30 results for “tennant”
Readyon Builds Four Layer Tenant Isolation for Multi Tenant Amazon EKS
ReadyOn has detailed a four-layer tenant isolation archit…
#NewsBeep #News #Artsanddesign #Amazon #Architecture&Design #ArgoCD #Arts #ArtsAndDesign #CloudSecurity #Design #Development #DevOps #Entertainment #GitOps #Isolates #Kubernetes #Multi-tenancy #Multi-TenantData #networksecurity #Observability #Policy #readyonfourlayerisolation #Security #ThreatModeling #UK #UnitedKingdom #VirtualPC
https://www.newsbeep.com/uk/814867/
Sheffield council tenants could get solar panels in next three years | News
It will be for those with poor energy efficiency Author: Rose MasonPublished 29 minutes ago A Sheffield councillor…
#Sheffield #UnitedKingdom #UK #GB #England #Headlines #News #Europe #EU #Britain #GreatBritain #sheffield
https://www.europesays.com/uk/1276037/
Readyon Builds Four Layer Tenant Isolation for Multi Tenant Amazon EKS
ReadyOn has detailed a four-layer tenant isolation architecture …
#NewsBeep #News #Artsanddesign #Amazon #Architecture&Design #ArgoCD #Arts #ArtsAndDesign #CA #Canada #CloudSecurity #Design #Development #DevOps #Entertainment #GitOps #Isolates #Kubernetes #Multi-tenancy #Multi-TenantData #networksecurity #Observability #Policy #readyonfourlayerisolation #security #ThreatModeling #VirtualPC
https://www.newsbeep.com/ca/947122/
Audit recommendation: review ConnectWise tenant OAuth applications immediately, rotate credentials, and lock down conditional access policies before this inventory discrepancy becomes a total write-off.
Reward: You've received a Negative-Value Asset Token, redeemable for one (1) corrective audit finding and a stern footnote in the quarterly report.
#CyberSecurity (3/3)
Hackers Use AI Agents to Target Over 2,250 Microsoft 365 Tenants Through ConnectWise
Hackers used AI agents and stolen ConnectWise application credentials to attempt access to more than 2,250 Microsoft 365 tenants, according to Microsoft’s technical investigation report. Microsoft attributed the campaign to Storm-0940, a China-state-aligned group, and said its ARTEX framework accelerated reconnaissance, authentication attempts, and cloud persistence. The targeting count does not mean every tenant was […] The post Hackers Use AI Agents to Target Over 2,250 Microsoft 365 Tenants Through ConnectWise appeared first on Cyber Security News .
Pulse ID: 6ae04aee2d7726bd40ef3e48
Pulse Link: https://otx.alienvault.com/pulse/6ae04aee2d7726bd40ef3e48
Pulse Author: CyberHunter_NL
Created: 2026-10-27 06:55:42
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
https://www.europesays.com/uk/1276037/ Sheffield council tenants could get solar panels in next three years | News #Britain #England #GreatBritain #sheffield #UK #UnitedKingdom
Reward: You've been issued a complimentary Spectral Compliance Badge — valid in all haunted tenants.
#CyberSecurity #APT #Storm0940 #ConnectWise #AIThreat #PersistenceUnlocked (3/3)
From January 1, rent for thousands of tenants in #Munich's #municipal apartments could rise
Tenants of municipal apartments in Munich will likely have to prepare for rent increases by the end of the year. The company #Münchner Wohnen, abbreviated #MüWo, plans to lift the moratorium on rent increases as of January 1. The increase will not affect all households, and the city council must make the final decision.
#Read More👇👇👇
⚠️ CRITICAL: Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants
Chinese threat actor Storm-0940 exploited compromised ConnectWise credentials to breach over 2,250 Microsoft 365 tenants using ARTEX, an open-source AI pen-testing tool. Attackers achieved privileged access and persistent backdoors in multiple organizations within hours. If your org uses ConnectWis…
🤖 AI generated summary
https://www.europesays.com/unitedstates/65125/ Maine Tenants Win $3.6M Settlement in Suit Against Landlord #Inflation #Inflation&Prices #Maine #Prices #RentersRights #settlements #video
China-linked hackers used agentic AI in attack on 2,250 Microsoft 365 tenants https://www.csoonline.com/article/4239028/china-linked-hackers-used-agentic-ai-in-attack-on-2250-microsoft-365-tenants.html
Pennsylvania Medicaid data proved supportive housing cut spending by $145/month among long-term tenants, driven by an $89 drop in inpatient stays and $64 drop in residential behavioral health. Targeted PSH stabilizes fragile patients while trimming inpatient waste. #HousingIsAHumanRight #Housing1st
https://www.europesays.com/ie/752144/ Readyon Builds Four Layer Tenant Isolation for Multi Tenant Amazon EKS #Amazon #Architecture&Design #ArgoCD #Arts #ArtsAndDesign #ArtsAndDesign #ArtsDesign #CloudSecurity #Design #Development #devops #Éire #Entertainment #GitOps #IE #Ireland #Isolates #kubernetes #MultiTenancy #MultiTenantData #NetworkSecurity #Observability #Policy #ReadyonFourLayerIsolation #Security #ThreatModeling #VirtualPC
West Seattle Blog… | BIZNOTE: Kizuki Ramen closing in West Seattle Junction (updated Saturday: new tenant signed) https://www.diningandcooking.com/us/62107/ #Washington #WashingtonDining #WashingtonFood #WashingtonGroceryStores #WashingtonRestaurants #WashingtonState #WashingtonStateDining #WashingtonStateFood #WashingtonStateGroceryStores #WashingtonStateRestaurants
A huge congratulations to Olivia Chow and the incredible slate of progressive councillors elected in Toronto tonight.
This win goes beyond any one person or campaign — it’s the result of years of movements organizing together, from tenant unions to climate activists, migrant rights advocates and those on the front lines of harm reduction. You mobilized and knocked on every last door to make this happen.
Tonight, you’ve secured a better future for Toronto together.
CW: részletek
A Microsoft szerint a Storm‑0940 (Kína-kapcsolat) ARTEX ügynökökkel támadta a ConnectWise ellátási láncát. Gépi sebességű jelszószórás: >2250 tenant, csúcs 2900 próbálkozás/perc; okt.10–14 több mint 151k sikertelen login. Az AI ügynökök később ellopott alkalmazáshitelesítésekkel léptek be és módosítottak jogosultságokat. https://linuxmint.hu/hir/2026/10/kinai-hatteru-hackerek-artex-ai-ugynokokkel-tamadjak-a-connectwise-ellatasi-lancat
#AI #ellátásilánc #ConnectWise #infosec
‘Our Ealing block of flats is sinking and bricks are coming loose – we fear someone will die’
Huge cracks are visible in the block at Hanger View Way in North Ealing The tenants have spent…
#London #Britain #UnitedKingdom #UK #GB #England #Headlines #News #Europe #EU #Ealing #Acton #Brokenhomes #EalingLondonBoroughCouncil #Housing
https://www.europesays.com/gbr/london/44739/
RE: https://travel-friends.chat/@organictraveller/117398630274835122
Breaking: Fritz Mühlenbäckerei is not going to continue the #bakery till at #CafeReichshof, but the tenant of the #cafe is. Here are the latest updates on the future of one of #Munich's oldest #organic #bakeries: https://www.organictraveller.de/organictraveller-munich-bakeries-butchers#neulinger
The Machine Week ran from October 13 to 22, and it produced 5 incidents where automation or AI agents did the heavy lifting. The headline number: a nation-state actor fired 2,900 sign-in attempts per minute at 2,250 Microsoft 365 tenants using an open-source AI pentest framework, reaching privileged access in under three hours.
ConnectWise / Storm-0940: AI Agents at Machine Speed
What happened: On October 15, Storm-0940 — a China-state-aligned group Microsoft tracks since 2021 — used ARTEX, a Go-based agentic AI penetration-testing framework, to compromise ConnectWise Cloud Backup's application credentials. From there, AI agents automated password spraying at 2,900 attempts per minute across 2,250+ downstream Microsoft 365 tenants, authenticating via already-trusted ConnectWise app identities without interactive sign-in. Microsoft disclosed the attribution on October 21.
Why it matters: The headline is "nation-state attack." The real risk is that ARTEX is open source. Any actor with a stolen OAuth app credential can now compress a multi-week intrusion into hours, and your MFA won't stop an app identity that's already trusted. Audit every third-party OAuth app registered in your tenant and revoke any you can't name.
Arista VCO: The Third Zero-Day in Four Months
What happened: On October 22, Arista published Security Advisory SA 0199 for CVE-2026-114625, a SQL injection in VeloCloud Orchestrator (on-prem) rated CVSS 9.9 that lets any logged-in user — down to "Enterprise Read Only" — escalate to superuser operator. It is the third exploited VCO zero-day since July 2026. Affected builds: 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10, 6.4.x before 6.4.2.12. Arista confirmed active exploitation at the time of disclosure.
Why it matters: The headline is "patch VCO." The real risk is that three zero-days in one product within four months means the same code path is being probed repeatedly, and on-prem VCO is the control plane for your entire SD-WAN. If you can't patch within 48 hours, isolate the orchestrator from the internet.
OVHcloud CLI: 94 Minutes on GitHub
What happened: On October 19, a compromised OVHcloud developer GitHub account was used to replace the download binaries for five CLI releases (v0.11.0 through v0.15.0) with a secret-stealing trojan. The malicious builds were live for 94 minutes (14:47–16:21 UTC+2) before detection. The trojan harvested cloud credentials, SSH keys, and environment variables from the local disk.
Why it matters: The headline is "don't download OVHcloud CLI." The real risk is that any CLI you curl | sh or brew install is a supply chain target, and a 94-minute window is enough for a CI pipeline to pull it. Pin your CLI tools by SHA-256 and verify release artifacts before execution.
Patch Tuesday: 1,413 CVEs and a MotW Bypass
What happened: On October 13, Microsoft shipped the largest Patch Tuesday in its history: 1,413 CVEs, including CVE-2026-96951, an actively exploited Windows Shell security feature bypass (CVSS 8.8) that defeats Mark of the Web. CISA added it to the KEV catalog the same day with a federal remediation deadline of October 16. The same week, Palo Alto patched an exploited PAN-OS RCE and Cisco patched an exploited Secure Email Gateway flaw.
Why it matters: The headline is "patch Windows." The real risk is that MotW is the last line between a downloaded file and Office Protected View or SmartScreen. A bypass means a single malicious attachment can now land in a sandbox-less context. Verify your endpoint actually applies the October 13 cumulative update, not just the patch metadata.
The Wider Machine Week: Automation Everywhere
Plex2Shell. Four chained Plex Media Server CVEs were patched on October 16. Crypto miners and a proxy backdoor appeared within 24 hours of the proof of concept. If you run Plex at home, it's already been scanned.
Capcom. On October 22, Capcom confirmed a breach of CAPCOM ID exposing 11.7 million account email addresses. Hackers also changed login passwords for 196 accounts and leaked dates of birth for 43.
Nikkei. On October 19, Japanese media group Nikkei disclosed its third breach in a month. Attackers used stolen credentials from October 7 to access a cloud development service, exposing 1.83 million records.
Oracle Health. On October 7, Oracle reported a breach of its healthcare unit affecting nearly 20 million US patients. Compromised data includes Social Security numbers, home addresses, and medical records.
Japan NPA. On October 21, the National Police Agency said personal information for approximately 125,000 officers and staff across 20 prefectural forces was compromised through an attack on cloud provider Arcadia.
What This Means for You
If an AI agent can reach your M365 tenant, your SD-WAN control plane, and your local SSH keys through three different trust paths in the same afternoon, you don't have a patching problem — you have a trust-boundary problem.#ai #themachineweek #security #software #coding #development #engineering #inclusive #community
The Machine Week: The Week Attackers Almost Went Full Autopilot
🏆 New Achievement! Asset Not Found: Everything Else Is Also Gone!
Conducting inventory audit. ConnectWise tenants: 2,250 compromised. Microsoft 365 accounts: 327 targeted across eight organizations. Failed logon events: 151,000-plus. Time defenders had to respond at 2,900 sign-in attempts per minute: approximately none. (1/3)
Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang
On September 8, 2026, we were alerted by a security researcher, Gadi Evron from Knostic, to a tenant…
#NewsBeep #News #US #USA #UnitedStates #UnitedStatesOfAmerica #Artificialintelligence #AI #ArtificialIntelligence #Technology
https://www.newsbeep.com/us/896104/
Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang
On September 8, 2026, we were alerted by a security researcher, Gadi Evron from Knostic, to a tenant…
#NewsBeep #News #Artificialintelligence #AI #ArtificialIntelligence #CA #Canada #Technology
https://www.newsbeep.com/ca/947868/
You review a 30-line template diff. Production sends 40,000 tokens assembled at request time from six sources, four of which changed this week and none of which appear in the pull request. The diff you approved is not the change you shipped.
This is the part of LLMOps that keeps biting teams after they have evals, tracing, and a gateway in place. The template is versioned in git. The context is assembled by code paths nobody treats as release artifacts.
The prompt is a build output
List what actually goes into a request for a typical RAG-plus-tools system:
Each is a dependency with its own version and its own deploy cadence. The retrieved chunks change when someone reindexes. The tool schema changes when a backend engineer renames a parameter and rewrites the description. Neither triggers a review of the prompt.
So when quality drops on Tuesday and no code shipped, there is no diff to look at. That is the failure this whole post is about.
Fingerprint everything the model sees
Compute a content hash over the inputs that can change model behaviour, and log it with every trace:
Store fingerprints always. Store full rendered prompts sampled or redacted, depending on your data rules — full-text retention is a compliance decision, not an observability one. The fingerprint is small, cheap, and answers "what changed" during an incident in one query.
The trade-off: a fingerprint that includes a timestamp, a request id, or a per-user greeting has near-zero collision rate and zero diagnostic value. Hash the parts that affect generation, not the metadata around it. I have watched a team spend a day on "why is our prompt hash changing every request" when the answer was a locale string.
A small assembler with provenance and eviction
You do not need a framework for this. You need three properties: every section carries a trust level, every section carries an eviction priority, and over-budget on a pinned section is a hard error rather than a silent trim.
from dataclasses import dataclass, field
from hashlib import sha256
import re
@dataclass
class Section:
name: str
text: str
trusted: bool # False for retrieval, tool output, user uploads
priority: int # higher survives truncation
pinned: bool = False # never evict; over budget means fail loudly
INSTRUCTION_LIKE = re.compile(
r"(ignore (all )?(previous|prior) instructions|you are now|system prompt)",
re.IGNORECASE,
)
def screen(text: str) -> str:
# Cheap heuristic, not a guarantee. Log hits and route to a stricter path.
return INSTRUCTION_LIKE.sub("[filtered]", text)
def count_tokens(s: str) -> int:
# Swap in tiktoken/the provider counter. One counter per model family.
return len(s) // 4
@dataclass
class Assembled:
prompt: str
fingerprint: str
dropped: list[str] = field(default_factory=list)
def assemble(sections, budget, model_id, template_version, snapshot_id):
ordered = sorted(sections, key=lambda s: (s.pinned, s.priority), reverse=True)
kept, dropped, used = [], [], 0
for s in ordered:
body = f"<{s.name} trust={'high' if s.trusted else 'low'}>\n"
body += (s.text if s.trusted else screen(s.text)) + f"\n</{s.name}>"
cost = count_tokens(body)
if used + cost > budget:
if s.pinned:
raise ValueError(f"pinned section {s.name} exceeds budget")
dropped.append(s.name)
continue
kept.append((s, body))
used += cost
# Render in original order so layout is stable across requests.
pos = {id(s): i for i, s in enumerate(sections)}
kept.sort(key=lambda pair: pos[id(pair[0])])
prompt = "\n\n".join(body for _, body in kept)
h = sha256()
for part in (model_id, template_version, snapshot_id, prompt):
h.update(part.encode())
return Assembled(prompt, h.hexdigest()[:16], dropped)
# Usage: build once per request, log the fingerprint beside the trace id.
ctx = assemble(
sections=[
Section("question", "why was my claim denied?", trusted=True, priority=10, pinned=True),
Section("policy_chunk", retrieved_text, trusted=False, priority=5),
Section("profile", tenant_blob, trusted=True, priority=1),
],
budget=12_000,
model_id="claude-sonnet-4",
template_version="support-v14",
snapshot_id=index_build_id,
)
Two details in there are load-bearing. Sections render in original insertion order rather than priority order, because reordering the same content changes model behaviour and makes your eval deltas unattributable. And pinned turns budget pressure into an exception instead of a degraded#ai #llm #devops #python #software #coding #development #engineering #inclusive #community
Context Assembly Is a Build Step: Versioning the Prompt You Actually Send
2026-W43 — Weekly Threat Roundup
🐚 PHP2Shell dominated the week: CVEs exploited before disclosure, millions of attempts, no confirmed compromises yet, but a third unpatched RCE arrived days later.
🤖 AI-accelerated attacks went mainstream: Storm-0940 used the Artex framework to compromise 300+ Entra tenants; ransomware affiliates…
https://threatnoir.com/weekly/2026-w43
#infosec #cybersecurity #threatintel
🤖 AI generated summary
🖲️ #Cybersecurity #Ciberseguridad #Ciberseguranca #Security #Seguridad #Seguranca #News #Noticia #Noticias #Tecnologia #Technology
⚫ Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack
🔗 https://www.darkreading.com/cyberattacks-data-breaches/microsoft-storm-0940-connectwise-supply-chain-attack
The China-linked actor used an AI-enabled penetration-testing tool to automate and accelerate its attack on more than 2,200 tenants.
A Subdomain Field That Became a Credential Harvester: SAP Cloud SDK CVE-2026-89111
SAP scores CVE-2026-89111 at 10.0. That is an unusual number for a server-side request forgery, and the reason is scope: the bug does not merely send a request to the wrong host, it hands the attacker the credentials needed to complete that request themselves. The affected package is the SAP Cloud SDK for Python, and the fix shipped in two parts, months apart, with a regression between them.
The mechanism
The SDK builds an OAuth2 token URL for the client credentials flow. Part of that URL comes from a caller-supplied value named tenant_subdomain, which the SDK substitutes into the URL by string replacement.
Whoever controls tenant_subdomain controls the destination host. When fetch_token runs, it sends grant_type, client_id and client_secret in the form body to whatever host that value points at. An attacker who can set the field to a host they operate receives the client secret directly, with no parsing trick required.
Those credentials buy a real access token from the legitimate endpoint. The token carries whatever permissions the original client held, and the documented Destination configuration stores third-party system credentials. The blast radius runs from one subdomain parameter to the credentials of every system that SDK integrated with.
Two fixes, and a window in between
The advisory lists affected versions below 0.45.2, with the fix in 0.45.2. According to the vendor, that is the whole story.
In practice it is not. Researchers tested each release and found that the module migration work in 0.53.0 reintroduced the flaw, which remained present through 0.55.0. Version 0.55.1 re-fixed it; the current release line is 0.58.5.
The per-version behaviour is reproducible. 0.45.0 and 0.45.1 send the secret to the attacker host, 0.45.2 blocks it, 0.53.0 and 0.55.0 send it again, and 0.55.1 and 0.58.5 block it. One test run against 0.53.0 captured two separate credential sets from a single request flow.
That gap is the finding worth carrying away. Anyone who patched to 0.45.2 and later upgraded to 0.53.0 for unrelated reasons became exploitable again, and no advisory said so. A version-range check driven by the vendor advisory alone would report those hosts as fixed.
Disclosure context
The issue was published at SAP Security Patch Day on 13 October 2026 alongside 19 other vulnerabilities: 4 critical, 3 high, and 4 that had been pre-published on GitHub. No in-the-wild exploitation has been reported.
Other items in the same batch matter for anyone tracking SAP exposure broadly. CVE-2026-89110 is a broken access control issue in NetWeaver Visual Composer. CVE-2026-89107 is code injection in S/4HANA. CVE-2026-89108 is a missing authorization check in Manufacturing Integration and Intelligence, scored between 9.9 and 9.1 depending on the source.
What to do
tenant_subdomain against the values your integrations actually use. It is a narrow control, but it addresses the injection point itself.The lesson that outlasts the CVE
Advisories describe the versions the maintainer knew about when the advisory was written. A regression introduced later, during a refactor, is invisible to an advisory-based scanner and to any team whose remediation reads as an instruction to upgrade past the listed version.
For a library that handles credentials, the durable control is a negative test in your own pipeline: point tenant_subdomain at a host you control, run the token fetch, and assert that no secret leaves. That test survives version changes, module migrations, and advisory text nobody has updated.
References
#sap #oauth2 #ssrf #credentialleak #software #coding #development #engineering #inclusive #community
A Subdomain Field That Became a Credential Harvester: SAP Cloud SDK CVE-2026-89111
As scams go, I've seen a lot worse.
> from: Microsoft [[email protected]]
subject: Important: Make a purchase to continue with your account
> Your account will be deleted by December 23, 2026—make a purchase to keep your billing account
You’re receiving this email because your Microsoft billing account ID e778b599-f0bd-5e3a-4b34-d19bdaebaba6:90e54f4e-836a-431a-a415-9b893b9f0b1b_2019-05-31 and associated Microsoft Entra ID tenant (tenant ID 5fa03a5e-dc38-44da-81a5-5167785fd74f) have been inactive for more than 200 days.To continue using your current billing account and tenant, make a purchase before December 23, 2026. If you don’t make a purchase before this date, your next purchase with Microsoft will require a new billing account and an associated Microsoft Entra ID tenant to continue using Microsoft services.
Make a purchase >
The payload, and this is the clever bit, is hosted on Azure. So the first thing you see is Microsoft's actual email page asking you to sign in. If you do, you'll be logging into the site with your actual Microsoft ID! And any associated payment etc. information.
The thing that makes this work is that Microsoft is (A) a legitimate cloud hosting provider, (B) a legitimate ID handler, and (C) dumbfuck retarded enough to plausibly invent a policy that you need to pay to keep your account.
🚨🇦🇪 Dubai Land Department data allegedly compromised, $100,000 demanded
The "Reze" ransomware group claims to have breached the Dubai Land Department, the government authority responsible for property registration and real estate regulation in Dubai.
The actor is advertising records involving 3,271 property owners, 32,211 tenants, and 43,986 properties, with approximately 450,000 participants referenced.
Published samples include names, phone numbers, Emirates ID numbers, passport details, and property ownership information.
The data is being offered for $100,000. The alleged breach has not been independently confirmed.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
Context Engineering over Prompt Engineering: Architecting Codebases for AI Agents
TLDR: Agents don't fail because your prompt was badly worded. They fail because your codebase was never designed to be read. The engineers getting compounding returns from agents aren't the best prompt writers. They're the ones whose repos carry the architecture outside their heads: context standards in the repo, strongly typed contracts, and deliberately pruned retrieval. Prompt engineering is the visible 10%. Context engineering is the structural 90%.
The Prompt Ceiling
Somewhere around 2024, the industry's collective mental model of "working with AI" became a prompt box. The skill was asking well. Whole courses, cheat sheets, and prompt libraries flourished on the premise that the delta between a good and bad AI outcome lived in the wording of your request.
For single-shot, single-file tasks, that was roughly true. It also quietly set everyone's expectations, and the expectations are now the problem.
Because in 2026 the work moved. Mid-level and senior engineers aren't asking a chatbot for a function anymore. They're dispatching agents across repositories of hundreds of thousands of lines, agents that read code, edit files, run tests, and open pull requests. And in this regime something counterintuitive happens that every serious team eventually notices: prompt quality stops being the constraint.
You can rewrite your prompt five times. You can role-play the model into a "senior staff engineer persona." Doesn't matter. The agent will still confidently duplicate an internal utility that already existed three directories away, import a dependency your org banned two quarters ago, and couple two modules your architecture has spent three years keeping apart.
Not because the prompt was weak. Because the codebase was opaque.
What an Agent Actually Sees
To understand why, look at what the average large repository exposes to a reader:
A new human engineer takes weeks to absorb all this, and that's with onboarding sessions and mentors and the ability to ask someone in the hallway. Then the industry hands an agent a repo checkout and a prompt, and acts surprised when the output violates constraints that were never written down anywhere the agent could read.
Here's the failure as it typically shows up, so common it's almost a template.
An agent is asked to "add a retry mechanism to the notification service." It produces a perfectly reasonable implementation. It also duplicates the exponential-backoff utility that already exists in an internal library, pulls in a third-party HTTP client the org specifically removed after a security audit, and places its new logic in a module that creates a circular dependency with the domain layer.
None of those are coding errors. All of them are context errors. And notice what makes them expensive: the code compiles, the tests pass, and the violations are only visible to someone who already knows the architecture. If that person exists, a senior just spent their verification budget (see the verification trap) catching things a document could have prevented.
Fix 1: Put the Architecture Where the Reader Is
The single highest-leverage change: stop storing architecture outside the repository.
The pattern that's emerged across serious AI-adopting orgs is an in-repo context standard, a known, versioned location that every agent (and every new human) reads first. An AGENTS.md or .context/ directory at the repo root holding the high-level domain model, the module boundaries and their rules, the explicit list of disallowed dependencies, the invariants ("never call X from Y," "all money fields are integers in minor units"), and pointers to the ADRs that matter.
Treated like code, not documentation. Reviewed in PRs. Updated when the architecture changes, in the same commit as the change.
The test for whether this is working is embarrassingly simple. Could a competent engineer who has never met your team make a boundary-respecting change using only what's in the repo? If your honest answer is "no, they'd need to ask someone in Slack," then your agent never had a chance. Neither did your next hire.
The corollary that surprises teams: this investment isn't really for the agent. It pays back twice. Once when the agent's first-draft PR respects the boundaries, and again every time a new human onboards in days instead of weeks. The agent didn't create the need. It just made the cost of not meeting it immediate.
Fix 2: Strongly Typed Contracts
The second fix is about what kind of surface your system presents to a reader.
Context files are necessary but they're advisory. Agents, like humans, follow probability, and prose is soft. Types are hard. The orgs getting the best agent behavior are the ones that make architectural constraints mechanically enforceable:
Any escape hatches at the boundaries, no stringly-typed config. The failure mode shifts from "plausible code that violates the design" to "code that doesn't run," and that shift is the entire ballgame. An error the compiler catches at generation time costs seconds. The same error caught in review costs a senior's attention. Caught in production, it costs six hours or six figures.The framing worth internalizing: every invariant you express only in prose is an invariant an agent will eventually violate, charmingly and with total confidence. Every invariant you express as a type or a lint rule is one less thing for the human reviewer to carry.
Fix 3: Prune the Context
The third fix is the counterintuitive one, because everything above has been "give the agent more context." But there's a failure mode on the other side, and mature teams hit it right around the time their context standards start working.
Context dilution. If your instinct is "the agent should know everything," you dump half the repository into the window, and the model now treats your critical domain rules as one equal voice in a choir of 40,000 tokens of boilerplate. The invariant you care about gets the same statistical weight as a vendored dependency's CHANGELOG. The agent saw the rules. It just didn't prioritize them, because you gave it no structure to prioritize with.
The working pattern is deliberate, selective context:
The principle underneath all three fixes is one the prompt-engineering era obscured: an AI agent is the most literal-minded new hire your team has ever onboarded. It will not infer your conventions. It will not ask a clarifying question in the hallway. It will follow exactly what's in front of it, at full speed, with total confidence.
Every year your team spent frustrated at new engineers for "not getting it," when the real problem was undocumented architecture and oral-tradition onboarding, is now doubled. Because the agent executes the misunderstanding immediately, at scale, in code.
The Question Behind the Question
If your codebase needs a person to already know your architecture in order to work safely in it, is that an asset or a liability? For twenty years, "the architecture lives in our senior staff's heads" sounded like job security. In an agent-heavy 2026, it sounds like a single point of failure with a Slack handle.
Your Turn
I'd genuinely like to hear how other teams are drawing this line, because the tradeoffs are real and I don't think there's a settled answer.
Comment with the ugliest thing an agent did in your repo that turned out to be your architecture's fault. Those stories are more useful than the prompts everyone keeps posting.
Next in the series: Deterministic Safety Gates for Agentic Workflows. What happens when agents stop writing code and start changing infrastructure, and why "the agent tested itself" isn't a safety argument.#discuss #ai #aiagents #softwareengineering #software #coding #development #engineering #inclusive #community
Context Engineering over Prompt Engineering: Architecting Codebases for AI Agents