Cutting our inference bill by 68% by being obsessive about optimization

When we previously blogged about our AI code reviewer in April, an average review cost a palatable $1.19. By the end of August, that figure had shot up to about $2.46. We hadn't made any significant architectural changes: the coordinator was still handing work to the same set of specialist reviewers, and the same risk tiers decided how intensive of a review we gave.

Around mid-September we tasked our agents with working out where those tokens were going and cutting them — aggressively. With code quality at high effort, the average review now costs just $0.77, down 68% from the $2.43 it averaged over our two most expensive weeks before we started. Our main goal was to cut costs, but as part of this work we also managed to optimize the reviewer, so that the median review now takes just 1m 32s instead of the 4m 09s it took before.

About 40% of the savings came from changes and optimizations to the reviewer's code, and the rest from experimenting with which models we use and how much effort they put in.

How a review doubled in cost

The chart below shows the cost of an Continue reading

Worth Reading 101926

Could the growing deployment of RPKI become a threat to routing stability? To answer that question, we analysed more than 11 years of RPKI and BGP data, measuring how much routing activity can be associated with RPKI-related changes.

The LoRa Alliance recently reported that there are 150 million global devices connected by LoRa technology. LoRa is shorthand for Long Range and is a radio technology that sends small bits of data over long distances using little battery power.

Today, powerful, widely available AI tools allow users to easily generate or alter photorealistic images to a degree that was difficult to imagine just a few years ago.

In 2025, Edgebeam Wireless was formed to take advantage of the unused spectrum of TV stations. The business is a partnership between the E.W. Scripps Company, Gray Media, Nexstar Media Group, and Sinclair.

Get ready for new gTLDs like .prompt, .dns, and even brands like .tiktok. Among the most sought-after names is .agent, which drew 13 applicants.

Meet Tigera at KubeCon + CloudNativeCon North America 2026

Ask a platform team how many AI agents are running in their clusters and you usually get a pause. Agents arrive through application teams, not platform teams. They call tools over MCP, invoke other agents and reach external model providers, and a Kubernetes service account tells you which pod made the call but not which agent and on whose behalf.

That gap is what we’re bringing to KubeCon + CloudNativeCon North America 2026, November 9–12 in Salt Lake City. Find Tigera at booth 150 for quick Lynx sessions on identifiying, governing and containing AI agents, and pick up a new t-shirt while you’re there. On November 9, before the show floor opens, join us for a workshop on securing AI agents on Kubernetes and a happy hour with the Lynx community.

November 9: Workshop and happy hour

Both events are at Le Méridien Salt Lake City Downtown (131 S 300 W), about a five-minute walk from the Salt Palace.

Discovering and Securing AI Agents on Kubernetes

2:00–7:00 PM MST · Triumph Salon · In-person or virtual

Peter Kelly, CTO at Tigera, walks through the path we’ve watched teams take with agents in production, in order. Discovery comes first, because agents Continue reading

Introducing Clairic, a new System One class of extraction models

Today, we're announcing a preview of a new class of System One-style models: extraction models. Our first one, Clairic, is available hosted on Workers AI as @cf/cloudflare/clairic.We intend to release the model open-weights soon. Clairic is an extraction model that is able to extract, compute, estimate, and forecast values from unstructured inputs — all at a significantly higher accuracy, faster latency, and cheaper cost than traditional LLMs.

Context

When System One models were announced by TypeSafe a month ago, it took the industry by storm. As referenced by TypeSafe in their blog and defined by Daniel Kahneman’s book Thinking, Fast and Slow, a System One model should be fast and precise, which contrasts a System Two model that is capable of deliberate reasoning (like LLMs). With this, TypeSafe introduced Jev — a model that is purpose-fit for a specific use case, and priced accessibly given its niche domain. It excelled where LLMs failed, helping users make decisions based on probabilities and well-typed outputs. The introduction of Jev prompted people to start thinking about a new class of models that were not LLMs and how to integrate them into their workflows.

We were inspired by the concept of System One models and Continue reading

Beyond the patch: Protecting your NetScaler gateway against future vulnerabilities

The recent disclosure of a major vulnerability in Citrix NetScaler pointed to a widespread weak point: a login page is an attack surface that can be used to compromise and access an application server. Indeed, the disclosures included an actively exploited flaw that allowed attackers to execute commands on affected gateways without signing in. As with any emergency patch, admins had to weigh cutting off or disrupting their users’ access with the risk of delaying a critical security update.

If you’re a NetScaler customer and you haven’t patched your instance, stop reading and go do that. This was a bad one. Once you’ve finished the patch, we’ll explore how to avoid a future fire drill by laying additional security controls.

This issue extends beyond NetScaler and can be applied to any internal application available on the Internet. Remote desktop portals, administrative consoles, and other publicly accessible authentication pages all deserve the same scrutiny: Does the intended audience require unrestricted Internet reachability? And can an attacker bypass this authentication check to reach the application's server?

Citrix released software updates to address the flaw, and Cloudflare followed with an emergency web application firewall (WAF) rule on October 1. But having a patch available Continue reading

YouTube Let AI Prototypes Read Production. The Token Did the Work.

TL;DR: Google Cloud’s post of 22nd July 2026 on why AI apps fail in production describes how a YouTube team gets AI prototypes in front of user research in weeks instead of quarters: a prototyping stack that hands each prototype read-only access to live production data through a proxy, keeps its code out of the production binary, and throws the prototype away once the idea is proven. The number behind the post is MIT Project NANDA’s finding, from July 2025, that just 5% of custom enterprise AI tools reach production. Told as a velocity story, the stack is an identity and policy design: the prototype never held a production credential, could not write however it was prompted, and had an end date by design. Few organizations can rebuild their product in a mirror, but the constraints that did the work cost less than the mirror, and an AI agent prototype on Kubernetes needs every one of them, with read-only decided per tool call rather than per database. This post takes the stack apart, maps it onto an agent prototype, follows the token into the gap between the prototype and the rewrite, then says what a governance layer like Tigera Lynx Continue reading

Working with Filters in Ansible

This post is part of an ongoing series - see all the posts below.

Ansible Course

We've already used a filter a few times in this series without spending much time on it. In the loops part, we used dict2items to turn a dictionary into a list, so we could loop over it. We also ran into a couple of problems that we couldn't solve at the time, such as sharing the same list of syslog servers between Cisco and Arista, even though their modules expect the data in a different format.

Filters are what solve these kinds of problems. In this part, we'll look at what filters are, go through some of the most useful ones, and see how to chain them together. By the end of it, we'll come back to the syslog problem and fix it using filters.

Before we start, I rebuilt the lab once again, so all the config from the previous part is gone. The project files and inventory are the same as before.

If you're reading this part without reading the previous ones, here's a quick summary of the lab. We have five switches. core1, core2, and access1 are Cisco IOL Continue reading

Ansible – Adding Arista and Multi-Vendor Playbooks

This post is part of an ongoing series - see all the posts below.

Ansible Course

So far, every device in our lab has been a Cisco switch. But very few real networks are made up of a single vendor. You might have Cisco in the campus, Arista in the data centre, and a few firewalls from yet another vendor. One of the biggest benefits of Ansible is that you can manage all of them from the same project, using the same inventory, the same playbooks, and the same way of working.

In this part, we'll add Arista switches to our lab. Arista is a good first step into multi-vendor automation, because just like Cisco, Ansible connects to it over SSH using network_cli. So most of what we've learned so far applies straight away, and we can focus on the differences.

Lab Topology

For this part, I've rebuilt the lab from scratch, so all the config we added in the previous chapters, such as NTP, syslog, and interface descriptions, is gone. Every device starts with only the default config created by Netlab.

As always, your lab doesn’t need to match mine exactly. All you need is a mix of Cisco Continue reading

The AI & SaaS Data Protection Gap: Why Fast-Growing Asia Pacific Businesses Are More Exposed Than They Realize

Palo Alto NAT Example

Most of the time, you'll be working with two types of NAT - Source NAT and Destination NAT. Source NAT is when you change the source IP address of your traffic (usually a private IP) to a public IP that is routable on the Internet. For example, if you have hundreds of people in your office, they are assigned private IPs. When their traffic goes out to the Internet, the Palo Alto firewall translates their private IP (source) to a public IP and the destination IP remains unchanged.

With Destination NAT, the process works the other way around. If you host publicly available resources in your network, like a web server, and someone on the Internet wants to access it, they will target a public IP address that is configured on the firewall. The firewall receives this request and then changes the destination IP to the server's real private IP and the source IP remains unchanged.

We'll also cover Bi-Directional NAT and U-Turn NAT. So, let's get started.

Just How Rosy Is That Datacenter Buildout Forecast?

Skate 3: Panduan Menggabungkan Trik dan Menyelesaikan Tantangan Kreatif

Skate 3 tetap menjadi salah satu permainan skateboard paling ikonik dan diminati hingga saat ini, terutama bagi para penggemar genre olahraga ekstrem dan simulasi skateboarding. Dalam periode terbaru, komunitas Skate 3 semakin berkembang dengan kreativitas yang melimpah, khususnya dalam menggabungkan trik skateboard dan menyelesaikan tantangan kreatif yang tersedia di dalam game. Artikel ini akan membahas secara mendalam tentang bagaimana cara menguasai kombinasi trik yang efektif dan teknik menyelesaikan berbagai tantangan kreatif di Skate 3, sehingga pengalaman bermain Anda menjadi lebih seru dan memuaskan.

Memahami Dasar Skate 3 dan Pentingnya Kombinasi Trik Skateboard

Skate 3 menawarkan gameplay simulasi skateboard yang realistis dan interaktif, yang menuntut pemain tidak hanya menguasai trik dasar, tetapi juga mampu menggabungkan berbagai gerakan untuk mendapatkan skor tinggi dan membuka tantangan baru. Kombinasi trik skateboard menjadi kunci keberhasilan dalam Skate 3 karena semakin kompleks kombinasi yang Anda kuasai, semakin besar peluang untuk meraih skor maksimal dan membuka level-level khusus.

Dengan teknologi kontrol yang terus diperbarui hingga saat ini, Skate 3 memungkinkan pemain untuk mengeksekusi trik secara presisi melalui kontrol analog yang fleksibel. Ini membuat setiap kombinasi trik menjadi sangat personal dan unik, meningkatkan elemen kreativitas dalam bermain. Oleh karena itu, memahami mekanisme dasar trik dan cara menggabungkannya secara Continue reading

Skate: Cara Menguasai Trik Skateboard dan Gameplay Bebas Menarik

Di era digital saat ini, budaya skateboarding tidak hanya menjadi sebuah hobi atau olahraga ekstrem, tetapi juga telah berkembang menjadi fenomena global yang menarik perhatian berbagai kalangan, termasuk para pecinta video game. Fokus pada keyword “skate” di artikel ini akan membahas secara mendalam bagaimana cara menguasai trik skateboard dan mengapa gameplay bebas dalam dunia skateboarding sangat diminati hingga periode terbaru.

Pendahuluan: Skateboarding dan Daya Tariknya Saat Ini

Skateboarding sebagai aktivitas fisik telah berkembang pesat sejak kemunculannya dan kini menarik minat lebih besar dengan berbagai inovasi dalam cara belajar dan bermain. Selain menghadirkan tantangan fisik, skateboarding saat ini semakin mudah diakses dan dipelajari berkat kemajuan teknologi serta komunitas yang terus tumbuh. Salah satu aspek menarik dari skateboarding adalah kemampuan untuk menguasai trik – sebuah keterampilan yang menjadi kebanggaan para pemula maupun profesional. Artikel ini akan membahas langkah-langkah utama dalam menguasai trik skate dan alasan mengapa gameplay bebas menjadi aspek yang tak terpisahkan dari pengalaman skateboarding yang mengasyikkan.

Cara Menguasai Trik Skateboard

Menguasai trik skateboard memerlukan kombinasi antara teknik, latihan yang konsisten, serta pemahaman teori dasar skateboarding. Berikut adalah beberapa cara efektif yang bisa diikuti oleh siapa saja yang ingin mendalami dunia skate.

1. Pahami Dasar-dasar Skateboarding

Sebelum mencoba trik sulit, penting Continue reading

Continuous accountability for Verified bots

A driver’s license tells you who someone is and that they passed a driving test, not whether they’ll drive responsibly in the future. The same is true for bots: verifying who operates it creates accountability, but trust depends on what it does next. A known bot can still ignore website preferences, overwhelm origins, or evade controls. It’s not always malicious — often it’s just a misconfiguration or a bug.

As we described in a previous blog post on bot behavior, we strive to verify two questions: “Are you who you say you are?” and “Can we trust you?” To be a Cloudflare Verified Bot, you broadly need to meet three criteria:

1. Identify yourself accurately and securely
2. Do only what you say you will do
3. Don’t engage in abusive behavior

Bots use Web Bot Auth to sign requests that establish their identity, which BotBase then catalogues in an open format. With identification addressed, our focus shifts to the second cardinal rule of Verified bots: thou shalt do no harm.

Today we introduce a system to evaluate and report when Verified bot behavior starts to deviate from this rule, ensuring that the answer to “Can we trust you?” remains “Yes.”

Continue reading

Best of the Hedge: 17, Programming Skills for Network Engineers

Network engineers do not need to become full-time coders to succeed–but some coding skills are really useful. In this episode of the Hedge, David Barrosso (you can find David’s github repositories here), Phill Simonds, and Russ White discuss which programming skills are useful for network engineers.

download

Automating Open-Source Malware Defense with Semgrep

Inference patterns create unique network demands

This post emphasizes the significance of network design for inference in AI, highlighting its distinct KPIs: Time to First Token (TTFT) and Inter-Token Latency (ITL). It discusses the prefill and decode phases, their resource profiles, and the challenges of KV cache management in multi-tenant environments, stressing the impact of network congestion on user experience.

The post Inference patterns create unique network demands appeared first on /overlaid.

A fully programmable secure web gateway

Every secure web gateway on the market works the same way: traffic matches a condition. A terminal action fires. Allow, Block, Isolate, Log. This model has been the foundation of network security for nearly 30 years, and it handles the common case well. But it has a ceiling, and customers with complex environments hit that ceiling regularly.

Earlier this year, we shared our vision to build a truly programmable SASE platform. We also outlined how the term programmability has become diluted by the security industry. Most vendors claim programmability because they have public APIs, Terraform providers, webhooks, and alerting. Cloudflare offers all of those things too, but that’s not enough. True programmability means running your own code — arbitrary logic that you wrote for your specific environment — inline in the policy evaluation path, at the moment a security decision is made.

Today, we’re excited to announce Cloudflare is bringing true programmability to Cloudflare Gateway and DLP (Data Loss Prevention) by integrating it with the entirety of our edge computing platform. We are releasing a new type of Gateway action, Forward, and custom validation functions, available to all Zero Trust plans. These capabilities allow you to use a Cloudflare Worker Continue reading

When Faster Supercomputers Aren’t Enough: A Million Reasons Why Advanced Computing Matters For Genomics

Deploy with Void

VoidZero's tools such as Vite, Vitest, Oxc, and Rolldown — bundled in one toolchain as Vite+ — have made frontend development faster, but building full-stack applications requires more than just a tooling stack. These applications need server routes, databases, local development environments, and a fast and easy way to deploy ideas to production.

We’re excited to open-source three new products that bring server routing, typed data access, and Cloudflare deployment into a unified Vite workflow.

• Void Platform: A shared deployment platform for teams to host Void apps on Cloudflare.
• Void SDK: A composable JavaScript SDK for building full-stack apps with Vite.
• Void CLI: A CLI for provisioning resources and deploying Vite apps to Cloudflare.

The CLI deploys apps built with the SDK to the Platform. All three products are open-sourced as a single JavaScript package and Vite plugin that you can install via npm install void. With Void, you can build your server and client together, carry types from your database to the UI, and let Void automatically provision the Cloudflare resources that your app uses.

We originally set out to build a single, private platform for all users to deploy apps to. After VoidZero joined Cloudflare, we Continue reading