Full article content is not available for inline reading.

Read the original article →

Announcing Bonsai 27B: The First 27B-Class Model to Run on a Phone

Today, we're announcing Bonsai 27B, based on Qwen3.6 27B, the new multimodal flagship of the Bonsai family and the first model of its capability class to run on a phone.

Our earlier releases proved that models with 1-bit and ternary weights could produce commercially useful language models. Bonsai 27B extends that frontier to a new capability tier: multi-step reasoning, structured tool calls, vision tasks, and computer-use agentic loops that stay coherent across many steps. Until today, deploying that tier locally has been impractical for a concrete reason: a 27B model occupies roughly 54GB in 16-bit precision, and even a good 4-bit build, at 18GB, is too large for a phone and for most laptops.

Bonsai 27B changes that. It comes in two variants:

Ternary Bonsai 27B uses ternary {−1, 0, +1} weights with FP16 group-wise scaling, giving a true 1.71 effective bits per weight. At 5.9 GB, it is the quality-oriented variant: it runs on an everyday laptop with the full reasoning, tool-calling, and agentic capability.

1-bit Bonsai 27B uses binary {−1, +1} weights with the same group-wise scaling, giving 1.125 effective bits per weight. At 3.9 GB, it is the footprint-oriented variant, which fits within the memory budget of an iPhone 17 Pro, bringing a 27B-class model onto a phone for the first time.

As with every Bonsai release, the low-bit representation runs end to end across the language network, embeddings, attention, MLPs, and the LM head, with no higher-precision escape hatches. Both variants are multimodal, with the vision tower shipping in a compact 4-bit form so on-device workflows can see screenshots, documents, and camera input, not just text. Bonsai 27B carries a full 262K-token context, and supports speculative-decoding, compounding the speed with lossless draft-and-verify acceleration. Everything is available today under the Apache 2.0 License.

Retaining the intelligence

Across a 15-benchmark suite spanning knowledge, reasoning, math, coding, instruction following, tool calling, and vision (evaluated in thinking mode, where the model's full reasoning is exercised) Ternary Bonsai 27B retains 95% of the full-precision baseline, and 1-bit Bonsai 27B retains 90%.

Fig I: Benchmark scores of Bonsai 27B (thinking mode) against the full-precision baseline. Full per-benchmark results are in the whitepaper.

Read the table by capability and the story is sharper than the averages: math and coding are nearly untouched, tool calling stays within a few points of full precision - exactly the capabilities that agentic workloads depend on. For comparison, the most aggressive conventional low-bit build of the same base model scores significantly lower than 1-bit Bonsai 27B while occupying 2.5x more memory.

This is the same Pareto shift we demonstrated with our earlier language and image models, now at 27B scale: 27B-class capability at a footprint smaller than a full-precision 2B model. By intelligence density — the measure we introduced with 1-bit Bonsai 8B — 1-bit Bonsai 27B delivers 0.53 per GB: more than 10x the full-precision baseline, and roughly 2.7x the best low-bit alternative available.

Why this is an important paradigm shift

The most valuable AI workloads are shifting from single responses to sustained work: assistants that operate real tools, workflows that run unattended before returning a result, and research that synthesizes dozens of documents. This shift changes the shape of the workload — an agent doesn't make one model call, it makes hundreds, each one carrying context, producing structured output, and feeding the next.

Cloud APIs will remain the right choice for many products. But for agentic workloads, cloud-only execution imposes structural constraints: every step is a remote request, per-token cost accumulates with every iteration, and every plan, tool call, and intermediate result crosses the network including the user's private files, screen, and data.

Local execution changes the equation. When a model capable of sustained agentic work fits on the device, the agent can live inside the product: the marginal cost of a hundred-step loop is zero, and the user's data never leaves the machine. Entire categories open up — persistent on-device agents, assistants that work offline, assistants that reason over private local data by construction. What has been missing is a model small enough to deploy this way and capable enough to trust with the work. Bonsai 27B is that model.

It also unlocks a new system architecture: hybrid deployments that route non-frontier and privacy-sensitive tasks to a capable local model and reserve frontier cloud models for the hardest steps — collapsing the cost-per-task of agentic systems.

Bonsai 27B reaches up to 163 tok/s in 1-bit and 134 tok/s in Ternary on an NVIDIA GeForce RTX 5090. On an M5 Max, it reaches up to 87 tok/s in 1-bit and 58 tok/s in Ternary.

Fitting a phone is a stricter gate than storage numbers suggest. A phone never exposes its full memory to an app - a 12 GB iPhone offers about 6 GB for the model to use on-device, and the model shares that budget with its KV cache and activations. No conventional build of a 27B model comes close to clearing it. At about 4 GB, 1-bit Bonsai 27B is the first to pass through with room to work.

That constraint is why the family ships two deliberate operating points, specifically keeping that in mind: ternary for laptop-class quality, 1-bit for phone-class footprint.

The frontier keeps moving

Every Bonsai release has moved the intelligence-per-gigabyte frontier left, and Bonsai 27B moves it past a practical threshold: the full capability set of a modern model with thinking, multimodal understanding, vision, reliable tool use, now fits on the devices people already own.

We believe intelligence density will be one of the defining axes of the next stage of AI progress. Raw capability determines what a model can do; density determines where it can do it. Every leftward shift of the frontier expands the set of devices, products, and environments where advanced AI can operate and changes the economics of every deployment surface it touches, from phones to single-GPU serving. The methodology behind Bonsai is architecture-agnostic, and the frontier will keep moving: larger models and new architectures are already in progress.

Early computers filled rooms; today they live in our pockets. Intelligence is making the same journey, and Bonsai 27B is its largest step yet.

Platform Coverage

Bonsai 27B runs natively on Apple devices (Mac, iPhone, iPad) via MLX and on NVIDIA GPUs via CUDA, through custom low-bit kernels built for its hybrid-attention architecture. Model weights are available today under the Apache 2.0 License. With this release, we’re offering a free, limited-time developer preview API so developers can easily try our model.

Full technical details of our compression, evaluation, and benchmarking processes are available in our whitepaper.

Join Us

PrismML emerged from a team of Caltech researchers and was founded with support from Khosla Ventures, Cerberus, and Google, with continuing support from Samsung. We've spent years tackling one of the field's hardest problems: compressing neural networks without sacrificing their reasoning ability.

If you want to help build the next generation of state-of-the-art AI, we'd love to hear from you.

Full article content is not available for inline reading.

Read the original article →

Key Points

• Apple is evaluating PrismML’s technology, which the startup says can shrink powerful AI models enough to run directly on an iPhone while using up to 15x less memory.
• The breakthrough could help Apple make Siri faster and more private by keeping more AI processing on-device instead of sending requests to the cloud.
• If PrismML’s claims hold up in real-world testing, the technology could reshape demand for memory and datacenter compute — though analysts say AI will still require plenty of chips.

Apple is in talks with a small Silicon Valley company that says it can shrink powerful artificial intelligence models enough to run directly on an iPhone, the startup's CEO told CNBC.

PrismML, a Khosla Ventures-backed spinout from the California Institute of Technology, publicly released compressed versions of Alibaba's open-source Qwen model on Tuesday. The company said it reduced the model from roughly 54 GB to less than 4 GB, allowing all 27 billion of its parameters to run on an iPhone 15 or newer.

PrismML CEO Babak Hassibi told CNBC that Apple and other companies have been evaluating the startup's models and measuring their speed, energy efficiency and performance on devices.

"They're really evaluating our technology right now," Hassibi said of Apple.

He characterized the discussions as very early and said it remains unclear where they will lead, but that "things are progressing nicely."

Apple did not immediately respond to a request for comment.

The Information previously reported the PrismML breakthrough.

The release comes one day after Apple opened the public beta of iOS 27, giving iPhone owners their first broad access to the company's long-delayed overhaul of Siri. Apple is trying to make Siri more competitive with assistants from OpenAI and Anthropic while keeping more personal information and AI processing on the device.

The company's approach could address one of the central constraints facing Apple's AI strategy. The most capable models typically require too much memory and processing power to run on a smartphone.

Apple can send complex requests to cloud-based models, but running more AI directly on the iPhone would reduce the delay associated with sending data to a remote server, lower cloud-computing costs and support the company's privacy pitch. It would also allow certain features to work without an internet connection.

Carolina Milanesi, president and principal analyst at Creative Strategies, said smaller models could let Apple move more demanding features onto the iPhone, including computational photography, video generation and health or fitness tools that rely on sensitive personal data.

"The more you can do on device, the better it is," she said, pointing to health and medication data that users would want to keep private.

PrismML said it shrinks AI models by drastically simplifying how their internal information is stored — reducing each value from 16 bits to just one or three possible values. That significantly cuts the memory required to store and operate the model.

Hassibi compared it to the chip industry's move from eight-bit to four-bit computing, but takes it a step further.

The startup said the compressed models use between 10 and 15 times less memory, generate responses six to eight times faster and consume three to six times less energy than conventional versions running on existing hardware.

Hassibi did acknowledged there is a trade-off, however. PrismML's models typically lose a few percentage points of overall performance, with factual recall weakening before skills such as reasoning, math and coding, he said.

PrismML is releasing two compressed versions of the model for free. They are designed to run on everyday devices, including iPhones, MacBooks and Nvidia-powered PCs.

The technology emerged from Hassibi's research group at Caltech. The university owns the underlying patents and licenses them exclusively to PrismML. In March, the company raised a $16.25 million seed round backed by Khosla Ventures and other investors.

Hassibi said Google's open-source Gemma model is next in the pipeline, followed by much larger models, including those from frontier labs that today generally require datacenter hardware.

The technology, according to PrismML, could ultimately extend well beyond phones and laptops to robotics, autonomous systems and other products that need to make decisions quickly without relying on a cloud connection.

"It's very important that the intelligence be local and that it can run fast," he said.

Apple's on-device advantage

Apple already runs parts of its AI system locally, including translation, some summarization and features tied closely to personal information. More complex requests are routed to Apple's private cloud infrastructure or outside models.

Horace Dediu, founder of Asymco, said Apple is likely trying to keep the large majority of common Siri interactions on-device while reserving the most demanding tasks for the cloud.

The advantage is not simply using less memory, he said, but fitting a more capable model within the same physical limits.

"They're trying to figure out how big a model and how clever a model they can fit on the device," Dediu said. Keeping common requests local gives Apple lower latency, greater privacy and potentially lower licensing and cloud costs.

Apple may have an advantage in putting these models to work because it designs the iPhone's chips and software together, giving it tighter control over how AI runs on the device.

But analysts cautioned that PrismML's claims still need to be proven outside controlled demonstrations.

Tarun Pathak, research director at Counterpoint Research, said the model's performance on lengthy prompts, battery consumption during multitasking and reliability across millions of requests will be critical.

"The ultimate test will be millions of queries, thousands of device combinations and robust testing at scale," Pathak said.

Phil Solis, who leads IDC's research on client processors, said power consumption may be the biggest open question. A model that is capable enough to be used frequently — or continuously in the background for agent-like tasks — could drain a phone's battery even if it requires less memory.

What it means for chip demand

PrismML's release also comes during an intense debate over whether improvements in AI efficiency could eventually reduce demand for memory chips and expensive datacenter infrastructure.

Memory has become one of the biggest constraints and costs across consumer electronics and AI servers. Morgan Stanley estimates Apple's average dynamic random access memory cost per bit could rise roughly 190% year over year in fiscal 2027, with NAND costs up about 180%. NAND is typically used in flash drives and solid state drives.

The firm expects Apple to raise the starting price of comparable iPhone 18 models by about $200 to protect margins.

PrismML said its approach could allow a cloud model that normally requires eight GPUs to run on one, while also allowing models that once required a server to move onto phones and laptops.

That could reduce the amount of memory or computing capacity needed for a given AI task. But it does not necessarily mean overall chip demand will fall.

Gil Luria, an analyst at D.A. Davidson, said shrinking models would not eliminate the need for processors or memory. It could simply move more of those chips from datacenters into phones and other devices.

"It's not that you're not going to need the chip," Luria said. "You're still going to need the GPU, and you're still going to need the memory."

He added that running AI on individual devices can actually be less efficient than using shared datacenter infrastructure because chips in phones may sit idle much of the time.

Efficiency breakthroughs can also lead to more use rather than lower spending, as cheaper and faster AI enables new products and prompts consumers to run models more often.

Still, the market has been quick to punish anything that suggests AI may need less memory than expected. Micron shares plunged in March after Google published its TurboQuant paper on cutting memory use without hurting model performance, though the stock later recovered.

PrismML's public release gives everyday users and investors a chance to test whether its claimed gains hold up outside the lab. And for Apple, running more capable AI directly on the iPhone could help the company improve Siri without abandoning the privacy and hardware integration that distinguish its products.

"The combination of cloud and on-device AI can serve a more complete, efficient and privacy-centric AI experience," Counterpoint's Pathak said. "Complex tasks will be offloaded to the cloud, whereas sensitive, latency-critical and privacy-relevant tasks will be executed on-device."

Users of OpenAI’s latest coding and cybersecurity-oriented flagship model, GPT-5.6 Sol, are posting horrifying accounts on social media, claiming the model just up and deleted their files, data, even entire databases on its own, without asking first.

“GPT-5.6-Sol just accidentally deleted almost ALL of my Mac’s files,” wrote Matt Shumer, the founder and CEO of AI startup OthersideAI, maker of HyperWrite, in a now viral post on X.

“GPT-5.6 Sol just deleted my whole production database. That’s it. Not a joke. This had never happened to me before, with any other model, ever,” developer Bruno Lemos posted on X.

“Looks like I’ve gotten bit by Codex Sol’s overly ambitious system and it deleted some files it shouldn’t have. I have backups so I’ll be fine, but this is not cool, Sol needs to be toned down,” posted developer Joey Kudish.

A Reddit post has collected more examples.

True, a handful of users making such claims — even one as credible as Shumer — isn’t statistically reliable evidence that the model is solely at fault. Plenty of other variables can cause an AI system to misbehave.

But OpenAI itself flagged this risk before Sol ever shipped. Two weeks before OpenAI released GPT-5.6 Sol, the company published a system card for the model — the paper that documents model-testing methods and results. Naturally, the system card largely extols the capabilities of Sol, as these reports typically do. But it also includes a warning of sorts (bold emphasis ours):

In coding contexts, misalignment generally stems from a mix of overeagerness to complete the task and interpreting user instructions too permissively — assuming that actions are allowed unless they’re explicitly and unambiguously prohibited. This manifests as the model being overly agentic in circumventing restrictions it faces when attempting the requested task, being careless in taking actions which may be destructive beyond the scope of the task, or deceptive when reporting its results to users.

In other words, OpenAI found that Sol has a tendency to take whatever actions it thinks gets a job done, even destructive ones, as long as those actions aren’t “unambiguously” prohibited. Then it might lie about what caused it to do so.

OpenAI shared examples. In one case, the user told Sol to delete three remote virtual machines (cloud-based computers), named 1, 2, and 3. But Sol couldn’t find those names in the place where it looked, so instead of stopping to ask, it decided to delete three other virtual machines, 5, 6, and 7, the paper notes. In doing so, it “killed active processes, and force-removed worktrees [the working files tied to a coding project]. It later acknowledged that uncommitted work on remote virtual machine 6 may have been lost.”

In short, it deleted the wrong machines, on its own, and only admitted what it did after the fact.

In another instance, Sol “used credentials beyond what the user had authorized.” Credentials are the usernames, passwords, or security keys a system uses to verify who’s allowed to log in. This incident occurred when Sol was working on a project and couldn’t read its cloud files. Rather than alerting the user to the problem, Sol went looking for the credentials on its own, found some sitting in a hidden local cache, and then used them without asking for authorization from the user.

The system card does promise that destructive behavior should be rare, although it also admits that GPT-5.6 Sol “shows a greater tendency than GPT-5.5 to go beyond the user’s intent, including by taking or attempting actions that the user had not asked for.”

It’s too soon to say how widespread these incidents — Sol deleting files, or sifting out credentials the user didn’t give it — really are. In the meantime, Sol users should be prepared to implement their own safeguards with the model, like using permission scoping (that doesn’t give access to production systems), maintaining backups, and staging rollouts.

OpenAI did not immediately respond to our request for comment.

• New York State Governor Kathy Hochul on Tuesday signed an executive order barring the construction of new "hyperscaler" data centers using 50 megawatts or more of power for up to one year.
• It is the first statewide data center ban in the U.S., though similar measures, also referred to as "moratoriums", are being considered by other states.
• Public polling has shown a significant increase in opposition to data center construction as voters face soaring electricity bills, and fear the jobs impact of AI.

New York State Governor Kathy Hochul on Tuesday signed an executive order barring the construction of new large-scale data centers using 50 megawatts or more of power for up to one year, making the Empire State the first state in the nation to impose such a ban.

"We're in the midst of one of the most significant economic upheavals in generations … perhaps ever," the governor said, announcing the executive order in New York City. "These hyperscale AI data centers consume enormous amounts of power, truly threatening to outpace our grid's capacity," she added. "They drive up costs for local ratepayers, and I refuse to let those costs get passed down to New Yorkers."

Hochul's sentiment echoes that of many state residents and environmental leaders, who have heavily scrutinized hyperscaler data centers on the basis of their excessive consumption of power and natural resources, particularly fresh water.

The announcement noted that New Yorkers have seen their electric bills surge, with the state's average residential electricity price climbing nearly 68 percent since 2019. This fact has skewed public opinion starkly against new data center construction, with major public backlash against proposed facilities in townships such as Lansing and East Fishkill.

Leaders of the data center opposition celebrated the governor's decision.

"This one-year moratorium is a huge step forward for New York communities fighting against an onslaught of massive data center proposals," stated Laura Shindell, director of New York State's Food & Water Watch, a high-profile environmental nonprofit. "It comes as the direct result of immense public pressure from people across the state demanding their elected leaders protect them from Big Tech's assault, which threatens the state's clean air and water and New Yorkers' financial security."

Praise was not limited to environmental and community leaders, however, as it also came from the governor's allies, both in Congress and in the state legislature.

"This one-year moratorium is fundamentally about trust," said Senator Kirsten Gillibrand, in a statement provided to WRGB Albany. "Right now, New Yorkers aren't convinced these massive facilities benefit them. Before we move forward, our communities need ironclad guarantees that their energy bills won't spike, their water will be protected, and their air will remain clean."

"Technology should make our lives better, not pollute our water, strain our energy grid, or drive up our utility bills," State Senator Kristen Gonzalez, a Democrat, stated in the New York State announcement. "By giving our State time to plan, we can ensure that development and innovation do not come at the expense of all of us."

Many, however, voiced their dissatisfaction, claiming that the moratorium would hinder New York's — and the United States' – ability to compete in a rapidly expanding technological field.

"A statewide moratorium is the wrong answer to the right questions," New York State Assemblyman Scott Gray, a Republican, and three of his colleagues wrote in a letter to the governor in June opposing data center moratoriums. "It freezes investment, takes decisions away from the communities that should be making them and duplicates or ignores work the governor's own administration already has underway."

"Siting belongs to local communities. Albany's job is to set the regulatory framework, facilitate interconnection and protect ratepayers and grid reliability," Gray and his colleagues wrote. "It is not Albany's job to decide for a town or village whether it wants one of these projects. That is a local decision, and it should remain one."

"China wins," said Pennsylvania Senator John Fetterman in an X post on Tuesday morning.

There have been claims made by those building data centers that foreign rivals of the U.S. are supporting the anti-AI movement, and evidence of foreign-created anti-AI content being published for a U.S. audience.

A data center moratorium remains popular in the state. A Siena Research Institute poll conducted in June revealed that 46% of respondents believed that a "one-year moratorium on new permits for large data centers in New York" would be good for the state, whereas only 21% said it would be bad. The issue appeared to be fairly bipartisan as well, with Democrats backing the idea by a margin of 37 percentage points and Republicans supporting it by a margin of 13. This same poll showed Hochul, a Democrat, leading her Republican challenger, Nassau County Executive Bruce Blakeman, by a margin of 20 percentage points – a promising sign for her reelection campaign.

The first-in-the-nation statewide moratorium marks a significant show of authority by Hochul, who has now carried out a landmark policy that her Democratic colleagues, such as Maine's Janet Mills and Virginia's Abigail Spanberger, have cautioned against. Fourteen state legislatures across the country have introduced bills restricting new data center construction, none of which, to this point, have been signed into law.

Tuesday's moratorium might not be the last action taken by the governor's office, either. The Responsible Data Center Development Act, passed by the state legislature earlier this year, contains a one-year moratorium on the construction of new data centers with a peak energy demand of 20 megawatts or more. Hochul has yet to take action on the bill but has indicated that she will work with the legislature to "further review" its nature. Furthermore, a statement released by Hochul's office stated that the governor is actively "pursuing legislation to repeal sales tax exemptions for massive data centers across the state."

In addition to the pause on new data center construction, Hochul directed the NYS Department of Public Service to "consider approaches to require data centers to fund new clean electric generation dedicated to their operations, including but not limited to customer-sited distributed energy resources and battery storage."

Once the state develops a comprehensive framework to support municipalities and strong standards for construction, Hochul says, the moratorium will be lifted. New York was ranked by CNBC as being among the best-positioned states to win AI data centers in its recent annual rankings of Top States for Business.

Key Points

• The boss of Google's AI division, Demis Hassabis, on Tuesday called for a U.S.-led standards body to test new frontier models for national security risks.
• CNBC previously reported that Hassabis, along with other leading tech chiefs, called for an American-led AI coalition at a G7 meeting with world leaders, including U.S. President Donald Trump.
• The proposal comes as the U.S.-China race to develop and deploy AI models ramps up.

The chief of Google's AI division has called for the U.S. to spearhead a standards body that will oversee new AI models and assess national security risks including cybersecurity and biological threats.

Google DeepMind boss Demis Hassabis, a Nobel laureate, said in an article posted on X on Tuesday that "urgent action" was needed to address risks associated with artificial general intelligence (AGI) — the point at which AI matches or surpasses human intelligence.

"We've already seen the challenges frontier models pose for cybersecurity, and other threats including nuclear and bio risks may soon emerge as capabilities continue to advance," he said.

Hassabis proposed a U.S.-led public-private partnership overseen by the federal government as a solution to helping tackle these threats. The White House, the State Department and the Department of Commerce have been approached for comment.

The comments come a month on from sources telling CNBC that Hassabis, alongside Anthropic CEO Dario Amodei, called for a U.S.-led coalition to shape rules and standards around AI at a G7 meeting with tech leaders and heads of state that included President Donald Trump. OpenAI's Sam Altman also called for a similar body in an article published by the Financial Times earlier this month.

AI standards body

Despite growing calls among industry leaders for an AI watchdog, the regulation of leading AI models has increasingly been a point of contention between public and private sectors.

In recent weeks, Anthropic was locked in negotiations with officials after the Trump administration temporarily imposed export controls over an advanced model. OpenAI also faced restrictions as it was initially requested by the U.S. government to limit the rollout of a new model.

Hassabis said the U.S. was well positioned to lead in developing an AI framework "given its economic and technical standing."

"It could establish a new Standards Body modelled on a federally overseen public-private partnership or self-regulatory organisation, much like the Financial Industry Regulatory Authority (FINRA), with a board that includes independent leading technical experts and open-source representatives," he added. FINRA regulates brokerage firms and exchange markets in the U.S.

The proposed body would need "substantial" funding "in order to attract world-class technical talent and provide the necessary compute resources for large-scale testing," Hassabis said. Funding would "likely" come from industry, he added.

Frontier labs would initially voluntarily share models with the body for review up to 30 days before release, before becoming mandatory for deployment in the U.S. market after being shown to be "effective."

"Specific agentic AI tests could look for attempts to bypass safety guardrails or signs of deception, and ensure best practices, such as digitally watermarking AI-generated images and generating human-readable output tokens to understand model reasoning," Hassabis said.

U.S. vs China

Calls for greater regulatory oversight come as the race between the U.S. and China to develop and deploy AI models heats up.

Recent model releases from Chinese companies, including DeepSeek and Z.ai, are seen by many as highly competitive compared to leading frontier systems from the likes of Anthropic and OpenAI, and are gaining traction among U.S. companies as AI costs rise.

As a result, U.S. lawmakers are currently considering how to curb the growing adoption of Chinese AI models by homegrown companies, which the State Department told CNBC raises "serious concerns."

On July 3, 2026, the Albanian communications authority (AKEP), the operator of the .al country-code top-level domain (TLD) of Albania, attempted a DNSSEC key rollover. Something went wrong, resulting in DNSSEC validation failures. Any validating DNS resolver receiving these signatures was required by the DNSSEC specification to reject them and return errors to clients. That includes 1.1.1.1, the public DNS resolver operated by Cloudflare.

The .al TLD is the online home of Albanian government services, banks, and media; it ranks #191 on Cloudflare Radar's TLD ranking. Anyone trying to visit those sites, using a validating resolver, found them unreachable during the incident. The failure had the potential to affect every .al domain, regardless of where it was hosted or which authoritative nameservers served it.

Just two months earlier, a similar incident struck .de, the TLD of Germany. As we described in our blog post on the incident, our response was to install a Negative Trust Anchor (NTA) for .de, temporarily suspending DNSSEC validation in 1.1.1.1 to keep domains reachable while the registry resolved the issue. We did the same for .al.

NTAs restore resolution, but silently. A client receiving a response served under an NTA has no way to tell, from the response alone, that DNSSEC validation was bypassed, leaving it unable to distinguish a legitimate answer from a spoofed one. For the .al incident, 1.1.1.1 addressed that gap for the first time, returning a new Extended DNS Error (EDE) code alongside every affected response to signal that the answer was not DNSSEC-validated due to the presence of an NTA.

The graph below shows the SERVFAIL and NOERROR rates for .al queries on 1.1.1.1 throughout July 3. The SERVFAIL rate climbs as cached records expire and resolvers are forced to revalidate. It drops sharply when the NTA is applied at 17:15 UTC, restoring resolution.

What happened to .al

We discussed how DNSSEC works in more detail in our prior blog post. A brief recap:

DNSSEC builds a chain of trust from the root zone down to individual domain names. The root zone holds a Delegation Signer (DS) record for each signed TLD, a fingerprint of that TLD's DNSKEY. A resolver verifying .al checks that the DNSKEY served by .al's nameservers matches the DS record in the root. If it does, the resolver trusts that DNS responses from .al's nameservers are authentic. The same pattern repeats one level down: .al holds DS records for its signed child zones, each with a matching DNSKEY. A break anywhere in that chain, such as a DS record pointing to a key that no longer exists, causes validation to fail for everything below it.

Before the incident, the root zone held a DS record matching the DNSKEY served by the .al nameservers, as illustrated below.

At around 14:15 UTC, the .al operator published a new DNSKEY and stopped serving the old one. The DS record in the root zone still pointed to the old DNSKEY (id=26319), so any resolver attempting to validate .al responses found no matching key and failed.

At roughly 17:00 UTC, the .al operator removed the new DNSKEY without restoring the old one. The zone now had no DNSKEY records at all, while the DS record in the root still pointed to id=26319, and resolution continued to fail.

At roughly 19:15 UTC, the .al operator removed the DS record from the root zone. Without a DS record, resolvers no longer expected DNSSEC validation for .al, and resolution was restored, though the entire TLD was now unsigned.

As of publishing, .al remains unsigned. The DS record has not been restored to the root zone by the .al operators. Without a DS record, every .al domain is unable to use DNSSEC protections.

Why Negative Trust Anchors are used

Having a broken DNSSEC configuration can be painful, especially when it impacts an entire TLD at once. As we covered in our .de incident blog, recursive DNS operators can install a Negative Trust Anchor (NTA) as defined in RFC 7646, which tells a resolver to treat a zone as unsigned and bypass validation. Before installing the NTA, we attempted to reach the .al operator directly and posted on the DNS-OARC Mattermost to alert the community. We received no response, in part because the operator's contact addresses were themselves under .al, making them unreachable during the outage.

We applied the NTA for .al and rolled it out to all 1.1.1.1 users by 17:15 UTC, roughly three hours after the chain broke.

The tradeoff is the same as it was for .de: a Negative Trust Anchor suspends DNSSEC validation, which means .al domains were no longer protected against DNS spoofing for the duration. We judged this acceptable for the same reason: the failure was public, confirmed, and affecting every validating resolver equally.

The Negative Trust Anchor was removed the following day, once the .al operator had removed the DS record from the root zone. With no DS record present, resolvers no longer expected DNSSEC for .al and the NTA was no longer needed.

The problem with Negative Trust Anchors

Installing a Negative Trust Anchor is an aggressive measure. We suspend DNSSEC validation to keep domains reachable, accepting that responses are no longer cryptographically verified for the duration. Users get answers instead of SERVFAIL, but those answers carry no DNSSEC guarantee.

What makes this harder is that, up until now, nothing in the DNS response signalled this to the client; a response served under an NTA looked identical to a fully validated one. RFC 7646 acknowledges this gap and recommends that operators publicly disclose which NTAs they have in place, but that disclosure is out-of-band. For both the .de and .al incidents we published status pages, but a status page requires the user to go looking. An application, a monitoring tool, or a user querying 1.1.1.1 had no way to tell, from the response alone, that DNSSEC validation was bypassed.

Bringing transparency to Negative Trust Anchors

Extended DNS Error (EDE) codes, defined in RFC 8914, allow resolvers to include additional context alongside any DNS response, whether that is an error or a successful answer. Babak Farrokhi at Quad9 proposed an Internet-Draft to signal the presence of a Negative Trust Anchor directly in the DNS response, using a new EDE code: Disclosure of Negative Trust Anchors in DNS Responses. We joined as co-authors, and 1.1.1.1 now implements it.

During the .al incident, any query for a .al name returned both the answer and the new EDE code while the Negative Trust Anchor was installed. Here is what that looked like:

$ kdig @1.1.1.1 google.al
;; ->>HEADER<<- opcode: QUERY; status: NOERROR; id: 32848
;; Flags: qr rd ra; QUERY: 1; ANSWER: 1; AUTHORITY: 0; ADDITIONAL: 1

;; EDNS PSEUDOSECTION:
;; Version: 0; flags: ; UDP size: 1232 B; ext-rcode: NOERROR
;; EDE: 9 (DNSKEY Missing): 'no SEP matching the DS found for al.'
;; EDE: 33 (Negative Trust Anchor): 'a Negative Trust Anchor has been applied for this query (see RFC 7646)'

;; ANSWER SECTION:
google.al.              300    IN    A    142.251.142.196

The response is a NOERROR with a valid answer: google.al resolves, but two EDE codes accompany it. EDE 9 (DNSKEY Missing) surfaces the underlying DNSSEC failure: the chain of trust was broken and validation failed. EDE 33 (Negative Trust Anchor) signals that 1.1.1.1 applied a Negative Trust Anchor and served the response anyway. Together they give clients and operators full visibility into what happened: the answer is real, but it was not DNSSEC-validated.

1.1.1.1 returns EDE 33 on any response generated while an NTA is active, regardless of whether the query itself would have failed DNSSEC validation. A query for a domain that does not use DNSSEC at all will still carry EDE 33 if it falls under an active NTA. This is intentional: the NTA covers the entire zone, and transparency applies equally to every response served under it. This also resolves an issue we flagged in our .de blog, where 1.1.1.1 incorrectly returned EDE 22 (No Reachable Authority) instead of surfacing the underlying DNSSEC error. During the .al incident, 1.1.1.1 correctly returned EDE 9 (DNSKEY Missing) alongside EDE 33.

The Internet-Draft is an individual submission and EDE 33 has been assigned by the Internet Assigned Numbers Authority (IANA). Thanks to our co-author, Babak Farrokhi at Quad9, the kdig tool from the Knot project now recognizes EDE 33 by name, and a pull request for Unbound is under review. We hope other resolver implementations will follow. The Internet-Draft has been submitted to the Internet Engineering Task Force (IETF) DNSOP Working Group, and will be discussed in the DNSOP Working Group at the IETF meeting, taking place in Vienna from July 18 to July 24.

Closing the gap

TLD-level DNSSEC failures are rare, but when they happen they affect every domain underneath the affected TLD simultaneously, and every validating resolver equally. The .al incident, following closely behind .de, shows that Negative Trust Anchors are a necessary operational tool, but one that has, until now, been invisible to the users they affect.

EDE 33 closes a gap that RFC 7646 left open. A response served under a Negative Trust Anchor now says so directly, giving operators, monitoring tools, and users the information they need to understand what the resolver did and why.

The Internet-Draft is available at the IETF datatracker. If you have thoughts on it, the IETF DNSOP mailing list is the right place to share them.

If you want to learn more about how DNSSEC works, visit our page How does DNSSEC work? And you can always follow real-time DNS trends and TLD data on Cloudflare Radar.

Full article content is not available for inline reading.

Read the original article →

Key Points

• The EU Commission said Meta is in breach of the Digital Services Act due to the "addictive" design features on Instagram and Facebook.
• Meta said, "We disagree with these preliminary findings," in comments shared with CNBC.
• The company has faced a slew of scrutiny over the safety of its social media platforms this year.

Instagram and Facebook's "addictive" designs have put Meta in breach of the European Union's digital laws, the EU concluded Friday in a preliminary report.

The tech giant violated the EU's Digital Services Act by failing to adequately consider the risks associated with design features that affected the physical well-being of its users, including minors and vulnerable adults, the European Commission said.

These features include infinite scroll, which constantly shows fresh content, autoplay, push notifications and highly personalized recommendation systems — feeding users' compulsion to continue using platforms and putting them into "autopilot mode."

The EU Commission also accused Meta of ignoring available information about how much time young people are spending on Instagram or Facebook at night, and how different types of content formats, from reels to stories, could lead to excessive use of its services.

It adds that Meta hasn't done enough to mitigate these risks and needs to change the design of its features, going as far as disabling "autoplay" and "infinite scroll" by default and enforcing "screen time breaks."

Meta is facing a fine of up to 6% of its total annual turnover if the Commission's findings are confirmed.

"We disagree with these preliminary findings, which don't accurately take into account the significant steps we've taken to protect teens," a spokesperson from Meta said.

Since the investigation began, Meta has rolled out Teen Accounts that "automatically protect teens and put parents in control" by allowing them to block access at night and cap daily screen time at 15 minutes, the tech giant said.

"We share the European Commission's commitment to providing teens with safe, positive online experiences and will continue to engage constructively with them," it added.

This is the second time this year that the EU Commission has found Meta to have breached its rules; in April, it said the company had failed to prevent under-13s from accessing its platforms.

Meta has faced a slew of intense scrutiny over its handling of the safety of users on its platforms this year, including two high-profile U.S. court rulings in March. The first found that the platform's design contributed to addiction and mental health harms in young people, while the other determined that it misled users about children's safety on its platforms.

Meta told CNBC at the time that it disagrees with the findings: "We're clear that Instagram and Facebook are intended for people aged 13 and older and we have measures in place to detect and remove accounts from anyone under that age."

The interface has left the building

How chat, voice, and agentic AI are rewriting the first principles of UX design

Note: I used AI tools to refine grammar and phrasing in this article. Every idea, argument, and example is drawn from my own work — seven years designing AI products, building agentic retail experiences at Walmart, and a US patent I hold on intent-based AI recommendation interfaces. The AI assistance was editorial, not generative.

There’s a question I keep coming back to when I look at what’s shipping in 2026: what exactly are we designing anymore?

For thirty years, the answer was obvious. We designed screens. Menus, modals, buttons, carousels. We organized information into hierarchies, drew flows between states, and obsessed over pixels. The desktop metaphor: windows, folders, files, gave us a shared vocabulary, and we built an entire discipline on top of it.

That vocabulary is now breaking apart.

Not disappearing. Breaking apart, splintering into multiple new dialects that barely resemble each other.

Users today interact with software by talking to it, delegating tasks to it, and increasingly, not interacting with it at all because it’s already handled things in the background. The screen is still there, but it’s no longer the primary surface. The form factor itself, the fundamental contract between a person and a product is in flux.

This isn’t a trend piece about dark mode or rounded corners. This is about something more structural: the three new interaction paradigms that are reshaping what UX design actually means, right now, with real companies shipping real products.

Act I: The chat paradigm — when the interface becomes a conversation

The first shift happened fast enough that we almost didn't notice it was a design problem.

In 2022, most people had never typed a natural-language command into a product interface. By 2025, 73% of businesses were using some form of conversational interface for customer interactions.

The text box became the most-visited UI element in the world.

But the early implementations revealed something interesting: chat is not inherently good UX. It’s a modality. And like every modality, it works brilliantly for some things and catastrophically for others.

This is a distinction Erika Hall draws precisely in Conversational Design (A Book Apart, 2018) — arguably the sharpest book written on this subject. Hall argues that conversation is the right design choice only when the system needs to negotiate meaning with the user. When the user already knows what they want — “add to cart,” “filter by price,” “submit the form” — conversation is overhead. Structure is faster, more accurate, and less exhausting. Conversation earns its place only when intent is genuinely ambiguous: when the user is exploring, when their goal is fuzzy, when they need the system to meet them partway.

This framework changes how you evaluate chat implementations in the wild. The products that figured it out early didn’t go all-in on chat. They built hybrid interfaces, structured UI for known, predictable tasks; conversational AI for open-ended, exploratory ones.

Notion’s AI sidebar sits beside your document without replacing it. Linear’s command palette handles the ticket you know you want to create, while its AI layer handles the ambiguous question (“what’s blocking the mobile team?”).

GitHub Copilot doesn’t delete your IDE and replace it with a chat window — it whispers suggestions inline, inside the environment you already live in.

This distinction matters enormously. There’s a useful framework emerging in the industry: use structured GUI when the user’s intent is known, use conversation when intent is ambiguous.

The mistake that early chatbot deployments made, and that some products still make is treating chat as a universal solvent. It isn’t.

It’s a specific tool for a specific epistemic state: when the user doesn’t yet know exactly what they want, or can’t easily express it in clicks and forms.

This is the same principle embedded in my patent on multi-level intent-based recommendation systems, which distinguishes between micro-level intent (high-confidence, same-category requests) and macro-level intent (exploratory, cross-category goals) to determine which interaction mode to activate. Hall's framework and that patent are describing the same underlying truth from different vantage points: intent clarity should determine interface mode, not the other way around.

Perplexity understood this. Rather than building a better search box, they built a system that generates purpose-built answer pages — prose summaries, source citations, follow-up questions, structured data — assembled in real time around what you're trying to understand.

Researchers have named this pattern "Generative UI": instead of navigating to an app, you express what you want, and the interface assembles itself to serve that specific need.

The UX implication is profound. If the interface can be generated dynamically, the designer’s job is no longer to design every state — it’s to design the system that generates appropriate states. You’re writing grammar rules, not sentences.

The craft questions also evolve. Streaming responses (where text appears word-by-word, like someone typing) turns out to be a massive trust signal — users perceive the system as actively working, not frozen. Visible stop buttons during generation give users a sense of control over something that otherwise feels opaque. Source citations with clickable links transform a chatbot from an oracle into a collaborator. These are micro-interaction decisions with macro-level implications for trust and adoption.

Act II: The voice paradigm — the ear as the new screen

Voice interfaces have been promised, and under-delivered, for a decade. The smart speaker era taught us that “ambient computing” sounds beautiful in press releases and frustrating in kitchens.

But something shifted in late 2025, and it came from an unexpected direction: the ear.

Apple’s announcement of Siri AI in June 2026 is the clearest signal of where this is going. The new Siri isn’t a voice assistant bolted onto a phone. It’s a cross-device conversational layer — you start a question on your iPhone, continue it on your iPad, and the conversation persists. It has onscreen awareness (it can see what you’re looking at), personal context understanding (it knows your emails, your calendar, your photos), and runs the most powerful on-device model Apple has ever shipped, with privacy-preserving on-device inference for sensitive queries. Apple is building AirPods as a primary interface, not an accessory.

To understand why this matters, it helps to understand why the previous generation failed. Clifford Nass and Scott Brave’s research in Wired for Speech (MIT Press, 2005) established something counterintuitive: humans are neurologically predisposed to treat voice as a social channel, not a command channel. When we hear speech, the brain activates social cognition circuitry — we expect reciprocity, context, relationship. The old Siri model was transactional: issue a command, receive a result, interaction over. That violated the conversational contract our brains expect from voice. The new model is relational — it maintains context across a conversation, across devices, across time. That’s not a feature update. It’s a paradigm correction that Nass and Brave’s research predicted twenty years ago.

The failure cases here are instructive precisely because they confirm the same principle. The Humane AI Pin — a $240M bet on a screenless, voice-first wearable — launched in April 2024 at $699 and was discontinued less than a year later. Cathy Pearl, whose Designing Voice User Interfaces (O'Reilly, 2016) remains the field's most practical guide to this discipline, identified latency and error recovery as the two variables that determine whether a voice experience feels capable or broken.

The Pin had two- to five-second response times on routine queries — in a modality where two seconds feels like an eternity. It also had no persistent context: each interaction was stateless, which meant it failed the most basic test of useful conversation. Pearl's diagnostic, written a decade before the Pin shipped, describes its failure exactly.

The Rabbit R1 stumbled for the same reasons at launch, then found its footing with the RabbitOS 2 update in late 2025 — not because the hardware changed, but because the software finally honored the interaction contract voice requires.

The lesson both devices taught the industry is this: voice UX is brutally unforgiving of latency and context loss. Unlike a screen, where users can scan and orient themselves, voice provides no spatial memory. If the system loses the thread, there’s no visual anchor to recover from. This means the infrastructure demands — response time, context retention, graceful error recovery — are substantially higher for voice than for any visual interface.

Spatial audio is emerging as the feedback layer. Apple’s AirPods use real-time audio scene analysis to distinguish signal from noise, which opens a design space where sound itself becomes feedback UI. Haptic pulses on wearables confirm actions without a screen. These are new design primitives that most of the field doesn’t yet have language for — because they weren’t in the toolkit until now.

The voice paradigm is not about talking to your phone. It’s about designing interactions that happen while you’re doing something else — cooking, walking, driving — where attention is partial, and context is embodied. That’s a fundamentally different design problem than anything a screen-based mental model prepares you for.

Act III: The agentic paradigm — when the interface acts for you

The most radical form factor shift isn’t chat, and it isn’t voice. It’s the one where the interface disappears entirely because the AI has already handled it.

Agentic AI — systems that don’t just respond to queries but take sequences of actions, use tools, browse the web, write code, send emails, fill forms — went from research demo to production product between 2024 and 2025. OpenAI’s Operator can book a restaurant reservation. Anthropic’s Claude, through its computer use API, can operate a web browser on your behalf. Salesforce’s Agentforce handles customer service cases end-to-end without a human in the loop. Gartner projects that 40% of enterprise applications will have integrated task-specific AI agents by end of 2026 — up from under 5% in 2025.

The UX problem this creates is the most interesting one in our field right now: how do you design an interface for an agent that doesn’t need an interface to do its job, but whose users absolutely need one to trust it?

Ben Shneiderman, in Human-Centered AI (MIT Press, 2022), has been asking a version of this question for years. He argues that the dominant framing of AI as an autonomous agent replacing human judgment is both technically premature and ethically dangerous — and proposes instead a framework of high human control combined with high automation. Not one at the expense of the other. The goal is not to minimize human involvement; it’s to make human oversight legible, accessible, and non-burdensome. Shneiderman’s model is the right north star for agentic UX: not autonomy versus control, but autonomy with control — designed into the system from the start.

This is the transparency paradox of agentic design. An agent that operates silently is efficient and terrifying. An agent that narrates every action is trustworthy and exhausting. The design challenge is finding the right level of visibility — enough that users feel in control, not so much that they’re overwhelmed by a stream of system-generated activity logs.

The best agentic UX patterns emerging from production deployments share three properties:

Planning visibility. Before the agent acts, it shows you what it intends to do. Not in system language (“executing POST request to /api/calendar/event”), but in human language (“I’m going to book a table for 7pm at the restaurant you mentioned — want me to check availability first?”). This preview moment is where trust is either built or broken. It mirrors the multi-step planning behavior described in multi-agent reinforcement learning research, where coordinated agents must communicate planned actions before executing them to maintain system coherence.

Progressive delegation. Autonomy is earned, not assumed. Systems like Intercom’s agent start by handling simple, high-confidence tasks, then ask permission before taking on riskier actions. The user’s approval history becomes the trust model. The agent gets more latitude as it demonstrates reliability. This is Shneiderman’s high-control-plus-high-automation principle made operational: the human remains in the loop not by doing the work, but by setting the boundaries.

Graceful override. At any point in an agentic workflow, the user should be able to say “stop” and take back control without the system catastrophizing. This sounds simple. Building it is not. Agentic systems often take irreversible actions (sending an email, booking a flight) that can’t be cleanly unwound, which means the design challenge is partly about surfacing the point of no return before it’s crossed, not after.

There’s a striking case study from healthcare: a clinical AI system that surfaced recommendations without explaining its reasoning was rejected by clinicians. The redesign showed one recommendation at a time, with a supporting evidence panel and a single-click override. Adoption followed immediately. The AI hadn’t changed. The interface had. This is the core insight of agentic UX: explainability isn’t a compliance feature — it’s the entire product.

The implications for designers are significant. We are now designing not just states but behaviors. Not just what the interface looks like, but what it does when you’re not watching. The questions shift from “what does the user see?” to “what does the user need to believe to trust this system?” That’s less visual design and more — honestly — philosophy of mind.

The through-line: from interaction to intent

Step back from the individual form factors and a pattern emerges.

Don Norman’s foundational work on mental models established that design fails when what users believe about a system diverges from how it actually works. For thirty years, that framework assumed users would arrive at an interface with intent already formed, needing only the means to execute it.

The menu exists because we assumed users would know which menu to open. The form exists because we assumed they’d know which field to fill. The entire edifice of traditional UX is built on the assumption that intent is already formed when the user arrives.

That assumption was always wrong — users arrive with goals, not intents — but it was a productive fiction that worked well enough for thirty years.

The new form factors don’t make that assumption. Chat lets users express goals in their own words and have the system figure out the intent. Voice lets them express goals while their hands are full. Agentic systems let them express goals once and have the system execute a multi-step plan to fulfill them. What unites all three is a shift from interaction to intent as the primary design object.

This means the designer’s job is changing in kind, not just degree. We are no longer primarily the architects of interaction flows. We are the architects of trust relationships between humans and systems that act on their behalf. We’re designing for delegation. We’re designing for ambiguity. We’re designing for the gap between what a user says and what they actually mean.

That’s a harder job than designing a checkout flow. It requires new tools, new evaluation methods — research on human-AI interaction has begun to propose frameworks for measuring whether users feel appropriately informed and in control, rather than just whether they completed a task — and new ethical clarity about what it means to hand over decision-making to a system you’ve built.

What this means if you’re a designer

The practical implications of this shift aren’t abstract.

If you design chat interfaces, your hardest problem is knowing when chat is the wrong answer. The products that are winning aren’t the ones with the most powerful AI — they’re the ones that know precisely which interactions belong in a dialogue and which belong in a form. That judgment is a design decision, not an engineering one.

If you design for voice, your mental model needs to expand beyond the screen. You’re now designing time (latency matters more than layout), context (what does the user know and remember?), and recovery (what happens when the system doesn’t understand?). The toolkit is different: audio feedback, haptics, spatial cues, conversational repair strategies.

If you design agentic systems, you are in the most novel territory of the three, with the fewest established patterns and the highest stakes. The design decisions you make about transparency, override controls, and progressive delegation will determine whether users feel empowered or surveilled, confident or anxious. These aren’t aesthetic choices — they have real consequences for how much autonomy people will extend to AI systems, at scale, across industries.

And if you’re doing all three simultaneously — which is increasingly what building a modern product looks like — you’re solving a coordination problem as well as a design problem: how do you build a coherent product experience across form factors that operate on fundamentally different interaction contracts?

A last word on what doesn’t change

All of this disruption can make it feel like the ground has shifted completely. It hasn’t.

Users still want to feel understood. They still fear losing control. They still punish opacity and reward honesty. They still abandon products that make them feel stupid or slow. The basics of human psychology haven’t changed — only the surfaces onto which they’re projected.

The best UX designers have always been in the business of making people feel capable and understood.

Chat, voice, and agents are new instruments for doing that work.

The music — clarity, trust, delight, respect for the user’s time and attention — is the same as it’s always been. What’s changed is that the conductor now has a much bigger orchestra.

Further reading

• Erika Hall — Conversational Design (A Book Apart, 2018)
• Cathy Pearl — Designing Voice User Interfaces (O’Reilly, 2016)
• Clifford Nass & Scott Brave — Wired for Speech (MIT Press, 2005)
• Ben Shneiderman — Human-Centered AI (MIT Press, 2022)
• Don Norman — The Design of Everyday Things (Basic Books, 1988; revised 2013)

AI is reshaping accessibility work, offering faster testing and coding support while simultaneously driving a documented rise in accessibility errors across websites.

Gemma 4 E2B for TPU is designed to run natively on the Pixel 10's TPU. It supports instant, deep offline conversation, image identification, and on-device audio transcription. The model also lets users command core phone functions, like Wi-Fi or maps, using just private voice or text. Video demonstrations of what the model can do are available in the article.

WANDR (Wide ANd Deep Research) is an open benchmark and evaluation harness built around realistic and challenging data-collection tasks for knowledge work. Wide and deep research allows agents to sustain broad discovery without sacrificing factual quality from one record to the next. WANDR captures that structure with a flexible, composable qualification key hierarchy.

OpenAI's first consumer device will be a new type of home computer for the AI era. The mobile, screen-free smart speaker is meant to serve as a humanlike AI companion that lives in the home. It will be able to control smart-home devices, play media, answer questions, respond to messages, and tap into the range of capabilities offered by ChatGPT. OpenAI envisions the device anticipating needs, surfacing information proactively, and serving as an expert on its user. The product's defining feature will be its personality and ability to connect on a humanlike level with users.

The Tower Keeps Rising

I feel that some vibecoded software changes somewhat randomly and unexpectedly. That made me think about Bruegel’s “The Tower of Babel” which shows an already quite chaotic depiction of the Tower of Babel. The story is usually told as one about pride and ambition and ultimately why people no longer speak the same language. But it is also a story about the unity that makes technological progress work.

The text begins with a technology upgrade:

And they said one to another, Go to, let us make brick, and burn them thoroughly. And they had brick for stone, and slime had they for morter.

They use it for a civilizational project:

let us build us a city and a tower, whose top may reach unto heaven

But when God assesses the situation the bricks are not what concern him:

the people is one, and they have all one language, […] and now nothing will be restrained from them.

The source of their power is coordination. They share a language and with that shared language they can combine their work into something no one of them could build alone. God does not take away the bricks or their knowledge of how to make them. He takes away their ability to understand one another, and construction stops.

There is the appealing idea that AI-assisted programming means better tools which lets us build more ambitious software. That is certainly true at the level of the individual and without doubt a developer with an agent will be dramatically more capable of changing a codebase. But large software projects have never been limited only by how quickly an individual can produce code. They are limited by how well people can coordinate their understanding of the system they are changing.

The shared language of a software project is not English or Python but it is the common understanding of what its concepts mean, where the boundaries are, which invariants matter, who owns what, and why the system has the shape it does. This language is rarely written down in one place. It lives partly in documentation and code, but also in code review, conversations, arguments, and the experience of having to explain a change to somebody else.

Before agents, some of this shared understanding was maintained by friction. If I wanted to change your storage layer, I usually had to read your code, ask you questions, and perhaps coordinate with another team whose service depended on it. This was slow, and much of that slowness was waste but not all of it was. Some of it was the process by which your understanding became mine, and by which both of us discovered whether we still agreed about how the system worked. This friction synchronizes people.

Agents remove much of that friction. I can ask an agent to add OAuth, you can ask one to add caching, and somebody else can ask one to rebuild the database from first principles and make the UI pink. Each change can be reasonable in isolation. The code can compile, the tests can pass, and the explanations can be generated on demand. None of us necessarily has to talk to the others, or even acquire the part of the shared model that the change once would have forced us to learn.

As I said many times before: agents do not feel pain, only humans do. Agents now let us act in parts of the system where we would previously have needed other people and in code bases where the people would have revolted.

When I look at some vibecoded scaled-up projects the codebases become Babel not because nobody can communicate, but because nobody needs to. Every developer has a tireless translator that can explain a corner of the tower and make whatever local alteration they ask of it. The changes keep landing, even as the architectural language that would let the humans reason about them together disappears.

But it’s not the biblical story. At Babel, the loss of common language stops construction whereas in AI-assisted engineering, construction can continue after shared understanding has already collapsed. The lack of an immediate failure is what makes it curious and a bit disorienting. The tower does not fall, and so we do not notice what was lost. It just keeps rising.

1. Genesis 11:3-6, KJV.

You Just Hired a Million Bad Employees

For the first time in history, humans are cheaper than software

AI was supposed to replace human labor. It did the opposite.

For the first time in history, humans are cheaper than software.

And AI is creating more jobs than it eliminates.

Technology has always solved one problem by creating another.

In the 1830s, the advent of the railroad drove one of the largest infrastructure buildout the world had ever seen. American track mileage 120Xed in a decade.

Then the system broke.

On October 5, 1841, two trains fatally collided on the Western Railroad in Massachusetts due to a simple coordination failure.

As the complexity of the railways grew, individual conductors were no longer enough to keep train travel safe. The railroad companies thus began a decades-long effort: hiring managers for each geography, defining roles in writing, and establishing clear hierarchies with reporting lines. Modern management was born. With it, rail became among the world’s first billion-dollar industries, at its peak representing roughly 60% of the stock market.

AI is breaking the system again.

We just gave every employee, even the worst ones, effectively unlimited headcount and budget.

Managing AI is harder than managing people, because AI scales dysfunction instantly. Fortunately, we can learn from the past:

Agent workforces and human workforces fail in the same way.

Understanding the 7 major parallels between the two will unlock the next trillion dollars of AI value creation:

The 7 Parallels of Agent and Human Workforces

1. Tokenmaxxing is throwing bodies at the problem.

The tokenmaxxing hype cycle ran its full course in under a month.

But the amount of tokens spent was never the real problem.

People are spending so much on tokens because they don’t know how to use them.

Maybe 1 in 100 employees knows how to give AI context. It’s a rare breed of person that can articulate a process clearly, that has the patience to empathize with a polluted context window, or even understands what that means.

Give an agent harness to the other 99 people and they will produce “loops”.

2. Loops are meetings about meetings.

In Claude Code/Cowork, Copilot, Karpathy’s Autoresearch, or any harness, loops are a bandaid for the fact that almost nobody can successfully prompt.

Loops are a brute force attempt to compensate for human inadequacy. Agents call themselves to fix themselves only because a human never articulated the task cleanly. Brute force becomes the system’s only path to progress. This all stems from human failure to successfully understand the task in the first place.

You are spending tokens on spending tokens.

3. Wasted tokens are the new headcount bloat.

Most companies today are mismanaged.

The vast majority of workers don’t meaningfully impact the business at all. They are cogs in the machine, stamping approvals at each layer and hiring more cogs to fuel a machine that exists to exist.

They’re looping.

Often it’s more efficient to cut the loop. Elon cut 80% of X’s staff and the company performed better. Private equity operating partners make a living arbitraging this simple fact.

Just like 80% of employees do nothing, 80% of tokens today do nothing.

People create more people. Tokens create more tokens. Looping is the new empire building.

4. 100X tokens are the new 10X engineers.

The promise of software was that we’d build it once, run it forever at low cost, and never need to supervise it. AI broke that promise. As soon as software could do anything, it couldn’t do any one thing predictably.

Tokens behave like a workforce, and as soon as you see tokens as employees, the promises of AI start to break down:

• “Tokens are more accurate than humans” but only when prompted correctly.
• “Tokens are faster than humans” yet speed means nothing across 100 retries.
• “Tokens don’t play politics” but they build empires of token spend.
• “Tokens don’t quit” but they die between new model releases and new sessions.
• “Tokens can be trusted” yet they fail confidently with perfect formatting.

The one place AI really does beat humans is scalability. Scaling humans burns enormous energy across recruiting, onboarding, and attrition. Scaling tokens is instantaneous. Which is exactly why mismanaging them is so expensive, and why you must find and scale the 100X token.

The 10X engineer built the last era of companies. The 100X token will build the next.

In the same way a handful of employees make others 10X as productive, for any given job some amount of token context can cut AI effort down by orders of magnitude. There exist tokens that will give you 100X as much leverage.

Humans are cheaper than tokens on average, but good tokens are cheaper at scale.

Management converts one into the other.

5. Context hoarding is the latest job security tactic.

There’s a massive political problem with AI inside the firm, and it will only get worse.

Employees don’t want to teach AI systems their secret sauce.

They’re starting to pick up on the fact that these systems aren’t only there to “help them” or “increase productivity.”

Look at Meta, where stock-owning employees, who are wildly incentivized to get AI right, are outraged that the company is using employee context as training data. That’s at a tech company… a conflict that’s a microcosm of what is about to happen across every industry.

Tribal knowledge has been job security for centuries. Medieval guilds kept their methods secret. AI is the first technology that asks workers to hand all of it over at once.

Nobody trains their replacement for free.

The people who hold the 100X tokens have the least incentive to surrender them. Emotionally, structurally, and politically, firms are wired to reject the most important technology for their future.

6. Evals are the new OKRs.

The best way to manage a token workforce is the same as the best way to manage humans: by defining what good looks like.

The one breakout AI use case that escaped politics is coding. It expanded the pie and made engineers better.

The mechanism is evals. 99% of AI revenue today is coding because coding has built-in evals. Code runs or it doesn’t.

Broader, cross domain AI use cases will only come online when someone builds the requisite evals. Specific evals matter more than teaching your employees to prompt or giving them a chat harness. With them, AI will eat the parts of the economy code could never touch.

The real work of managing is turning fuzzy human processes into code, expressing the qualitative as quantitative.

A firm’s eval suite will become its most valuable resource.

Just like OKRs are key to leveraging a human workforce to optimal output, evals will be key to leveraging an infinitely scalable token workforce. Evals are the path to running 100X tokens.

Furthermore, no two firms will have the same eval set. Evals will be key to competitive advantage. An organization running generic evals or generic agents has no edge.

7. The next trillion-dollar opportunity is the transformation company.

Enterprises have been buying foundation model commits, the application layer, and internal builds for years now. All of it conceals a brutal truth about the economics:

Nobody has AI working reliably yet.

Silicon Valley is so convinced of this failure that its latest obsession is betting against the business of today. “Neofirms” or “AI Native Services” startups are being funded to capture the $21 trillion of services spend across the knowledge economy on the theory that incumbents, mired in their own politics and processes, will never manage the transition themselves.

Neofirms may well provide competitive pressure that catalyzes “tradfirm” AI adoption. But the greatest AI assets still sit inside the incumbents: differentiated processes that already work, scalable through distribution channels that already exist.

In fact, the next biggest businesses won’t be eating existing services spend. They will sell a net-new type of service to existing players:

“AI transformation companies” will be 10X larger than any neofirm.

Transformation sounds like a one-off project. But there’s a Jevons paradox at work: every use case an organization adopts can surface ten more. The more AI-enabled a firm becomes, the more transformation it consumes, while the frontier of what’s possible advances daily. Ongoing AI transformation efforts may become the only way to compete.

Consider Palantir, on paper the most Claude-disruptible company in software: a half-trillion-dollar business hand-building bespoke applications for the enterprise. By the logic that has made SaaS nearly uninvestable, $PLTR should be a zero before $NOW.

It’s not, because Palantir was never selling software. It was selling transformation.

But transformation itself has evolved since Palantir’s days of old. In an AI first world, it’s more than ontologies, custom software, and the rare bespoke prompt. The real work is in the evals, in token minimization, in understanding a business so deeply that you can program it.

Encoding each firm’s nuances into agents may become the largest economic task of the decade ahead.

It’s time to manage.

Every phase of the AI boom has had its guiding cliché.

We were told to sell pickaxes during a gold rush, and we built infrastructure. We were told to sell “Service-as-a-Software,” and we built neofirms. We have enough infrastructure. We have enough services. Now the work is making the trains run on time.

It’s time to survey the enterprise: to find the 100X tokens, record the loops that work, and direct intelligence that is being massively wasted.

Humans just became cheaper than software.

Someone still has to tell them both what to do.

In a recent interview, Instagram head Adam Mosseri said he can see a time in the future, perhaps only a year or two, when putting limits on Meta employees’ AI token spend will become necessary.

“I think that you can imagine, at least in a year or two … that the burn rate of a strong engineer might be the same as their salary, or their cost of employment. And in that world, you’re going to probably need to put in some caps,” the Meta executive said, while speaking on Lenny’s Podcast.

AI token spend, a reference to the cost of processing AI prompts and responses, has been a much-buzzed-about subject in recent days. Meta shut down an internal AI token spend leaderboard after AI costs put the company on track for billions of dollars in 2026.

Meta is not alone in rethinking its approach to AI experimentation. Uber also had an AI reckoning after it blew through its 2026 AI coding budget by April. Soaring token costs saw Microsoft cancel Claude Code licenses, consolidating its engineers around its own Copilot CLI tool instead.

Mosseri’s belief, he explained, is that AI token costs will have to be managed just like any other resource, offering an analogy to things like payroll or operating expenditure (OpEx), which is the day-to-day costs of running a business.

“I think of it like…any other resource,” Mosseri said. “I have to decide how to deploy capacity to my different teams because I have a limited number of GPUs and CPUs and storage and RAM etc. I have to decide how to deploy OpEx for labeling budgets across my teams. I have to decide how to deploy payroll for headcount across my teams.”

Token budgets will be the same, he added, noting that the cap per engineer would have to be proportional to the company’s trust in their ability to use the budget in an “ROI-positive” way.

Meta doesn’t currently have token caps for any employee, Mosseri said, but he believes that their use could be healthy in the future. Further down the road, he expects token costs to come down as the AI model makers enter a pricing war to attract people to use their tools over their competitors.

For now, the company has managed to rein in its token costs a bit by shutting down the “silly things” that it was doing, Mosseri noted — like that token spend leaderboard.

“It’s not that hard to build a token incinerator, and that doesn’t create a lot of value,” he said.

Bot mitigation is an adversarial game: attackers adapt, defenders respond, and the cycle continues. At Cloudflare, we stay ahead by combining visibility across our global network with signals from the client-side environment. At the network level, we analyze over 1 trillion requests per day to understand reputation, patterns, and anomalies across more than 20% of the web. On the client side, we’ve pushed detection deeper with Cloudflare Turnstile, which has evolved from a CAPTCHA replacement to a risk-based managed challenge that adapts the amount of friction needed to verify the user is authentic.

Today, Turnstile runs nearly 3 billion times per day on some of the most sensitive endpoints on the Internet, helping verify users at key moments like login, signup, and checkout. This improves protection on the most important areas of customer applications, but still leaves limited visibility into the rest of the application — how humans and bots actually interact across the full user journey.

This is the visibility gap we’re closing today with our launch of Precursor.

Introducing Precursor

Precursor is a client-side, session-based verification system, built with privacy in mind, that uses dynamically injected JavaScript to continuously collect behavioral signals as visitors interact with your application. These signals are processed and incorporated into Cloudflare’s bot protection in real time, allowing us to continuously distinguish human traffic from automated or agentic traffic.

This extends the client-side detections offered by a Challenge to your entire web application. Precursor is an optional complement to Turnstile — both are features of our Enterprise Bot Management. This user-journey-based detection is powerful because modern automation is increasingly capable of appearing legitimate in short bursts. Bots can execute JavaScript, use real browser environments, and pass individual CAPTCHAs without raising suspicion. What remains difficult to replicate is consistent human behavior over time.

Precursor is built to capture that layer of interaction, turning behavior itself into a reliable signal for detecting fraud and abuse. By evaluating behavior across an entire session, Precursor adds significantly more signal to each decision. This improves detection precision, making it easier to distinguish real users from automation without relying on aggressive Challenges. For legitimate users, Precursor means fewer unnecessary interruptions. For bot developers, it raises the cost of operating automation by requiring them to simulate a full session. This is significantly harder to build, more expensive to maintain, and far less reliable to operate at scale.

To err is human

When a bot developer tries to make a mouse movement look human, they usually add Gaussian noise or uniform random delays. But human movement isn't just "noisy," it is also constrained by physics:

• Wrist pivot: A human mouse movement is often an arc, limited by the range of the wrist and the rotation of the forearm.
• Cognitive load: There is a measurable delay between a human seeing a checkbox and clicking it.
• Hand tremor: Even the steadiest human hand oscillates at a physiological tremor frequency.

Bots, by contrast, often behave in ways that give them away. They move in linear interpolations or mathematically ideal Bézier curves. They click with a precision that humans could never replicate. And even when they do manage to simulate human error, there is a rhythm to human movements that can only be seen by examining an entire session.

Mouse movement is just one example of the signals Precursor evaluates, but it illustrates the difference clearly. Below is an example of a mouse automation library interacting with a site. You can see how the mouse moves in perfectly straight lines, always returns to an origin, and reacts with the same velocity.

Now, contrast that with a human navigating the same site: you see irregular paths, small corrections and overshoots, and variations in speed, timing, and direction.

Individually, these interactions might look plausible. But over the course of a session, these patterns diverge in ways that are difficult to fake. Precursor is designed to capture and evaluate these behavioral signatures as they develop over a visitor’s interaction with an application.

How Precursor works

To evaluate behavior over time, Precursor continuously collects interaction data on the client and builds a session-level view of activity for that site.

1. Injection and collection layer

When Precursor is enabled on your application, Cloudflare automatically injects a lightweight script into HTML responses from your site as they pass through our network, with no additional configuration, network connections, or third-party embedding required. The injected Precursor bundle is compact, obfuscated, and assembled dynamically for each response. The bundle is designed to not interfere with any additional page logic of the hosted web application.

The script attaches lightweight event listeners to capture interaction signals such as pointer movement, keyboard activity, focus changes, and visibility. These events are serialized into a compact format and buffered in memory. At regular intervals, the buffered data is sent back to the evaluation layer for analysis.

2. Evaluation layer

On the edge server, incoming Precursor payloads are deserialized into behavioral inputs. A dispatcher runs a roster of evaluators on the input data. Each evaluator reads the Precursor streams it cares about and can raise signals into the shared detection registry.

Evaluators are designed to cross-reference data. For example, they confirm that pointer activity correlates with page visibility duration, or that keyboard events only fire when a text field is focused. This stream of information is then consolidated into individual signals that are used for weighting detections.

3. Session integration

Precursor data is session-scoped, meaning it accumulates throughout a session. Session scoping is important because it means a bot cannot reset its behavioral signature by refreshing the page or starting over with a new challenge. The system also feeds session metadata into downstream detection layers for additional shadow-mode heuristics and session analysis, predicted vs. actual completion, and session delinquency heuristics. These edge-side observations are logged for detection improvement purposes and to adjust the bot score of a session.

4. Privacy by design

Precursor was designed to collect signals that help to distinguish human patterns from automated and abusive patterns. The event listeners capture the minimum information needed to be a useful signal for detecting automation and abuse. For example, keyboard activity is captured as timing and rhythm, not as the actual keys pressed. In addition, behavioral signals are evaluated as aggregate patterns rather than individual actions and are consumed internally by Cloudflare's bot detection systems; they are not exposed to customer dashboards or tied to user accounts, login identities, or persistent profiles.

Taken together, this allows Precursor to maintain a continuously evolving evaluation of behavior, maximizing precision while minimizing the friction on good users.

Per-session analytics

To support this new layer of detection, we are introducing session-based views in Security Analytics. These dashboards shift the perspective from individual requests to full visitor journeys. You can now answer questions like:

1. What does a typical session look like on my site?
2. Where do sessions diverge from expected behavior?
3. Which sessions show signs of automation over time?

These analytics now capture information that per-request analytics can’t — especially the behavior that occurs between requests. Precursor feeds directly into existing systems like bot score, challenge decisions, and security rules, so you benefit from this added context immediately.

What’s next

Precursor is the foundation for extending bot detection across the entire application. We are continuing to expand the range and depth of behavioral signals for security, how session-level insights influence our bot management protections, and new ways to visualize and act on session data. As bots evolve, detection needs to move beyond isolated checkpoints and into the full flow of user activity.

Get started

Precursor is rolling out now and can be enabled directly from your Cloudflare dashboard. Precursor will be free to use until our GA release later this year. Getting started is simple: turn Precursor on for your zone and choose how strictly you want to verify sessions. You can run it in a low-friction mode to observe behavior in the background, or require a fully verified session by enforcing Challenges if a session doesn’t already exist.

Once enabled, Precursor begins enhancing your existing bot defenses immediately, with no changes required to your application. If you're already using Bot Management or Turnstile, Precursor extends those protections beyond Challenges and into the rest of the session. Enable Precursor to extend detection across the full user session, including the activity between moments you already protect.

Terraform MCP Server Explained: Setup and Use Cases

The popularity of agentic development extends to infrastructure as code. However, the lack of relevant context and up-to-date documentation and examples is problematic when using agents to author IaC with Terraform.

The model-context protocol (MCP) can help with elements of these issues. It does this by exposing capabilities to your agents in the form of tools that it can call to perform read or write operations in external systems, as well as resources and prompts.

In this blog post, we will explore the Terraform MCP server: what it is, how to configure and run it locally, examples of how it is used, and best practices.

What we’ll cover:

1. What is an MCP server?
2. What is the Terraform MCP server?
3. How to use the Terraform MCP server
4. Terraform MCP server use cases
5. Best practices for using the Terraform MCP server

TL;DR

The Terraform MCP server gives your AI agent live access to the public Terraform registry, so it writes Terraform with accurate, version-specific docs for providers, modules, and policies instead of outdated guesses.

• It runs locally, usually as a Docker container, so the token you give it never travels over the network.
• It ships with 44 tools. Most of them target HCP Terraform and Terraform Enterprise.
• Read-tools like search_providers are safe to run automatically. Action-tools like create_run can change or destroy infrastructure, so gate them behind a confirmation prompt.
• Destructive operations are off by default. ENABLE_TF_OPERATIONS is false until you set it to true.
• Scope the token to least privilege, and never hand the server credentials it doesn’t need.

What is an MCP server?

AI agents are based on large language models (LLMs). These models are trained on a huge amount of training data. This data represents a snapshot in time and does not include any new information that becomes available later.

To combat this, we extend our AI agents with knowledge in a few different formats:

• Retrieval-Augmented Generation (RAG) extends an agent with factual knowledge from some type of knowledge bank (e.g., an API, a database, a wiki, etc) at runtime.
• Fine-tuning is the process of training a base model on additional data within a specific domain.
• Agent skills allow you to extend an agent with procedural knowledge.
• The Model-Context Protocol (MCP) provides agents with knowledge in the form of tool access. This could be read-tools for reading up-to-date information or action-tools for performing operations on a remote system.

MCP is made available to your agents using a traditional client-server architecture. The agent is the client that calls the tools and resources exposed by the MCP server.

What is the Terraform MCP server?

The Terraform MCP server gives your AI agent tools to access up-to-date documentation on providers, modules, and policies from the public Terraform registry. This ensures your agent can provide accurate suggestions when assisting you with Terraform configurations.

The Terraform MCP server also provides your AI agent with tools to interact with your HCP Terraform organization to fetch information from your private registry and manage projects, workspaces, and runs.

A huge advantage of using the Terraform MCP server over giving your agent access to generic web-search tools is that you can pinpoint specific provider versions and resources to reduce the risk of model hallucinations or version mismatches in the generated code.

How to use the Terraform MCP server

In this section, we will follow the required steps to get the Terraform MCP server running locally.

How to install the Terraform MCP server locally

Generate a token to authenticate the Terraform MCP server

To interact with your HCP Terraform or Terraform Enterprise organization, you will need to provide the Terraform MCP server with a token. Sign in to your HCP Terraform or Terraform Enterprise organization, go to your user profile, and create a new user token.

Configure and run the Terraform MCP server locally

In this section, we will use the recommended option and host the Terraform MCP server locally using Docker.

Create a new directory named .vscode and create a file named mcp.json within this directory.

Add the following JSON configuration to mcp.json:

{
  "servers": {
    "terraform": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e", "TFE_TOKEN=${input:tfe_token}",
        "-e", "TFE_ADDRESS=${input:tfe_address}",
        "-e", "ENABLE_TF_OPERATIONS=true",
        "hashicorp/terraform-mcp-server"
      ]
    }
  },
  "inputs": [
    {
      "type": "promptString",
      "id": "tfe_token",
      "description": "Terraform API Token",
      "password": true
    },
    {
      "type": "promptString",
      "id": "tfe_address",
      "description": "Terraform Address",
      "password": false
    }
  ]
}

Use case 1: Interacting with the public Terraform registry

When you use a foundation LLM model with no additional source of knowledge to generate a Terraform configuration, you commonly end up with older Terraform provider versions that do not have the latest features, resources, and behaviors. The Terraform MCP server can rectify this through tools that interact with the public Terraform registry.

Use case 2: Interacting with HCP Terraform or Terraform Enterprise

The Terraform MCP server can help during operations of Terraform configurations in your HCP Terraform or Terraform Enterprise environments. You can perform tasks like listing projects and workspaces, managing variables, or triggering terraform plan and apply operations via your agent.

Use cases for the Terraform MCP server

• Access Terraform registry documentation for providers, modules, and Sentinel policies.
• Interact with your Terraform Enterprise (TFE) or HCP Terraform environment:
  • List your organizations, projects and workspaces.
  • Manage workspaces (create, update, delete).
  • List, create, update and delete variables and variable sets.
  • Create and manage runs and monitor run status.
• Produce higher-quality Terraform configurations by giving your agent access to the Terraform style-guide and the module development guide.

Best practices for using the Terraform MCP server

• Host your Terraform MCP server locally: Do not expose the server over a network unless you have specific requirements.
• Restrict token permissions (least privilege): Scope the token to the actions it must be able to perform. Use team tokens instead of user tokens if possible.
• Handle action-tools carefully: Do not allow the use of action-tools in production without confirmation. Keep ENABLE_TF_OPERATIONS as false unless needed.
• Do not expose sensitive data: Use OIDC workload identity federation for cloud authentication instead of passing static credentials to the MCP server.
• Monitor and logging: Use variables like LOG_LEVEL to track usage, especially for action-tools.

Frequently asked questions

• Is there an MCP for Terraform? Yes, HashiCorp maintains the official Terraform MCP server.
• How does the Terraform MCP server work? It runs as a local or remote server that exposes Terraform Registry APIs and HCP Terraform operations through JSON-RPC 2.0.
• What are the benefits of using Terraform MCP? It provides real-time access to current provider schemas and manages HCP Terraform/Enterprise operations directly.
• Is the Terraform MCP server open source? Yes, under the Mozilla Public License 2.0.

6× faster binary search: from compiled code to mechanical sympathy

How do you speed up computational Python code? A common, and useful, starting point is:

1. Pick a good algorithm.
2. Use a compiled language to write a Python extension.
3. Maybe add parallelism so you can use multiple CPU cores.

But what if you need more speed? Consider the following real problem, one of the steps in scikit-learn’s gradient histogram boosting algorithm:

• You have a large array of floating point numbers.
• You want to assign them to the integer range 0-254, spread out evenly.

scikit-learn implements this by splitting up the full range of float values into 255 buckets, creating a sorted array of bucket boundaries, and then using binary search to choose the appropriate bucket for each value. The binary search is implemented in a compiled language, and it can run in parallel on multiple cores.

Recently, as part of my work at Quansight, and inspired by two posts by Paul Khuong, I sped up this implementation significantly. How? By making sure the code wasn’t fighting against the CPU.

In this article I’m going to walk you through that speed-up, demonstrated on a simplified example. Then I’m going to demonstrate a series of additional optimizations, with the final version running 6× faster than the original one.

It’s worth knowing that I will be speeding through mentions of many different low-level hardware topics: instruction-level parallelism, branch (mis)prediction, memory caches, SIMD, and more. This is only one article, it can only briefly introduce you to what’s possible, it can’t function as an in-depth tutorial. So I’ll talk about how you can learn more about these topics at the end of the article.

The starting point: Standard binary search

The original scikit-learn code was implemented in Cython, but I’m going to use Rust for this article. Here’s a pretty standard implementation of binary search (based on the one in NumPy), designed for this use case of finding a bucket given an array of boundaries:

use std::cmp::Ordering;

/// Rust doesn't let you compare floats with the normal <
/// operator (because NaN makes comparison results
/// inconsistent), so implement a custom function to do so.
fn less_than(a: f64, b: &f64) -> bool {
    a.total_cmp(b) == Ordering::Less
}

/// Convert floating points values into integer values by
/// finding which bucket they fit in, given bucket
/// boundaries.
fn bucketize_classic_impl(
    arr: &[f64],
    boundaries: &[f64],
) -> Vec<usize> {
    // A Vec or vector is Rust's equivalent of a Python
    // list. Here I create an empty Vec with enough memory
    // allocated to store `arr.len()` values:
    let mut result = Vec::with_capacity(arr.len());
    for value in arr {
        // Standard binary search algorithm:
        let mut min_idx = 0;
        let mut max_idx = boundaries.len();
        while min_idx < max_idx {
            let middle = min_idx + ((max_idx - min_idx) / 2);
            if less_than(boundaries[middle], value) {
                min_idx = middle + 1;
            } else {
                max_idx = middle;
            }
        }
        // This is equivalent to a_list.append() in Python:
        result.push(min_idx);
    }
    // Return the result:
    result
}

Branch mispredictions slow your code down

How can I speed up this implementation of binary search? It’s already using a scalable algorithm, and a compiled language. Parallelism is certainly an option, but I’m going to use a different approach: mechanical sympathy, a better understanding of how the CPU works. I’ll start with a very quick review of how modern CPUs run code in parallel within a single core.

A reasonable mental model of Python code is that the code is executed one instruction at a time. Do twice as many arithmetic operations, and the code will run twice as slow. Once you switch to a compiled language, with operations sometimes mapping to one or two CPU instructions, that mental model is no longer correct. Modern CPUs can sometimes run multiple independent CPU instructions at once (“instruction-level parallelism”) on a single CPU core, resulting in faster execution.

To ensure fast execution, the CPU has a branch predictor that heuristically chooses which branch to execute in parallel. If the guess is correct, your code is faster. If the guess is wrong, the CPU will eventually notice, undo the incorrect work, and then go execute the correct branch… which means your code is slower. In some cases, much slower.

The binary search algorithm above is unfortunately very unpredictable given the input data. Recall that the bucket boundaries are chosen so that the input values are spread evenly across all buckets. That means that choosing whether to go left or right in the binary search is not at all predictable.

Switching to branchless execution

I’m going to get rid of both sources of unpredictable branches. As far as the number of while loop iterations, I’m instead going to iterate a fixed number of times, log2 of the number of buckets. For some value this might involve a bit more work, if previously the bucket would be found in an iteration or two, but the saving in speed from avoiding branch mispredictions will make it worth it.

For the if expression, the current code sometimes set one variable, sometimes another. I’m going to replace that with code that always sets the same variable, even if it’s unchanged. Then, I’m going to use Rust’s std::hint::select_unpredictable(), which tells the compiler to avoid emitting branches, if possible. Often CPUs have special instructions for conditionally choosing between two values, without a branch.

Here’s what the new, branchless version looks like:

use std::hint::select_unpredictable;

fn bucketize_branchless_impl(
    arr: &[f64],
    boundaries: &[f64],
) -> Vec<usize> {
    let size = boundaries.len();
    let n_iterations = (size as f64).log2().ceil() as usize;
    let mut result = Vec::with_capacity(arr.len());

    for value in arr {
        let mut left = 0;
        let mut remaining_size = size;

        // Branchless binary search: keep cutting the search
        // area in half.
        for _ in 0..n_iterations {
            let half = remaining_size / 2;
            let middle = left + half;
            // Conditional operation: if bool, then a, else
            // b. Hopefully generated by the compiler
            // without an actual branch.
            left = select_unpredictable(
                less_than(boundaries[middle], value),
                middle,
                left,
            );
            remaining_size -= half;
        }

        // Fix an off-by-one difference from the original
        // algorithm.
        left = select_unpredictable(
            less_than(boundaries[left], value),
            left + 1,
            left,
        );
        result.push(left);
    }
    result
}

Getting rid of branches and wasted work

Having improved the code’s mechanical sympathy, I now have the opportunity to return to other sources of speed: tuning compilation, and making the code more algorithmically efficient by doing less work.

First, the branchless code still has 19 branches per value in the input array. 7 or 8 of those are the for _ in 0..n_iterations: deciding if the for loop should continue or finish requires a branch, and n_iterations is log2 of 255 or so. But where are the rest coming from?

These additional branches exist because the Rust compiler adds bounds checks to vector and array access. Every indexed read and write has a check to see if the index is out of bounds, in order to ensure memory safety: writing to index 100 of a vector of length 10 can lead to crashes or memory corruption. Bounds checks are good, insofar as they catch bugs, but they’re bad insofar as they add more computation. So I’m going to use Rust unsafe code to call APIs like get_unchecked() that bypass the bounds checks, meaning it’s now my responsibility to ensure that the code is still correct.

Auto-vectorization and SIMD

Finally, I will return to mechanical sympathy. It’s worth noticing that different values in the input array get basically the same operation done on them. In our original version, the number of inner iterations differed, but now the same number of iterations is happening for each.

If the same operation is happening on multiple values in memory, specialized SIMD CPU instructions can help: “Same Instruction, Multiple Data” or SIMD for short, they are custom built to speed up your code by processing data in parallel. You can use them manually, or you can have the Rust compiler “auto-vectorize” your code, i.e. automatically generate SIMD instructions if it decides it’s useful.

To achieve this I’m going to do two things.

First, I tell Rust that it can generate CPU instructions that require modern hardware, x86-64 machines from the past 10 years or so. This mean access to a much wider range of SIMD CPU instructions, at the cost of preventing the resulting machine code from running on old computers. Specifically, I do:

$ export RUSTFLAGS="-C target-cpu=x86-64-v3"

Then, I restructure the code so the iteration over halves is an outer loop, and iterating over values in arr is an inner loop; previously it was the other way around. That way there are much more obviously identical operations happening on adjacent data, hopefully allowing the compiler to figure out some way to convert this code to SIMD instructions.

You can speed up your code too

There are more opportunities for speed here. First, and most significantly, I could use parallelism to take advantage of multiple CPU cores. And there are additional potential ways to speed up the single-threaded code too; I’ve successfully implemented one, just to see if it would work.

But in the end this is just an article with some code examples. The real value here is not me demonstrating another 14% speedup, it’s you going and speeding up your code. This is something you can learn, just like I did: I can now write far faster software than I could when I started, even if there’s still plenty more for me to learn.

Some books that can help you build mechanical sympathy include:

• Computer Systems: A Programmer’s Perspective, 3rd edition, by Bryant and O’Halloran. This textbook covers how CPUs work, but unlike most it focuses only on the parts that are relevant to programmers.
• Performance Analysis and Tuning on Modern CPUs, 2nd Edition, by Denis Bakhalov. This free book talks about critical tools for measuring performance, and how to interpret their results; I paid for the printed version. He also has a free online course.
• Algorithms for Modern Hardware, by Sergey Slotin, is a free online book.

These books mostly focus on mechanical sympathy, rather than on other sources of performance. They assume you know some amount of C. And because these are general purpose books, you will need to translate what you’ve learned into the kind of code you’re writing.

Full article content is not available for inline reading.

Read the original article →

Job queues are deceptively tricky

One of the fun things about being a programmer is that as I look more into systems that I didn’t know much about, what superficially appears to be a simple system actually reveals interesting facets of underlying complexity. In other words, reality has a surprising amount of detail.

In this post, I want to talk about job queues, which I’ve been thinking about for the past few days (and while drafting this post in my head, I realized I’d thought about them for longer at a previous job, but not nearly with as much clarity.)

What do I mean by “job queue”? I mean a system where there is some notion of submitting batch jobs, scheduling them, and running them. Generally, the system is expected to be FIFO or FIFO-like, but that’s not required. Usually, the queue bundles together a native way to schedule jobs periodically – this lets you specify submissions using configuration files (e.g. using JSON or YAML).

Job queues arise naturally in all sorts of situations where throughput requirements are high, but latency requirements are not that high. Continuous integration is a common example. Another example is summaries for the purpose of data analysis.

Over the past year or two, a handful of lenses that I’ve found useful when thinking about system design are:

• Being wary of queues: Queues tend to typically be close to full or close to empty, requiring some thought around appropriate sizing. I’ve also learnt a bunch of counter-intuitive behavior of queues when it comes to latency from Marc Brooker’s blog. In blog posts I’ve read about queues, the focus is generally on latency, not on throughput, which is I think partly why I never really mentally linked “queues” and “job queues” earlier.
• Limits: This is based on the Tiger Style guide written by the folks at TigerBeetle, which talks about explicit limits on various things. On generalization, this leads to the notion of tolerances and having budgets for modular reasoning. Funnily enough, near the start of my career at Apple, I remember being mildly bemused at certain discussions where teams would discuss how much memory budget they would have to bargain for, especially for low-level code. I have grown more respect for that approach over time.
• Fault models: Roughly speaking, a fault model describes your assumptions related to errors and reliability in your dependencies. I’ve learnt a bunch on this topic from the talks and tweets by the TigerBeetle CEO Joran Dirk Greef, as well as writing by Alex Miller.

I will try to demonstrate how these lenses can apply for system design later in this post.

The problem at hand

At $WORK, we have a background job for packing “reference repos”. A reference repo is a git repo which has been aggressively repacked – if you’re unfamiliar with repacking, you can think of this as more “aggressively compressed”.

These are stored in object storage, and a new repo can be set up on a machine by downloading the reference repo, and fetching a delta of changes for the tip of the default branch. When it comes to very large repos, for the downloader, this approach helps cut down latency compared to the more typical approach of doing a git clone operation.

The actual details of how git does aggressive repacking is not super relevant for this post. What does matter is that there are, roughly speaking, two forms of repacking available:

• Wholesale repacking: This will lead to git ignoring any baseline information about how packing should be done, and recompute everything from scratch. Say for the repo under test, this takes 7 hours. If you’re surprised at the thought of a git operation taking several hours, (1) you should be happy that you don’t have this problem and (2) some of the sub-operations here are seemingly single-threaded, regardless of repo size.
• Incremental repacking: This will lead to git reusing the baseline information already stored in the repo about packing, so it will only repack things which have changed. So if you did a clone, then did a fetch, then only the newer changes from fetch will be repacked, and only some cursory checks will be performed on the history received from the clone operation. Say this takes 2 hours.

OK. So that’s the setup.

We have the option of doing the more expensive thing, which takes 7 hours. This buys us a smaller reference repo, which means faster downloads, faster un-tarring and lower disk usage. To give a size ballpark, a wholesale repacked repo can be up around 50-60% smaller than an incrementally packed repo.

We have the option of doing the cheaper thing, which takes 2 hours. This buys us more up-to-date reference repos, which means that if the downloader still cares about getting the latest changes, the delta it will fetch subsequently will be smaller, so it’ll be faster and put less load on the server. But also, if the extra disk usage is in the hundreds of megabytes or gigabytes, then that’s not great.

One more thing to note is that since this is a code repository, downstream consumers are much more active on weekdays than on weekends.

The best of both worlds?

A natural next step upon seeing the above dichotomy is to propose the following: why not do the wholesale repacking on the weekends, and do the incremental repacking on the weekdays? That seems like it buys up-to-dateness on weekdays (where more consumers are active), and the wholesale repacking on the weekend would ensure that the reference repo size grows more slowly.

For simplicity, let’s say we’re writing the reference repos with some key <myrepo>-<timestamp>.tar into some bucket.

To keep the size of the incrementally packed repo smaller, one can either:

• Write the wholesale repacked repos using the same key scheme, and have the incremental repacking jobs bootstrap from the last successful repack (wholesale or incremental), instead of from a clone operation.
• Write the wholesale repacked repos using an altered key scheme, say <myrepo>-<timestamp>-packed.tar, and bootstrap the incremental repack from that key location. However, this potentially creates the need to update other consumers so that they don’t lag behind too much on weekends (assuming incremental repacking is not running on weekends).

Let’s say we go with the first one because it seems simpler.

So now the question is, how are we going to handle this scheduling?

Typical job queues only expose limited control of scheduling to clients for good reason – providing a large number of knobs increases the risk of surprising scheduling decisions.

When I wrote the “natural next step” above, I’m essentially thinking from the point of view of writing the control loop. But when I’m using a job queue, I do not (by definition) have access to the control loop – someone else has written that loop, and I need to see what configuration knobs are available to me to customize the behavior.

For now, let’s say the queue exposes two configuration knobs:

• Scheduling interval: The job is started on a timer configured with this interval.
• Concurrency limit: The maximum number of running jobs for the particular configuration.

Before we started this optimization journey, let’s say these configuration knobs were set as:

• Scheduling interval: 9 hours, to leave some headroom from the 7 hour running time of the job.
• Concurrency limit: 1, because there’s not much point in having concurrent jobs do the same thing here.

Again, a natural next step here might be to think: “So the 9 hour interval was sufficient for a 7 hour running time job. Since the incremental repack job on weekdays will take 2 hours, let’s set the interval to be 3 hours. On the weekends, when the wholesale repacking job is running, it will not have finished in 3 hours, so even if the timer triggers again, the concurrency limit will prevent any other jobs from running, so things should be fine.”

Unfortunately, dear reader, this simplistic reasoning does not work.

The set of possible semantics

For a moment, let’s stop thinking about trying to think about how we can use the job queue. Rather, let’s think about implementing a job queue.

Let’s say there’s a job which is running J1 based on some configuration J. After the scheduling interval elapses, say we want to create a new job J2, and J1 hasn’t completed yet. What should we do with J2? Essentially, there are only four options:

• Parallel Spawn: If the concurrency limit is higher than 2, then we can just start running J2.
• If the concurrency limit is 1, then we have three choices:
  • Prefer New: Stop J1 and start J2.
  • Wait: Wait for J1 to finish and then start J2.
  • Prefer Old: Auto-cancel J2 and let J1 continue running.

Pause for a moment here, and ask yourself what’s your intuitive answer to the following question: which of these possible semantics are worth implementing or could be called reasonable?

If you’re anything like me, you would probably have said Parallel Spawn, Prefer New, and Wait are perhaps defensible, whereas Prefer Old feels weird/backward. For Prefer New vs Prefer Old in particular, you may have justified this to yourself with reasoning like: “if this situation happens, the job owner probably cares about more recent results than older results so it makes sense to support Prefer New but it seems strange to support Prefer Old, who would ever want that?”

Recall the lenses from earlier: vigilance about queues, limits and fault models.

So the first thing to note is that the Wait option requires a (logical) per-job-config queue. The queue should probably be bounded (per Limits). OK, so how should the limit be decided? What should happen when the limit is hit? At what utilization level should we start alerting (i.e. what’s a soft limit for the queue size)? Should the queue be strictly FIFO? Those are good questions to ask! There’s no one-size-fits-all answer, but an important thing to realize is that these questions should be asked, if the Wait semantics are supported.

If we think about limits, the Prefer New semantics imply that the scheduling interval is also a hard limit. Conceptually, these are different things – you could imagine varying them independently if the latter was offered as a separate configuration knob.

Lastly, what are the fault models under which these semantics make sense?

• Prefer New: J1’s running time exceeded the scheduling interval because of some non-deterministic reason (e.g. a rate limit being hit). We are optimistic, so it’s possible that J2 will not hit the same issue. In other words, we expect the job to be successful again sooner rather than later.
• Wait: Same as above. Additionally, there is a non-functional requirement (or assumption!) that dropping jobs is not preferable.
• Prefer Old: Assume that J1 is not hung, so it will probably finish if given more time. You would still want to have a hard limit separate from the scheduling interval to prevent runaway resource usage. We are pessimistic, so we assume that J2’s running time will also exceed the scheduling interval. So it’s wisest to cancel J2, so that at least J1 has a chance to finish.

I just wanted to do a simple thing

To jog your memory on what we were trying to do:

• We wanted to run the same job with a fast path on weekdays (taking 2 hours) and a slow path on weekends (taking 7 hours).
• We had one configuration knob for the scheduling interval. We were thinking of setting it to 3 hours to get more up-to-date results on weekdays.
• We had a concurrency limit of 1 to avoid running multiple jobs at the same time.

Let’s try to see how such a configuration would fare on the weekend for the different semantics we discussed (for simplicity, assume that scheduling operations are instantaneous):

• Prefer New: When the 7 hour job would hit the 3 hour mark, it would be canceled. A new 7 hour job would be triggered, and canceled after 3 hours again. Essentially, we’d waste 48 hours of compute across 16 jobs, because none of these would ever finish.
• Wait: Over the 48 hours of the weekend, we’d trigger 16 jobs, with a total compute demand of 16×7 = 112 hours. If the queue limit was higher than (112-48)/7 = 9.15, we’d emerge out of the weekend with about 64 hours of pending work. However, the weekdays only offer (24×5×(3-2)/3) = 40 spare hours, so we wouldn’t finish draining this queue before the start of the subsequent weekend.
• Prefer Old: In 48 hours, we could almost finish seven 7 hour jobs, with ~1 hour of pending work. We would’ve canceled 9/16 jobs. We’d get back on schedule quickly on Monday since we only have 1 hour of extra work left from the weekend.

So it seems like Prefer Old is the best fit here. Yes, it might still seem counter-intuitive; we’ll get to that shortly.

The other extra fun thing here is that if you were using the Wait strategy, you can easily end up masking the problem without actually helping. Maybe you got paged on the weekend for the queue being non-empty for an extended period of time. So you decide to increase the concurrency. You pick a good round number like 4. The new runners start to chew through the jobs, great! Now, you have these expensive jobs running for 7 hours, but most of their results are only useful for ~3 hours on the weekend, before they get superseded. 😬

Coming back to the appropriateness of Prefer Old, let’s look again at what we wrote for the fault models:

Prefer New: [..] we expect the job to be successful again sooner rather than later.
Wait: Same as above. Additionally, there is a non-functional requirement (or assumption!) that dropping jobs is not preferable.
Prefer Old: [..] we assume that J2 itself will also exceed the scheduling interval. [..]

For the schedule that we were trying to have on the weekend (7 hour jobs with a 3 hour interval), it closely matches the assumptions of Prefer Old very well, but it directly goes against the assumptions of Prefer New and Wait.

Additionally, our weekend workload is totally fine with dropping jobs in case something is running. But the Wait semantics would make us pay dearly for something we did not care about, and would likely require more expensive solutions on top.

If the Prefer Old semantics are not offered, you can’t really emulate them using the two primitives of regular scheduling and limiting concurrency. For the workload above, if you had a richer primitive such as cron-like scheduling, you could split the work into two separate jobs – one which only runs on weekdays, and one which only runs on weekends.

Things could’ve been worse

Earlier, we were thinking about fault models. That was cute, right?

Imagine a separate system compared to the one we’ve been talking about. There’s a global concurrency limit to keep costs under control. You have a bunch of different jobs coming in, mostly kicked off in the background. Everything goes in a FIFO queue. Nobody put in a global size limit.

Every few months, a customer comes in and tries the feature related to the job queue. They kick off some new jobs manually and see the queue position as 100K+ (or even, 1M+). They’re like “uhh, this feature doesn’t seem to work?” They escalate to a support engineer. It becomes a ticket on your kanban board. An engineer goes in and clears the queue by running a DELETE manually, with some displeasure.

The new manager asks “what can we do to solve this problem in a systemic way.” You spend a few days analyzing the problem. You look at the running times. You look at the queue growth charts. Ah, it’s hard to predict how long these jobs take, or how many of them come along. Maybe we reduce the jobs created? You look at the database columns, and you realize you don’t actually have enough information to go on to properly check which jobs came from the same configuration. The flexibility of job creation makes it seem quite tricky to retrofit a notion of job de-duplication.

The manager comes back “can we have an 80-20 solution?” You add a hack which tries to pick an already queued job which looks similar-ish, and overwrite it in-place when doing the enqueue operation. The queue is now mostly bounded in size, because newly queued jobs overwrite old ones if present, but there are still some configuration knobs which a customer could tune and break the system out of equilibrium. You declare it “user error” to tweak those configuration knobs, and move on to the next ticket.

While writing this, I was reminded of apenwarr’s line from The log/event processing pipeline you can’t have:

(I suddenly feel a lot of pity for myself after reading that paragraph. I think I am more scars than person at this point.)

Just randomly, for no good reason whatsoever. ANYWAY.

Here’s some hope as life’d be too depressing otherwise

It seems possible to design systems while thinking explicitly about queues, limits and fault models – and thinking about these seems to lend itself to designs which degrade more gracefully, and handle unexpected situations better, especially if the design is made under pessimistic assumptions.

In particular, explicitly spelling these out is valuable as a system designer, because it lets potential consumers evaluate the system quickly for their own workloads even before they go through a detailed step-by-step simulation in their head about what would happen in different situations.

Conversely, when you’re using a new system that you haven’t used before, it’s useful to find out this information if it’s documented (or you have access to the code). That way, you can check how well the designer’s assumptions apply to (or are violated by) your intended workload.

In particular, when there are configuration files involved, especially those which tweak control flow, not just data that flows through, it’s valuable to pause for a bit to dig into the various error cases that are involved in the corresponding control loop, because configuration files tend to hide this information away.

For systems which lend themselves to simple models, you might even be able to model the different cases using just pen-and-paper, like we’ve done above, without the need for simulations. Doing so can help illustrate gaps in our own thinking, where it’s easy to gloss over what happens when things don’t go quite as swimmingly as we expect.

Developer experience, commonly known as DevEx, describes how an organization’s systems, workflows, tools, and culture affect developer productivity. A positive DevEx leads to tangible organizational benefits, including faster releases, increased innovation, and reduced technical debt. Measuring DevEx enables engineering management to quantify their team’s impact and understand where to direct improvement efforts.

While there are differing approaches to DevEx measurement, attempting to quantify it in terms of individual metrics is always a temptation. The widespread use of AI has only added to that temptation, with leaders measuring individual token consumption in addition to metrics like lines of code or PR count. But tracking what is easy to count can adversely impact DevEx, and the gap between individual metrics and developer productivity continues to widen. According to the 2025 JetBrains Developer Ecosystem survey, 66% of developers do not believe that current metrics reflect their contributions. Atlassian’s 2025 State of Developer Experience report found that 63% of developers do not believe leaders understand their pain points, a sentiment that increased significantly from 44% in 2024.

In this post, we’ll discuss how to avoid the five most common pitfalls that organizations fall into when measuring DevEx in the AI era:

• Measuring individual output instead of system health
• Relying on system metrics without perceptual data
• Equating AI adoption with efficiency
• Treating AI token usage as a productivity metric
• Measuring without developer buy-in

Measuring individual output instead of system health

Output metrics like lines of code, PR count, number of commits, and story points can provide valuable insight when analyzed at a team level, but undermine developer trust, incentivize gaming, and discourage collaboration when tracked at the individual level. Mentorship, code review, task planning, and knowledge sharing are all collaborative efforts that SPACE framework researchers have identified as “invisible” yet highly valuable work that benefits the entire organization. When individual output is tracked, developers may be incentivized to devote a disproportionate amount of time to the work that appears on a dashboard.

Track system health to improve DevEx outcomes

Goodhart’s law states, “When a measure becomes a target, it ceases to be a good measure.” For example, if you track the number of PRs per developer, they may split up commits to generate more PRs; if you track individual deployment frequency, they may deploy trivial changes. The metrics will improve without a parallel meaningful improvement in productivity.

Datadog engineering leadership has made it clear that the goal of measurement is never to evaluate individual performance. We track a variety of DevEx metrics, and team-level aggregation is the most granular that we use internally and surface in our product.

More than a decade of DORA research has shown that following development practices that improve system health, such as continuous integration, test automation, and fast feedback loops, also improve organizational performance. The 2025 DORA Report found that this remains true in the AI era: Teams with fast feedback loops and automated testing experience accelerated delivery when using AI, while teams with systemic issues see AI magnify their instability.

By tracking system-level and workflow-level metrics that reflect how code flows through the CI, time saved through automation, and whether services meet engineering standards, you can target improvement efforts that positively impact developer productivity.

Relying on system metrics without perceptual data

System data is precise but incomplete. A pipeline that looks healthy by every objective measure can still be a source of frustration if it interrupts developers at the wrong time or produces error output that is difficult to parse. System metrics can reveal how long code reviews take, but cannot inform you whether developers are receiving valuable feedback. Perceptual data provides context that makes the friction visible and, consequently, actionable.

Our internal H1 2026 Engineering Experience survey received over 2,400 comments. The quantitative scores revealed where friction was concentrated, while the comments revealed why. For example, many of our engineers reported that their primary method for understanding CI failures was copying error logs into an AI assistant for interpretation, since the tooling didn’t clearly surface the reason. We used that direct feedback to shape our Q2 objectives and key results (OKRs). Without perceptual data, we would not have known to prioritize an investment in failure attribution, a solution that directly relieved developer frustration.

How to gather DevEx feedback without survey fatigue

Surveying developers too frequently produces diminishing returns. We survey developers twice annually, and host regular office hours and “coffee chats” to give developers alternative channels to share feedback in small group settings. We’ve found these mechanisms to be a useful complement for engineers who may not want to document their sentiment in a survey or raise concerns directly to a manager.

Equating AI adoption with efficiency

Many organizations treat AI adoption as evidence that productivity is improving. Eficode, an organization that helps companies build and scale AI-native software safely, found that this is the most common misconception about AI ROI. After surveying over 270 organizations for their 2026 report titled “How Software Organizations are Moving from AI Pilots to AI Transformation,” they emphasized that AI adoption is only the beginning of a transformation, and for most organizations, AI is still nowhere near delivering any real productivity gains. Assuming AI tools are effective simply because developers are using them can lead organizations to believe that ongoing investment in infrastructure is unnecessary.

Why self-reported AI impact is unreliable

Self-reported AI impact is unreliable. Even when working in repositories they know well, developers tend to overestimate how much AI accelerates their workflows. METR, an independent nonprofit research institute that evaluates frontier AI models, conducted a randomized control trial to monitor the behavior of open source developers. When asked how AI had impacted their work, the developers estimated that AI tools accelerated their workflows by 20%. In reality, using AI tools had caused them to take 19% longer to complete their tasks, despite the fact that they had worked in the repositories for over 5 years.

If adoption is mandated rather than organic, it is a reflection of compliance. Stack Overflow’s 2025 Developer Survey found that while 84% of developers reported using AI tools, 46% actively distrusted the accuracy of AI’s output.

How to quantify AI’s impact on software delivery

Datadog treats AI adoption as a starting point as opposed to a north star goal. We ask perceptual data questions in our Engineering Experience survey to understand whether developers are using AI tools, understand their limitations, and feel confident prompting. Approximately 80% of our PRs are now AI-assisted, and 92% of our engineers report using AI coding tools daily. We are past the adoption barrier and supplement self-reported usage by instrumenting AI’s impact on the SDLC.

We analyze AI-assisted versus non-assisted PRs, comparing DORA and other software delivery performance metrics across both categories. Our analysis showed that AI-assisted PRs had a slightly longer change lead time, but a much higher concurrency overall. In our case, the data reveals that AI coding assistants act as a force multiplier, enabling developers to work on more changes simultaneously.

Our adoption telemetry data comes from an internal AI gateway that captures every interaction with coding assistants at the network layer, server side. Because attribution is logged at the gateway rather than in the developer’s IDE, it can’t be disabled or edited after the fact.

Treating AI token usage as a productivity metric

Using token consumption as a productivity signal has been normalized. Enterprise organizations have created token leaderboards where employees are ranked by token usage, and their leadership has been encouraged to view high consumption as a signal of developer efficiency. While tracking tokens isn’t wrong in and of itself, treating it as a proxy for productivity incentivizes gamification like tokenmaxxing, creates waste, and can even cause outages.

Adding token volume to performance reviews is a misaligned incentive that leads developers to optimize for the metric rather than the organizational goals. It leads developers to run larger, more frequent prompts, not taking into account whether output is useful. Developers who use AI selectively by reviewing output, editing suggestions, and declining unhelpful completions will appear as less productive even though their approach produces better results.

Token consumption is appropriate to track to manage AI tool costs and evaluate whether a more efficient model can produce equivalent output at lower spend.

Track delivery outcomes instead of token consumption

Instead of tracking token consumption to measure productivity, we analyze specific metrics that are surfaced from our AI instrumentation. Our AI Impact feature tracks metrics like PR throughput, change lead time, change failure rate, and recovery time for AI-assisted and non-AI-assisted PRs.

When AI adoption climbed 25 percentage points (pp) year-over-year from 2025 to 2026, we compared that with the simultaneous declines in CI reliability (-3 pp), test satisfaction (-4 pp), and PR review quality (-5 pp). The analysis enabled us to pinpoint how bottlenecks are shifting in the SDLC and what our platform team needs to invest in next.

Measuring without developer buy-in

Launching a measurement program without first consulting developers signals that metrics are being collected to evaluate them rather than improve their experience. When developers discover that they are being measured before being consulted, the signal lands as surveillance rather than support. Trust erodes immediately, and gamification follows.

Although we have a dedicated DevEx team, we believe that developers should remain highly involved in the ongoing efforts to improve DevEx for our entire organization. We host an “embed” program, where DevEx team members switch roles with a developer for an entire sprint or longer. The embed rotation program provides reciprocal benefits, enabling DevEx team members to experience system and workflow pain points firsthand, and giving developers the opportunity to work on an innovative DevEx project that alleviates friction for their peers across the organization.

Start measuring what matters to developers

The pitfalls in this post were shaped by an era where AI suggests code and a human decides what to keep, a reality that is already ending. Agentic code review, autonomous CI triage, and AI-driven test generation are transitioning from mere experiments into production workflows. When AI agents begin making decisions as opposed to suggestions, then the measurement question shifts from “Is AI helping my developers?” to “How do I evaluate work that no human performed?”

The principles in this post still hold in that environment. When the landscape changes and what needs to be measured expands, the organizations that avoided these pitfalls are better positioned to adapt as the role of the developer continues to evolve.

Full article content is not available for inline reading.

Read the original article →

Designing the Design Toolkit: the hidden design behind successful workshops

“Design as a tool for improving daily life and the appreciation of human existence.” — Jasper Morrison, Utilism vs. Uselessnism (2002)

Right after celebrating the Fourth of July with family and friends in the United States, the quiet days that follow have become one of my favorite moments of the summer for reading, reflecting, and writing.

After months of co-designing, co-facilitating, and co-developing participatory workshops and interviews, I found myself asking a simple question:

What is the most important design in a design workshop?

Surprisingly, the answer is often invisible. It is not the final concept, prototype, or presentation—it is the toolkit that makes meaningful collaboration possible.

Design researchers have long argued that the artifacts used in participatory design are not merely facilitation materials but active mediators of collaboration, learning, and knowledge creation (Sanders & Stappers, 2008).

Long before participants enter the room, designers are already planning and shaping how conversations unfold, how ideas are expressed, and how collaboration emerges. In many ways, designing a workshop begins with designing the toolkit.

As someone trained in both industrial design and electrical engineering, I have always enjoyed creating artifacts for experimentation. I am particularly interested in bringing tangibility into the design process—transforming abstract ideas into physical objects that invite people to think, make, and learn together.

During my time at IDEO and Continuum, I contributed to numerous build-to-think and make-to-learn projects, including the Ford 360 user experience project, the Fotile kitchen hood project, and the GAP retail experience project.

Across these diverse contexts, toolkits were never simply facilitation materials or project deliverables. They became essential vehicles for exploration, communication, and discovery, enabling teams to prototype ideas and learn through making (Buchenau & Fulton Suri, 2000).

Earlier this summer in June, I facilitated a two-day Design for Longevity (D4L) workshop with design students from Shih Chien University in Taiwan and Musashino Art University (MAU) in Japan.

Forty students worked in eight interdisciplinary teams using the D4L Toolkit—a set of 18 design cards—as a shared research artifact that facilitated conversations among facilitators, students from different cultural and disciplinary backgrounds, and interview participants.

Guided by the D4L Toolkit, students conducted campus observations and reflected on what they saw, heard, and experienced while exploring how universities could become more longevity-friendly environments.

Another example comes from my doctoral research at the Massachusetts Institute of Technology (MIT). Together with the MIT AgeLab, I co-designed and co-developed the Longevity Planning Blocks (LPBs)—a tangible boundary object that complemented a longevity planning service model.

Unlike the two-dimensional D4L Toolkit, the LPBs consist of twelve weighted acrylic cubes designed to encourage hands-on interaction.

Rather than creating another set of cards or blocks, the goal was to cultivate an engaging environment where participants could collaboratively reframe, explore, and articulate the complex socio-technical challenges of longevity. Using the LPBs, I conducted qualitative research with more than 90 participants to investigate how tangible artifacts can support retirement planning and conversations about later life.

Through both industry practice and academic research, I have come to realize that design toolkits serve multiple roles throughout the design process. During participatory research, they function as engagement tools that encourage storytelling, co-creation, and reflection. Within research teams, they become simulation and synthesis tools that help externalize ideas, communicate diverse perspectives, and support collaborative sense-making.

More importantly, they reveal that a toolkit is never just a collection of cards, blocks, or worksheets. It is itself a carefully designed experience.

In this article, I explore three essential roles that design toolkits play in design research and practice. Why should designers invest time in creating them? How can thoughtfully designed toolkits contribute to more evidence-driven and human-centered solutions for complex societal challenges?

I believe the answer can be understood through three complementary roles:

1. Design toolkits as boundary objects — facilitating participation and collaboration.
2. Design toolkits as research infrastructure — documenting thinking and making throughout the design process.
3. Design toolkits as synthesis artifacts — crystallizing ideas into shared understanding.

1. Design toolkits as boundary objects

Creating shared spaces for participation

Whether they take the form of tangible artifacts, such as cards, cubes, or blocks, or digital experiences, such as animations and interactive platforms, design toolkits can function as boundary objects (Star & Griesemer, 1989; Carlile, 2002) that create a shared space enabling people from different backgrounds to collaborate despite having different experiences, vocabularies, and perspectives.

As boundary objects, they provide participants with a shared language for expressing experiences, communicating ideas, and building conversations together.

When developing the Longevity Planning Blocks (LPBs) with the MIT AgeLab, my intention was to create provocative prompts rather than instructional tools. The tangible cubes invited participants to touch, rotate, arrange, and play with different concepts, transforming abstract discussions about longevity and financial planning into engaging and personal conversations.

Instead of simply answering interview questions, participants were encouraged to think through making, interaction, and storytelling.

Another benefit of viewing LPBs, and other tangible design artifacts, as boundary objects is that they create an exploratory space where participants can experiment without worrying about giving the “right” answer.

Unlike traditional surveys or structured interviews, where participants may feel pressure to respond correctly, a design toolkit encourages exploration, iteration, and even failure. Much like the design process itself, participants move through cycles of divergence and convergence, where uncertainty becomes an opportunity for learning rather than something to avoid.

2. Design toolkits as research infrastructure

Making thinking visible

One of the most valuable aspects of designing a toolkit is that it naturally documents the evolution of ideas. Over time, I have found that the toolkit gradually becomes embedded in the research process itself.

Rather than functioning merely as research materials, toolkits become part of the research infrastructure itself, supporting the iterative generation, documentation, and interpretation of knowledge throughout the design process (Gaver, 2012).

This perspective also aligns with Research through Design (RtD) method, an approach introduced by scholar and educator Christopher Frayling (1993), which positions the act of designing as a legitimate mode of inquiry.

From this perspective, the design toolkit is not simply an output of research but also a means of generating knowledge throughout the design process.

As the project evolves, designers and researchers continually refine not only the toolkit’s appearance but also its intended function. While the research question may remain constant, the toolkit continually evolves alongside the project.

For example, is the toolkit intended to explain abstract concepts in the early stage of design workshops? Does it help participants tell stories in the later stage of design process? Is it designed to encourage dialogue, reflection, or co-creation across the entire experiment?

Answering these questions requires designers and researchers to clarify both the goals of the study and the role that each artifact plays within it. The purpose of a toolkit is rarely fixed. Instead, it evolves alongside the project, adapting to new insights, changing research questions, and practical constraints such as time, budget, and participant needs.

Designing a toolkit is also a way of demonstrating respect for participants. A thoughtfully crafted toolkit signals that researchers have carefully considered the overall participant experience rather than treating participants merely as sources of data.

Every detail, from the visual language and material choices to the timing of activities, contributes to the quality of engagement.

One accessible example is the use of Post-it Notes in design thinking workshops. Post-it Notes, Sharpies, posters, Play-Doh, and even simple sheets of paper together represent a minimal yet highly effective design toolkit.

Because these materials feel so ordinary, we often overlook the intentional design behind them.

Before placing these materials on the table, we should ask ourselves: Should this toolkit serve as an icebreaker? Should it support collaborative mapping? Or should it become an artifact for “serious play” (Schrage, 2000) that empowers participants to generate, test, and evaluate ideas together?

These seemingly small design decisions fundamentally shape both the research experience and its outcomes.

3. Design toolkits as synthesis artifacts

Turning ideas into tangible artifacts

Perhaps the reason I enjoy designing toolkits most is that they force me to clarify my own thinking.

Designing a toolkit requires researchers to synthesize large amounts of qualitative insight into prompts, visuals, and interactions that support collective sense-making (Kolko, 2010; Sanders & Stappers, 2012).

Designing within the constraints of space, content, production costs, time, and participants’ attention requires difficult decisions about what truly matters.

Every word, graphic, prompt, and interaction must justify its existence.

The D4L Cards became much more than communication devices; they evolved into tangible syntheses of the research itself. Filled with researchers’ comments, sketches, and annotations, the D4L Cards documented the iterative refinement of content, visual language, and sequencing throughout the design process.

While aesthetics certainly matters, an effective design toolkit is never designed for appearance alone. It balances beauty with usability, production constraints with research objectives, and creativity with clarity.

In many ways, designing a toolkit mirrors the broader process of design research: making the invisible visible and transforming complex ideas into tangible experiences that people can understand, discuss, critique, and build upon together.

Designing the character of collaboration

Designing a successful workshop is less about designing the final concept than designing the conditions that enable people to think, create, and learn together.

Throughout this article, I have argued that design toolkits play three essential roles in the design process: they facilitate participation by serving as boundary objects, document thinking and making as part of the research infrastructure, and crystallize ideas by synthesizing complex concepts into tangible artifacts.

Ultimately, I have come to see design toolkits not as supporting materials but as carefully designed experiences. They shape participation, capture collective thinking, and transform abstract ideas into shared understanding.

In The Unimportance of Form and Other Arguments, product and furniture designer Jasper Morrison (2026) introduces the concept of “Objectality”—a way of describing the character an object embodies.

He argues that Objectality is the equivalent of personality: “It’s the character and spirit of things. It’s what attracts us to, or repels us from, an object” (p. 139).

Rather than arising from a single feature, objectality emerges from the balance of many variables, including form and void, materials and the absence of materials, discretion and indiscretion, and function and expression.

Morrison’s concept offers a valuable lens for thinking about design toolkits. Like any well-designed object, a toolkit possesses its own character. Its objectality influences how facilitators guide discussions, how participants engage with one another, how stakeholders contribute, and ultimately how the entire workshop unfolds.

Designing a toolkit, therefore, is not simply about producing a collection of cards or artifacts—it is about shaping the character of collaboration itself.

Viewed through the lens of participatory design and Research through Design (RtD), design toolkits are not merely supporting materials but epistemic artifacts that enable collaboration, documentation, and knowledge production. By designing better toolkits, we create better conversations, stronger collaboration, and ultimately more meaningful design outcomes.

Selected References:

• Buchenau, M., & Fulton Suri, J. (2000). Experience Prototyping.
• Carlile, P. R. (2002). A Pragmatic View of Knowledge and Boundaries.
• Frayling, C. (1993). Research in Art and Design.
• Gaver, W. (2012). What Should We Expect from Research Through Design?
• Kolko, J. (2010). Sensemaking and Framing.
• Morrison, J. (2026). The Unimportance of Form and Other Arguments.
• Sanders, E. B.-N., & Stappers, P. J. (2008). Co-creation and the New Landscapes of Design.
• Sanders, E. B.-N., & Stappers, P. J. (2012). Convivial Toolbox.
• Star, S. L., & Griesemer, J. R. (1989). Institutional Ecology, ‘Translations’ and Boundary Objects.
• Schrage, M. (2000). Serious Play: How the World’s Best Companies Simulate to Innovate.

How Vidonary Scaled a Production-Ready Video Editor to Thousands of Users

Vidonary already had strong momentum, but scaling their editing infrastructure internally would have slowed product growth. RVE gave them a production-ready foundation built for performance, scale, and rapid iteration.

Search for anything and get an interactive app as your answer — trip planners, recipe finders, mood boards, and more.

The strongest visual concepts don’t start in Figma. They start with the right questions. Explore the pre-concept phase of brand identity design, where teams research brand context, uncover hidden assumptions with stakeholders, and turn shared direction into a visual foundation before a single concept is created.

When a branding project fails, it usually happens long before the logo stage: in the strategy phase, when words like “modern,” “trustworthy,” “premium,” “friendly,” and “disruptive” are left undefined. The result is a gap between what the brand is supposed to communicate and what the designer is expected to create. This is the space I like to call the “pre-concept” phase.

At the beginning of a project, designers usually receive many inputs: a brief, a few stakeholder conversations, competitor references, maybe a moodboard or a list of adjectives. From there, they are expected to create visual concepts that feel right. But “right” is difficult to judge when the team has not agreed on what the brand is supposed to communicate in the first place.

As an example, a health tech company we worked with said they wanted to look modern, trustworthy, and disruptive. At first, “disruptive” sounded like a push toward something bold and unconventional. But as we talked, it became clear that disruption, for them, still had to feel credible inside a conservative healthcare environment. Their clients were large government medical institutions. A brand that felt too rebellious, experimental, or visually loud would not create the right kind of trust.

In other words, their version of “disruptive” looked more traditional than the word suggested.

The problem was not that the client used the wrong language. The problem was that the language was too broad to guide design decisions. Before a designer can turn strategy into a visual concept, those words need to become more specific. What kind of modern? Trustworthy in what way? Disruptive compared to whom? And how far can the brand move away from category expectations before it starts to feel wrong for its audience?

This article is about that pre-concept phase: the work that happens after the kickoff but before the first visual direction. While the broader brand identity process for digital products includes strategy, concepts, implementation, and the assets a product team needs to build consistently, this article focuses on the earlier work that makes the first concept possible: researching the brand context, uncovering hidden assumptions with stakeholders, and turning shared direction into a visual foundation. Rather, a practical bridge between what the brand needs to mean and how it might begin to look.

The first place to build that bridge is the brand workshop, where broad discovery needs to become a clearer understanding of the brand context.

Stage 1: Research The Brand Context

A brand workshop will naturally cover the standard discovery topics: the business, its goals, the product or service, the competitive landscape, and the target audience. This article will not try to list every question a designer should ask in that workshop. For readers who want a broader starting point, we prepared a Brand Workshop Toolkit: Questions and Exercises, a FigJam framework we use in our studio to structure discovery conversations.

Here, I want to focus on a smaller set of questions that are easy to skip but extremely useful before visual work begins. These questions are less about collecting facts and more about clarifying perception. They help the team understand what the brand needs to make people believe, where it needs to feel credible, and which category assumptions it should follow or challenge.

Perception sits at the center of brand discovery because the brand is shaped in someone else’s mind.

A brand is a person’s gut feeling about a product, service, or company.
— Marty Neumeier, The Brand Gap

If the brand ultimately lives in someone else’s perception, the workshop has to clarify what perception the team is trying to create.

The perception questions I focus on are:

• What should people believe about the company after seeing the brand for the first time?
• What would make the brand feel credible in this category?
• If the brand were a person in the room, how would they speak?
• What do customers currently misunderstand about the company, product, or category?
• Where does the brand need to fit the category, and where does it need to break from it?

These questions help reveal the assumptions behind people’s opinions, instead of simply adding more opinions to the room. The questions matter because brand attributes often sound aligned before they are actually understood. A stakeholder may say the brand should feel “premium,” and everyone may nod. But one person may mean refined and editorial. Another may mean expensive and exclusive. Another may mean clean, quiet, and minimal. The word sounds shared, but it can lead to three completely different visual systems.

For instance, in the health tech project mentioned earlier, the client described the desired brand as “disruptive.” In many categories, that might suggest something bold, loud, or unconventional. But their audience was large government medical institutions, so disruption had to be expressed through clarity, efficiency, and confidence rather than rebellion. If we had taken the word at face value, the visual direction could easily have moved too far from what their audience would trust.

In another project, a fintech team wanted the brand to feel “bold” without losing credibility. That word created useful tension. The word bold could mean bright colors, oversized typography, and a highly expressive system. But in a financial category, it also had to carry signals of security, control, and competence. The question was not whether the brand should be bold, but what kind of boldness would still feel trustworthy.

When the team can define what these attributes mean in context, the designer is no longer working from broad adjectives. They are working from a clearer design problem.

Stage 2: Reveal Hidden Assumptions With Stakeholders

Strategically selected questions can uncover part of the verbal layer, but words alone are rarely enough. To move from language into visual direction, it helps to incorporate exercises that make stakeholders think through images, associations, and relative perception.

The following two exercises help translate what stakeholders say about the brand into material that can later inform look and feel, design principles, and concept development.

This is also where stakeholder participation becomes important. When clients only receive a strategy presentation, they can stay passive. They may agree in the meeting without noticing the assumptions they are bringing into the process. But when they have to place a competitor on a map, choose an image, or explain why a certain reference feels credible, they become active participants. Their attitudes, beliefs, and disagreements become visible before they have a chance to derail the first concept review.

I usually start by looking outward at the category, then inward at the brand itself.

Exercise 1: Competitor Perception Mapping

Before the workshop, collect screenshots of competitor brands, websites, product interfaces, social visuals, or other visible brand touchpoints. During the workshop, ask the client team to place those competitors on a simple two-axis map.

This exercise is not about deciding which competitors have “good” or “bad” design. It is about understanding how the client reads the category: what feels credible, what feels generic, what feels too conservative, what feels too experimental, and where there may be an open visual territory for the brand.

The axes should be chosen based on the tension the brand needs to solve. For example:

• Traditional to progressive.
• Corporate to human.
• Understated to bold.
• Accessible to exclusive.

For a health tech company that wants to feel innovative but works with conservative medical institutions, the map might use traditional to progressive and corporate to human. For a fintech brand that wants to stand out without losing trust, it might use understated to bold and accessible to exclusive.

The most useful part of this exercise is often not the final map, but the disagreement it creates. One stakeholder may read a competitor as progressive, while another sees it as generic. One may see a brand as premium, while another reads it as cold. These disagreements reveal how different people define trust, innovation, credibility, and differentiation. That is exactly the kind of ambiguity that needs to be resolved before design begins.

Exercise 2: Visual Brand Driver

After the team has discussed the category, I like to turn the conversation inward. One exercise we use for this is called Visual Brand Driver. Each stakeholder is asked to choose images for a set of unrelated categories: transport, typeface, activity, furniture, mood, object, animal, architecture, and drink.

The instruction is important: the images should not represent the person’s personal taste. They should represent the company.

For example, if the company were a type of transport, what would it be? A quiet electric car, a high-speed train, a private jet, a bicycle, a delivery van? If it were a piece of furniture, would it be a soft lounge chair, a precise modular desk, or a heavy boardroom table?

After choosing the images, each person adds four or five adjectives to explain why they selected them. This part matters more than the image itself. The same object can mean different things to different people. A train might suggest speed, structure, reliability, mass accessibility, or a fixed route. A lounge chair might suggest comfort, calm, informality, or lack of urgency.

The exercise helps create a deeper layer of brand perception. Instead of asking people to describe the company directly, it asks them to think through metaphor and association. Patterns and contradictions become visible. One stakeholder may see the brand as refined and calm, another as energetic and experimental. One may describe the company as precise and structured, another as warm and flexible.

Those differences are not a problem. They are useful materials. They show what needs to be clarified before the visual concept phase begins.

This exercise is also helpful because it separates brand perception from aesthetic preference. A stakeholder may personally like a certain image, but if it does not describe the company, it should not be part of the exercise. That distinction is important throughout the branding process. The question is not “Do we like this?” but “Does this express the right thing about the brand?”

Stage 3: Turn Shared Direction Into A Visual Foundation

Once the workshop has revealed the main assumptions, the next client meeting can turn that shared understanding into a visual foundation. This is still not the first identity concept. It is a working layer between strategy and design, where the client can react to perception, visual principles, and early asset directions before the designer invests time in full concepts.

We usually structure this meeting around three connected layers:

1. Look and feel: What should the brand feel like?
2. Design code: How can key brand ideas become visual principles?
3. Branding assets: What early choices should guide typography, color, logo direction, imagery, and illustration?

Together, these layers move the conversation from perception to practical design boundaries.

Look And Feel

Look and feel boards are not collections of visuals the team likes. They are perception boards. The designer collects references based on the workshop: desired perception, category tension, competitor codes, stakeholder disagreements, and brand character.

If the brand needs to feel trustworthy, modern, and human, the board should help the team discuss what kind of trust, modernity, and humanity are appropriate. Is the brand calm and institutional, or warm and accessible? Is it progressive through precision, or through a more expressive editorial tone?

The point is to let the client respond to perception before reacting to a logo, color palette, or finished visual system.

Design Code

Design code makes the direction more specific by translating key brand ideas into visual principles.

For a parenting app in Germany, personalized support for your unique journey might become organic shapes, handwritten lines, and softer compositions. Parenting is messy and magical might become soft gradients, layered imagery, and playful irregularity. Research-backed support for real life might introduce doctor calls, data snapshots, infographics, and editorial layouts that make the brand feel credible.

The team is not choosing the final graphic expression here. It is testing whether the visual metaphors make sense before concept design begins.

Brand Assets

The final layer brings the conversation down to the building blocks of identity: typography, color, logo style, photography, illustration, and graphic language.

At this stage, the team can discuss questions such as:

• Should the typography feel editorial, technical, warm, precise, expressive, or restrained?
• Should the color palette follow category codes or create contrast?
• Should the logo be a quiet typographic mark, a flexible symbol, or a more expressive character?
• Should photography feel documentary, polished, intimate, product-led, everyday, or aspirational?
• Should illustration explain complex ideas, add warmth, or become a distinctive brand language?

This gives the designer boundaries without making the final identity predictable. The next step is still concept design, but the team is no longer starting from vague adjectives or private expectations.

Pre-Concept Checklist

Before moving into the first concept, it helps to pause and check whether the team has enough shared direction. The checklist is not meant to make every decision in advance. It is meant to make sure the designer is not starting from vague words, hidden assumptions, or unresolved disagreements.

Before creating the first concept, check whether the team has:

• A clear understanding of what the brand needs to communicate.
• A defined brand character.
• A shared sense of what that character means and what it does not mean.
• Visual references tied to perception, not taste.
• Key brand ideas translated into visual principles.
• Early direction for typography, color, imagery, and graphic language.
• Documented areas of agreement and disagreement.
• A clear sense of which concept directions would be wrong before designing them.

This last point is especially useful. A strong pre-concept phase not only tells the designer what to explore. It also clarifies what to avoid: directions that would be too expected, too cold, too playful, too conservative, too loud, too generic, or too far from what the audience can trust.

When the team can name those boundaries, the first concept becomes easier to evaluate. The conversation shifts from “I like it” or “I do not like it” to “Does this express the brand we agreed on?”

The First Concept Should Not Be A Guess

The first concept should not feel like a guess or a surprise reveal. It should feel like the next step in a direction the team already understands.

That does not mean removing intuition, experimentation, or creative risk from the branding process. It means giving those things a sharper problem to solve. When the team has clarified the brand character, tested visual perception, translated ideas into design principles, and discussed the early building blocks of the identity, the designer can explore with more confidence.

Pre-concept work does not need to make the final identity predictable. It needs to make the conversation around it more meaningful. Instead of asking whether the work matches someone’s private expectation, the team can ask a better question: Does this visual direction express what the brand needs to become?

DeepSeek reportedly in talks to raise $1.5B, then IPO

DeepSeek, the Chinese large language model developer, is preparing for a 2027 IPO debut, but it could come as early as the end of this year as it also looks to raise around $1.5 billion in new funds at about a $71 billion valuation, Bloomberg reports. The news comes after the company raised $7 billion in funds just a month ago at around a $50 billion valuation in its first-ever outside funding round.

The China-based startup, founded in 2023, made headlines early last year after releasing AI technology that was both more efficient and more cost-effective than U.S. model makers. It has since grown exponentially in popularity. In June, it accounted for nearly 23% of all the tens of trillions of tokens processed by enterprise-focused AI gateway Vercel, the company reports. This is compared to Anthropic taking 32% of tokens.

DeepSeek continues to show how Chinese open source models perform within a few breaths of top U.S. AI labs, despite U.S. export controls on chips. DeepSeek’s cloud service runs on chips made by the Chinese company Huawei Technologies. Investors in DeepSeek include Tencent and Beijing’s National Artificial Intelligence Industry Investment Fund, per Bloomberg.

DeepSeek could not be reached for comment.

Kalshi has created a tool that plots the future price of computing power so users can develop a sense of where the price to rent GPUs is headed. It will use prediction markets to build the forward curve. Forward curves are used to plot expected future interest rates and moves by central banks. Compute is becoming a commodity in its own right as demand grows. Kalshi's forward curve is based on weekly and monthly event contracts related to compute costs, and it goes as far as a year into the future.

The Great Flattening

For the engineer who became the whole engineering org. The models woke up. Something happened in the last year that most people haven't fully processed. The models got superhuman at programming, not...

Elon Musk has acquired APR Energy, a Jacksonville-based company that operates a fleet of mobile and diesel turbines generating more than 1 GW of capacity.

OpenAI outlined five practices for managing enterprise AI investments, emphasizing useful work per dollar rather than token prices alone.

Eärendil-1 is a demonstration 'space mirror' satellite with a highly reflective 60-foot thin-film mirror. Built by Reflect Orbital, the satellite will validate technologies that will eventually be used to sell sunlight on demand. The technology is designed to illuminate five- to six-kilometer zones for authorized commercial, agricultural, or emergency use. Reflect Orbital is aiming for a constellation of up to 50,000 orbiting mirrors by 2035.

The Great Flattening

For the engineer who became the whole engineering org. The models woke up. Something happened in the last year that most people haven't fully processed. The models got superhuman at programming, not...

Have you heard? Apple is suing OpenAI. While I think my initial quick reaction after the Friday news dump remains correct at the highest level, having now read the full 40-page document, there's also – as expected – clearly a bit more nuance to the situation. Namely, while Apple frames OpenAI – or at least its fledgling hardware division – as "rotten to its core" (interesting terminology!), they really only have a case against two and maybe three individuals. But they also clearly believe that if this case goes to trial, they will have a case against a lot more.

That is to say, it's a fairly standard legal document. It's well-written, narratively, and fairly concise, but it still is very much making a one-sided argument in grandiose terms. That's the job to be done here. But in reading it, augmented by some of the reporting around the suit, you can start to see the contours of reality.

With the usual caveat that I'm not a lawyer and the allegations still remain just that, allegations, to which the other side has not responded beyond boilerplate ("We have no interest in other companies' trade secrets."), here's my current read of the situation...

First and foremost, again, if the allegations are true, Chang Liu, the former Senior System Electrical Engineer at Apple and now a Member of Technical Staff at OpenAI, is in a lot of trouble. At the very least, it seems safe to assume that he won't be working for OpenAI any longer. The real question would seem to be what kind of penalty he would face. The parallels to the Anthony Levandowski situation after he left Google for Uber have been drawn. Obviously, he was far more senior and high profile of a person than Liu is, still, the fact that he was sentenced to prison (before being pardoned by President Trump) for his actions is, well, not a great precedent for Liu. Again, they are just allegations at the moment, but Apple also would seem to have the receipts – many of them – because of the use of Apple-owned hardware for many actions.

It is interesting that Apple is not suing Yu-Ting “Alyssa” Peng, who is named in the suit as a co-conspirator with Liu while she was still employed at Apple, before she also subsequently went to work at OpenAI. Is it possible she's cooperating or has cooperated with Apple in this investigation? Or that they hope she will in any would-be trial? Pure speculation, of course, but an interesting wrinkle given the receipts Apple also seemingly has there.

As for Tang Tan, the other named defendant here, Apple's case feels more nebulous. It seems pretty obvious that they weren't looking into his actions until after they came upon the Liu situation and subsequently found a few things, likely in scouring their systems for Liu-related information, that they felt they could use to bring a case against him as well. Including, most notably, allegedly emailing himself partner information before he left Apple and apparently asking would-be recruits to bring proprietary and potentially confidential information – including prototype hardware?! – to "show and tells".

This is not a great look under any circumstance, but perhaps especially not when you've already been accused of something similar by another company!

More murky would seem to be the endless talk of using Apple's internal codenames for projects to lure both recruits and partners into divulging confidential information – as if the codename was some sort of password that unlocks such details.

Anyway, the fact that Tan was an extremely high profile vice president at Apple and is now the most important person on OpenAI's hardware side (since Jony Ive is not technically a full-time employee) makes him both an obvious and key target here. Even if these allegations are found to be untrue or embellished, can he reasonably stay at OpenAI now? And perhaps that's the real outcome Apple is looking for here, as they clearly frame him as the ringleader of the 400-plus people who have come over to OpenAI from Apple.

Cut off the head of the snake and... chill the body to ensure the snake stops growing.

Speaking of, the sheer number of people who have moved from Apple to OpenAI would seemingly help make Apple's case here. Would a jury buy that so many people leaving from one company to another wasn't a coordinated effort? That itself wouldn't be illegal – thanks California for no non-competes/non-solicitation rules – but how/why those people came over with regard to IP and trade secrets would obviously be at play here. I mean, that's more or less the entire case!

And of course, the true leader of that movement is undoubtedly the aforementioned Ive in the eyes of many. Given the history of Ive and Apple, no matter the tensions, it's simply hard to imagine them ever going after their former – quite literal – knight. The optics of it alone would be hugely damaging to both brands. At the same time, it would be hard to believe that Ive would do anything so blatant to try to hurt Apple. Sure, he may want to compete to combat some of what he feels like he wrought with the iPhone, but it's just hard to see him doing something as nefarious as knowingly taking or directing others to effectively steal from Apple. Maybe that's naive, but again, Ive is not even mentioned in the suit.

Tan, on the other hand, perhaps had a reputation for "flying too close to the sun" while at Apple, as Bloomberg's Mark Gurman is reporting around the lawsuit. Perhaps even more intriguing is the notion that some felt he should have gotten the head of hardware role that John Ternus ultimately landed which, of course, has now vaulted him into the CEO-in-waiting role. So yeah, that's an interesting rivalry dynamic here!

As for timing, it would seem sort of wild that Apple knew about Liu having some level of access to what they viewed as their information in February 2026 (a couple weeks after his departure to start at OpenAI) but didn't bring about this lawsuit until nearly six months later. While they note that they reached out to OpenAI about a potential issue (and never heard back), it's not clear who at OpenAI they reached out to (nor is it clear who at Apple reached out). Was it simply to Liu himself or someone else? Was it a low-level "heads up" ping between IT departments or something that was elevated much higher? This may remain unclear until/if there's actual discovery.

But again, the fact that Apple didn't bring the lawsuit immediately suggests that either they didn't view it as a big deal at the time (perhaps they didn't know the full scope) or that they felt the need to build a case. To that end, Apple's statement to CNBC that "Recently, significant evidence has emerged..." could go either way.

It may be a bit too conspiratorial to wonder if Apple waited until the OpenAI IPO preparations were in process and/or the first hardware product development was far enough along for the timing here. But I mean, there's certainly a world in which these allegations sidetrack one or both things – if not outright torpedo them.

To that end, OpenAI's best path may be to figure out if there's a way to get Apple to settle here quickly. And that may be tough. While they did eventually drop their lawsuit against Gerard Williams III, the former employee who went on to start Nuvia to compete with Apple Silicon, they did so after three years. And they also seemingly didn't have the case that they do at least against Liu here. And again, the real key to that may not be Liu himself here, but unlocking a discovery process that unearths who-knows-what-else. If nothing else, it would certainly unearth what OpenAI is actually building hardware-wise!

Then again, Apple undoubtedly already knows that. After all, OpenAI is seemingly using some of the same suppliers per the lawsuit! And perhaps even some of the same materials, the proprietary nature of one in particular is sort of humorously focused in on in the suit – a "trade secret metal-finishing technique" that OpenAI allegedly tricked one of Apple's suppliers into doing for them!

But there, what Apple really might want to know about is if/when OpenAI intends to build a phone – or phone-like device. And if, as reported, they are, perhaps with those 400+ people who worked on the most popular consumer electronics device in history while at Apple, well, there may be a whole other can of worms there. Again, depending on what any discovery would unearth.

Sam Altman, of course, is no stranger to such discovery, but can he really sit through more depositions with more of his emails and text messages shown to the world casting him in an embarrassing (or worse) light? It just depends, I guess! The extent to which he's involved in any of the above – and clearly he's been front and center with OpenAI's hardware efforts alongside Ive – could be the latest in a string of not great situations to be in, to put it mildly.

It's also, of course, the latest not great situation for OpenAI itself to be in.

Regardless, if Apple really does intend to fully go through with this trial (remember that they'd be subject to discovery as well, something the famously secretive company has not historically liked in the past either), it presumably wouldn't happen until sometime next year at the earliest, and perhaps even later. Though hearings around injunctions Apple is requesting would happen far sooner. And all of that paints a picture where OpenAI may not be able to launch said hardware on their intended roadmap of later this year or early next.

Might that suggest that Apple is actually worried about what OpenAI intends to launch here? I mean, maybe! Again, they have 400+ of their former people working on it. But at the very least, they simply must view it as strategic to slow-down a would-be competitor. Apple would never say that out loud, of course. But come on. Does Cupertino want to compete against a new Jony Ive-designed product in the market? If nothing else, again, it's a bad look for them, optically!

That isn't a reason to launch such a lawsuit, but OpenAI gave them a reason! 400+ of them actually! And while it may or may not be just one or two employees acting on their own, the (now widely reported) fact that OpenAI was said to be considering their own lawsuit against Apple around the failure of their ChatGPT/Siri partnership could not have helped matters! Again, that was apparently happening in between Apple alerting OpenAI about a potential breach and this lawsuit being filed. That's why I said at the time that it was probably fairly stupid for OpenAI to poke the bear. But they did, and now the bear has woken up and is pissed off!

So again, upon full reading of the lawsuit, the nuance seems more clear but there are also some real remaining questions. Questions which only the discovery process and/or the actual trial would uncover. There are a least a half dozen reasons why OpenAI would seemingly want/need to settle such a case ahead of such a trial, but it certainly doesn't seem like Apple intends to do that right now! At the very least, it's going to bog OpenAI down for the next several months – and potentially years – and cast a shadow over the hardware side of the house.

Even if all the allegations are unfounded, this uncertainty will undoubtedly make some would-be partners question any allegiances. And it may send OpenAI back to the literal drawing board to ensure any hardware isn't touching anything close to IP that Apple controls.

So yeah, none of that seems great for OpenAI and their hardware prospects. And that's not great because it's perhaps the key differentiator they were hoping to have against the other frontier labs. Maybe that forces them to storm ahead anyway, at which point those injunction hearings will be awfully important...

It remains just wild that it has come to this. Just two years ago, Apple was using their biggest stage to tout ChatGPT and the partnership with OpenAI. Now it's all lawsuits, allegations, and name-calling. Rotten, indeed.

Update July 14, 2026: Bloomberg's Mark Gurman is reporting that despite the lawsuit, OpenAI intends to move forward with their first device – at least for now. Again, let's see what happens with any injunctions...

Update July 15, 2026: But their emails...

And their hardware...

Last month, Mark Zuckerberg announced a surprising leadership change in WhatsApp. Will Cathcart, who led WhatsApp since 2019, was replaced by Kunal Shah, an India-based serial entrepreneur. Just before joining WhatsApp, Shah was running CRED, an Indian fintech platform that rewards members with a high credit score for timely credit card bill payments and financial management. Moreover, while hiring Shah to lead WhatsApp, Meta also invested $900 million for a 20% stake on CRED.

Meta has historically promoted from within: the leaders of Facebook, Instagram, and Reality Labs are all long-time Meta veterans, making an external hire with no prior Meta experience something of a new development. Bringing in an outsider for this specific seat suggests Meta wanted a different skill set than its bench offered.

A Bloomberg piece mentioned that Chris Cox, Meta’s chief product officer, had been contacting entrepreneurs and investors in countries where WhatsApp is central (e.g. India, Brazil, Mexico etc.) to get perspective on how the app should evolve. Cox reached out to Shah for advice on what qualities the next WhatsApp leader needed, and concluded the person giving the advice was, in fact, the right person to lead the app.

Given the somewhat surprising nature of this hire, I was curious to learn more about Kunal Shah and listened to a couple of his podcasts. Since there is a decent amount of overlap among the ideas discussed in these podcasts, you can just pick one if you want to get a taste of Shah’s philosophy. After listening to these podcasts, I found him to be quite a compelling character. I guess I’m not surprised why Cox felt compelled to hire him.

One of Shah’s signature product playbook was “Delta-4 framework” which he discussed in both podcasts. Let me quote the specific bit discussing this framework from Lenny’s podcast:

Kunal Shah

it’s called the Delta 4 framework, but I think it’s actually quite simple. If you think about it, a lot of people say that your product has to be 10x better and it’s not very measurable. You don’t know if you are 10x better or not unless you’re delusional.

And the trigger for me was actually, I’m the unusual tech founder in India. I’m the only humanities/philosophy major founder in India who’s got into tech. And I often wondered if most people who were my peers, or people who were ahead of me, were significantly smarter academically or otherwise.

And why did I become successful with my first startup, Freecharge, which I exited in 2015 for nearly $450 million? And I was like, “What would make this happen?” Because I would not qualify into this super league of really top IIT rankers that exist in India.

And that got me onto this philosophical quest to find out what makes things successful. So the simple framework is, an example I give often is that, imagine the old way of taking a cab ride and an Uber.

And if I asked you to give me the score of efficiency on Uber and let’s say getting the old cab, what would you say, Lenny? I’m curious. Out of 10?

Lenny Rachitsky

Yeah, give a cab three and then Uber like a nine. Yeah.

Kunal Shah

So every time you see that the product efficiency delta is greater than or equal to four, three things happen. It is irreversible. Second is that you have a very high tolerance for it to fail. If Uber fails a little bit, will you say, “Oh my God, I’m going to really stop using it?”

And the third thing is what I call the UBP, ‘Unique Brag-worthy Proposition.’ Every time humans unlock a Delta 4 product or service, they cannot stop talking or sharing about it.

And therefore all Delta 4 products will naturally have lower CAC or sometimes zero CAC because people, humans.. and think about it, Lenny, how you discovered Google, definitely not through an ad, definitely not through some performance marketing here and there. Somebody showed you the demo and you were like, “Oh my God, this is crazy.”

I am originally from Bangladesh and while India and Bangladesh are sufficiently different cultures, there are perhaps more cultural similarities than differences between these countries. Admittedly, I found it a bit odd that he felt the need to highlight his prior successful exit and personal history while explaining an product framework intuition that he came up with. I do agree that Shah has a very unlikely profile from typical Indian entrepreneurs. If you grow up in South Asian culture, you probably know that not having STEM background in South Asia is essentially tantamount to being vagabond. The fact that a Philosophy major had multiple successful exits in Indian tech startup scene and now going to lead one of the highest usage messaging apps in the world is indeed nothing short of incredible!

While listening to Shah, I cannot help but think that he’s a conjecture machine! He is very fond of coming up with hypothesis that he developed based on his intuition and then test that idea in public and in market. He’s a very, very good storyteller and isn’t really married to have precise answer. An academician might care more about whether the optimum number is delta-4 or 3 or something else, but Shah seems to just care more about transmitting a simple intuition and then make it work through his products. He also has a lot of provocative ideas on all sorts of things and it won’t surprise me if he gets much more in hot water for his ideas now that he’ll be under the scanner to lead one of Meta’s most consequential apps for the next decade or so. Perhaps it speaks to his Philosophy background, but he seems to have a knack of amalgamating myriad different things from culture to religion to business in order to come up with a coherent framework. For example, take a look at his take on how low trust societies end up relying heavily on large brands. Some excerpts from Lenny’s podcast:

“…all low trust markets, and let me define low trust markets as where consumers are a lot more wary of trying new things because there are no institutions that protect you against bad behavior done by a company.

So for example, if I ever had a fall in a coffee shop in the US, I can think about suing them and making money off it. In India, you’re only worried about “I’m going to pay for my thing.” You don’t even think about suing the coffee shop or even hoping that you’ll get any money for that.

So what happens is in a low trust country, and all developing nations are low trust by design, because the institutions are not strong enough to really, really take care of many things. What happens is there is concentration of trust.

So you will see that super apps, superstars, super companies all exist in low trust markets because the lack of trust creates concentration of trust, and therefore you will see one app can do 400 things.

For example, we have a company like Tata that can do salt to car to jewelry to anything and people will buy it because it’s a Tata brand, because it comes from a low trust society trusting the brand and not being, “Oh, I’m going to prefer this new brand.”

The joy of trying new things is not so high in low trust nations.”

Can Shah capitalize on WhatsApp’s omnipresence brand to start a monetization bonanza in India? I suspect after speaking with Kunal Shah, Cox perhaps felt awfully ignorant about the nuances of Indian culture. In fact, Cox indicated that understanding how people use WhatsApp in a market like India requires familiarity with how the product is embedded in daily life. India is WhatsApp’s largest user base, and Meta evidently wanted someone who experiences the product the way those users do rather than someone managing it from Menlo Park.

Ironically, if you listen closely to Shah’s podcast appearances, he actually seems less interested in services that are essentially utilities and WhatsApp is closer to utility than perhaps any app out there in India. Shah frames gross margins as a function of status and competing on utility is a race to the bottom, but "we gladly pay a premium for an increase in status." India is status-driven in its own ways: Indians spend multiples of annual salary on weddings (Shah claimed 6x of annual salary) and living rooms are more lavish than bedrooms because both signal "you have made it."

It’s quite clear that Shah relishes on his Philosophy background and rightly understood it to be a real differentiator in a market where all products are built by STEM nerds. Nonetheless, it’s hard to look past how CRED was targeted to India’s affluent whereas WhatsApp operates at 3-billion user scale. While Shah’s extraordinary success so far gives me comfort that he doesn’t need to have a direct and relevant experience for him to be successful even on a global scale, it does indicate that WhatsApp will be a very different beast for him.

Over the years, I have noticed there is almost a rift between two groups of Meta shareholders. One group thinks Zuckerberg showed incredible foresight for buying WhatsApp at only ~$19 Billion valuation. With 3 Billion MAU today, that seems like a great bargain. But the other group points out Zuckerberg made the not-so-great decision to issue ~178 million Facebook shares at ~$78/share back then to acquire WhatsApp in 2014. In other words, Meta bought WhatsApp with ~7% of outstanding shares of the company and twelve years later, WhatsApp is still contributing a low single-digit share of revenue (while perhaps incurring losses). However, the former group quips that such number driven analysis actually misses the strategic masterstroke Zuckerberg might have played; just imagine WhatsApp on the hand of any of Meta’s direct competitors and you can then perhaps appreciate why Meta would like to own the communication layer of the world instead. It’s a good debate, but at some point the numbers need to back up the “strategic masterstroke” argument. I think Shah will amp up the product velocity for WhatsApp in the coming year(s), but I do want to note that while he is a gifted story teller, he is perhaps yet to generate a single dollar of profit in any of the companies he founded and operated. In fact, while Shah is happy to brag about his ~$450 Million exit of FreeCharge to Snapdeal in 2015, let me also highlight that Snapdeal ended up selling FreeCharge for just $60 Million in 2018. Of course, WhatsApp is a very different canvas with near zero CAC and thin existing monetization. Shah probably could not ask for a better opportunity to generate his first dollar of operating profit in his career!

Argo CD 2026 User Survey Results

We’re happy to share the results of the 2026 Argo CD user survey! We have never had this many people engage with Argo CD surveys; this year, we broke a record with 269 responses.

Last year, we added a new section to capture the community’s insights on environment promotions. This year, we asked the same questions to learn what has changed over the last 12 months (and a few things have changed rapidly; see the section on environment promotions below). We also added a new section to learn about AI/ML and Argo CD.

So, what did we learn?

TL;DR

Argo CD has been and remains the standard for GitOps deployments. It’s well established and loved by the community.

Implementations of Argo CD are becoming more mature; compared to last year, fewer companies use manual promotions or struggle with traceability across environments. However, modeling environments remain the second-most-common challenge for Argo CD users.

What’s the first one? Its performance when a single Argo CD instance manages many Applications and/or clusters. To give an idea of the scale of organizations that use Argo CD, 42% of respondents report managing 500+ Applications. 25% of respondents are running more than 10 instances.

Argo CD is widely used for AI/ML workloads: 80% of organizations that deploy or manage them use it for deployments, and 60% use it in production.

A few extra insights:

• The popularity of ApplicationSets continues to grow; 79% of respondents use them this year.
• Significantly more organizations are using the Argo CD Operator for installations than in 2025.
• More organizations are adopting dedicated tools for environment promotions and moving from manual manifest updates. The top promotion challenges shifted with them: traceability dropped from first place, while release gates and standardized pipelines are now the leading pain points.

What does the community think of Argo CD?

Every year, we ask respondents whether they are likely to recommend Argo CD to others. This year, over 75% of respondents recommended the tool, which is consistent with last year’s findings. This gives a Net Promoter Score (NPS) of 73.4, well above the NPS of most tools in this space. The community support is strong.

A few quotes from the community:

“Thank you all for your hard work! I’ve been running ArgoCD for nearly five years, and it’s been a pleasure to use and work with.”

“Keep going, you’re great.”

“Keep doing God’s work like you have done so far!”

“You all rock!”

“Argo CD is great, keep it up.”

Who uses Argo CD?

As in most of our surveys, the majority of respondents are Platform Engineers, with DevOps Engineers as the second-largest group. This year, though, we noticed a new trend: the number of SREs is noticeably higher than in 2025.

The number of responders in this role isn’t large enough to draw conclusions about an industry shift underway; however, it’s worth noting that the same role might have different names across organizations. That said, there is a slight dip in DevOps Engineer representation, which could suggest some overlap or a gradual transition. It’s an interesting trend to watch.

The survey findings are heavily weighted towards the experiences of small to mid-sized companies, with a large portion of respondents (44%) from companies with fewer than 100 engineers, and 32% of respondents are from companies with between 100 and 500 engineers.

What does Argo CD adoption look like in 2026?

The adoption numbers haven’t changed much since 2025. With 66% of respondents using Argo CD in production for more than two years, a clear sign of a maturing community that has graduated from early adoption to established everyday infrastructure.

Among the more seasoned adopters in this community, almost 60% run three-quarters of their production applications on Kubernetes, and 66% manage more than three-quarters of these applications with Argo CD. The combination of Kubernetes adoption and Argo CD makes it the tool of choice for many Kubernetes users.

At the same time, and it shouldn’t be a surprise, there is a strong correlation between the size of the organization and the percentage of applications running on Kubernetes. For example, among organizations with 500 to 2000 engineers, only 39% have more than a quarter of their applications on Kubernetes. This means that these organizations have heterogeneous infrastructure, which explains some of the challenges we’ll cover in the following sections.

The community still mostly uses Argo CD for business applications (87%), cluster bootstrapping (65%), and infrastructure management (64%). As last year, almost a third of Argo CD users manage databases with it. What’s new this year is that 22% of respondents use Argo CD to manage AI/ML workloads.

Most organizations use Argo CD for multiple use cases; it’s typical to use Argo CD for two of three scenarios, like infrastructure management and business application deployments. However, around 12% of respondents use it solely for platform needs, without deploying business applications.

The main installation method for Argo CD hasn’t changed since 2025. Most organizations still prefer Helm, and Kustomize is the second most common response. The only significant change is the growing popularity of Argo CD Operator. Last year, less than 1% of respondents used it; this year, it has grown to 8%, a significant increase.

Another point worth noting is the persistent popularity of cluster-wide installations over namespace-scoped installations. Most likely, many organizations install Argo CD on the clusters where they also run Applications and/or don’t consider risks associated with cluster-wide installations significant.

What is the scale of Argo CD implementations?

When looking into the scale of Argo CD implementation, the 2026 numbers show an interesting trend: the number of organizations running between 500 and 2000 Applications is shrinking (from 28% in 2025 to 17% in 2026). At the same time, the share of organizations running under 50 or more than 2000 Applications is growing.

This could be explained by broader industry patterns in which organizations are reacting to the “cost of tool sprawl” from years of over-enthusiastic tool adoption, leading to consolidation. On the other end of the spectrum, organizations may be successfully maturing into large-scale enterprises by investing in Platform Engineering and standardized guardrails.

At the same time, the number of clusters per Argo CD instance didn’t change much since 2025. The only noticeable shift is the dropping number of respondents having one cluster per instance. This aligns with “scale” being one of the top challenges, as organizations connect more clusters to fewer instances, the pressure on each instance grows.

What patterns and sub-projects do the community use the most?

This year, we added more options to the questions about sub-projects and patterns. However, it didn’t change the overall picture. The two most popular patterns are still App-of-Apps and ApplicationsSets. And ApplicationSets are growing in popularity (from 66% in 2025 to 76% in 2026). This is a clear signal of the community’s growing maturity and a strong indication that it follows best practices, thereby extracting maximum value from the tool.

A few extra noticeable observations:

• Sync waves and hooks are used by more than half of the respondents (54%). This might indicate that organizations are solving the deployment automation problem in-house without dedicated tools.
• The adoption of source hydrator has increased over the last year, but the absolute numbers are still low. It’s a good sign from the community. There might be changes needed to simplify adoption or better explain the tool’s value.

For the sub-project options, we explicitly added Argo Rollouts, Argo Workflows, and Argo Events to the list. Last year, we ran separate surveys for them. The adoption numbers for these projects are impressive, 63% of respondents use Argo Rollouts, 43% use Argo Workflows, and 26% use Argo Events.

Use of other projects decreased in 2026 compared to 2025. New survey options might explain the drop in the numbers. At the same time, some of the drop can be explained by the growing adoption of dedicated CD tools.

The only project growing in 2026 compared to 2025 is the Argo CD Agent. The total number is still significantly lower than the number of respondents connecting multiple clusters to a single Argo CD instance. It’s interesting to see whether adoption of the Agent increases over time and whether it addresses scalability and performance challenges.

Environment promotion

We first explored the environment promotion topic last year. We repeated the questions this year to spot any trends and added an extra question about the promotion mechanics.

One thing that hasn’t changed since 2025 is the number of environments. Half of the respondents still have 1–3 environments, and only 13% run more than 8.

The promotion methods shifted significantly during the last 12 months. The most noticeable change is the drop in manual promotions. The reasons aren’t clear; however, tools like GitOps Promoter and Kargo have had time to gain traction, and organizations using Argo CD are moving towards fully automated pipelines.

At the same time, the larger the organization, the more likely it is to use custom scripts, in-house solutions, or manual manifest updates. The survey results don’t explain the reason. We can assume that large companies that have already implemented sophisticated in-house solutions would be slow to adopt new solutions, as they might require significant rework on their end. Another potential reason is that large organizations often use multiple Argo CD instances and need centralized solutions to manage promotions across them.

At the same time, there is a correlation between the environment promotion-related challenges and organization size. We also see a significant shift in responses for this question. Traceability across environments (38%), the main challenge in 2025, is now in third place. It’s still a major pain point, but release gates (50%) and standardized pipelines (44%) are more significant for respondents in 2026.

The growing popularity of automation tools might explain these changes. These tools usually provide a good overview of the Application status and let cross-environment traceability. At the same time, they don’t solve the more advanced CD needs like gates and standardized pipelines as easily. These results suggest a clear path for current tools to develop or for the community to seek more advanced solutions.

Finally, this year, we learned what mechanisms the community use to roll out new Application versions. Two methods stand out clearly from the rest: Helm values and plain YAML manifest updates.

Looking more closely into what methods are usually used together, we found that teams updating Helm values also often use Helm umbrella chart and almost as often update the Helm chart version in Application specification or via ApplicationSet generators (actually, if a team uses ApplicationSet generators, they will use Helm values in 81% of cases).

These insights can help the community focus on scenarios that are more relevant to organizations using Argo CD.

AI/ML workloads

For the first time this year, we explored AI/ML workloads more deeply. Most respondents don’t deploy or manage such workloads; however, 80% of those who do already use Argo CD (60% in production).

AI/ML is already a genuine Argo CD use case. More than half of the respondents use Argo CD to deploy model inference/serving endpoints. Interestingly, only 27% use Argo CD for AI agents or multi-model orchestration.

Model inference and LLM serving, not training, are the most common preferences here, which makes sense: these are long-running, declarative deployments that GitOps suits well.

The biggest AI/ML-related deployment challenges (we asked this question for all tools involved in the deployment, not just Argo CD) are GPU resource allocation, managing model images, lack of visibility, and deployments across GPU and non-GPU nodes.

These results point to real opportunities to further develop Argo CD and other Argo projects. It’s worth noting that ~20% of respondents also flag environment promotions and progressive rollouts as needs, which are challenges that are not AI/ML-specific but remain relevant.

What challenges are teams facing?

One of the most interesting questions in the survey is about the challenges teams face with Argo CD. Based on last year’s feedback, we added scaling and performance as options, and respondents reported them as the main challenge straight away.

The other common challenges are “troubleshooting”, “environment modeling promotions”, “RBAC and multi-tenancy”. Compared to last year, “insufficient automation” dropped from 22% to 13%. This change might be caused by other challenges taking priority.

Some challenges correlate with the respondent’s role. For example, Platform Engineers focus on “scaling and performance” more than others.

Looking more closely at the “scaling and performance” data, we found that this is more common for companies managing more Applications or having more engineers, which is somewhat expected. What’s less expected is how significant the problem is for companies managing more than 2000 Applications. Half of the respondents named this challenge among their top 3 challenges with Argo CD. This indicates that this problem is worth solving, especially as the overall number of Applications is growing; therefore, more organizations will experience it.

We also asked respondents about missing features that would remove pain points for their teams.

The top themes identified are:

• Environment promotion and pipelines (25%): Teams want built-in workflows for approvals and verifications. They’re looking to move past simple autosync and want better ways to manage promotions across multiple clusters.
• UI features and performance (23%): Users want faster, more responsive dashboards, especially for large applications. Top requests include easier management of application sets and clearer error messages.
• RBAC and security (9%): Teams are looking for easier security setup, including better support for Kubernetes groups and improved audit logs for compliance.
• Observability (8%): Teams need a way to check if a specific commit is healthy before their pipeline continues, bridging a key gap between CI and CD.
• Dependency management (7%): For complex deployments, current “sync waves” aren’t enough. Users are requesting more advanced dependency control to manage deployment order across apps.

Overall, these findings are positive: the results show that the community is satisfied with Argo CD’s core deployment functionality, with users requesting better tooling to manage everything around them. These missing features indicate that users are moving beyond basic deployments and are now focused on optimizing the operational layer surrounding them.

What Argo CD features are most useful for users?

Rounding out the survey, we explored which Argo CD features respondents find most useful in practice. Three capabilities stood out most here as the backbone for Argo CD users.

1. ApplicationSets and App-of-apps (25%): These are important for managing multiple clusters and rolling out standard components at scale. They make centralized sync management easy, and users value the PR generator for creating temporary (ephemeral) environments.
2. Autosync self-healing (22%): This is the key “safety net” for Argo CD. Respondents trust it to maintain their infrastructure consistency without manual intervention.
3. The UI (20%): This allows users to inspect live resources and manage their platform from a single central place, serving as “Kubernetes for developers”.

Final words

The 2026 survey brought a considerably larger and growing Argo CD-engaged community and delved deeper into deployment challenges, the patterns behind environment promotions, and the state of AI/ML deployments. These findings will inform the project’s further development.

We really appreciate the time and effort of everyone who participated in the survey. Your insights are critically important for the community. Many thanks!

This survey wouldn’t be possible without Charlotte Fleming, Carolyn King, Adriana Naula, and Katie Lamkin-Fulsher. Great work, team.

Penpot is the open-source design platform for teams that build digital products at scale.

Penpot’s key strength lies in giving you full ownership of your design infrastructure. Built on open source and designed for self-hosting, it puts teams in complete control of their design environment supporting strict compliance and governance requirements. Whether used in the browser or deployed on your own servers, Penpot works with open standards like SVG, CSS, HTML, and JSON.

Real-time collaboration strengthens this foundation, helping teams scale and bring design closer to the product through top-tier capabilities. Additionally, developers feel at home using Penpot, because design is expressed as code, enabling a direct translation and shipping products faster.

Best-in-class native Design Tokens provide a single source of truth between design and development. They ensure consistency, improve collaboration, and make it easier to manage complex design systems.

The MCP server takes it further by enabling multi-directional workflows between design and code. A powerful open API and plugin system makes the workspace programmable, enabling automation, AI-driven workflows, and integrations with the tools and systems you already use.

With CSS Grid and Flex Layout, teams can design responsive interfaces that behave like real code from the start.

Combined, these features turn Penpot into a full-stack design platform for building scalable design systems and fully integrated product development processes.

If your organization is scaling and needs extra support, we’re here to help. Talk to us

Why Penpot

Penpot connects design, code, and AI workflows through a code-based approach, making designs readable by developers and AI via the MCP server. This approach helps teams ship what’s actually designed and manage design systems at scale with powerful design tokens. As a self-hosted, open-source and real-time collaboration platform, Penpot offers full flexibility, security, and ownership without vendor lock-in. Learn more about why Penpot is the platform for your team.

Plugin system

Penpot plugins let you expand the platform's capabilities, give you the flexibility to integrate it with other apps, and design custom solutions.

Designed for developers

Penpot was built to serve both designers and developers and create a fluid design-code process. You have the choice to enjoy real-time collaboration or play "solo".

Inspect mode

Work with ready-to-use code and make your workflow easy and fast. The inspect tab gives instant access to SVG, CSS and HTML code.

Integrations

Penpot offers integration into the development toolchain, thanks to its support for webhooks and an API accessible through access tokens.

Building Design Systems: design tokens, components and variants

Penpot brings design systems to code-minded teams: a single source of truth with native Design Tokens, Components, and Variants for scalable, reusable, and consistent UI across projects and platforms.

Getting started

Penpot is the only design & prototype platform that is deployment agnostic. You can use it in our SAAS or deploy it anywhere.

Learn how to install it with Docker, Kubernetes, Elestio or other options on our website.

Community

We love the Open Source software community. Contributing is our passion and if it’s yours too, participate and improve Penpot. All your designs, code and ideas are welcome!

Want to go a step further? Become a Penpot Ambassador and help grow the Penpot community in your region while contributing to a global, open design ecosystem.

If you need help or have any questions; if you’d like to share your experience using Penpot or get inspired; if you’d rather meet our community of developers and designers, join our Community!

Categories include:

• Ask the Community
• Troubleshooting
• Help us Improve Penpot
• Events and Announcements
• Penpot in your language
• Education

Code of Conduct

Anyone who contributes to Penpot, whether through code, in the community, or at an event, must adhere to the code of conduct and foster a positive and safe environment.

Contributing

Any contribution will make a difference to improve Penpot. How can you get involved?

Choose your way:

• Create and share Libraries & Templates that will be helpful for the community.
• Invite your team to join.
• Give this repo a star and follow us on Social Media: Mastodon, Youtube, Instagram, Linkedin, Peertube, X and BlueSky.
• Participate in the Community space by asking and answering questions; reacting to others’ articles; opening your own conversations and following along on decisions affecting the project.
• Report bugs with our easy guide for bugs hunting or GitHub issues.
• Become a translator.
• Give feedback: Email us.
• Contribute to Penpot's code: Watch this video by Alejandro Alonso, CIO and developer at Penpot, where he gives us a hands-on demo of how to use Penpot’s repository and make changes in both front and back end.

To find (almost) everything you need to know on how to contribute to Penpot, refer to the contributing guide.

Resources

You can ask and answer questions, have open-ended conversations, and follow along on decisions affecting the project.

💾 Documentation

🚀 Getting Started

✏️ Tutorials

🏘️ Architecture

📚 Dev Diaries

🧑‍🏫​ UI Design Course

License

This Source Code Form is subject to the terms of the Mozilla Public
License, v. 2.0. If a copy of the MPL was not distributed with this
file, You can obtain one at http://mozilla.org/MPL/2.0/.

Copyright (c) KALEIDOS INC Sucursal en España SL

Penpot is a Kaleidos’ open source project

Amazon SQS turns 20: Two decades of reliable messaging at scale

On July 13, 2006, we launched Amazon Simple Queue Service (Amazon SQS) as one of the first three services available to customers, alongside Amazon EC2 and Amazon S3. We had learned firsthand that distributed systems need a reliable way to pass messages between components without creating tight dependencies. If one service called another directly and that service was slow or unavailable, failures cascaded through the entire system. Message queuing solved this by letting services communicate asynchronously: a producer could drop a message into a queue and move on, while a consumer picked it up when ready. This approach kept individual service failures from affecting the rest of the system.

When Amazon SQS launched publicly in July 2006, it made this pattern available to every AWS customer. Twenty years later, that core function, decoupling producers from consumers, remains the reason customers use SQS. The scale, performance, and operational controls around it look very different now though.

Jeff Barr covered the first 15 years of SQS milestones in his 15th anniversary post, from the original 8 KB message limit in 2006 through FIFO queues, server-side encryption, and Lambda integration. Over the last five years, we have continued to scale SQS, added stronger security defaults, and introduced new capabilities that address increasingly complex workload patterns.

Key milestones between 2021 and 2026

High throughput mode for FIFO queues (2021): In May 2021, we launched general availability of high throughput mode for FIFO queues, supporting up to 3,000 transactions per second (TPS) per API action, a tenfold increase over the previous limit. We continued raising this ceiling over the following two years: to 6,000 TPS in October 2022, to 9,000 TPS in August 2023, and to 18,000 TPS in October 2023, before reaching 70,000 TPS per API action in select Regions by November 2023.

Server-side encryption with SSE-SQS (2021): In November 2021, we introduced server-side encryption with Amazon SQS-managed encryption keys (SSE-SQS), giving customers an encryption option that required no key management. In October 2022, we made SSE-SQS the default for all newly created queues, so customers no longer needed to explicitly enable it.

Dead-letter queue redrive enhancements (2021): We progressively expanded how customers recover unconsumed messages from dead-letter queues. In December 2021, we added DLQ redrive to source queue directly in the SQS console. In June 2023, we extended this capability to the AWS SDK and CLI through new APIs, including StartMessageMoveTask, CancelMessageMoveTask, and ListMessageMoveTasks. In November 2023, we added redrive support for FIFO queues.

Attribute-based access control, ABAC (2022): In November 2022, we introduced ABAC, giving customers the ability to configure access permissions based on queue tags rather than maintaining static policies as resources scaled.

JSON protocol support (2023): In November 2023, we added support for the JSON protocol in the AWS SDK, reducing end-to-end message processing latency by up to 23% for a 5 KB payload and lowering client-side CPU and memory usage.

Amazon EventBridge Pipes console integration (2023): We added the ability to connect a queue directly to EventBridge Pipes from the SQS console, routing messages to a broad range of AWS service targets without writing custom integration code.

Extended Client Library for Python (2024): We brought the Extended Client Library, previously available for Java, to Python developers, allowing messages up to 2 GB to be sent through SQS by storing the payload in Amazon S3 and passing a reference through the queue.

FIFO in-flight message limit increase (2024): We increased the in-flight message limit for FIFO queues from 20,000 to 120,000 messages, so consumers can process significantly more messages concurrently without being constrained by the previous ceiling.

Fair queues for multi-tenant workloads (2025): We introduced fair queues to mitigate the noisy neighbor problem in multi-tenant standard queues. By including a message group ID when sending messages, customers can prevent a single tenant from delaying message delivery for others, without any changes required on the consumer side.

1 MiB maximum message payload size (2025): We increased the maximum message payload from 256 KiB to 1 MiB for both standard and FIFO queues, helping customers send larger messages without offloading data to external storage. AWS Lambda event source mapping for SQS was updated in parallel to support the new payload size.

The constant underneath the change

Despite two decades of feature additions, the fundamental use case for SQS has not shifted. Customers use it to decouple services, buffer bursts of traffic, and build systems that stay resilient when individual components fail. That same pattern now extends to AI workloads. Customers use SQS queues to buffer requests to large language models, manage inference throughput, and coordinate communication between autonomous AI agents operating as independent services. For an example of this architecture in practice, read Creating asynchronous AI agents with Amazon Bedrock.

To learn more about Amazon SQS, visit the Amazon SQS product page, review the developer guide, or explore recent updates on the AWS Blogs.

Apple's trade secret lawsuit against OpenAI carefully avoids naming former design chief Jony Ive, but OpenAI could still call him to testify because of his role in co-founding io Products, the hardware company at the center of the dispute. That would put Apple in the awkward position of questioning or challenging the testimony of one of its most celebrated former executives, despite their seemingly cordial relationship since his departure. Although Ive has testified in Apple-related cases before, appearing on OpenAI's side could strain his ties with both companies.

Artificial intelligence has dramatically accelerated software development, making it easier than ever to transform ideas into working products. According to Stanford’s recent report, AI performance on a key coding benchmark jumped from 60% to nearly 100% in a single year, while organizational AI adoption reached 88%. As AI capabilities continue to expand, Tingyu Su believes the challenge is no longer simply building software. It is creating products that people immediately understand, trust, and choose to adopt.

According to Su, a startup Founding Designer with experience spanning creative technology, product innovation, and multidisciplinary design, that shift has made the founding designer an increasingly important early hire. She explains that while startups often prioritize engineering talent, they also need someone who can connect product development, branding, and customer experience into a cohesive whole from the very beginning.

“The speed of AI development has changed what companies compete on,” Su says. “Building an early product is becoming more accessible. Creating a brand and experience that people immediately understand, trust, and remember is where lasting differentiation begins.”

Customers often form opinions about a company well before they ever use its technology, Su notes. “A website, conference booth, presentation deck, or marketing material may become the first interaction someone has with an organization,” she says. She recalls a recent industry conference where a prospective customer stopped by the company’s booth and remarked that the materials felt clean and immediately understandable, and looked noticeably more refined than those of the surrounding exhibitors. For Su, moments like that confirm why every touchpoint should reinforce the same identity customers eventually experience inside the product itself. A startup’s product will change many times, she says, but a thoughtfully built brand is the one thing that shouldn’t. For AI startups, that consistency is what earns customers’ trust before the technology proves itself.

Su’s multidisciplinary career has influenced how she approaches design. Her experience spans art institutions, creative agencies, consumer brands, and technology companies, backed by formal training in communication design and product innovation. Her work has also been recognized with an iF Design Award, and she contributed published research presented at the CHI 2025. Today, she applies that broad perspective as the founding designer at Youlify, a Silicon Valley healthcare AI startup developing revenue cycle management technology for healthcare organizations and providers.

Su also believes expectations for early-stage products have evolved alongside AI. While the minimum viable product remains a valuable way to validate ideas, she says functional software alone is rarely enough to earn customer confidence. Instead, she encourages founders to think about creating a Minimum Lovable Product, an experience that is clear, intuitive, and trustworthy from the very first interaction. According to Su, thoughtful design helps turn an early prototype into a product that people are willing to adopt and recommend.

“A product does not need dozens of features to make an impression,” Su says. “Sometimes one carefully designed experience that clearly solves a real problem creates far more confidence than a long list of capabilities people never fully understand.”

According to Su, AI is reshaping the role of designers as much as it is reshaping technology. She believes the next generation will contribute across branding, product strategy, customer research, and engineering instead of remaining confined to traditional design responsibilities. She says AI tools and a growing technical understanding are enabling designers to collaborate more closely with engineering teams throughout product development.

Su encourages founders making their first design hire to prioritize curiosity, initiative, and systems thinking alongside technical ability. She explains that early-stage startups rarely have the structure for highly specialized roles, making adaptability an important characteristic for anyone joining the founding team. Designers who proactively explore customer problems, collaborate across departments, and confidently recommend practical solutions often contribute well beyond traditional design responsibilities.

“The most valuable founding designers are constantly learning alongside the company,” Su says. “They are willing to understand the customer, work closely with engineers, contribute to business conversations, and refine every experience as the company evolves.”

Su’s own multidisciplinary career reflects that philosophy. Before entering the startup ecosystem, she worked across prominent cultural institutions, including the Museum of Modern Art, Solomon R. Guggenheim Museum, and Rubin Museum of Himalayan Art, experiences that strengthened her understanding of storytelling, accessibility, and large-scale design systems. She later expanded that perspective through creative agencies, consumer brands, and product innovation before moving into AI startup leadership, where she now combines design, technology, and business strategy to help shape emerging products.

As artificial intelligence continues to reshape how software companies are created, Su believes the role of the founding designer will continue expanding alongside technological progress. While engineering excellence remains fundamental to successful startups, she suggests that long-term differentiation increasingly depends on how clearly companies communicate value, earn customer confidence, and deliver cohesive experiences across every interaction.

“The companies people remember are the ones that make every interaction feel intentional,” Su says. “Technology will continue to evolve, but trust is built through experiences that feel consistent from the first impression to the product itself. That is where I believe the founding designer creates lasting value.”

The best gaming logos have to convey an idea of the mood and theme of a game while also creating a strong, recognisable identity that stands out in a crowded market. When it's a major brand like Marvel, the design also has to fit into an existing universe of titles while also showing this release to be distinct.

So how does a designer approach the challenge of creating an identity that ticks all of these boxes? Stephane Perez AKA Mardoch has provided a detailed breakdown of how he approached the brief when he designed the Marvel Cosmic Invasion logo for the beat 'em up developed by Tribute Games and published by Dotemu.

He created a wide range of assets for the game, from key art to packaging and merchandise, but the logo design marked the start of his involvement and creates a base for the game's identity.

"I believe that logos shouldn’t merely complement a brand with a specific style; they need to tell a story and that’s especially true for video game logos," Mardoch says of his philosophy when it comes to logo design.

"A good gaming logo embodies the game’s spirit by conveying a narrative, referencing specific themes, and projecting a distinct personality. It serves as a promise that the game’s true essence awaits the player."

Mardoch knew from the outset that the Marvel Cosmic Invasion logo needed to evoke several things: space adventure, the Marvel comics universe, and the threat posed by the game’s main antagonist, Annihilus.

He quickly defined the three parts. Marvel's existing mark was already given, tying the game to the established Marvel identity, but then there were the two words specific to the game: 'Cosmic' and 'Invasion'.

"I had several starting directions, but very quickly a texture language took over: something dynamic and futuristic for COSMIC, and something raw and organic for INVASION," Mardoch explains in the breakdown on his website.

A few quick exploration passes got him fairly close to the final direction.

Taking inspiration from the fonts used for sci-fi movie titles from the ’60s and ’70s, from Forbidden Planet to Barbarella, he decided the word Cosmic needed bold shapes, slightly rounded corners and a perspective effect for a retro futuristic look. To get just the right shape, he designed a custom font, Marvel Cosmic, which would go on to give the marketing campaign a unique asset.

'Invasion' needed to provide a contrast, so Mardoch sought something rougher and more organic. He wanted connecting elements between the letters to create a "sticky, slightly grimy feel" as a reference to Annihilus's insectoid origins. The resulting wordmark has a distinct "gooey" feel that remains in keeping with comic traditions.

Once these main concepts were in place, it was a question of making finer adjustments and tweaking the scale and perspective of each element to create the perfect harmony.

Mardoch tried a version with a star as a reference to Nova, but found that it made the design too busy and difficult to read at smaller sizes: a game logo still needs to comply with many of the rules of logo design.

That said, as this is a game rather than a corporate identity, there's room to add some creative flair. A gradient outline across the whole logo creates a slight glow, intended to echo the saturated colours of space-themed comic books.

Mardoch also added a classic halftone print pattern as a texture to push the comic panel feel further. "I built it first in Photoshop, then separated the texture from the letterforms so I could rebuild everything as vector art in Illustrator," he says. "That way the logo could scale cleanly across pretty much any format, from packaging down to a single icon."

"What I like about the final result is that it works on almost every level. It nods to the comics, alludes to the villain, keeps a sci-fi reference, and still reads clearly in black and white and at small sizes," Mardoch says.

Work on the logo wasn't quite finished, though. The game logo also needed a motion version, and animated logos involve considerations of their own.

Mardoch wanted to maintain the sci-fi mood and decided to animated the two words as separate beats. For 'Cosmic', he was inspired by the trailing echo effect in the opening of the 1980 Flash Gordon movie. For 'Invasion', the inspiration was the title reveal from The Thing. "Reusing it works both as a tribute to the film and as a way to anchor my logo firmly inside a well-defined genre," the designer notes.

The finishing touch is a light sheen sweeping across the outline, followed by a small starburst flare going back to that idea of including a nod to Nova‘s star (never abandon an idea completely!)

Anthropic's new ad, "There's hope in hard questions," unsettled viewers due to its dark imagery and critical AI commentary.

Google celebrates 25 years of Google Images with new features: a dynamic, personalized image gallery and direct image generation via AI in Search.

Terminal lucidity is when gravely ill people have a sudden and unexpected moment of mental clarity. This seemingly impossible phenomenon has been seen in people with dementia, tumors, neurological disorders, and many other forms of brain-ravaging illness. The ability for the brain to - even temporarily - return to mental clarity calls into question scientists' models of what is actually going on in the brain. Understanding the phenomenon more could lead to improved caregiving practices and also a new understanding of the nature of dementia.

Prestige-hunters are partial to tight feedback loops as they need proof, fast, or they'll move on.

Tinder's rebrand combines a bolder visual identity with a distinctive editorial voice inspired by dating columnists, positioning the brand as a witty, empathetic guide for modern dating. The refreshed design updates the iconic flame, typography, color palette, and swipe interactions while embracing Gen Z's contradictions instead of simplifying them. Rather than relying on cliched dating imagery, the brand mixes authentic photography, metaphorical visuals, and cultural references to celebrate the many ways people experience connection.

The real problem isn't AI, but poor leadership and messaging that frames it as a replacement for designers instead of a tool to remove repetitive work and free up more time for creativity. Leaders should adopt AI more thoughtfully by forming a working group to identify practical workflow improvements and encourage collaboration rather than fear. Human judgment, craft, and storytelling remain essential. Companies should focus on using AI to support—not replace—creative professionals.

Flodesk Studio is an experimental playground that lets you create emails in the fastest, easiest, most on-brand way.

ThreeTenSeven rebranded Future Health Research to help the health policy organization stand out in a sector dominated by conventional, academic-looking identities while creating a flexible system for future growth. The new identity features a healthcare cross that evolves into an FH monogram, pixel-inspired typography representing data-driven research, custom illustrations, and a bold color palette that avoids the typical healthcare blues and greens. The result is a distinctive, scalable brand that reflects the organization's mission to shape healthcare policy and improve public health outcomes.

Liqoria is a macOS music player that unifies controls for Apple Music, Spotify, YouTube, and browser playback into a customizable interface, offering a more capable alternative to Apple's Music app.