political shifts. Kleppmann notes that while these technologies began as idealistic research projects, they are increasingly becoming mainstream industry trends. For engineers, the implication is clear: designing systems that prioritize user agency and interoperability is not just a technical preference but a strategic necessity in an unstable geopolitical landscape. The next step is observing how quickly these architectures are adopted to counteract centralized power structures. Good read!

A new Paubox survey reveals that in healthcare organizations using AI coding assistants, IT staff build more often than developers, signaling a structural shift in who creates software. By Business Wire.

Paubox has released preliminary findings from a July 2026 survey of 151 healthcare leaders, revealing a significant shift in who builds software within the sector. The data, scoped exclusively to organizations already using AI coding assistants to handle protected health information (PHI), indicates that IT staff are the primary builders in 84% of surveyed organizations, compared to 58% for developers and engineers. Strikingly, in roughly two in five of these organizations, developers are not involved in AI-assisted building at all.

This trend suggests that the adoption of AI coding tools has widened the pool of creators beyond the traditional engineering function. The survey highlights that four out of five healthcare leaders cite the ability to let non-developers build software as a key driver for adopting these tools. Consequently, IT teams, operations staff, compliance officers, and even clinicians are increasingly producing software. This democratization of development is coupled with widespread deployment: 80% of the surveyed organizations have already implemented AI-assisted tools that patients use directly.

While the headline finding focuses on personnel rather than technology, the implications for governance are substantial. As non-technical staff generate more code, the burden of maintaining security and compliance falls on different organizational layers. Paubox notes that this is part of a broader benchmarking effort, with the full 2026 report set to detail the volume of tools produced and the agent infrastructure connecting AI services to core systems. Engineers should watch for how healthcare organizations manage the technical debt and security risks introduced by this decentralized development model, particularly as AI-assisted workflows become more integrated into patient-facing systems. Interesting read!