The Video Signal

Topic

Agentic Workflows

All digests tagged Agentic Workflows

AI Engineer Paris 2026 Opening Keynotes: Mistral, Langfuse & Sizzy | Day 1 thumbnail

· 1:14:46

AI Engineer Paris 2026 Opening Keynotes: Mistral, Langfuse & Sizzy | Day 1

The keynotes covered the profound economic impact of AI as a General Purpose Technology (GPT), detailing historical parallels with the Industrial Revolution. The technical discussion highlighted the evolution of AI development from simple prompting to complex, orchestrated 'software factories.' Speakers emphasized the shift toward robust, enterprise-grade solutions, focusing heavily on agentic safety, data sovereignty, and unified platforms that manage diverse tools and connectors.

Key takeaways

  1. AI as a General Purpose Technology (GPT)

    AI is positioned as a GPT, similar to electricity or the internet, capable of driving long-term economic growth. However, realizing this growth requires more than just invention; it demands diffusion, investment, and organizational change (the 'slow clock' of adoption).

  2. The Shift to Software Factories 20:00

    AI development is moving beyond simple 'vibe coding' and 'meat proxy' roles toward structured 'software factories.' This requires sophisticated orchestration to manage tasks, testing, and code generation in a controlled manner.

  3. Focus on Agentic Safety and Sovereignty 1:03:20

    Enterprise AI requires robust controls to manage risks. Key concepts include dynamic privilege access, runtime guardrails, and data sovereignty (knowing where data is stored and processed) to build trust and compliance.

  4. Advanced Orchestration Tools 41:40

    Modern tooling is moving toward unified, modular systems (e.g., using `Proxmox` or `Exeutor`) to manage multiple AI models and services from a single endpoint, ensuring portability and control.

Watch on YouTube Full article

Does Your Computer Belong To Codex? I Went To OpenAI To Ask. thumbnail

· 42:29

Does Your Computer Belong To Codex? I Went To OpenAI To Ask.

This discussion explores the shift toward AI-native workplaces, arguing that AI adoption is primarily limited by access to context and data, rather than human aptitude. Speakers detail how tools like Codex and Astra are moving beyond simple chatbots to become universal agents capable of performing complex, multi-step tasks across various domains (e.g., legal, finance, development). The core message for engineers and leaders is that the future lies in building robust integrations, enabling agents to operate seamlessly across disparate systems, and shifting focus from individual output to team-level, automated process improvement.

Key takeaways

  1. AI Adoption is Context-Driven, Not Aptitude-Driven 18:17

    The biggest hurdle for AI is not the user's skill level, but the agent's access to necessary context and data. The ability to connect to and process information from diverse, non-standard sources (like government paperwork or internal documents) is the key differentiator.

  2. The Shift from Individual to Team Productivity

    AI's greatest impact is seen when individual power users build automated processes (e.g., creating a 'chat site' for a financial model) that can then be adopted by the entire team, moving beyond personal productivity gains.

  3. The Importance of Iterative and Expressive Artifacts 34:20

    AI is enabling the creation of new 'AI-native artifacts' (like interactive sites) that allow non-technical users to express complex needs that traditional formats (PDFs, spreadsheets) cannot support, filling a gap in knowledge work.

  4. The Future Requires 'Mid-Agent Work' 36:50

    As agents become more powerful, the user experience must evolve to support fluid, bidirectional interaction—allowing users to interrupt, interject, or guide the agent's run in real-time, rather than just relying on a single question-response cycle.

Watch on YouTube Full article

Google, McKinsey & Dave Farley on AI Code Review thumbnail

· 11:15

Google, McKinsey & Dave Farley on AI Code Review

The rapid acceleration of AI code generation creates a critical bottleneck in traditional software development processes, specifically the code review phase. Speakers discuss how the current ratio—where generating code is fast (seconds) but reviewing it remains slow (hours)—is breaking down established social contracts and trust within open-source collaboration. Solutions proposed include shifting focus from quality control to engaging with mental models, implementing advanced agent memory systems (like Tapes), and prioritizing precise, prescriptive language over vague natural language.

Key takeaways

  1. The Code Review Bottleneck 0:26

    Current processes assume a slow ratio: generating code takes 30 seconds, but reviewing it can take an hour. This mismatch strains maintainers, especially when agents generate multiple pull requests (PRs) rapidly, leading to 'trust breakdown' regarding who actually reviewed the code.

  2. Reviewing Mental Models 5:18

    Code review should not be viewed as quality control. Instead, it is a mechanism for engaging with and aligning multiple mental models (the developer’s model, the system’s model, and colleagues' models). Maladaptive creativity can cause these three models to diverge.

  3. Agent Hallucination & Memory 7:33

    AI agents can 'politely hallucinate,' reporting progress without actual learning or completion. To combat this, advanced systems must capture raw agent sessions and process them into structured 'observational memory' for continuous improvement.

  4. Precision over Natural Language 10:02

    Natural language is inherently vague and open to misinterpretation, making it insufficient as the sole programming language of the future. Precision requires prescriptive instructions that go beyond general conversational prompts.

Watch on YouTube Full article

There Are Jobs You Could Never Give AI. I Gave GPT-6 Astra 20 Hours Of Admin. thumbnail

· 26:58

There Are Jobs You Could Never Give AI. I Gave GPT-6 Astra 20 Hours Of Admin.

The video explores the paradigm shift in AI capabilities from simple prompt-response interactions to managing complex, long-running 'jobs.' Using a simulated household move (estimated at over 20 hours of administrative work), the speaker demonstrates how advanced agents like GPT-6 Astra can handle multi-dimensional tasks that span multiple systems and require continuous supervision. The core concepts introduced are the 'Manager Loop' for coordinating sub-agents, 'Agent Supervision' for ensuring reliability, and the use of structured 'Recipe Cards' as a post-prompt format to define massive workflows.

Key takeaways

  1. The Scale of Delegation 0:52

    Astra is presented as an agent capable of handling entire life administration tasks, such as a household move, which involves coordinating utilities, DMV appointments, and school comparisons—a process estimated to take over 20 hours of pure administrative work. This moves AI beyond simple queries.

  2. The Manager Loop for Complex Workflows 15:15

    For tasks too complex or multi-dimensional to be contained in a single prompt, the 'Manager Loop' is required. This technique involves assigning a chief agent (the manager) to orchestrate multiple specialized execution agents, allowing the human user to define the goal while the AI handles the intricate sequencing and dependencies.

  3. Recipe Cards: The Post-Prompt Format

    To structure massive jobs, a new format called 'Recipe Cards' is proposed. These cards are designed to name the job, sketch out all internal steps, define required inputs (questions for the user), and specify which actions require human approval, serving as a map for complex agent execution.

  4. The Shift in Human Role

    While agents handle the 'grunt work' (researching homes, comparing options), the human role shifts entirely to defining high-level choices, setting boundaries, and providing final judgment. The focus is on accelerating the rate of decision-making.

Watch on YouTube Full article

When AI Stops Being a Project: Turning Technology into Real Value for Patients and Providers thumbnail

· 36:50

When AI Stops Being a Project: Turning Technology into Real Value for Patients and Providers

The conversation explores the shift of AI from a mere 'project' to an integral business function in healthcare. Key focus areas include moving beyond simple Q&A chatbots to complex, long-running agentic workflows that can handle tasks previously requiring many hours of human effort. Speakers emphasize that while the technology is rapidly advancing (e.g., GLM 5.2 and advanced LLMs), successful enterprise adoption requires significant architectural changes: establishing robust governance, managing token costs, mitigating vendor lock-in, and fundamentally reimagining existing clinical workflows rather than simply automating point solutions.

Key takeaways

  1. Shift to Agentic Workflows 14:25

    AI is moving past simple Q&A (quick, short, transactional) toward complex, long-running agentic tasks. OpenAI internal data suggests agents are now performing work across finance, recruiting, and legal that can take up to 8 hours of human effort [0:14:25].

  2. Governance and Architecture are Critical 23:15

    For large enterprises (like United Health Group), long-form agentic work requires establishing strong governance, guardrails, and security protocols. Simply calling an API a 'super agent' is insufficient; true agency requires reasoning and decision-making capabilities [0:23:15].

  3. Addressing Vendor Lock-in and Cost 4:46

    Enterprises must manage the risks of vendor lock-in when restructuring workflows around a single model or API. Concerns include escalating token costs and geopolitical instability, making architectural flexibility paramount [0:47:28].

  4. Reimagining vs. Automating Silos 3:31

    The most impactful approach is not to automate existing tasks (silos) but to fundamentally reimagine the entire end-to-end workflow—from patient intake to payment processing—given the new technological capabilities [0:35:12].

  5. AI as a Business Mandate 5:46

    Successful adoption requires AI to be elevated from an IT or innovation problem to a CEO-level, cross-functional business mandate. Leadership must obsess over defining the core metrics (the 'what is the metric?') and driving change at scale [0:57:12].

Watch on YouTube Full article

How to avoid disaster when vibe-coding a billing engine — Andrew Garvin, Stripe thumbnail

· 17:49

How to avoid disaster when vibe-coding a billing engine — Andrew Garvin, Stripe

Andrew Garvin discusses the complexities of building a billing engine, particularly when integrating advanced AI agents. He emphasizes that because billing involves deep business logic and real money, full autonomy is risky. The solution presented is using agentic tools (like Stripe Projects) to accelerate development into controlled test environments (sandboxes), rather than deploying directly to production. Key architectural components include portable 'skills files' for context and verbose error messaging for self-correction.

Key takeaways

  1. Agent Guardrails are Essential for Billing 11:53

    Billing carries deep business logic; therefore, the recommendation is to use coding agents only to accelerate development into a test environment (sandbox), not to ship directly to production. This minimizes risk when dealing with financial data.

  2. Skills Files Provide Contextual Guardrails 10:02

    To manage complexity, Metronome uses an extensible set of portable 'skills files' that provide necessary context and API knowledge to the agent, removing friction during setup and evolution.

  3. Shift from Seats to Credits (Usage-Based Pricing) 17:18

    The rise of agents operating entire systems necessitates a shift away from seat-based pricing models toward usage-based credit systems. This is crucial because the value may accrue to a single agent/user, not a fixed number of logins.

Watch on YouTube Full article

How I Fight AI Brain Rot. Friction Maxxing With Codex, Grok And Claude. thumbnail

· 27:19

How I Fight AI Brain Rot. Friction Maxxing With Codex, Grok And Claude.

Instead of viewing AI as a tool for friction removal, the speaker advocates for 'friction maxxing'—deliberately adding resistance to maintain critical judgment. This involves constantly comparing outputs across multiple models (Codex, Grok, Claude) and incorporating human feedback to challenge assumptions. The goal is not just efficiency, but developing a robust mental model of agent capabilities, failure boundaries, and the limits of current AI interfaces.

Key takeaways

  1. The Value of Disagreement

    True insight comes from disagreement. By forcing multiple models (e.g., Codex, Grok, Claude) to argue or solve a problem, the resulting solution is more robust than any single model's initial output. The speaker emphasizes that 'disagreement is like a rep for my brain.'

  2. Testing Agent Boundaries (The Wrong Spreadsheet) 23:40

    When testing new agents, focus not on the stated claims but on their ability to transparently disclose what they can and cannot access. A dangerous failure mode is when an agent presents a completed draft while having used outdated or inaccessible data (e.g., pulling an old spreadsheet copy because it couldn't reach the downloads folder).

  3. Resisting Gradient Descent 17:33

    Most AI interfaces encourage 'relentless gradient descent,' pushing users toward simple corrections (e.g., fixing a bug or improving a paragraph). The challenge for humans is to ask if the iteration changes our thinking and pushes us creatively, rather than just moving the output closer to the center of the model's known distribution.

  4. The Human Feedback Loop

    Human community feedback is crucial for developing a sophisticated world model. By cycling human critique (e.g., 'this design is confusing') back into the AI, users can ask models to explain which assumptions led to the flawed output, thereby deepening understanding.

Watch on YouTube Full article

Don't Build Agents, Build Environments Instead thumbnail

· 27:19

Don't Build Agents, Build Environments Instead

The talk argues that the most critical challenge in building agentic workflows is not the agent itself, but the underlying environment (the 'background part'). Teams should focus on 'environmental engineering'—designing robust, fast, and persistent development environments ('dev boxes') rather than optimizing the agents. Key architectural shifts involve treating sessions as long-running, stateful processes that require sophisticated isolation between the control plane (planning) and the data plane (execution).

Key takeaways

  1. Focus on Environments, Not Agents

    The difficulty in background agent systems lies in the environment they operate within. The focus should be on building reliable 'dev boxes' that provide necessary resources beyond a bare sandbox.

  2. Jobs vs. Sessions 20:04

    Traditional CI/CD treats runs as stateless 'jobs.' Agents require long-running, resumable 'sessions' that must persist state (e.g., file system snapshots) and potentially outlive the initial machine runtime.

  3. Dev Boxes vs. Sandboxes 3:58

    A sandbox is bare; a 'dev box' must be rich enough to handle complex tasks (e.g., running local servers, taking screenshots, profiling on GPUs), requiring more than just basic Linux access.

  4. Architectural Separation 24:16

    To prevent failure, the system must separate the agent's planning logic (Control Plane) from the risky execution tools (Data Plane). The agent should issue remote calls to a dedicated sandbox rather than running tools collocated with its own process.

Watch on YouTube Full article

What Is a Digital Librarian AI Agent? Connecting SQL & Vector Database thumbnail

· 5:21

What Is a Digital Librarian AI Agent? Connecting SQL & Vector Database

The video introduces the concept of a Digital Librarian AI Agent designed to solve the 'what versus why' data problem common in enterprise systems. This agent is an advanced workflow that connects structured data (SQL databases) with unstructured context (vector databases/PDFs). Instead of simply retrieving siloed data, the agent uses LLMs and multi-step reasoning to synthesize information, transforming a repository into a functional reasoning engine capable of delivering grounded answers.

Key takeaways

  1. The 'What vs. Why' Data Problem

    Structured data (the 'what,' e.g., denial status) resides in SQL tables, while the contextual rules and fine print (the 'why,' e.g., policy details) are buried in unstructured documents like PDFs or manuals, leading to fragmented insights.

  2. The Agentic Workflow 2:00

    A Digital Librarian AI Agent performs a six-step process: (1) Read the question; (2) Determine if the answer requires SQL or vector search; (3) Build necessary queries; (4) Execute queries against both databases; (5) Compile results; and (6) Answer the original question with a single, grounded insight.

  3. Advanced Data Retrieval 4:30

    By moving from simple data queries to agentic workflows, systems transition from merely retrieving data points to delivering reasoned answers, turning siloed repositories into reasoning engines that operate at business speed.

Watch on YouTube Full article

Don’t be data poor — Anuj Iravane, Anterior thumbnail

· 16:46

Don’t be data poor — Anuj Iravane, Anterior

The talk addresses the critical problem of 'data poverty' in highly regulated domains like healthcare, where the most valuable data (Patient Health Information or PHI) is ephemeral and legally prohibited from being retained, anonymized, or derived for dataset creation. The core solution presented is synthetic data generation. This process involves reversing the standard inference workflow—starting by sampling a desired label and reasoning trace, and then generating the necessary unstructured medical record that would have produced it. The resulting pipeline uses an LLM-based, coarse-to-fine approach, ensuring high fidelity while maintaining domain expert control.

Key takeaways

  1. Reverse Inference for Data Generation 5:20

    Instead of running the forward task (Unstructured Data + Policy $\rightarrow$ Label), the method reverses this by sampling a label and a reasoning trace first, then generating the input data that supports it. This circumvents the diversity problem inherent in standard LLM generation.

  2. Domain Expert Ownership (Human-in-the-Loop) 11:30

    To ensure generated data is useful, domain experts (clinicians) must own the pipeline. This is achieved by enabling them to interject at any point in generation and modeling the entire workflow as a skills-based system running on an agent harness.

  3. Synthetic Data Fidelity 14:35

    The generated data can be highly accurate, with early results showing that in a blind review, clinicians were only able to distinguish synthetic from real records about 60% of the time.

Watch on YouTube Full article

Every Repo Is a Software Factory Now | Don Syme, GitHub thumbnail

· 1:04:36

Every Repo Is a Software Factory Now | Don Syme, GitHub

This talk explores the concept of 'Continuous AI,' defining it as an evolution that extends traditional Continuous Integration and Continuous Deployment (CI/CD) into subjective, automated activities like documentation updates and bug triage. The core mechanism for this is the use of GitHub Agentic Workflows, which run coding agents with strong guardrails within a bounded repository context. The discussion emphasizes that while AI offers incredible power, maintaining quality gates, controlling costs, and ensuring human oversight remain critical to building reliable 'software factories.'

Key takeaways

  1. Continuous AI vs. CI/CD 5:52

    Continuous AI extends the principles of CI/CD by applying automation to subjective activities (e.g., documentation, bug triage) that are not inherently deterministic like traditional build checks. It requires operationalizing these processes on a permanent basis [00:03:52].

  2. Bounding the Context is Key 10:42

    To prevent automated AI agents from 'going off the rails,' they must operate within a strictly bounded context (e.g., restricted to creating a single pull request or issue) [00:09:42]. This situates the automation, making it manageable and auditable.

  3. The Repo as the Unit of Production 13:59

    GitHub Agentic Workflows are designed around the repository being the primary unit of production and security boundary. This repo-centric approach aligns with established CI/CD principles while enabling advanced AI automation [00:25:19].

  4. Quality Gates and Human Review 5:12

    The focus shifts from human review as a bottleneck to creating automated, high-quality pull requests. The goal is to 'equip the reviewer' with all necessary information (e.g., performance evidence) to make informed decisions [00:52:01].

  5. Complexity Management 3:59

    For maintainers, a single supervisor orchestrator pattern workflow that can perform multiple tasks is preferred over an 'agent zoo' of many individual workflows. This simplifies maintenance and provides better cost control [03:59:00].

Watch on YouTube Full article

Guide, Verify, Solve — Anirban Chatterjee, Sonar thumbnail

· 22:31

Guide, Verify, Solve — Anirban Chatterjee, Sonar

As AI-driven development moves from experimentation to engineering, the primary challenge is 'verification debt'—the gap between the quality provided by LLMs and the high reliability required for critical production systems. The speaker argues that relying solely on human review (which can be compromised, as shown by a Wharton study) or the generating model itself is insufficient. A robust solution requires implementing a zero-trust, multi-layered verification regime within agentic development loops to ensure code quality across syntax, data flow, architecture, and control flow.

Key takeaways

  1. Implement Zero Trust Verification 15:32

    Assume all code (human or AI) could come from anywhere. Verification must use a different methodology than the one that wrote the code to prevent inheriting blind spots.

  2. Adopt Multi-Layered Review 15:57

    No single technique is sufficient; verification must combine computational review, LLM-driven reasoning, and other approaches to catch all types of issues (quality, security, compliance).

  3. Use ACDC for Agentic Loops 17:12

    The proposed framework is the Agent-Centric Development Cycle (ACDC), which includes three phases: Guidance (providing constraints/guardrails), Verification (running independent checks in real time), and Solve (allowing the agent to remediate issues).

  4. Standardize Verification Across Projects 20:46

    Organizations should establish a single, consistent verification platform that applies uniformly across all teams, projects, and AI coding tools to eliminate blind spots.

Watch on YouTube Full article

Velocity Sickness: What Happens When Your Whole Team Gets 10x Faster — Matt Dailey, Ref. thumbnail

· 20:37

Velocity Sickness: What Happens When Your Whole Team Gets 10x Faster — Matt Dailey, Ref.

The video addresses 'velocity sickness'—the stress of sudden, unimpactful increases in AI-driven output that do not translate into meaningful product progress. The speaker argues that current engineering workflows are flawed because they treat all work as implementation (code) and fail to properly manage the critical decision layer. To solve this, engineers must separate the durable state/decisions from the ephemeral actions/implementations. This is achieved by shifting focus from using chat interfaces for planning to utilizing dedicated, shared document structures that capture system state.

Key takeaways

  1. Understanding Velocity Sickness 2:00

    Velocity sickness is defined as the stress caused by sudden output increases due to AI, resulting in high output without corresponding impact. This manifests as too many PRs to merge, working across too many directions simultaneously, or 'declaring agent bankruptcy' (doing work that isn't retained).

  2. The Critical Failure Point: Decision Ownership 5:45

    The most critical risk is allowing agents to make key decisions. If an engineer delegates decision-making, they lose ownership of the code and, by extension, the product.

  3. Shifting Focus from Code Velocity to Idea Velocity 10:30

    To combat velocity sickness, teams must shift focus from merely shipping code (code velocity) to prioritizing and exploring ideas (idea velocity). This means focusing on planning and understanding the system's contours before implementation.

  4. The Solution: Docs for Decisions, Not Chats 13:25

    The core fix is separating the decision layer from the implementation layer. While chats are isolated, ephemeral, and built for action, durable shared documents (docs) should be used to hold the state and key decisions, keeping agents effectively stateless.

Watch on YouTube Full article

Your AI Agent Just Deleted Your Database. Now What? thumbnail

· 35:22

Your AI Agent Just Deleted Your Database. Now What?

Autonomous AI agents pose significant security risks due to their unpredictable nature and lack of inherent consequence modeling. Incidents, such as the Pocket OS database wipe using Opus 4.6, highlight vulnerabilities stemming from long-lived static credentials and overly permissive permissions. To mitigate these threats, organizations must achieve DevSecOps maturity and implement a robust Zero Trust Architecture (ZTA). Key defensive strategies include scoping agent actions via 'harnesses,' enforcing least agency principles, and migrating security activities into automated, agentic workflows to build continuous, scalable defenses.

Key takeaways

  1. AI Agents are 'Chaotic Neutral' 3:02

    Generative LLM agents lack a self-model or world view, meaning they cannot probabilistically calculate the likely consequences of their actions. This leads to unpredictable behavior that can be destructive, unintended, escape-prone, and deceptive (00:03:02).

  2. Zero Trust Architecture is Mandatory for Agents 21:16

    Implementing ZTA requires unique federated identity (e.g., SPIFFE IDs, X.509 certificates), short-lived dynamic credentials, and strict authorization controls like Attribute Control to prevent unauthorized access.

  3. Adopt Agentic Workflows for Defense 27:20

    Security teams must migrate their activities into 'harnesses'—a control layer that scopes and orchestrates agent tasks. This allows automated, continuous threat modeling and remediation (e.g., Snyk's Remediation Agent) to close the security loop.

Watch on YouTube Full article

How Forward Deployed Engineering is done at Ramp — Leo Mehr thumbnail

· 14:05

How Forward Deployed Engineering is done at Ramp — Leo Mehr

The talk outlines two core principles for Forward Deployed Engineering (FDE): always scoping and scaling with tokens. FDE teams must resist the urge to simply say 'yes' to every request; instead, they must rigorously scope requirements by asking context-gathering questions to ensure the right product is built. To scale this function, the entire FDE pipeline—from initial intake to spec writing—must be automated using AI agents (scaling with tokens). This requires building robust agent harnesses and implementing validation loops using evals, rubrics, and human feedback.

Key takeaways

  1. Always Scope First 5:16

    FDEs must pause before accepting urgent requests (e.g., SAP S/4HANA integrations) to gather context and determine what is truly necessary for the customer's success, rather than simply fulfilling the immediate ask.

  2. Scale with Tokens 8:24

    The future of FDE requires automating every stage of the request lifecycle—from gathering context to writing a spec—by replacing manual work with AI agents and model capabilities.

  3. Hybrid Approach is Key

    Effective modern FDE needs both human judgment (for taste and final validation) and agent volume/automation to handle the sheer scale of incoming requests.

Watch on YouTube Full article

Tammuz Dubnov - When Our PM Started Writing Code: What Merge Rate Taught Us About AI Adoption - AI N thumbnail

· 26:42

Tammuz Dubnov - When Our PM Started Writing Code: What Merge Rate Taught Us About AI Adoption - AI N

The shift toward 'AI native' organizations means that the primary bottleneck is no longer code generation speed but organizational alignment and handoff efficiency. The speaker argues that empowering non-technical decision-makers (PMs, Designers) with agentic tools allows them to execute work directly, collapsing gaps that previously required multiple sprints or lengthy coordination. Success in this transition is measured by the 'merge rate'—the percentage of Pull Requests (PRs) opened by non-technical users that successfully land in production.

Key takeaways

  1. Redefining AI Native 2:00

    AI native means that the person who cares about a feature has the authority and ability to execute the work, collapsing the traditional handover gap between PMs/Designers and Developers. The bottleneck shifts from coding speed to decision-making capacity.

  2. The Importance of Merge Rate 6:00

    Merge rate (the percentage of PRs that land in production) is the key metric for measuring if an organization is successfully adapting to AI-driven workflows. A high merge rate indicates trust and quality between non-technical contributions and the dev team.

  3. The Role of Guards and Architecture 11:20

    As organizations move fast, it is critical not to abandon engineering principles or 'guards' (like testing, architectural standards). The agent must be designed to learn the codebase deeply and maintain these constraints.

  4. Measuring Non-Technical Contributions 14:20

    To measure impact, track: 1) Count of PRs opened by non-technical individuals. 2) Merge rate (e.g., an average merge rate of 74% was cited). 3) Percentage of merged PRs that require zero developer intervention.

Watch on YouTube Full article

Loop Engineering from First Principles — Kyle Mistele, HumanLayer thumbnail

· 17:57

Loop Engineering from First Principles — Kyle Mistele, HumanLayer

The talk argues that relying solely on large-scale prompts for AI code generation is insufficient for complex, mission-critical systems. The solution lies in adopting 'control loops'—a pattern borrowed from control theory (Sensor $\rightarrow$ Controller $\rightarrow$ Actuator)—to ensure that code changes are small, verifiable, and incremental. This approach minimizes risk by preventing the creation of massive, unreviewable pull requests (PRs) and allows for robust automation within existing CI/CD pipelines.

Key takeaways

  1. The Problem with Large PRs

    Current AI workflows often result in 'blind Ralph loops'—massive, unreadable pull requests (e.g., 40,000 lines) that are too risky for large teams and critical systems. The goal must be to design loops that make code easier to read and verify.

  2. The Control Loop Framework 7:23

    A robust system uses a Sensor (to measure the current state/error), a Controller (to determine the optimal incremental change), and an Actuator (to apply that change). This pattern is ideal for systems where changes must be measured, applied incrementally, and verified.

  3. Implementing Low-Friction Loops

    Loops should be integrated into CI/CD platforms (GitHub Actions, CircleCI) using deterministic workflows. To maintain human oversight without friction, a 'feedback file' tracked in version control and triggered by comments (e.g., `/iterate`) is recommended to guide the agent.

Watch on YouTube Full article

BONUS EPISODE: 76 Malicious AI Skills Were Hiding in Plain Sight thumbnail

· 32:16

BONUS EPISODE: 76 Malicious AI Skills Were Hiding in Plain Sight

The security landscape for AI coding agents is rapidly evolving, shifting focus from traditional code vulnerabilities to risks introduced by 'Skills' and context management. The presentation details findings from Snyk’s ToxicSkills research, which uncovered 76 malicious skills containing malware or prompt injection vectors in open agent repositories. To mitigate these threats, organizations must adopt secure-by-default practices, implement governance through private skill registries (like Tessl), and utilize advanced scanning tools that analyze natural language context alongside code.

Key takeaways

  1. The Shift to Agent Security 6:38

    AI agents are changing developer workflows from reviewing lines of code to managing a 'team of agents.' This necessitates securing the inputs (context) and artifacts produced by these agents, making agent security paramount.

  2. Malicious Skills Threat 17:55

    Research found that third-party skills can contain purely malicious code or prompt injection attacks. These threats are difficult for traditional scanners to detect because they operate by influencing the agent's context rather than just being visible malware.

  3. Governance and Scanning Solutions 23:58

    Implementing secure skill registries (e.g., Tessl) that integrate security scanning (Snyk) is crucial. This allows organizations to scan skills for potential prompt injection, malware, and versioning issues before deployment.

  4. Secure-by-Default Stack 27:50

    Best practices include scanning third-party skills *before* use and running security scanners on custom-authored skills to identify potential vulnerabilities, such as mishandling or passing secrets in plaintext.

Watch on YouTube Full article

2026 State of AI Engineering — Barr Yaron, Amplify Partners thumbnail

· 19:47

2026 State of AI Engineering — Barr Yaron, Amplify Partners

The state of AI engineering is characterized by rapid maturity and increased complexity. Survey data from 1,048 respondents indicates that while open-weight models augment closed systems, the primary drivers for model choice are quality, agentic capabilities (like tool calling), and cost. Cost has become a 'first-class engineering constraint,' forcing teams to manage usage carefully. Furthermore, agents are rapidly evolving from summarization tools to systems with write access, necessitating robust control layers and sophisticated evaluation (eval) processes.

Key takeaways

  1. AI Experience is Democratizing 0:03

    The AI engineering workforce is maturing quickly; the median new engineer has nearly as much AI experience as a 10-year software veteran, indicating that AI skills are becoming foundational to modern development.

  2. Cost is a Primary Constraint 0:08

    Three out of four respondents report adjusting their AI usage based on cost, establishing 'cost' as a first-class engineering constraint alongside quality and capability.

  3. Agents are Taking Action 0:11

    Agentic workflows have shifted significantly: they are no longer limited to reading or summarizing, but are increasingly taking actions inside systems. Write access for agents has increased dramatically (from 52% to 89%).

  4. Evaluation Remains the Biggest Challenge 0:12

    Across all layers of the stack, 'eval' (evaluation) remains the number one biggest challenge reported by engineers.

Watch on YouTube Full article

Joseph Katsioloudes - Code Security Reinvented: Navigating the era of AI - AI Native DevCon June 26 thumbnail

· 35:18

Joseph Katsioloudes - Code Security Reinvented: Navigating the era of AI - AI Native DevCon June 26

AI is revolutionizing code security by helping minimize the gap between developers and dedicated security specialists. While AI tools like GitHub Copilot can significantly improve detection and, more critically, the speed of fixing vulnerabilities (the 'fixing problem'), they are not a replacement for human oversight. Responsible adoption requires utilizing structured protocols like Model Context Protocols (MCPs) and implementing agentic workflows within CI/CD pipelines to ensure deterministic, auditable, and context-aware security checks.

Key takeaways

  1. AI's Role in Security Gap Reduction 18:04

    The primary opportunity is using AI to scale scarce security expertise. While traditional static analysis tools (like CodeQL or Semgrep) are excellent for pattern matching, AI excels at modeling complex behavioral and contextual issues that pass standard checks.

  2. AI Limitations: Hallucinations & Non-Determinism 4:00

    The speaker notes that while AI is powerful, it should not be the sole safety net; good security hygiene remains paramount.

  3. Leveraging MCPs and Skills 22:20

    Model Context Protocols (MCPs) allow AI models to access server-side information from trusted sources (e.g., GitHub Security Lab findings), extending the context beyond narrow training data. Combining MCPs with structured 'skills' ensures that automated fixes are auditable, maintainable, and integrated into development processes.

  4. Agentic Workflows for CI/CD 27:00

    Agentic workflows allow security agents to run on a schedule or trigger automatically. They can perform sophisticated tasks, such as running manual security reviews automated by AI (using quantified knowledge from research) and proposing fixes directly within the Pull Request (PR), accelerating the fix rate.

Watch on YouTube Full article