InfoWorld

Every September, with metronomic regularity, we have a new version of the Java platform. One small point about timing is that the first release candidate of JDK 27 was delayed by two weeks due to the release of the first Critical Security Patch Update (CPSU) for the JDK. The need for a CPSU is a direct implication of AI models , such as Anthropic’s Claude Mythos, becoming much better at identifyi…

For years, I thought of billing as a domain I would have to learn from scratch. Ledgers. Taxes. Proration. Regulations. Money. After 11 years building cloud datacenter management systems, I assumed my infrastructure experience would take me only so far. I was wrong. A few years ago, when I began working on billing, what surprised me most wasn’t how different the domain was. It was how familiar th…

Common Vulnerability Scoring System (CVSS) severity tells you how serious a vulnerability could be. Exploit Prediction Scoring System (EPSS) estimates how likely exploitation is in the next 30 days. Neither one, by itself, tells you what your team should fix first. Run a dependency scan on any moderately sized JavaScript project and you will probably see a table of findings, many of them labeled …

Bob, IBM’s agentic software development platform is now available to run on premises and in private clouds, sovereign clouds, and air-gapped environments to give users more control over their data. IBM is hoping to lure companies operating in heavily regulated environments or managing sensitive source code and regulated data. In such environments, running AI operations means that they are under s…

Over the past few weeks, people have been pushing a stack of reports at me as evidence that AI is dangerous to humanity. The OpenAI incident disclosures , the METR and Redwood Research joint investigation, the Nightingale Collective’s DseWiki report, and Ruby Central’s RubyGems update are the latest chapter in a story many people already believe: The machines are turning on us, and this time we h…

Tools such as Anthropic Claude Code or OpenAI Codex have changed the face of software development, and all the signs are that this investment is set to increase further. But is paying a monthly subscription (and perhaps additional usage fees) cost-effective? Will the increasing level of investment in AI-generated software prove to be worthwhile? That’s a question several economists from the US Na…

Microsoft and Google are joining a project to create an open specification for exchanging semantic models across data, analytics, and AI platforms. The project already has the backing of over 60 companies including Databricks, Informatica, Mistral AI, Nvidia, Oracle, Salesforce, and Snowflake. Their support for Ossie makes it a little more likely that future analytics platforms will be interopera…

Google has unveiled a new frontier AI model after months of delay. Gemini 4 Argon is designed to handle complex, long-horizon workloads spanning software engineering, enterprise knowledge work such as legal and financial analysis, and cybersecurity. But only a few organizations can get their hands on it for now. Argon is “rolling out to a set of trusted cyber defenders through our Fairwind Progra…

After many years of watching how Microsoft develops platforms and rolls out technologies to external users, one thing is clear: anything that is important to Microsoft internally quickly becomes important to anyone building on top of Windows or Azure. The transition from internal to external tooling invariably takes the form of new features in Visual Studio and Visual Studio Code . Often these ca…

In most companies, the struggle to answer a new question fast has nothing to do with a lack of data. The problem is a lack of semantics. Or to put it another way, a lack of agreement about what the data means . Suppose a CFO wants to generate a new report on revenue by customer segment. It sounds simple, but in practice, for the employees tasked with executing the CFO’s directive, it means a mult…

OpenAI says true agentic AI has finally arrived, pushing beyond the trivial capabilities of early-stage virtual assistants. This week at OpenAI Dev Day , the company introduced Dots, which CEO Sam Altman described as “remarkably capable, always-on” agents powered by GPT‑6 Astra. Dots have their own cloud computer, can be accessed in ChatGPT, Slack, or Teams, and plug into more than 4,000 apps bas…

As enterprises increasingly turn to coding agents for building applications, Stack Overflow has added new capabilities to Stack Internal, its enterprise-focused platform for centralizing proprietary technical knowledge, to help development teams turn organizational knowledge into trusted, actionable context that these agents can understand and use. Stack Internal now evaluates knowledge based on …

True to its name, AI-model-training tool Unsloth would do more work than it was asked to when developers checked out a model: It would also allow arbitrary code to execute on their machines. Pillar Security found that simply selecting a model in Unsloth Studio caused the application to download and execute Python code from the model repository. This could potentially allow attackers to use a spec…

My mom used to say that Hodges’s law was “Junk expands to fill the space allotted for it.” We lived in three houses over the years, each one bigger than the previous house as our family grew, and each house became just as full of junk as the one before it. My mom was echoing C. Northcote Parkinson , whose famous law said the same about work—that it expands to fill the time given to get it done. I…

Testing deterministic systems is relatively straightforward. Create an assertion that the system should pass, and automate validating it against a series of input-to-output data patterns. When new test patterns are needed, use observability sources to extract them from actual usage data or to create synthetic test data . But testing AI models and agents with nondeterministic outputs doesn’t align…