AI and development — August 8, 2026

Hardware and infrastructure

Armenia opens an AI factory, but the big numbers still live in the future tense

Firebird opened an NVIDIA DSX site in Hrazdan. NVIDIA calls it the largest in the CIS and intends to invest in the company; the amount and terms were not disclosed. Named partners include Dell, Schneider Electric, Vertiv, and CoreWeave, with Perplexity as an early customer.

Every impressive figure describes not what came online on August 8, but a future target. More than 70,000 Rubin and Blackwell GPUs and 300 MW in Armenia are due by the end of 2027. Roughly 2 GW across several countries is Firebird's roadmap for the end of 2028. Neither Firebird nor NVIDIA reported current power or the number of installed accelerators.

That does not make the opening meaningless. The company says the site went from an empty construction plot to operation in just over six months; the region now has a real operator with suppliers and a first customer. But the distinction between "opened" and "fully built" is the most important part of the story.

An AI factory is increasingly sold as one unit: compute, networking, power, cooling, and operations. Its capacity cannot be verified from a ceremony photo; we need actual megawatts, installed accelerators, and capacity available to customers.

Sources: Firebird on the opening, NVIDIA on the site.

GPU scarcity is treated with scheduling and memory movement

ElastiCo tries to colocate training and offline inference on the same GPU cluster. Training jobs hold devices even during lighter phases, while inference reserves headroom for peaks; the scheduler chooses resource shapes and pairs of jobs with tolerable interference.

On a 64-A100 test cluster, the authors raised average SM utilization from 25% with static Volcano to 46%. The stronger comparison is not that one but the more honest elastic Lucid baseline: 38% versus 46%. Everything beyond 64 GPUs was tested in simulation rather than on hardware.

OasisKV addresses another source of scarcity. It keeps most of the KV cache out of HBM and prefetches only the blocks likely to be needed by the next decode step. Speculative decoding supplies the hint. On eight H100s, the authors measured 1.69x throughput on one reasoning workload and up to 2.1x on long-context serving versus dense vLLM, while preserving quality within 0.7 points at the chosen KV budget.

Neither preprint has been independently reproduced, and each headline depends on its baseline. Together, however, they show an important direction: a new GPU is not the only way to obtain more compute. A huge reserve lies in when a job occupies the device and which data truly must remain in expensive memory.

Sources: ElastiCo, OasisKV.

Observability and evaluation

Telemetry notices the failure but loses the cause

TelemetrySuffBench separates three questions: did a failure occur, at which step did its cause arise, and should the system abstain when evidence is insufficient?

On synthetic agent traces, five frontier models given full telemetry identified the originating step with accuracy ranging from 33.8% to 97.2%. When the same traces were presented through metadata-, OpenTelemetry-, and OpenInference-like views, failure detection remained nearly perfect at 99.5–100% F1, while cause localization collapsed to at most 0.5%. Removing decision content reduced it to zero for every model.

This is not a measurement of production OpenTelemetry: the benchmark is synthetic, and the format names describe representations chosen by the authors. But it captures a real defect in our dashboards. A failed status and the last error answer "whom should we wake?" They say almost nothing about which earlier decision produced the later failure.

Agent observability needs more than tool logs; it needs provenance: which inference led to the next action, where the data came from, and which policy version allowed the transition. Without those links, an expensive diagnostic model sees a neatly formatted loss of information.

Source: TelemetrySuffBench.

Replay evaluates a trajectory that no longer exists after a model swap

The usual way to test a model router sounds reasonable: take a recorded agent trajectory, replace a cheap model's response with a stronger model's answer, and see whether the outcome improves. The Replay Gap tests that assumption.

The author forked live mini-SWE-agent trajectories at controlled points, restored the environment, and continued with another model. In 74–77% of early swaps, the very next action diverged from the original. All five observed outcome flips occurred in swap arms; none appeared in 359 same-model control forks. Static log stitching incorrectly predicted all five cases in which success could change.

The study is narrow: one scaffold, two small Qwen models, and only five outcome flips. Yet it demonstrates a causal error, not a statistical nuance. A new answer changes the next tool call, that call changes repository state, and the old trajectory ceases to be a counterfactual.

A neighboring preprint on routing adds a second warning. Across four standard benchmarks, the theoretical oracle gap was large, but the best prompt router recovered only 7.5–14.4% of it. After correcting for selection among 11 policies, the data did not establish an advantage over the best fixed model at all. The experiment used 0.5–7B models rather than frontier agents, so the discipline of the conclusion matters more than its magnitude.

A router must be evaluated through a live fork, and its victory tested after selection. Otherwise an attractive gain is manufactured twice: first by a replay that never existed, then by choosing the best configuration on the same data.

Sources: The Replay Gap, selection-valid routing diagnostics.

Agent security

Prompt injection in VirusTotal meets llama.cpp containers

Researcher ropbear published three prompt-injection attacks against VirusTotal's Gemini-backed Code Insights API. A comment in analyzed code made the model label download-and-execute behavior as a benign tool in 45 of 50 requests; another attributed harmless code to a fictional APT1234 group in 21 of 50. A third payload broke the expected response schema and exposed the backend model string.

Google and VirusTotal did not publicly confirm the work. This is one self-published report, with tests designed and graded by the author, while the post-patch samples contained only ten requests each. The percentages should not be read as a stable benchmark. The mechanism is plausible, however: the system passes code and comments from an untrusted file into an LLM, then treats its textual verdict as analysis.

The same day, llama.cpp merged initial tool isolation for its existing agent mode. llama-server can now proxy built-in shell tools into a Docker container instead of the host. This is an early merge, not a finished security boundary, but the direction is right: untrusted input will still reach the model, so the consequence of a tool call must be constrained by infrastructure.

A scanner that reads potentially malicious code must treat the code itself as a hostile instruction. Defense begins not by asking the model to ignore comments, but by ensuring that its wrong conclusion has no direct path to the host and secrets.

Sources: Code Insights research, tool isolation in llama.cpp.

Claude Code brings trust, budget, and remote sessions into one place

Claude Code 2.1.225 learned to show the spend limit imposed by an LLM gateway, together with reset time and an operator message. The claude agents command gained a workspace trust prompt. And SendMessage can now not only reply to a remote session, but initiate a conversation with a Remote Control session found by name on another machine.

Much of the release fixes exactly the seams created by long-running distributed work: an ephemeral token must not overwrite a persistent one, a message must not remain stuck forever without notification, and a self-hosted runner must verify a writable directory before registration.

Individually, these are changelog maintenance. Together, they show that a coding agent is no longer a process in one terminal. It has a workspace identity, remote peers, an external gateway budget, and its own lifecycle. That makes a control-plane bug more dangerous than a poor model answer: it can halt every session, deliver a message to the wrong place, or silently replace credentials.

Source: Claude Code 2.1.225.

Models and languages

Safety tuned for English does not transfer automatically

SurakshaEval assembled 2,968 human-written prompts in ten Indian languages and English. They cover general and regional risks: politics, caste and ethnic stereotypes, law, culture, specific people, and adult content. The authors ran 27 models and observed worse safety in native scripts, especially for lower-resource languages.

The headline scores look precise—for example, a best combined pass rate of 70.7—but the ground truth is weaker than that precision implies. Responses were graded by a panel of GPT-4.1-mini and GPT-5-mini, and agreement with humans on a Malayalam sample was 69.2%. The ranking should therefore be treated as a signal, not a final verdict.

The substantive conclusion is simpler. Translating a safety policy does not produce local safety. Implicit bias, regional history, and permissible context surface through language itself, while a judge trained on another distribution may miss the very failure it is supposed to measure.

A multilingual product needs more than a translated interface and system prompt. It needs local scenarios, native speakers in the review, and a separate evaluation of the judge itself.

Sources: SurakshaEval, project repository.

Developer tooling

SGLang becomes an operating system, not merely an inference engine

SGLang 0.5.17 shipped in a cycle of 582 pull requests from 194 contributors. The release added serving for Kimi K3, rewrote the server's front half from Python in multithreaded Rust, and made Unified Radix Cache aware of session references so eviction does not remove a prefix still held by an active agentic or RL session.

A separate weight-cache daemon keeps weights on the GPU when the engine restarts. The project says that, in one case, loading DeepSeek-V4-Pro TP8 fell from roughly 35 minutes to 6 minutes 20 seconds. This is an internal measurement from one configuration, not a universal 5.6x for every model.

More interestingly, the optimizations are not confined to kernel throughput. The server frontend, restarts, cache session ownership, and distributed prefill are becoming equal parts of the serving stack. When a model weighs hundreds of gigabytes, six minutes of recovery and one wrong eviction decision can cost a product more than a few percent of matrix-multiply speed.

The inference engine is gradually becoming an operating system for long-lived model sessions.

Source: SGLang 0.5.17.

A short open-source signal

ComfyUI 0.31.0 added local support for Wan-Animate2 and MiniMax-H3, a universal w4a8 quantization scheme, and API nodes for Flux 3 video and SeeDance 2.5. The last two are clients for hosted APIs, not new open weights. It is a small but useful distinction: an interface in an open-source tool does not make the model it exposes open.

Source: ComfyUI 0.31.0.

The issue's main technological shift

On August 8, the scarce resource was not model power but preserved causality.

A scheduler sees GPU occupancy but must understand interference. Observability sees a failure but loses the decision that caused it. Replay preserves an old log, but not the world that would follow another answer. A safety benchmark translates a prompt, but not necessarily the local context or judge quality.

The next layer of agent infrastructure must therefore preserve not more data, but the right links: decision -> action -> environment change -> result. And it must constrain action where those links can still be wrong.