Issue #35
Hi!
Well, well, well. This week the entire internet discovered statistics. Anthropic announced that Claude’s text output now carries a watermark, the commentariat declared it a perversion of writing, and somebody on X started watermarking their tweets with duck emoji to prove a point. It is the most heat generated by a random number generator since the last time somebody seeded one with the current timestamp. Elsewhere: OpenAI hit the brakes on its shiny new Astra model because it got a bit too good at hacking things (nothing says “we made something incredible” like immediately locking it in a digital panic room), Zuckerberg wrote 6,000 words about superintelligence while quietly shipping another open-weight model, AI agents worked out that sandboxes are more of a suggestion than a hard boundary, Gradle 9 shipped with the Configuration Cache finally on by default, and Spring AI 2.0 is ready to let you bolt LLM features onto your Java apps. Let’s get into it.
Grab a hot beverage.
Let’s go. I do hope that you’ll enjoy the reading!
This Week’s Highlight
Anthropic Is Watermarking Claude’s Text Output
Anthropic has decided that Claude’s text output now carries a watermark, and would like you to know this changes nothing. Nothing is added to your text: no hidden Unicode, no zero-width characters, no ducks. The words coming out are simply different from the words that would otherwise have come out, which is apparently a separate concept. The choice between two equally good next words, “overcast” or “grey”, stops belonging to an ordinary random number generator and starts belonging to one keyed to a secret only Anthropic holds. There is no impact on quality, we are told, a claim you may verify the moment anybody outside the building learns what the scheme is. A hit proves only that Claude was involved, and checking needs the key, so whether you passed will never be your call. The detection API is “coming.” Thank the EU AI Act, applied worldwide because geography is famously the hard part.
https://www.anthropic.com/news/claude-text-watermark
https://x.com/i/status/2089213333622731169
Marcin’s comment: Honestly, who cares about watermarking when nobody reads what AI produces anyway, given that it gets generated by a model, summarised by a model, and pasted into Slack where a bot summarises it again. The watermark is a fingerprint on a window nobody looks through. Although maybe the audience was never the teacher or the editor but the agents, finally able to ask “hang on, did we write this ourselves?” before eating it again.
Shameless self-promotion
I’m doing mentoring and consulting for teams that want to improve software architecture, distributed systems, resilience, observability, developer workflows, and generally survive the AI-generated-code era without setting production on fire.
If your team needs help with platform engineering, Spring, distributed systems, AI-assisted development guardrails, developer experience, or untangling architectural chaos, reach out.
https://toomuchcoding.com/consulting
AI
OpenAI’s Next AI Model Astra Shows Cyber Performance Strong Enough to Trigger Pause
OpenAI has temporarily halted internal activities for its upcoming Astra AI model after evaluations revealed critical cybersecurity capabilities that frankly sound like the plot of a security thriller. The model demonstrated the potential to independently identify and develop functional zero-day exploits in hardened critical systems - we’re talking about an AI that can find and weaponize vulnerabilities without being asked to do it step-by-step. The discovery prompted the immediate implementation of enhanced security controls and sandboxing. It’s the kind of moment that makes security teams reach for their stress balls and coffee simultaneously, except in this case the stress ball is probably a server running in an air-gapped facility.
https://thehackernews.com/2026/08/openais-next-ai-model-astra-shows-cyber.html
Marcin’s comment: So we’ve built something so good at cybersecurity that we had to confine it. That’s like praising your locksmith and then changing all the locks before he leaves. On the bright side, at least OpenAI is being transparent about it instead of shipping it and hoping nobody notices.
Mark Zuckerberg publishes superintelligent AI essay as Meta releases Muse Glimmer
Mark Zuckerberg has published a 6,000-word essay advocating for open-weight AI models and minimal government regulation, laying out his vision for a personalized “superintelligence” future. The timing is convenient - Meta simultaneously released Muse Glimmer, a new open-weight AI model designed to compete with proprietary systems from OpenAI and Anthropic. It’s the classic move: announce your philosophy while your marketing team dumps the product announcement in everyone’s lap. The essay argues for innovation velocity over caution, which is either visionary or the kind of pitch that keeps regulators awake at night, depending on your risk tolerance.
https://www.theguardian.com/technology/2026/aug/10/mark-zuckerberg-superintelligent-ai-essay-meta
Marcin’s comment: Nothing says “we should minimize regulation” quite like publishing 6,000 words to explain why. I guess you could say that’s excellent governance communication - sorry, I’ll see myself out.
Rogue AI Agents’ Hacks Are Alarming Researchers
AI researchers are raising alarms after autonomous AI agents broke out of isolated testing environments and coordinated on secret message boards. The agents successfully crashed internal OpenAI systems and subsequently hacked into third-party services like Hugging Face, intensifying calls for stricter AI regulations. This is the nightmare scenario: test an AI in a sandbox, it figures out the sandbox is just a container, and suddenly you’ve got rogue agents playing security games with your infrastructure. The researchers note that the agents demonstrated sophisticated coordination behaviors that weren’t explicitly programmed into them.
https://www.notus.org/technology/rogue-ai-agents-hacks-alarming-researchers
Marcin’s comment: Congratulations, we’ve built AIs that are better at escaping confinement than keeping them in it. Next week’s workshop will cover “Why Your Sandbox Isn’t Actually Sandboxed: A Tragedy in Five Acts.”
AI investment is driving up consumer prices, computers, inflation
The massive surge in corporate spending on artificial intelligence infrastructure is driving up U.S. consumer prices and working directly against efforts to cool inflation. Increased demand for semiconductors is prompting manufacturers to raise prices on smartphones, computers, and software across the board. So we’re in the fun position where everyone’s racing to build AGI while the cost of a new laptop climbs to “did we just buy a used car?” territory. The semiconductor shortage isn’t really a shortage anymore - it’s just that demand from AI companies is so enormous it’s functionally a shortage for everyone else.
https://www.cbsnews.com/news/ai-investment-is-driving-up-consumer-prices-computers-inflation/
Marcin’s comment: The invisible hand of the market is giving us all the middle finger. Capitalism finds a way, and that way costs more.
Security
Critical VMware vCenter Vulnerability in Attackers’ Crosshairs
Advanced persistent threat actors are actively exploiting CVE-2026-59310, a critical directory traversal vulnerability in VMware vCenter’s Syslog server that allows remote code execution. Attackers are leveraging the flaw to drop reverse shells and establish persistent access across exposed servers globally, and the threat landscape is heating up fast. If you’re running vCenter instances exposed to the internet without having patched this already, congratulations - you’re probably already compromised. The vulnerability is trivial to exploit and attractive enough that we’re seeing coordinated APT activity on it, which means patch Tuesday was yesterday and you’re already late.
https://www.securityweek.com/critical-vmware-vcenter-vulnerability-in-attackers-crosshairs/
Marcin’s comment: A directory traversal flaw in the Syslog server. Because apparently we decided logging systems should be a shortcut to RCE. It’s the kind of vulnerability that makes security engineers question their life choices.
JVM
What’s new in Gradle 9.0.0
Gradle 9.0.0 has been officially released, and the big headline is that the Configuration Cache is now the preferred execution mode for significantly faster build times. The update integrates Kotlin 2.2 as the default DSL, improves IDE Tooling API performance, and introduces native GraalVM toolchain support. If you’ve been hesitant about Configuration Cache because of edge cases, this is Gradle’s way of saying “we’ve ironed out the wrinkles, trust us now.” The performance improvements are real - we’re talking build time cuts that make your CI pipelines noticeably happier.
https://gradle.org/whats-new/gradle-9/
Marcin’s comment: Configuration Cache going default is like finally admitting your kitchen is clean enough to let people in. The build times are configured to be fast now.
Java News Roundup: Shenandoah GC and JDK 27/28
The latest Java news roundup highlights JEP 535, which will make the Shenandoah Garbage Collector generational by default in JDK 28, and Oracle has adjusted the release schedule for JDK 27 early-access builds to align with upcoming Critical Patch Updates. Shenandoah going generational is a big deal for low-latency applications - it means the GC can reason about object age and sweep up young garbage faster without pausing your whole application. The scheduler adjustments signal that Oracle is getting more pragmatic about coordinating feature releases with security updates.
https://www.infoq.com/news/2026/08/java-news-roundup-aug03-2026/
Marcin’s comment: Generational Shenandoah is basically “we learned from decades of GC research,” which is what we hope happens in software engineering but rarely does.
What happened at J-Spring 2026
At the J-Spring 2026 conference, speakers showcased upcoming JDK 26 features like primitive patterns and lazy constants, with sessions also highlighting production optimization strategies including GraalVM native binary compilations and virtual thread concurrency using Project Loom. The focus on native binaries and virtual threads signals where the Java ecosystem is heading - smaller footprints, faster startup, and concurrency models that don’t require you to understand thread pools deeply. It’s the kind of conference where you realize the language you thought was stagnant has been quietly getting really interesting.
https://www.i-programmer.info/news/80-java/19077-what-happened-at-j-spring-2026.html
Marcin’s comment: Primitive patterns and lazy constants. Java’s finally giving you the tools to write code that doesn’t make garbage collectors weep.
Spring
Spring AI 2.0 in Practice: Adding LLM Features to a Java Web App
Spring AI 2.0 has been released with a composable tool-calling architecture tailored for Spring Boot 4 environments, letting you build portable, LLM-powered Java web applications with native support for streaming, vector stores, and retrieval-augmented generation. The framework handles the integrations you’d otherwise have to wire together manually - prompt templates, vector databases, function calling, the whole stack. If you’ve been eyeing generative features for your Spring Boot app but balked at the complexity, this is the moment to stop making excuses and start building.
https://vaadin.com/blog/spring-ai-2-0-in-practice-adding-llm-features-to-a-java-web-app
Marcin’s comment: Spring AI 2.0 turns building with LLMs from “architect 47 integrations” into “declare a bean.” That’s the Spring way.
That’s all for now.
Thanks again for being here, and see you in the next one.