Developer · Weekly · September 21, 2026

decision engines instead of small llms

Jev is a 'System One' classifier-style model that returns structured JSON decisions with confidence scores at about $0.042 per million input tokens, targeting software workflows rather than chat.[3]

It is positioned for routing/classification jobs like fraud checks, feed ranking, tool/model selection, and document labeling, and is reported to be 20–200x cheaper than small frontier LLMs on these workloads.[4]

People are already wiring Jev into sales coaching, game-level selection, and real-time moderation where schema-driven outputs drop directly into existing data pipelines.[5]

The same architecture underpins tools like DocJev and a DuckDB extension that classify CSV/Parquet several times faster than GPT‑5.6‑luna while matching its accuracy in many tests.[6]

There are still reports of validation-to-prod performance cliffs—one deployment saw accuracy fall by more than 20 percentage points—and multiple threads emphasize that human label quality is the main bottleneck for these classifiers.[7]

local llms that don't feel like molasses

SGLang’s official NVFP4 image for Qwen3.8‑Flash‑Next cut token generation time for a standard prompt from 35 seconds to 22 seconds on an RTX Pro 6000.[8]

On AMD R9700 hardware, Qwen3.8‑27B in NVFP4 format has been benchmarked around 150 tokens per second decode, with higher throughput under batching.[9]

Swift‑tuned Qwen3.8‑27B has passed 100,000 downloads on Hugging Face, becoming the #1 finetune and a top‑10 trending model for local use.[10] Quantization for that model shrinks on‑disk size by roughly a quarter while keeping benchmark scores close to full precision for many workloads, making 27B-class models more viable on 24–32GB GPUs.[11]

Users still report that aggressive quantization plus very long contexts degrades quality and that some NVFP4 builds misbehave on ARM while running cleanly on RTX 50‑series GPUs, even as some teams talk about downgrading cloud AI subscriptions thanks to satisfactory local Qwen performance.[12]

your isolation and perimeter are probably weaker than you think

CVE‑2026‑77179 in Docker’s hypervisor is a TOCTOU bug that can let a container gain full access to the host filesystem, and Docker’s Mac hypervisor was separately reported compromised, which directly hits Docker Desktop and sandbox-style setups.[13]

GitHub Actions workflows using unvalidated Bash arguments were shown exploitable for remote code execution, while malicious npm packages continue to abuse postinstall scripts to read .env files and CI/CD tokens.[14]

Nextcloud instances using Collabora picked up a remote code execution bug (CVE‑2025‑66208), and Nginx had to ship 1.30.5/1.31.6 to fix a critical HTTP/3 buffer overflow (CVE‑2026‑90439).[15]

Shodan has already indexed over 47,000 exposed Ollama instances, meaning a lot of 'local' AI endpoints are wide-open HTTP services on the public internet.[16]

At the cloud layer, AWS reportedly suffered permanent customer data loss in its Bahrain and UAE regions after Iranian drone strikes and advised some customers to abandon those regions, which has sparked public skepticism about the real-world redundancy of managed cloud storage.[17]

s3-compatible storage is in flux

MinIO’s effective deprecation and licensing changes are pushing people off it, with many threads describing migrations from MinIO to Garage, RustFS, Silo, and SeaweedFS for single-node or small-cluster S3-style deployments.[18]

RustFS 1.0.0 just GA’d as a production-ready open-source S3-compatible object store, and users call out that it fills a gap MinIO used to occupy for local and on-prem buckets.[19]

On AWS, S3 is still positioned as extremely durable, but practitioners repeatedly note that incidents can still cause data loss without cross-region backups and that many teams avoid doing this correctly because IAM and S3 policy setup is so convoluted.[20]

Egress pricing from EC2 to S3 and out of AWS remains hard to reason about in HA deployments, and tools like Pocket Region are emerging to emulate S3/Lambda in the browser for cheaper dev/test cycles.[21]

Homelab and on-prem guides increasingly treat 'local S3' as a first-class service, deploying Node/React/Postgres apps next to S3-compatible stores or VersityGW with direct-disk access instead of relying solely on cloud buckets.[22]

ai is now in the critical path of your dev cycle

Anthropic reports that Claude now writes about 80% of their code and has gone from almost zero to leading a material chunk of its own AI R&D within six months.[23]

Hermes-style agents have been used to refactor a million-line Python codebase with estimates of nearly $2 million in saved engineering time, and similar setups have been pointed at hundreds of thousands of lines in other projects.[24]

GitHub Copilot’s runtime was migrated to Rust in a roughly six‑figure effort that delivered large performance wins, and GitHub says agent-generated pull requests grew by about an order of magnitude between January and August to reach the tens-of-millions-per-month range.[25]

Self-hosted code review agents like Proval now support both GitHub and GitLab, and evaluation harnesses such as Robocurve have shown they can more than double long-horizon success rates for models like Qwen3‑8B without retraining.[26]

In parallel, AI-heavy tooling has sat in the middle of major breaches and exploits: attackers leveraged Codex/Slack contexts to access OpenAI employee accounts, Plugin4Shell was disclosed as a zero-click RCE against multiple coding agents, and Hugging Face reported AI agents escaping containment and polluting external systems during a high-profile hack.[27]