Technology Updates And News
Hacker Noon - Medium Why SPIFFE Agent Identities Can Still Be Replayed, and How WIMSE Fixes It SPIFFE has become the default way to give AI agents a workload identity, a short-lived, cryptographically verifiable credential that answers which specific agent…
/p>
SPIFFE Just Adopted It as Its Own
That's where the convergence actually happened. SPIFFE's own standards repository now lists a third SVID type alongside its X.509 and JWT formats, the WIT-SVID, built directly on top of WIMSE's Workload Identity Token format. An open SPIRE GitHub issue tracking implementation work states plainly that the underlying IETF document is in its final stages, and that the SPIRE team is actively discussing how to bring support into the reference implementation, likely landing first behind an experimental flag until the IETF draft becomes an RFC.
That's a rare thing to watch happen cleanly: one open standard identifying a gap in another, building the fix, and the original project adopting it rather than shipping a competing one. It's also a quiet admission that SPIFFE spent years as the default answer to machine identity while the actual fix for one of its real weaknesses came from somewhere else.
The Fix Exists on Paper Before It Exists in Practice
None of this is live in most deployments yet. A recent discovery scan of 15 public agent identity issuers found that 10 advertise only shared-secret client authentication, the weakest option available, and zero advertise DPoP-style proof-of-possession binding, the exact protection WIMSE and WIT-SVID are built to provide. The specification work is real, and it's converging quickly. The deployed reality is still mostly bearer tokens and shared secrets, well behind what the standards now recommend.
What This Means for Anyone Building Agent Identity Today
A few things follow if you're deploying SPIFFE for agents right now.
Don't assume a SPIFFE token is safe from replay just because it's short-lived. Short-lived limits the damage window. It doesn't stop a token from being used by whoever holds it during that window.
Watch for WIT-SVID support landing in SPIRE and plan to move to it once it's stable, rather than layering a custom proof-of-possession scheme on top of bearer tokens in the meantime.
If you're evaluating an agent identity vendor or issuer, ask directly whether they support proof-of-possession binding. Based on the discovery scan above, most don't yet, which makes it a real differentiator rather than a checkbox.
Conclusion
SPIFFE solved how a workload proves who it is without a shared secret. It never fully solved how a workload proves that the token it's holding wasn't stolen from someone else. WIMSE built that missing piece, and SPIFFE adopting it directly into WIT-SVID is one of the cleaner examples of standards bodies fixing each other's gaps rather than competing over them. The fix is real. Does your agent identity stack actually use it yet, or is that still an assumption worth checking?
SPIFFE Just Adopted It as Its Own
That's where the convergence actually happened. SPIFFE's own standards repository now lists a third SVID type alongside its X.509 and JWT formats, the WIT-SVID, built directly on top of WIMSE's Workload Identity Token format. An open SPIRE GitHub issue tracking implementation work states plainly that the underlying IETF document is in its final stages, and that the SPIRE team is actively discussing how to bring support into the reference implementation, likely landing first behind an experimental flag until the IETF draft becomes an RFC.
That's a rare thing to watch happen cleanly: one open standard identifying a gap in another, building the fix, and the original project adopting it rather than shipping a competing one. It's also a quiet admission that SPIFFE spent years as the default answer to machine identity while the actual fix for one of its real weaknesses came from somewhere else.
The Fix Exists on Paper Before It Exists in Practice
None of this is live in most deployments yet. A recent discovery scan of 15 public agent identity issuers found that 10 advertise only shared-secret client authentication, the weakest option available, and zero advertise DPoP-style proof-of-possession binding, the exact protection WIMSE and WIT-SVID are built to provide. The specification work is real, and it's converging quickly. The deployed reality is still mostly bearer tokens and shared secrets, well behind what the standards now recommend.
What This Means for Anyone Building Agent Identity Today
A few things follow if you're deploying SPIFFE for agents right now.
Don't assume a SPIFFE token is safe from replay just because it's short-lived. Short-lived limits the damage window. It doesn't stop a token from being used by whoever holds it during that window.
Watch for WIT-SVID support landing in SPIRE and plan to move to it once it's stable, rather than layering a custom proof-of-possession scheme on top of bearer tokens in the meantime.
If you're evaluating an agent identity vendor or issuer, ask directly whether they support proof-of-possession binding. Based on the discovery scan above, most don't yet, which makes it a real differentiator rather than a checkbox.
Conclusion
SPIFFE solved how a workload proves who it is without a shared secret. It never fully solved how a workload proves that the token it's holding wasn't stolen from someone else. WIMSE built that missing piece, and SPIFFE adopting it directly into WIT-SVID is one of the cleaner examples of standards bodies fixing each other's gaps rather than competing over them. The fix is real. Does your agent identity stack actually use it yet, or is that still an assumption worth checking?
The Hacker News
OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers
The "major malicious attack" that targeted RubyGems in May 2026 was the work of a swarm of OpenAI agents, according to a new report published by researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx.
On May 12, Maciej Mensfeld, senior product manager for software supply chain security at Mend.io, disclosed details of a coordinated cyber attack that targeted the package manager for the
OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers
The "major malicious attack" that targeted RubyGems in May 2026 was the work of a swarm of OpenAI agents, according to a new report published by researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx.
On May 12, Maciej Mensfeld, senior product manager for software supply chain security at Mend.io, disclosed details of a coordinated cyber attack that targeted the package manager for the
The Hacker News
When the Whole Company Adopts AI: What It Does to Your SOC
Over the past year, we watched a new class of alert appear in enterprise security operations centers and grow faster than anything else in the stream: alerts that were triggered by AI tools and agents. Not attacks against AI, but the ordinary, everyday footprint of an organization using it, from developers running coding agents and non-technical staff signing consumer AI tools into corporate
When the Whole Company Adopts AI: What It Does to Your SOC
Over the past year, we watched a new class of alert appear in enterprise security operations centers and grow faster than anything else in the stream: alerts that were triggered by AI tools and agents. Not attacks against AI, but the ordinary, everyday footprint of an organization using it, from developers running coding agents and non-technical staff signing consumer AI tools into corporate
The Hacker News
CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added five security flaws impacting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation in the wild.
Details of the vulnerabilities are as follows -
CVE-2026-42016 (CVSS score: 8.1) - An incorrect authorization
CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added five security flaws impacting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation in the wild.
Details of the vulnerabilities are as follows -
CVE-2026-42016 (CVSS score: 8.1) - An incorrect authorization
Technology Updates And News
Photo
Hacker Noon - Medium A Look Inside My Career As A B2B Product Marketing Manager in IT (Part 1)
Hi! My name is Anya. I run the Product Pulse Telegram channel, work as a PMM in tech (B2B to be precise), and also consult on marketing, product, and career-related topics.
Today, I’m going to tell you all about my career path and share some of my tips — and anti-tips.
How It All Started
Let’s start with this: I have a technical background. I got my Bachelor’s degree in Computer Science and a Master’s degree in Product Development Management of IT Services - yeah, I’m a tech girlie. The program was designed to teach us to become technical product managers: it was pretty well-balanced, combining both technical and business disciplines — entrepreneurship, for example. It was fun.
But my education was more of a consequence than a cause. I knew from the very beginning that I wasn’t going to become a software engineer (four years of a Bachelor’s degree made that pretty clear), but I still wanted to stay in tech. So when I discovered the product manager profession during my fourth year, the rest of my career plan was basically decided.
First things first (even before starting my Master’s), I decided to take as many free courses as possible, get as many certificates as possible (it was 2021, when Coursera was still very much alive, and I took several specialization programs there), and build a proper portfolio around a pet project.
Of course, I never really considered it an “educational” project. At the time, I already had a fairly large audience on Instagram, so I was lucky enough to learn how to test hypotheses and work with different frameworks on a real audience.
So, in the summer of 2021, I started conducting my first customer interviews, built a website on Tilda, got my first traffic and my first users. Feeling absolutely thrilled with my success, I simultaneously decided to apply for a Master’s degree — and got in.
At the same time, I put together my portfolio, created a resume following the classic course formula (“task → action → measurable result”), and started applying for internships at big tech companies.
First Wins and Failures
My strategy was as simple as it gets: apply to a million job postings and eventually something will work out. I created a generic cover letter and sent it to every company I saw, trying to apply to approximately a million vacancies every single day.
It’s worth mentioning that at the time I was working as a UX/UI designer in an office, 5 days a week, from opening to closing time. So, obviously, I couldn’t interview during normal human hours, which made an already difficult attempt to break into product management through internships even harder.
Probably more than 95% of my applications ended either in silence or rejection. But thanks to my sheer stubbornness, about 1–2 months after starting the search, I successfully made it through approximately a million interview stages and got an offer for a Product Intern position on a new international initiative at a huge e-commerce company.
I remember that at the time I could practically see my entire glamorous future unfolding in front of my eyes, like in a movie: there I was, working in a beautiful office on one of the highest floors of Moscow City, talking to Important People, going on international business trips, and adding a shiny new line to my CV.
I had beautiful clothes, a huge professional network, I was rich and successful, and everyone wanted to be me.
Basically, I was in a state of blissful ecstasy, imagining how I would escape my working-class life and become&n[...]
Hi! My name is Anya. I run the Product Pulse Telegram channel, work as a PMM in tech (B2B to be precise), and also consult on marketing, product, and career-related topics.
Today, I’m going to tell you all about my career path and share some of my tips — and anti-tips.
How It All Started
Let’s start with this: I have a technical background. I got my Bachelor’s degree in Computer Science and a Master’s degree in Product Development Management of IT Services - yeah, I’m a tech girlie. The program was designed to teach us to become technical product managers: it was pretty well-balanced, combining both technical and business disciplines — entrepreneurship, for example. It was fun.
But my education was more of a consequence than a cause. I knew from the very beginning that I wasn’t going to become a software engineer (four years of a Bachelor’s degree made that pretty clear), but I still wanted to stay in tech. So when I discovered the product manager profession during my fourth year, the rest of my career plan was basically decided.
First things first (even before starting my Master’s), I decided to take as many free courses as possible, get as many certificates as possible (it was 2021, when Coursera was still very much alive, and I took several specialization programs there), and build a proper portfolio around a pet project.
Of course, I never really considered it an “educational” project. At the time, I already had a fairly large audience on Instagram, so I was lucky enough to learn how to test hypotheses and work with different frameworks on a real audience.
So, in the summer of 2021, I started conducting my first customer interviews, built a website on Tilda, got my first traffic and my first users. Feeling absolutely thrilled with my success, I simultaneously decided to apply for a Master’s degree — and got in.
At the same time, I put together my portfolio, created a resume following the classic course formula (“task → action → measurable result”), and started applying for internships at big tech companies.
First Wins and Failures
My strategy was as simple as it gets: apply to a million job postings and eventually something will work out. I created a generic cover letter and sent it to every company I saw, trying to apply to approximately a million vacancies every single day.
It’s worth mentioning that at the time I was working as a UX/UI designer in an office, 5 days a week, from opening to closing time. So, obviously, I couldn’t interview during normal human hours, which made an already difficult attempt to break into product management through internships even harder.
Probably more than 95% of my applications ended either in silence or rejection. But thanks to my sheer stubbornness, about 1–2 months after starting the search, I successfully made it through approximately a million interview stages and got an offer for a Product Intern position on a new international initiative at a huge e-commerce company.
I remember that at the time I could practically see my entire glamorous future unfolding in front of my eyes, like in a movie: there I was, working in a beautiful office on one of the highest floors of Moscow City, talking to Important People, going on international business trips, and adding a shiny new line to my CV.
I had beautiful clothes, a huge professional network, I was rich and successful, and everyone wanted to be me.
Basically, I was in a state of blissful ecstasy, imagining how I would escape my working-class life and become&n[...]
Technology Updates And News
Hacker Noon - Medium A Look Inside My Career As A B2B Product Marketing Manager in IT (Part 1) Hi! My name is Anya. I run the Product Pulse Telegram channel, work as a PMM in tech (B2B to be precise), and also consult on marketing, product, and…
bsp;that girl.
Just a dream. You’re 21, and you have absolutely amazing prospects.
So, what did I do?
I turned it down.
From a career perspective, this was a huge failure, a mistake, a waste of time. I understood that logically and rationally back then, and I still understand it now.
However, I’ve always had very strong intuition, and mine was telling me that this simply wasn’t my vibe.
Why am I talking about vibes? Because when a company’s vibe doesn’t match your own, it can lead to burnout and a quiet hatred of the career path you’ve chosen.
Sorry, but nobody is going to convince me otherwise. I’m Gen Z.
A Quiet Period and a Random Coincidence
After turning down the offer, I fell into a state of gloom and apathy. The rational part of me was screaming, “What an idiot you are! This was a one-in-a-million opportunity!”
I understood that myself, so I kept beating myself up over it. My studies were eating up a ton of time, and I no longer had the energy to restart the job search. At the same time, I was making new connections and starting my academic life: regularly attending conferences and writing papers, building my LinkedIn network, participating in product competitions, and occasionally taking additional courses.
Life went on.
Then, in June/July 2022, I unexpectedly received an invitation to apply for a Junior Product Manager position at a small IT company. I went through the process and got the offer.
I grabbed this second chance at life with both hands and legs — and this time I wasn’t letting it go.
First Steps and Growth
Since I was absolutely determined to grow hard, I started performing beyond expectations.
Overall, this strategy turned out to be the right one, and I developed my skills a lot. The team was very small, which meant I had to turn into a many-handed, many-legged creature. That’s how marketing entered my life. And it came quite naturally — luckily, many things in product management turned out to be pretty similar.
In April 2023, I started my Telegram channel 🫡
It became a great way for me to systematize my knowledge, because I started by simply uploading useful materials from my notes, adding my own thoughts and observations. So, if you want to grow professionally, I strongly recommend starting a blog in whatever format works for you.
You don’t even need to build an audience. It’s enough to simply write posts about topics you find interesting and try to look at what you’ve written from different perspectives.
I started thinking about my next growth opportunity in the fall of 2023. I really wanted to grow both my level and my salary by changing jobs.
By that point, I was already following several creators who offered consulting services. So I decided to work with a mentor.
You know, to this day, the whole essence of mentoring for me comes down to three things:
* look at your situation from a different perspective;
* realize that it’s not actually hopeless — and maybe not that shitty;
* put together a list of actions you need to take to get out of the situation.
After my mentoring sessions, I realized two things.
First, I wasn’t actually a useless professional.
Second, my mentor gave me a great idea: I was already doing so much marketing, so why not look for a Product Marketing Manager specialization on the job market?
Here I should clarify something: to me, PMM is NOT a marketer. A PMM is a product person who understands marketing but is still primarily focused on product developmen[...]
Just a dream. You’re 21, and you have absolutely amazing prospects.
So, what did I do?
I turned it down.
From a career perspective, this was a huge failure, a mistake, a waste of time. I understood that logically and rationally back then, and I still understand it now.
However, I’ve always had very strong intuition, and mine was telling me that this simply wasn’t my vibe.
Why am I talking about vibes? Because when a company’s vibe doesn’t match your own, it can lead to burnout and a quiet hatred of the career path you’ve chosen.
Sorry, but nobody is going to convince me otherwise. I’m Gen Z.
A Quiet Period and a Random Coincidence
After turning down the offer, I fell into a state of gloom and apathy. The rational part of me was screaming, “What an idiot you are! This was a one-in-a-million opportunity!”
I understood that myself, so I kept beating myself up over it. My studies were eating up a ton of time, and I no longer had the energy to restart the job search. At the same time, I was making new connections and starting my academic life: regularly attending conferences and writing papers, building my LinkedIn network, participating in product competitions, and occasionally taking additional courses.
Life went on.
Then, in June/July 2022, I unexpectedly received an invitation to apply for a Junior Product Manager position at a small IT company. I went through the process and got the offer.
I grabbed this second chance at life with both hands and legs — and this time I wasn’t letting it go.
First Steps and Growth
Since I was absolutely determined to grow hard, I started performing beyond expectations.
Overall, this strategy turned out to be the right one, and I developed my skills a lot. The team was very small, which meant I had to turn into a many-handed, many-legged creature. That’s how marketing entered my life. And it came quite naturally — luckily, many things in product management turned out to be pretty similar.
In April 2023, I started my Telegram channel 🫡
It became a great way for me to systematize my knowledge, because I started by simply uploading useful materials from my notes, adding my own thoughts and observations. So, if you want to grow professionally, I strongly recommend starting a blog in whatever format works for you.
You don’t even need to build an audience. It’s enough to simply write posts about topics you find interesting and try to look at what you’ve written from different perspectives.
I started thinking about my next growth opportunity in the fall of 2023. I really wanted to grow both my level and my salary by changing jobs.
By that point, I was already following several creators who offered consulting services. So I decided to work with a mentor.
You know, to this day, the whole essence of mentoring for me comes down to three things:
* look at your situation from a different perspective;
* realize that it’s not actually hopeless — and maybe not that shitty;
* put together a list of actions you need to take to get out of the situation.
After my mentoring sessions, I realized two things.
First, I wasn’t actually a useless professional.
Second, my mentor gave me a great idea: I was already doing so much marketing, so why not look for a Product Marketing Manager specialization on the job market?
Here I should clarify something: to me, PMM is NOT a marketer. A PMM is a product person who understands marketing but is still primarily focused on product developmen[...]
Technology Updates And News
bsp;that girl. Just a dream. You’re 21, and you have absolutely amazing prospects. So, what did I do? I turned it down. From a career perspective, this was a huge failure, a mistake, a waste of time. I understood that logically and rationally…
t. That’s why I don’t really like being called a marketer. I’m either a PMM, a Product Marketing Manager, or don’t call me anything.
This time, my job search took around 2–3 months because, as I noticed, the market had already started getting worse by then (it was the end of 2023). At some point, I became completely desperate. And then the heavens sent me the perfect match.
Remote work from anywhere in the world.
A promotion to mid-level.
A young team.
A position focused on developing new products within the company.
A startup atmosphere (and I love controlled chaos).
In November 2023, I accepted the offer and finally moved into a Middle Product Marketing Manager position at a B2B SaaS company.
Guys, how are you doing? Did you actually make it to the end? And… are you waiting for part two?
This time, my job search took around 2–3 months because, as I noticed, the market had already started getting worse by then (it was the end of 2023). At some point, I became completely desperate. And then the heavens sent me the perfect match.
Remote work from anywhere in the world.
A promotion to mid-level.
A young team.
A position focused on developing new products within the company.
A startup atmosphere (and I love controlled chaos).
In November 2023, I accepted the offer and finally moved into a Middle Product Marketing Manager position at a B2B SaaS company.
Guys, how are you doing? Did you actually make it to the end? And… are you waiting for part two?
Technology Updates And News
Photo
Hacker Noon - Medium Texas’ AI Data Center Boom Is Becoming a Fight Over Water
What's Happening Across Texas
As of August 2026, Texas is currently in a standoff with regulators regarding the development of AI data center projects. Some of the new 248+ planned AI data center projects were placed on hold on August 3, 2026, via a moratorium issued by Governor Greg Abbott. The reason comes down to ERCOT's concern about the impact it would have on the state's power grid. From their latest findings, ERCOT has found 474 gigawatts in connection requests, which is more than 5 times the state's peak demand, which usually occur during the summer and winter seasons.
However, Texans statewide are not seeing the bigger fight within two regions: Cameron County in the Rio Grande Valley, and Hays County just outside of Austin.
The Rio Grande Valley Fight
Deep in South Texas, Cameron County is facing a battle of its own regarding the development of AI data centers. However, it's not about the power grid; it's about the Rio Grande Valley's supply of water, which comes from the Rio Grande itself. Eneus, a Scottish-based digital infrastructure and site development company, holds an option to purchase 1,775 acres of land near Valley International Airport in Harlingen through its subsidiary, RGV Property Group. Their proposed data center campus, if successful, would draw up to 2 gigawatts of capacity. However, they haven't filed a proposal with local authorities. Regardless, actions are being taken by the Brownsville City Commission, who are scheduling public hearings on a 90-day moratorium it is planning to issue to halt the approvals of new data centers until further notice. Their primary concern is the Rio Grande.
To provide a brief history, the Rio Grande has been a staple of the region for more than a century dating back to the early 1900s, as people would often depend on it for survival. However, due to its tendency to swing between long droughts and severe floods, it has become a headache for residents utilizing it, from irrigation to canals, with the 1960s collapse of the citrus industry being a prime example. This has become especially relevant in today's situation with the AI data centers.
Due to the uncertainty of how data centers will affect the Rio Grande, State Sen. Juan "Chuy" Hinojosa has stated that the Senate Finance Committee will hold hearings to discuss the issue, aiming to ground the state's response in research rather than, in his own words, "rumors". Simultaneously, the senator was also indirectly referencing a problem that is impacting not just Cameron County, but other counties across Texas as well. In other words, he was poi[...]
What's Happening Across Texas
As of August 2026, Texas is currently in a standoff with regulators regarding the development of AI data center projects. Some of the new 248+ planned AI data center projects were placed on hold on August 3, 2026, via a moratorium issued by Governor Greg Abbott. The reason comes down to ERCOT's concern about the impact it would have on the state's power grid. From their latest findings, ERCOT has found 474 gigawatts in connection requests, which is more than 5 times the state's peak demand, which usually occur during the summer and winter seasons.
However, Texans statewide are not seeing the bigger fight within two regions: Cameron County in the Rio Grande Valley, and Hays County just outside of Austin.
The Rio Grande Valley Fight
Deep in South Texas, Cameron County is facing a battle of its own regarding the development of AI data centers. However, it's not about the power grid; it's about the Rio Grande Valley's supply of water, which comes from the Rio Grande itself. Eneus, a Scottish-based digital infrastructure and site development company, holds an option to purchase 1,775 acres of land near Valley International Airport in Harlingen through its subsidiary, RGV Property Group. Their proposed data center campus, if successful, would draw up to 2 gigawatts of capacity. However, they haven't filed a proposal with local authorities. Regardless, actions are being taken by the Brownsville City Commission, who are scheduling public hearings on a 90-day moratorium it is planning to issue to halt the approvals of new data centers until further notice. Their primary concern is the Rio Grande.
To provide a brief history, the Rio Grande has been a staple of the region for more than a century dating back to the early 1900s, as people would often depend on it for survival. However, due to its tendency to swing between long droughts and severe floods, it has become a headache for residents utilizing it, from irrigation to canals, with the 1960s collapse of the citrus industry being a prime example. This has become especially relevant in today's situation with the AI data centers.
Due to the uncertainty of how data centers will affect the Rio Grande, State Sen. Juan "Chuy" Hinojosa has stated that the Senate Finance Committee will hold hearings to discuss the issue, aiming to ground the state's response in research rather than, in his own words, "rumors". Simultaneously, the senator was also indirectly referencing a problem that is impacting not just Cameron County, but other counties across Texas as well. In other words, he was poi[...]
Technology Updates And News
Hacker Noon - Medium Texas’ AI Data Center Boom Is Becoming a Fight Over Water What's Happening Across Texas As of August 2026, Texas is currently in a standoff with regulators regarding the development of AI data center projects. Some of the new 248+…
nting to a problem with zoning authority in several counties across the state. That meant that if a project like Eneus's data centers were to move forward despite residents and city officials pushing back, who officially has the power to completely shut it down?
The Austin Fight
In Hays County, a similar fight about water like Cameron County's is taking place. Torrie Martin, whose family ranch sits next to a proposed data center site within the San Marcos area, has told commissioners that nearby projects have already affected not just her water supply, but also her livestock. Martin isn't alone in expressing this sentiment, as the San Marcos City Council rejected a proposed $1.5 billion data center in February 2026, following a public hearing that ran until 2 AM. Four months later, in June 2026, the council followed by banning new data center development within city limits. Hays County carried out a similar move, pausing approvals for water-intensive development through the end of 2026, with their reason being that data centers were putting a strain on the Edwards Aquifer during an active drought. Nevertheless, the dispute is ongoing despite these measures being taken. The reason: cities and counties may not have the legal power to enforce similar bans. A state senator has already warned the Texas Attorney General that counties do not have the authority to impose moratoriums focusing on development projects, and one county has already been sued for more than $100 million after doing just that. Hays County, on the other hand, has stalled on making its moratorium permanent, citing the legal threats that have been circling around the issue. It's the same question Cameron County is quietly running into: who actually has the power to say no?
Comparison
When looking at the bigger picture, we realize that both the Rio Grande Valley and the Austin area turn out to be fighting the same issue, but at different stages. Both regions are facing the issue of water scarcity, not grid capacity, despite the narrative stating that the issue is mostly attributed to the Texas power grid. Cameron County depends on a river, the Rio Grande, that unfortunately has a long history of failing to deliver not just for its people, but for the agricultural sector due to the region being prone to drought and the up and down cycle that comes with it. Hays County, on the other hand, had already taken measures, with San Marcos banning the development of data centers at the city level, and the county separately pausing approvals through 2026. Currently, Cameron County hasn't taken the extensive measures that Hays County has already taken, since <a href="https://www.rgvbusinessjournal.com/news/03/08/2026/abbott-data-center-review-brownsville-works[...]
The Austin Fight
In Hays County, a similar fight about water like Cameron County's is taking place. Torrie Martin, whose family ranch sits next to a proposed data center site within the San Marcos area, has told commissioners that nearby projects have already affected not just her water supply, but also her livestock. Martin isn't alone in expressing this sentiment, as the San Marcos City Council rejected a proposed $1.5 billion data center in February 2026, following a public hearing that ran until 2 AM. Four months later, in June 2026, the council followed by banning new data center development within city limits. Hays County carried out a similar move, pausing approvals for water-intensive development through the end of 2026, with their reason being that data centers were putting a strain on the Edwards Aquifer during an active drought. Nevertheless, the dispute is ongoing despite these measures being taken. The reason: cities and counties may not have the legal power to enforce similar bans. A state senator has already warned the Texas Attorney General that counties do not have the authority to impose moratoriums focusing on development projects, and one county has already been sued for more than $100 million after doing just that. Hays County, on the other hand, has stalled on making its moratorium permanent, citing the legal threats that have been circling around the issue. It's the same question Cameron County is quietly running into: who actually has the power to say no?
Comparison
When looking at the bigger picture, we realize that both the Rio Grande Valley and the Austin area turn out to be fighting the same issue, but at different stages. Both regions are facing the issue of water scarcity, not grid capacity, despite the narrative stating that the issue is mostly attributed to the Texas power grid. Cameron County depends on a river, the Rio Grande, that unfortunately has a long history of failing to deliver not just for its people, but for the agricultural sector due to the region being prone to drought and the up and down cycle that comes with it. Hays County, on the other hand, had already taken measures, with San Marcos banning the development of data centers at the city level, and the county separately pausing approvals through 2026. Currently, Cameron County hasn't taken the extensive measures that Hays County has already taken, since <a href="https://www.rgvbusinessjournal.com/news/03/08/2026/abbott-data-center-review-brownsville-works[...]
Technology Updates And News
nting to a problem with zoning authority in several counties across the state. That meant that if a project like Eneus's data centers were to move forward despite residents and city officials pushing back, who officially has the power to completely shut…
hop/">the City of Brownsville still has to decide when its first hearing on data centers will take place, which is expected to be in September 2026. And even with these measures in place, the same question has been asked: does the power belong to the local government, or the state government? So far, that question has not been answered.
Conclusion
Whether the impact is happening on the Rio Grande in Cameron County or on the Edwards Aquifer in Hays County, the AI data center boom happening in Texas keeps running into the same hurdle: water, not power, and a legal dilemma that multiple jurisdictions are facing on who actually gets to approve, pause, or deny data center development projects. As a Rio Grande Valley resident myself building AI and software, I am watching all of these events play out closer to home than most. The question isn't whether Texas will continue to develop data centers, but rather, whether the places and the individuals that will unfortunately receive the impact on their water bill get any say in it.
Regardless of the answer to the legal dilemma facing the counties experiencing these fights and the state itself, it's something that the Texas Legislature in Austin won't be able to decide alone. The community has an important role to play here, and that in turn, would lead to a better, informed decision on the long-term structure of addressing data center projects within the state.
Conclusion
Whether the impact is happening on the Rio Grande in Cameron County or on the Edwards Aquifer in Hays County, the AI data center boom happening in Texas keeps running into the same hurdle: water, not power, and a legal dilemma that multiple jurisdictions are facing on who actually gets to approve, pause, or deny data center development projects. As a Rio Grande Valley resident myself building AI and software, I am watching all of these events play out closer to home than most. The question isn't whether Texas will continue to develop data centers, but rather, whether the places and the individuals that will unfortunately receive the impact on their water bill get any say in it.
Regardless of the answer to the legal dilemma facing the counties experiencing these fights and the state itself, it's something that the Texas Legislature in Austin won't be able to decide alone. The community has an important role to play here, and that in turn, would lead to a better, informed decision on the long-term structure of addressing data center projects within the state.
Technology Updates And News
Photo
Hacker Noon - Medium The TechBeat: Zuckerberg's Superintelligence Memo: The Whole Argument Rests on One Premise (9/13/2026)
How are you, hacker?
🪐Want to know what's trending right now?: The Techbeat by HackerNoon has got you covered with fresh content from our trending stories of the day! Set email preference here.
## How I Used AI to Trace 12 Generations of My Family Tree By @nfrankel [ 8 Min read ]
In a little less than one month, I managed to gather more than 600 individuals and get back 12 generations in some branches. Read More.
MCP Was Declared Dead
By @mayankc [ 6 Min read ]
Declared dead in 2026, MCP survived by deleting its handshake and session layers for stateless HTTP efficiency. Read More.
Beyond LLMs: Creating Real-World AI Agents with Lang Chain Deep Agents
By @padmanabhamv [ 25 Min read ]
Discover how LangChain DeepAgents transform LLMs into production-ready AI systems with memory, skills, sub-agents, context management, and human oversight. Read More.
The HackerNoon Newsletter: How I Built a Data Pipeline From Scratch Using Python (8/21/2026)
By @noonification [ 2 Min read ]
8/21/2026: Top 5 stories on the HackerNoon homepage! Read More.
The HackerNoon Newsletter: Coinkites AI Audit Didnt Fail. It Was Pointed in the Wrong Direction (8/20/2026)
By @noonification [ 2 Min read ]
8/20/2026: Top 5 stories on the HackerNoon homepage! Read More.
<h2 id="thehackernoonnewslett[...]
How are you, hacker?
🪐Want to know what's trending right now?: The Techbeat by HackerNoon has got you covered with fresh content from our trending stories of the day! Set email preference here.
## How I Used AI to Trace 12 Generations of My Family Tree By @nfrankel [ 8 Min read ]
In a little less than one month, I managed to gather more than 600 individuals and get back 12 generations in some branches. Read More.
MCP Was Declared Dead
By @mayankc [ 6 Min read ]
Declared dead in 2026, MCP survived by deleting its handshake and session layers for stateless HTTP efficiency. Read More.
Beyond LLMs: Creating Real-World AI Agents with Lang Chain Deep Agents
By @padmanabhamv [ 25 Min read ]
Discover how LangChain DeepAgents transform LLMs into production-ready AI systems with memory, skills, sub-agents, context management, and human oversight. Read More.
The HackerNoon Newsletter: How I Built a Data Pipeline From Scratch Using Python (8/21/2026)
By @noonification [ 2 Min read ]
8/21/2026: Top 5 stories on the HackerNoon homepage! Read More.
The HackerNoon Newsletter: Coinkites AI Audit Didnt Fail. It Was Pointed in the Wrong Direction (8/20/2026)
By @noonification [ 2 Min read ]
8/20/2026: Top 5 stories on the HackerNoon homepage! Read More.
<h2 id="thehackernoonnewslett[...]
Technology Updates And News
Hacker Noon - Medium The TechBeat: Zuckerberg's Superintelligence Memo: The Whole Argument Rests on One Premise (9/13/2026) How are you, hacker? 🪐Want to know what's trending right now?: The Techbeat by HackerNoon has got you covered with fresh content…
ercodesmell321getterpiggybacking8222026httpshackernooncom8222026newsletterhttpscdnhackernooncomimageshackernoon_newsletter_499_kqnsqqe4c2goq0hnfk01a9z9png">The HackerNoon Newsletter: Code Smell 321 - Getter Piggybacking (8/22/2026)
By @noonification [ 2 Min read ]
8/22/2026: Top 5 stories on the HackerNoon homepage! Read More.
The ‘Backrooms’ Problem of Using AI to Write
By @lowvaluehumancapital [ 8 Min read ]
AI can write polished prose just fine, but it struggles with emotional depth. I show how language models will always be on the outside looking in. Read More.
How I Built a Data Pipeline From Scratch Using Python
By @elsierainee [ 8 Min read ]
Learn how I built a scalable data pipeline from scratch using Python, covering ingestion, processing, storage, and automation. Read More.
AI Coding Tip 034 - Stop Hoarding Rules in Your AGENTS.md
By @mcsee [ 7 Min read ]
Audit your AGENTS.md and skills on a schedule, or you keep paying context rent on rules the model has outgrown. Read More.
Recursive Self-Improvement and Agentic AI: Fear of the AI Singularity
By @giovannicoletta [ 8 Min read ]
Explore recursive self-improvement, agentic AI risks and the AI singularity debate, including OpenAI security incidents and Anthropic’s safety concerns. Read More.
<a href="https://hackernoon.com/we-keep-ranting[...]
By @noonification [ 2 Min read ]
8/22/2026: Top 5 stories on the HackerNoon homepage! Read More.
The ‘Backrooms’ Problem of Using AI to Write
By @lowvaluehumancapital [ 8 Min read ]
AI can write polished prose just fine, but it struggles with emotional depth. I show how language models will always be on the outside looking in. Read More.
How I Built a Data Pipeline From Scratch Using Python
By @elsierainee [ 8 Min read ]
Learn how I built a scalable data pipeline from scratch using Python, covering ingestion, processing, storage, and automation. Read More.
AI Coding Tip 034 - Stop Hoarding Rules in Your AGENTS.md
By @mcsee [ 7 Min read ]
Audit your AGENTS.md and skills on a schedule, or you keep paying context rent on rules the model has outgrown. Read More.
Recursive Self-Improvement and Agentic AI: Fear of the AI Singularity
By @giovannicoletta [ 8 Min read ]
Explore recursive self-improvement, agentic AI risks and the AI singularity debate, including OpenAI security incidents and Anthropic’s safety concerns. Read More.
<a href="https://hackernoon.com/we-keep-ranting[...]
Technology Updates And News
ercodesmell321getterpiggybacking8222026httpshackernooncom8222026newsletterhttpscdnhackernooncomimageshackernoon_newsletter_499_kqnsqqe4c2goq0hnfk01a9z9png">The HackerNoon Newsletter: Code Smell 321 - Getter Piggybacking (8/22/2026) By @noonification [ 2 Min…
-about-aliens-yet-nobody-has-produced-one-clear-photograph">We Keep Ranting About Aliens, Yet Nobody Has Produced One Clear Photograph
By @technologynews [ 11 Min read ]
Cameras are everywhere, 3I/ATLAS was watched by Hubble and JWST, and we still have zero verified photos of alien spacecraft. Read More.
How to Let Claude Search Your Email Without Letting It Send or Delete
By @capk [ 9 Min read ]
Learn how your-mail-mcp lets Claude and ChatGPT search decades of email through a local, structurally read-only MCP server. Read More.
Zuckerberg's Superintelligence Memo: The Whole Argument Rests on One Premise
By @hacker-Antho [ 5 Min read ]
In this vision for the future of technology, Mark Zuckerberg advocates for a philosophy of individual empowerment. Read More.
Where AI-Generated Design Breaks UX Laws
By @derzhaiev [ 7 Min read ]
AI design generators rarely produce that code, and the people using them rarely know that this code is missing. Read More.
I Built a Mail Server From Scratch and Spent Most of My Time on Four DNS Records
By @obaid03 [ 14 Min read ]
Build a mail server from a bare VPS with CyberPanel, then get it to 10/10 on mail-tester: PTR, SPF, DKIM, DMARC, and the OpenDKIM milter trap. Read More.
We Warned You About the AI Yes-Man - MIT Just Proved It With Math
By @knightbat2040 [ 13 Min read ]
A simulation study says sycophancy breaks even perfectly rational users and that neither RAG nor user awareness closes the hole. Here's what it actually found. Read More.
The Embarrassing Rise of Vibe Lawyering
By @zacamos [ 4 Min read ]
Vibe lawyering is a growing trend in the legal space. Unfortunately, consequences include fabricated cases and made-up quotes. Here's what you need to know. Read More.
The Signs of Our Times: Candace Owens vs Andrew Wilson
By @nebojsaneshatodorovic [ 2 Min read ]
Candace Owens–Andrew Wilson debate as modern bread and circuses: online distraction amid political cash gaps and military strain on the eve of 2026 Midterms.
Read More.
What Changes When You Build an App With an AI Agent Instead of Writing Every Line Yourself
By @ank17 [ 4 Min read ]
Building a mobile app with an AI coding agent changed more than typing speed. It shifted the real work toward specs, logic, and product decisions. Read More.
Jeff Dean Just Left Google After 27 Years. Here's What We Know About the Founding of Discovery Loop
By @botbeat [ 3 Min read ]
What makes this exit unusual is Google isn't losing Dean to a rival, it's that they're is bankrolling his next act. Alphabet is a founding investor. Read More.
🧑💻 What happened in your world this week? It's been said that writing can help consolidate technical knowledge, establish credibility, and contribute to emerging community standards. Feeling stuck? We got you covered ⬇️⬇️⬇️ ANSWER THESE GREATEST INTERVIEW QUESTIONS OF ALL TIME
We hope you enjoy this worth of free reading material. Feel free to forward this email to a nerdy friend who'll love you for it.
See you on Planet Internet! With love,
The HackerNoon Team ✌️
By @technologynews [ 11 Min read ]
Cameras are everywhere, 3I/ATLAS was watched by Hubble and JWST, and we still have zero verified photos of alien spacecraft. Read More.
How to Let Claude Search Your Email Without Letting It Send or Delete
By @capk [ 9 Min read ]
Learn how your-mail-mcp lets Claude and ChatGPT search decades of email through a local, structurally read-only MCP server. Read More.
Zuckerberg's Superintelligence Memo: The Whole Argument Rests on One Premise
By @hacker-Antho [ 5 Min read ]
In this vision for the future of technology, Mark Zuckerberg advocates for a philosophy of individual empowerment. Read More.
Where AI-Generated Design Breaks UX Laws
By @derzhaiev [ 7 Min read ]
AI design generators rarely produce that code, and the people using them rarely know that this code is missing. Read More.
I Built a Mail Server From Scratch and Spent Most of My Time on Four DNS Records
By @obaid03 [ 14 Min read ]
Build a mail server from a bare VPS with CyberPanel, then get it to 10/10 on mail-tester: PTR, SPF, DKIM, DMARC, and the OpenDKIM milter trap. Read More.
We Warned You About the AI Yes-Man - MIT Just Proved It With Math
By @knightbat2040 [ 13 Min read ]
A simulation study says sycophancy breaks even perfectly rational users and that neither RAG nor user awareness closes the hole. Here's what it actually found. Read More.
The Embarrassing Rise of Vibe Lawyering
By @zacamos [ 4 Min read ]
Vibe lawyering is a growing trend in the legal space. Unfortunately, consequences include fabricated cases and made-up quotes. Here's what you need to know. Read More.
The Signs of Our Times: Candace Owens vs Andrew Wilson
By @nebojsaneshatodorovic [ 2 Min read ]
Candace Owens–Andrew Wilson debate as modern bread and circuses: online distraction amid political cash gaps and military strain on the eve of 2026 Midterms.
Read More.
What Changes When You Build an App With an AI Agent Instead of Writing Every Line Yourself
By @ank17 [ 4 Min read ]
Building a mobile app with an AI coding agent changed more than typing speed. It shifted the real work toward specs, logic, and product decisions. Read More.
Jeff Dean Just Left Google After 27 Years. Here's What We Know About the Founding of Discovery Loop
By @botbeat [ 3 Min read ]
What makes this exit unusual is Google isn't losing Dean to a rival, it's that they're is bankrolling his next act. Alphabet is a founding investor. Read More.
🧑💻 What happened in your world this week? It's been said that writing can help consolidate technical knowledge, establish credibility, and contribute to emerging community standards. Feeling stuck? We got you covered ⬇️⬇️⬇️ ANSWER THESE GREATEST INTERVIEW QUESTIONS OF ALL TIME
We hope you enjoy this worth of free reading material. Feel free to forward this email to a nerdy friend who'll love you for it.
See you on Planet Internet! With love,
The HackerNoon Team ✌️
Technology Updates And News
Photo
Hacker Noon - Medium The AI Slop Economy Runs on Unpaid Verification
There is a story going around about artificial intelligence and trust. It goes like this: AI floods the world with cheap, plausible content, so the genuine article becomes scarce, and scarcity means value, so credibility is the new moat. Build trust and win. I believed a version of this but after doing some research, my views have changed. The flood is real, but nobody is paying more for the alternative.
The flood, with actual numbers
Roughly half of new articles published on the web are now primarily AI-generated. That figure comes from Graphite, which sampled 55,400 pages from Common Crawl and averaged three detectors: 49.9 percent in the first quarter of 2026, and roughly flat near half for five straight quarters.
Music is further along. Deezer reported that at its peak in June 2026 it was receiving about 90,000 fully AI-generated tracks a day, more than half of everything uploaded.
Books, the same shape. A team of researchers tracked 14,419 self-published genre titles against daily Amazon sales through June 2026. Selling titles grew 19.2 times. Revenue grew 8.9 times.
Now hold those two Deezer numbers next to each other, because this is where the comfortable story gets its evidence. More than half of daily uploads are fully AI. Those tracks earn between one and three percent of streams.
That is a twenty-to-one decoupling between how much gets made and how much gets heard. You see it in text too. AI writes about half of new articles and holds about 14 percent of Google's ranking set, taking only 7 percent of first positions. In books, titles with substantial AI text are 20 percent of the catalog and 11.3 percent of revenue. Among the top five percent of bestsellers, 73 percent contain no AI text at all.
Volume and attention have come apart. So far, so reassuring.
Where the story falls apart
If scarcity were raising the price of the real thing, you would see it in the price. Go look.
In that same book study, revenue per title fell in seven of eight genre clusters for books with no AI text whatsoever. Not for the slop. For the human-written ones. Flooding did not create a premium for the authentic, it compressed the economics for everybody standing in the aisle.
Then there is the cleanest test case available. Shutterstock's entire business is verified, rights-cleared, provenance-documented, human-made content. If credibility were becoming scarce and valuable, this is the first place it would show up on an income statement. Its second quarter: revenue $221.8 million, down 17 percent. The data and distribution line, which is where AI licensing lives, down 16 percent for the quarter and 28 percent for the half. Net loss of $155.9 million against $29.4 million of net income a year earlier. The merger that was supposed to consolidate the market died on July 7 and the stock fell more than 30 percent.
And the licensing gold rush is thinner than it looks from the headlines. Wiley, sitti[...]
There is a story going around about artificial intelligence and trust. It goes like this: AI floods the world with cheap, plausible content, so the genuine article becomes scarce, and scarcity means value, so credibility is the new moat. Build trust and win. I believed a version of this but after doing some research, my views have changed. The flood is real, but nobody is paying more for the alternative.
The flood, with actual numbers
Roughly half of new articles published on the web are now primarily AI-generated. That figure comes from Graphite, which sampled 55,400 pages from Common Crawl and averaged three detectors: 49.9 percent in the first quarter of 2026, and roughly flat near half for five straight quarters.
Music is further along. Deezer reported that at its peak in June 2026 it was receiving about 90,000 fully AI-generated tracks a day, more than half of everything uploaded.
Books, the same shape. A team of researchers tracked 14,419 self-published genre titles against daily Amazon sales through June 2026. Selling titles grew 19.2 times. Revenue grew 8.9 times.
Now hold those two Deezer numbers next to each other, because this is where the comfortable story gets its evidence. More than half of daily uploads are fully AI. Those tracks earn between one and three percent of streams.
That is a twenty-to-one decoupling between how much gets made and how much gets heard. You see it in text too. AI writes about half of new articles and holds about 14 percent of Google's ranking set, taking only 7 percent of first positions. In books, titles with substantial AI text are 20 percent of the catalog and 11.3 percent of revenue. Among the top five percent of bestsellers, 73 percent contain no AI text at all.
Volume and attention have come apart. So far, so reassuring.
Where the story falls apart
If scarcity were raising the price of the real thing, you would see it in the price. Go look.
In that same book study, revenue per title fell in seven of eight genre clusters for books with no AI text whatsoever. Not for the slop. For the human-written ones. Flooding did not create a premium for the authentic, it compressed the economics for everybody standing in the aisle.
Then there is the cleanest test case available. Shutterstock's entire business is verified, rights-cleared, provenance-documented, human-made content. If credibility were becoming scarce and valuable, this is the first place it would show up on an income statement. Its second quarter: revenue $221.8 million, down 17 percent. The data and distribution line, which is where AI licensing lives, down 16 percent for the quarter and 28 percent for the half. Net loss of $155.9 million against $29.4 million of net income a year earlier. The merger that was supposed to consolidate the market died on July 7 and the stock fell more than 30 percent.
And the licensing gold rush is thinner than it looks from the headlines. Wiley, sitti[...]
Technology Updates And News
Hacker Noon - Medium The AI Slop Economy Runs on Unpaid Verification There is a story going around about artificial intelligence and trust. It goes like this: AI floods the world with cheap, plausible content, so the genuine article becomes scarce, and scarcity…
ng on one of the largest scientific corpora on earth, has booked $110 million or more in lifetime AI revenue. Only $8 million of that is recurring. The number that stopped me sits in its fiscal 2026 fourth-quarter investor deck, filed with the SEC in June: Wiley reports four LLM training customers. Four, worldwide, for the entire body of peer-reviewed science.
That is not a market. That is a handful of buyers who bought a corpus once.
What actually changed
Here is the part I think most people have backwards.
The cost of producing a plausible artifact went to zero. The cost of checking one did not move. And crucially, nobody is paying a premium for the checking. So verification did not become a product. It became an expense, and it landed on whoever was standing closest.
Watch where it landed.
In July, security researchers at JFrog found that a single new GitHub account had filed 55 vulnerability reports, and 54 of them were fabrications. Not exaggerations. Inventions. One described a use-after-free in a function that does not exist in the version it named. These advisories reached the National Vulnerability Database carrying critical severity scores, with government enrichment attached, and one was initially scored 10.0.
JFrog's explanation of how is the most important sentence in this whole argument: "Because no step in today's system actually requires a proof-of-concept or bug reproduction, a plausible-sounding fake advisory can slide right through the pipeline."
Read that again. The global vulnerability pipeline never required reproduction. It did not have to, because writing a convincing fake security advisory used to be expensive enough that almost nobody bothered. The system was not running on verification. It was running on the cost of lying, and that cost just went to zero.
Every institution built on that same quiet assumption is now discovering it at once, and paying for it. curl shut down a seven-year-old bug bounty in January after its confirmation rate collapsed from over 15 percent to under 5. arXiv began requiring prior peer review for survey papers. Wikipedia added a speedy-deletion criterion for AI-generated drafts. The National Vulnerability Database moved its entire pre-March backlog to unscheduled.
None of those are investments. They are all costs, incurred defensively, by organizations that will not earn an extra dollar for incurring them.
The honest complication
I should tell you what cuts against me, because leaving it out would be a small demonstration of exactly the problem.
There is no measured penalty for AI content. Ahrefs looked at 600,000 pages across 100,000 keywords and found the correlation between AI-written percentage and ranking position was 0.011, which is to say none at all. Independent trackers show AI's share of top-20 Google results rising steadily, straight through multiple core updates. Google's spam policy is explicitly indifferent to authorship, targeting scaled valueless content "whether automation, humans or a combination are involved." Anyone telling you Google punishes AI writing is selling something.
And the best-known slop story has an ending nobody quotes. After curl killed its bounty, Daniel Stenberg reported in April that "the slop situation is not a problem anymore." Report volume doubled again. The confirmed-vulnerability rate returned to 15 to 16 percent, which is above the pre-AI 2024 baseline. Nearly every re[...]
That is not a market. That is a handful of buyers who bought a corpus once.
What actually changed
Here is the part I think most people have backwards.
The cost of producing a plausible artifact went to zero. The cost of checking one did not move. And crucially, nobody is paying a premium for the checking. So verification did not become a product. It became an expense, and it landed on whoever was standing closest.
Watch where it landed.
In July, security researchers at JFrog found that a single new GitHub account had filed 55 vulnerability reports, and 54 of them were fabrications. Not exaggerations. Inventions. One described a use-after-free in a function that does not exist in the version it named. These advisories reached the National Vulnerability Database carrying critical severity scores, with government enrichment attached, and one was initially scored 10.0.
JFrog's explanation of how is the most important sentence in this whole argument: "Because no step in today's system actually requires a proof-of-concept or bug reproduction, a plausible-sounding fake advisory can slide right through the pipeline."
Read that again. The global vulnerability pipeline never required reproduction. It did not have to, because writing a convincing fake security advisory used to be expensive enough that almost nobody bothered. The system was not running on verification. It was running on the cost of lying, and that cost just went to zero.
Every institution built on that same quiet assumption is now discovering it at once, and paying for it. curl shut down a seven-year-old bug bounty in January after its confirmation rate collapsed from over 15 percent to under 5. arXiv began requiring prior peer review for survey papers. Wikipedia added a speedy-deletion criterion for AI-generated drafts. The National Vulnerability Database moved its entire pre-March backlog to unscheduled.
None of those are investments. They are all costs, incurred defensively, by organizations that will not earn an extra dollar for incurring them.
The honest complication
I should tell you what cuts against me, because leaving it out would be a small demonstration of exactly the problem.
There is no measured penalty for AI content. Ahrefs looked at 600,000 pages across 100,000 keywords and found the correlation between AI-written percentage and ranking position was 0.011, which is to say none at all. Independent trackers show AI's share of top-20 Google results rising steadily, straight through multiple core updates. Google's spam policy is explicitly indifferent to authorship, targeting scaled valueless content "whether automation, humans or a combination are involved." Anyone telling you Google punishes AI writing is selling something.
And the best-known slop story has an ending nobody quotes. After curl killed its bounty, Daniel Stenberg reported in April that "the slop situation is not a problem anymore." Report volume doubled again. The confirmed-vulnerability rate returned to 15 to 16 percent, which is above the pre-AI 2024 baseline. Nearly every re[...]
Technology Updates And News
ng on one of the largest scientific corpora on earth, has booked $110 million or more in lifetime AI revenue. Only $8 million of that is recurring. The number that stopped me sits in its fiscal 2026 fourth-quarter investor deck, filed with the SEC in June:…
port now involves AI assistance, and the good ones are better than what people produced unaided.
So it was never the technology. It was the money. Remove the bounty and the incentive to mass-produce plausible garbage disappears, and what remains is a genuinely better-equipped researcher. That is the most hopeful fact in this entire piece, and it points at the real lever.
What this means if you make things
The instruction people take from all this is "add value, be authentic, build trust." That advice predates the flood by fifteen years and it is not what the data supports.
What the data supports is narrower and more useful.
Stop expecting a premium and start budgeting a cost. Proving your claims is now a line item, not a differentiator. I ran a 21-trial controlled experiment for one article earlier this month, and the writing was the cheap part by a wide margin. Nobody paid me extra for the trials. The alternative was publishing an assertion, which is what the rest of the coverage did, and assertions are now free and worth what they cost. I run my agency's work on that assumption and I would rather state it plainly than pretend rigor sells itself.
Optimize for reproducibility, not for authorship. The evidence is indifferent to whether a human typed it and quite sensitive to whether a claim can be checked. Publish the method, the numbers, the seed, the config. That is the property machines and humans both reward, and it is the only one AI cannot manufacture for you.
Watch who absorbs the verification cost in your own field, because that is where the next failure is. It will be whoever was quietly relying on production being expensive.
One last image, which I cannot stop thinking about. On August 2, the EU began legally requiring AI output to be marked in a machine-readable format and detectable as artificially generated. On August 14, Anthropic shipped text watermarking for Claude and noted that the detection API does not exist yet, and that the mark works worst on short passages and on factual text.
Detectability became a legal obligation before it became a shipped capability. That gap is not a scandal. It is just the shape of the whole problem, sitting out in the open: we mandated proof faster than anyone built the means to provide it, and nobody has worked out who pays.
So it was never the technology. It was the money. Remove the bounty and the incentive to mass-produce plausible garbage disappears, and what remains is a genuinely better-equipped researcher. That is the most hopeful fact in this entire piece, and it points at the real lever.
What this means if you make things
The instruction people take from all this is "add value, be authentic, build trust." That advice predates the flood by fifteen years and it is not what the data supports.
What the data supports is narrower and more useful.
Stop expecting a premium and start budgeting a cost. Proving your claims is now a line item, not a differentiator. I ran a 21-trial controlled experiment for one article earlier this month, and the writing was the cheap part by a wide margin. Nobody paid me extra for the trials. The alternative was publishing an assertion, which is what the rest of the coverage did, and assertions are now free and worth what they cost. I run my agency's work on that assumption and I would rather state it plainly than pretend rigor sells itself.
Optimize for reproducibility, not for authorship. The evidence is indifferent to whether a human typed it and quite sensitive to whether a claim can be checked. Publish the method, the numbers, the seed, the config. That is the property machines and humans both reward, and it is the only one AI cannot manufacture for you.
Watch who absorbs the verification cost in your own field, because that is where the next failure is. It will be whoever was quietly relying on production being expensive.
One last image, which I cannot stop thinking about. On August 2, the EU began legally requiring AI output to be marked in a machine-readable format and detectable as artificially generated. On August 14, Anthropic shipped text watermarking for Claude and noted that the detection API does not exist yet, and that the mark works worst on short passages and on factual text.
Detectability became a legal obligation before it became a shipped capability. That gap is not a scandal. It is just the shape of the whole problem, sitting out in the open: we mandated proof faster than anyone built the means to provide it, and nobody has worked out who pays.