State of AI Engineering

What The State of AI Engineering Report Reveals About AI in Production

AI engineering has moved past experimentation, but are your observability practices keeping up? Datadog analyzed LLM telemetry from 1,000+ customers to reveal what's actually happening at scale: model adoption shifts, hidden token costs, and what the rise of agentic frameworks means for reliability. Download the report to benchmark your AI stack against production reality.

eMudra got breached! - Google found that weak randomness exposed the private keys of eight eMudhra intermediate certificate authorities, potentially allowing attackers to create trusted HTTPS certificates and impersonate websites. Chrome blocked the affected keys, while India’s CERT-In clarified that the incident concerns browser-trusted certificates, not eMudhra’s regulated digital-signature and eSign services. Read more.

Railway’s Secrets Escaped - Railway detected suspicious activity involving systems that store customer environment variables, warning that some encrypted values may have been accessed and decrypted. Because these variables can contain API keys, database passwords, and registry credentials, Railway advised users to rotate their secrets and check logs while its investigation continues. Read more.

LiteLLM’s not so good update! - Attackers compromised LiteLLM’s release pipeline and published a malicious version, v1.107.0, containing malware designed to steal credentials and enable remote code execution. The affected package and container images were removed or corrected, and users who ran them during the exposure window were advised to treat their environments as compromised and rotate accessible secrets. Read more.

Factory: Turning AI Coding Agents Into a Software Factory

AI coding tools can write functions, fix bugs, and review pull requests, but software development involves much more than writing code. Teams must understand requests, plan changes, test software, review security, manage releases, and monitor applications after deployment. Factory wants to connect these activities into one system through its Software Factory platform. Instead of using separate AI agents for individual tasks, it aims to create a connected workflow that can move software from an initial request to production, with engineers setting goals and controlling how much work agents can perform independently.

What Is Factory’s Software Factory?

Factory describes its Software Factory as a self-improving system for the software development lifecycle (SDLC). It uses AI agents called Droids to handle different engineering tasks while sharing context across stages. This means information collected during planning can also guide coding, testing, and review, reducing the need to explain the same problem repeatedly.

The process starts with signals such as bug reports, customer feedback, internal discussions, and business requirements. The system can classify these requests, plan the work, generate code, validate changes, and support deployment. After software reaches production, monitoring and incident reports can create new tasks, forming a continuous feedback loop.

The goal is not simply to produce more code. Factory wants engineering teams to measure whether work is completed faster, software remains stable, and production problems are resolved more efficiently.

How Its AI Agents Work

Factory provides several ways to run Droids. Developers can use the command-line interface or desktop app for individual tasks, while persistent remote computers support work that continues across sessions. Automations coordinate recurring workflows, and Missions divide larger projects into smaller tasks that multiple agents can handle.

The platform also covers activities beyond coding. Its Code Review feature examines pull requests, while QA supports browser-driven test generation. Security Review checks changes against frameworks such as STRIDE and OWASP. AutoWiki keeps repository documentation updated, and incident workflows help investigate production problems.

Factory also provides ready-made automation recipes. Examples include fixing lint errors, scanning dependencies for vulnerabilities, detecting API contract changes, generating missing tests, and refreshing documentation on a schedule. Teams can adapt these workflows to their repositories instead of building every automation from scratch.

Choosing Models and Controlling Deployment

One important feature is model routing. Different AI models have different strengths, costs, and speeds, so Factory can route tasks to suitable models rather than relying on one model for everything. It supports providers such as OpenAI and Anthropic, along with custom endpoints.

Deployment is another focus. Organizations can use the fully managed service, a hybrid setup, their own data center, or an air-gapped environment without external network access. This matters for companies with strict requirements around source code, sensitive information, and infrastructure control.

Factory also includes governance features such as permission limits, command allowlists and denylists, audit trails, and validation gates. Engineers can define which actions agents may perform and where human approval is required.

Measuring Results Beyond Code Generation

Factory emphasizes metrics such as time from request to production, cost per merged pull request, incident resolution time, and the percentage of work completed without human intervention. Its website shares examples of customers reporting shorter release cycles, faster code reviews, and reduced incident resolution times. These are company-reported results, not guarantees for every team.

Factory’s broader idea is that AI engineering should become a connected system rather than a collection of coding assistants. By linking planning, implementation, testing, security, deployment, and monitoring, it aims to reduce repetitive work while keeping engineers responsible for goals, quality, and risk.

Know more.

Node.js Bug! - Node.js fixed a high-severity vulnerability in its Brotli decoder that could allow remote code execution when applications process maliciously crafted compressed data. The flaw, tracked as CVE-2026-111497, affects supported Node.js release lines, with fixes available in versions 22.23.4, 24.22.1, and 26.12.1. Read more.

PHP’s new bug creates headache! - Wiz researchers uncovered critical memory-safety flaws in PHP’s core engine that could allow unauthenticated remote code execution or disclosure of sensitive process memory. Dubbed PHP2Shell, the vulnerabilities affect PHP versions dating back to 5.4, and the PHP team released fixes for supported branches on October 21, 2026. Read more.

Buzz of the Week!

Torn Writes

A torn write occurs when a system updates a data block but crashes before the entire block is written. The storage device may contain a mix of old and new data instead of one complete version. This can corrupt database pages, filesystem metadata, or critical records. It often appears during power loss or unexpected system shutdowns. Databases prevent it using write-ahead logs, checksums, or atomic-write mechanisms. It is especially important in storage engines where even a partially written page can break recovery.

Things that launched. Things that went viral. Things you'll pretend to try.

LiteCli

LiteCli is a command-line interface for SQLite with autocomplete and syntax highlighting.

Usql

Usql is a universal command-line SQL client that works with PostgreSQL, MySQL, SQLite, SQL Server, and several other databases.

pueue

pueue is a terminal-based task manager for queuing and controlling long-running commands.

Build Braincells, Not Just Features

This weekend’s read: The AI Story Wall Street Doesn’t Want to Hear

This week’s watch: How did Humans Invent Bed?

Meanwhile…