Since 2012, musl’s crypt() returns “*” when it can’t hash a password, and anything over 256 bytes fails. “*” is also what Linux stores for an account with no password. Long password in, “*” out, “*” on file: login accepted. A 2016 OpenSSH change makes sshd borrow another account’s salt, so the attack only needs one user on the box with a real password.
All four at once: Alpine (or another musl system) running OpenSSH without PAM, which is how Alpine ships it; password logins on, the default; an account with no password set (“*”, not locked with “!”); and another account that has one. Debian, Ubuntu, PAM setups and containers that don’t run sshd are fine.
Where it bites: a payroll SaaS takes client files over SFTP in an Alpine container. Clients use passwords, the internal ops account uses keys only. Anyone who reaches port 22 can sign in as ops. Or an Alpine cloud VM whose alpine user (passwordless doas, so root) was safe until someone added a password account for an auditor.
apk upgrade -U -a and restart sshd. Upgrading the package doesn’t replace the running daemon.The same week, a Paint RCE fix that some Windows fleets couldn’t get from the Store, and an AI coding agent sending its user’s email to third-party sites, made the same point: the risk sits in defaults nobody reviewed.
We inventory what actually runs on your hosts, VMs and edge devices, enforce SSH and account baselines in CI, and keep one patch report across packages, images and apps. Send us your list of base images and hosts, and within days you’ll know which ones would have let a 257-character password in.
With a coding agent, that same engineer ships four thousand lines before Friday. The pull requests look clean, the tests are green, and the design decisions underneath are still bad. Only now there are ten times as many of them, spread across your codebase.
Google’s DORA team surveyed nearly 5,000 technology professionals for its 2025 report on AI-assisted development. Their headline: AI acts as an amplifier. It magnifies what high-performing teams already do well, and the dysfunctions of teams that struggle. Throughput went up with AI adoption. Delivery instability kept rising too.
GitClear analyzed 211 million lines of code and found the same pattern from another angle. In 2024, code blocks with five or more duplicated lines grew eightfold, and moved (refactored) lines fell almost 40%. It was the first year copy-paste outnumbered refactoring.
Agents write code fast. Whether that code stays cheap to change depends on the person steering them.
A fintech reconciliation service. The agent needs rounding rules and writes them inline, four times, in four files. Months later, a regulator changes the rule. Someone updates three of them. The fourth produces a one-cent mismatch per transaction that finance spends a quarter chasing.
A marketplace order API. A junior asks for “retry on failure” and gets exactly that, minus an idempotency key. Under load, the payment provider times out, the job retries, and a slice of customers are charged twice on your biggest sales day.
A SaaS reporting module. Every new report gets its own query, written from scratch by the agent. Each one is fine alone. Together they turn the database into the bottleneck, and nobody can say which of 60 near-identical queries to optimize.
A logistics schema migration. Generated in seconds, reviewed in minutes, no down migration. It works in staging. In production it locks a table during peak hours, and rolling back means a manual restore.
None of these are model failures. The model did what it was asked. The missing piece was someone who knew what to ask, and what to reject.
Typing speed stopped being a differentiator. What separates engineers in 2026 is judgment:
A strong engineer with an agent is a small team. A weak one with an agent is a growing maintenance bill.
Nebulosa provides managed engineering contractors from Latin America for companies that need to grow their team or run part of it. You get engineers who work in your stack, your time zone and your repos, and we handle the rest:
The cost of a bad hire grew with every model release. The upside of a good one grew faster.
AI agents suit this kind of watch. They don’t sleep and they don’t get bored. Their limit is context: a model sees only so much text at once, and a full stack, with its logs, metrics and code, will never fit. Ask one agent to cover all of it and it either samples too thin or forgets what it saw an hour ago.
Split the stack the way your team already does, and give each part its own agent:
A coordinator sits on top. It never sees raw logs, only short findings, and turns three related signals into one incident for the on-call engineer.
Pick the subsystem that hurts most when it fails silently. We’ll build its specialist on your telemetry, read-only, next to the alerts you already have.
]]>If your company ships software, here’s what that means:
The tool is the easy part. The real work is doing it with authorization, validating every finding with tests and fixing what turns up. That’s what we do.
Want to know what an AI agent can learn from your app? We’ll run a proof of concept on your own build.
]]>Where they pay off:
You can run it on Jev’s API or on open-source models like Laya or Kev inside your own cloud, so your data never leaves your infrastructure.
The model is the easy part. The real work is choosing the right questions, calibrating the thresholds and wiring it into your systems. That’s what we do.
Want to see it on your own data? Send us a sample and we’ll build you a proof of concept.
]]>That changed in 2026. Google’s security team now has AI agents doing the first draft of C-to-Rust migrations, and engineers spending their time on verification instead of typing.
The pressure behind it is not new. Memory safety bugs account for about 70% of vulnerabilities in C and C++ codebases, according to Google’s security team. What is new is the clock: as models get better at finding bugs, the time between discovery and exploit keeps shrinking.
Two Google announcements, weeks apart, moved this from research to practice.
The pilot: giflib. Google’s security team rewrote giflib, a widely used C library for GIF images, using Gemini.
The model: Gemini 4 Argon. On September 30, Google announced Gemini 4 Argon. It is a general frontier model, but migrations were one of its headline uses.
Google’s own write-up is clear that AI rewrites are not hands-off. The work moved from typing code to proving it behaves the same. Four things decide whether a rewrite reaches production:
Scope matters too. Google picked giflib because it was small, stable and had no SIMD or assembly. Hand-tuned SIMD code, like libgav1’s, took many rounds of profile-guided work.
We start with the test oracle, not the translation. The order matters, because every later step depends on having something to compare against.
The model writes the first draft fast. The real work is choosing what to migrate, building the oracle, owning the unsafe boundary and shipping with a way back. That’s what we do.
Have a C library that reads untrusted input? Send us the repo and a sample of real inputs. We’ll build a proof of concept: a Rust drop-in running side by side with your C version under a differential fuzzer, so you see the evidence before you decide.