Last year, we enabled Media over QUIC (MoQ) on every Cloudflare server and opened the network for anyone to test. It provided a global MoQ endpoint, but not the isolation and access controls needed to run an application.
Today, we’re adding those isolation and access controls. The new MoQ provisioning API lets you create an isolated relay for your application and issue separate credentials for publishers and subscribers. The relays you create are available across Cloudflare’s network within seconds, with no servers to deploy, size, or load balance. Cloudflare now supports the draft-14 and draft-16 versions of the MoQ Transport protocol with authentication support.
You can create relays through the API and the Cloudflare dashboard. They are completely free to use during beta.
A QUIC recap on MoQ
MoQ (originally short for Media over QUIC) is a new open protocol under development at the Internet Engineering Task Force (IETF), the standards body that also standardized HTTP, TLS, and QUIC. It is being developed in the open and will become a free public standard (an RFC) that anyone can implement. No single company owns it.
MoQ is a publish/subscribe system. A publisher sends out streams of data that have names, and subscribers ask for those streams by name. Between them sit relays, which are just CDN servers that copy each stream to everyone who wants it. A relay never has to look inside the data it forwards, so one publisher can reach a large audience without handling the fan-out itself.
Because relays don't care what's in the data, the same protocol can carry many things that each used to need a separate system: live video, video calls, low-latency messaging, and more. It runs on QUIC, the transport under HTTP/3, which is what keeps latency low.
The practical result is that you don't have to build and run your own fleet of specialized servers. You publish to a CDN through one simple API and get both low latency and large scale for much less cost.
How we got here: the MoQ open preview
Last year, we launched the first global MoQ relay network: every Cloudflare server in over 330 cities became a MoQ relay, free and open to anyone. Because these endpoints required no authentication, they were ideal for protocol testing and client development. More than 1,000 unique clients still connect each day to test against them.
But an unauthenticated relay isn't suitable for production, because you can't control who publishes and who subscribes. That rules out any application that needs confidentiality, access control, or a clear split between publisher and subscriber roles. Take a live auction site, where bids have to reach bidders in milliseconds. MoQ is a good fit, but publishers and subscribers need different permissions, so that a viewer's credentials can't be used to hijack the publisher's tracks.
What is a relay on the Cloudflare MoQ Network?
In most MoQ deployments today, a relay is a dedicated server or a dedicated process on a shared server. Scaling this architecture means running more instances, assigning clients to them, and adding load balancers as demand changes. This is not how any Cloudflare service works, including our Realtime SFU WebRTC service.
Provisioning a relay doesn’t start a virtual machine, container, or dedicated process. Instead, it creates an isolated scope across the existing global network.
That scope separates your namespaces, tracks, and objects from those belonging to other relays. It also defines who can enter the scope and whether they can publish or subscribe. Clients connect to the Anycast endpoint, and Cloudflare handles routing them across the network.
If you’re familiar with web hosting, creating a Cloudflare relay is more like adding a virtual host than starting a new web server. Since the infrastructure is already running, the provisioning API adds your application’s configuration and credentials. This makes the relay available immediately without choosing regions, estimating capacity, or setting up a load balancer.
The control plane API for MoQ at Cloudflare
The provisioning API is a control plane: it manages relays and the tokens used to reach them, and it never touches the media that flows through them.
There are two kinds of resources.
A relay is the isolated scope from the previous section, so one application's streams never mix with another's.
A token is a credential that grants a set of operations (publish, subscribe, or both) on a single relay. Handing publishers and subscribers different tokens is what stops a viewer from taking over a broadcaster's tracks.
Each token is scoped to the operations a client needs, can be given an expiration, and can be revoked on its own. That lets you grant exactly the access a client should have, and take it back later without disrupting anyone else.
For now, each token applies to an entire relay and permits publishing, subscribing, or both. We're working in the IETF and the wider MoQ community on a richer scheme that works for everyone. If you have opinions, tell us at [email protected].
Creating a relay takes a single API call and only needs a name:
Cloudflare returns a relay ID and the two default tokens: The first token can publish and subscribe, and the second can only subscribe.
To give a client narrower access, add more tokens. This one is a subscribe-only token for viewers that expires at the start of 2027:
In the Cloudflare dashboard
You can also create a relay in the dashboard:
Go to Media > Realtime > MoQ Relay. Select Create relay, give it a name, and then confirm.
Connect a publisher and a subscriber
You can create and manage tokens through the API or dashboard, just as you can the relay itself. Give your broadcaster the publish-and-subscribe token and your viewers the subscribe-only token. Each client sends its token when it opens a MoQ session, and the relay enforces what that token is allowed to do.
The token travels in the URL path. For example, with the open-source moq-rs tools, a broadcaster can publish a fragmented MP4 stream from ffmpeg:
A viewer connects with moq-sub:
The relay reads the token when the session opens and checks whether the requested operation is allowed.
What we changed to support draft-16
The provisioning API is only one part of what’s new. The MoQ transport itself is advancing fast, and Cloudflare now supports draft-16 of the IETF MoQ spec in its relays. This draft adds two features relevant to publishing and subscribing.
PUBLISH now lets a publisher send a track to a relay before a viewer requests it. Without PUBLISH, the first subscription must travel through the relay chain to the publisher before the publisher starts sending. With PUBLISH, the relay can already be receiving the track when the first viewer connects.
SUBSCRIBE_NAMESPACE lets a subscriber request every track announced under a namespace instead of requesting tracks individually. The subscription also covers tracks added later, such as a new video rendition or audio track introduced during a live stream.
You can now connect a draft-16 client to use both features.
Built in the open
MoQ is an open standard, developed at the IETF by engineers across the industry. This lets clients and relays implement a common protocol. That interoperability is less useful if every relay provider requires a different control plane for creating scopes and issuing credentials.
In that vein, we’re documenting the design behind this API in the MoQ CDN Provisioning Internet-Draft. The draft calls the provisioned resource a scope rather than a relay, but both terms refer to the same logical delivery context: a boundary that applications create and then enter with a credential.
The goal is for multiple CDN and relay implementations to support a common provisioning model. The document is still an Internet-Draft, not an RFC, and its API model may change as the working group develops it.
Available today, still free in beta
The MoQ relay provisioning API is available now, as part of the MoQ beta. It's free to use at any scale during this preview period.
The API will change as we develop it, so we recommend checking the developer docs for updates and breaking changes.
We’d also love to hear what you want next. Finer-grained permissions? Bring-your-own signing keys? Let us know at [email protected].
Black Hat USA returns to Mandalay Bay in Las Vegas this August, bringing together security practitioners, researchers, and leaders from around the world. Rapid7 will be there in the Business Hall, with new capabilities, live demonstrations, expert-led sessions, and two days of activities at the Border Grill.
This year, our focus is preemptive security: helping security teams anticipate credible risk, respond at machine speed, and maintain an accurate view of their security and compliance posture as their environment changes.
Visit the Rapid7 booth at Black Hat USA
You can find Rapid7 at booth #2445 in the Mandalay Bay Business Hall, open and running on the following days and times:
Tuesday, August 4: 4:00–7:00 p.m.
Wednesday, August 5: 9:00 a.m.–6:00 p.m.
Thursday, August 6: 9:00 a.m.–4:00 p.m.
The booth will include two demonstration stations, seating, giveaways, and our friendly team of Rapid7 experts – there to help you explore the challenges most relevant to your organization. A chess-inspired theme reflects the principle behind preemptive security: understanding what may happen next and acting before risk becomes an incident.
Live demonstrations will cover four connected areas of the Rapid7 platform:
Predictive risk and vulnerability management: See how attacker behavior and exposure context can help teams focus remediation on vulnerabilities that present credible risk.
Agentic threat detection and response: Explore how the Rapid7 AI Engine and technology from Kenzo Security support adaptive investigations and reduce the time analysts spend gathering context.
Continuous compliance automation: See how Cyber GRC connects governance workflows with live security data, automates evidence collection, and identifies control drift.
Preemptive MDR: Learn how continuous SOC operations, exposure context, and Rapid7 Labs threat intelligence can extend the coverage of internal security teams.
Explore the latest Rapid7 launches at Black Hat
Black Hat will provide a closer look at several additions to the Rapid7 platform, including the general availability of Cyber GRC.
Cyber GRC brings security operations and governance teams closer together by connecting GRC workflows with live security data. The solution draws evidence from SecOps telemetry into compliance dashboards, helping teams maintain a current view of their controls, while AI-assisted workflows reduce the manual inputs involved in third-party risk questionnaires and other repetitive tasks.
Attendees can also learn more about Preemptive MDR Alerts, predictive vulnerability management, and enhanced agentic SOC investigations. These capabilities combine exposure data, asset criticality, threat intelligence, and detection context to help teams identify where attackers are most likely to act. Some will be presented as early-access previews, so availability will vary.
Join us at Border Grill
Rapid7 will take over the Border Grill at Mandalay Bay on Wednesday, August 5 and Thursday, August 6. The space will include additional demonstrations, meeting areas, expert presentations, breakfasts & lunches, and opportunities to speak with Rapid7 leaders and product teams.
Rapid7 Executive Chairman Corey Thomas will discuss how AI-driven threats are changing security operations and what it takes to move toward a more preemptive model.
Agentic SOC: Threat Detection and Response
Thursday, August 6, 9:30–10:15 a.m.
Lisa Washburn, Senior Director of Product Management, will explore how AI agents can investigate alerts at machine speed while keeping expert judgment involved.
Cyber GRC in the Age of AI
Thursday, August 6, 11:30 a.m.–12:15 p.m.
Jon Schipp, Senior Director of Product Management, will show how live security data and automated evidence can support continuous audit readiness.
Border Grill will also host live demos, customer and executive meetings, and the Rapid7 Happy Hour on Wednesday. VIP access begins at 4:00 p.m., followed by general admission from 5:00–7:30 p.m.
Hear from Rapid7 security researchers
Rapid7 researchers Jack Heysel and Spencer McIntyre will present The Metasploit Framework 6.5: Malleable C2 Payloads, New Relay Capability and Protocol Session Upgrades at Arsenal Station 4 in the Business Hall on Wednesday, August 5 from 4:00–5:00 p.m.
Book time with Rapid7 at Black Hat
Whether your priority is reducing exposure, giving SOC analysts better context, improving response speed, or strengthening audit readiness, you can book a meeting or tailored demonstration with the Rapid7 team.
Last month, the story broke (alternate link) that Madison Square Garden uses facial recognition software on everyone entering the facility, and—among other groups—flags activists that oppose using facial recognition.
Turns out that the system was shut off for Taylor Swift’s wedding.
Evan Greer—one of the people that MSG alerts on—comments:
Ironically, Swift herself has reportedly used facial recognition at her own concerts to identify stalkers. This “privacy for me, surveillance for thee” attitude feels like a perfect encapsulation of the future we’re already living in: one where wealthy elites can afford privacy, while the rest of us are forced to live in a corporate surveillance panopticon.
Whatever privacy measures Swift had in place for the wedding seems to have worked. No photos have leaked online.
Дизайнът винаги ме е привличал. Дотолкова, че в един момент от младостта си дори си представях как го изучавам в университета. Слава богу, открих фотожурналистиката преждевременно (или тя мен), а веднага след нея – и визуалния сторителинг (разказване на истории – б.р.). Всичко оттам нататък бе подчинено на едно-единствено желание: да разказвам истории в образи.
В дизайна също има немалко сторителинг. В него безкомпромисно стои и функцията. Именно тук се различават дизайнът и художествените изкуства. Много млади хора биват привлечени от територията на дизайна, бъркайки я с място за естетическо себеизразяване. Както често отбелязва моята колежка и бизнес партньорка Деница Тонева, между двете съществува фундаментална разлика: дизайнът е длъжен да служи на човека, докато изкуството няма такова прагматично задължение. Поне не и в ежедневния, утилитарен смисъл. Изкуството служи на духовните ни потребности и на емоционалното свързване със самия себе си и с другите в обществото.
Въпреки това в дизайна има огромно пространство за творчество, защото той сам по себе си е метод/начин на работа и светоглед (като не-дизайнер мога да си позволя лукса да се изказвам лаически). Дизайнът борави с визуалния език и с всички смисли и знаци от историята на изкуството, през семантиката, до съвременния начин на живот и съответните културни и трансдисциплинарни елементи от ежедневието. Но истината е, че оставам силно заинтригувана от методологията, тоест от начина, по който дизайнерите сканират околната ни среда, как събират, курират, разчитат и накрая превеждат хаоса на езика на формите. Това за мен си е висш пилотаж на вкуса.
Под полите на Витоша
Дизайнът е просторно понятие. В него съжителстват дузина паралелни светове: от анатомията на буквите и шрифтовете, през физическите обекти, до пространствените инсталации и дигиталните преживявания. Затова и не пропускам фестивала „Мелба“, на който екипът на студио „Комплект“ привлича световни имена от тази сфера.
Тази година София беше домакин на фестивала Европейски награди за дизайн 2026(European Design Awards). Зад организацията на това мащабно гостуващо събитие стои дългогодишният упорит труд на Бояна Гяурова и Адриана Андреева от студио „Комплект“, които парче по парче градят местната дизайн среда. Този път те буквално поставиха България на европейската карта, привличайки стотици чуждестранни специалисти, които се „вмъкнаха под полите на Витоша“ (директно намигване към визуалната идентичност на събитието, разработена от дигиталната агенция Next-DC).
Фестивалът за комуникационен дизайн се проведе между 11 и 14 юни в София и предложи богата програма с изложба на плакати, посещения в български дизайн студиа, обмен между европейски специалисти, изложба „20 години комуникационен дизайн“ и два дни вълнуващи лекции на международни и български дизайнери. Всичко това, последвано от черешката на тортата – наградите в множество категории. Един от най-интересните моменти на подобни събития са лекциите, за някои от които ще споделя в следващите редове.
Оголване на излишното
В добрия дизайн всяка стъпка логично следва предишната. Едно от златните му правила гласи: „Кажи го кратко и ясно.“ Няколко от лекторите подчертаха, че простите идеи не са скучни или повърхностни – те са достъпни. Извън този празничен балон обаче в България все още дизайнът се бърка с декорацията, с повърхностното „разкрасяване“, а не със смисленото структуриране. В този контекст простото се възприема като враг – като нещо празно, недостатъчно сочно и лишено от превземки.
Нидерландското студио G2K (представено от Франк Баас и Юри Наута) обаче изповядва тъкмо обратното верую: Keep it simple. Неговата философия изисква да се оголи излишното, за да се разкрие есенцията. Баас и Наута илюстрираха своя подход, давайки пример с работата си по визуалната идентичност на театъра в Гронинген. След като достигат до есенцията на тази културна институция, се ражда и техният визуален преразказ на същността ѝ: „Да провокираме и разбъркаме мисълта.“ Така се създава една смела, директна визия, която умишлено залага на объркания текст, доверявайки се на факта, че човешкият мозък има капацитета да се справи с хаоса и да сглоби смисъла сам.
Понякога дизайнът се проявява и в ежедневните решения. Доказаха го немският графичен дизайнер Пол Вогенрайтер и българският му колега Мирослав Живков. Тяхното сътрудничество се разгръща по оста София – Велико Търново – габровското село Баланите. Пол постепенно се мести от Германия към Пловдив, после към Търново и накрая се установява в къща в село наоколо, а Мирослав основава независимото си печатно студио NoPoint Atelierв село Баланите.
NoPoint Atelier преобразява една стара къща в творческа лаборатория, където ежедневното рисуване и аналоговите процеси се превръщат в терапия и начин за осмисляне на света. За Мирослав Живков е нормално да произведе 20 скици за час. Динамика, в която той умишлено търси свобода, за да не позволи на рутината да пречупи творческото му аз. Заедно с Пол Вогенрайтер осъществяват концепцията за плакат със своите проекти, създадени за пространството ТаМ. Постоянното изследване на границите между подреденото мислене и визуалния експеримент донесе на техния съвместно номиниран проект сребърно отличие от Европейските награди за дизайн 2026 – първото подобно признание за България на този форум.
Изчезващото усилие
Дизайнът освен всичко друго може да бъде и титанично усилие. Янис Константинидис от спечелилото „Еми“ анимационно студио NOMINT започна презентацията си с интригуваща метафора: атлазените беседкови птици, които прекарват целия си живот в изтощително градене и цветово подреждане на гнездо, като рискът да загинат е близо 70%. Цялото това огромно усилие служи единствено за привличане на партньор.
Константинидис пренася акцентиращия върху трудността подход в киното: неговите филми за WWF и BBC са заснети с истински топящ се лед, реален огън и дим. Процесът е толкова труден, че става неделим от посланието. Константинидис ни напомни, че вложеното усилие е основната награда от творческия процес – съзнанието, че си дал всичко от себе си, за да сътвориш нещо автентично.
Това физическо усилие изчезва с всеки технологичен напредък в света на изкуствения интелект, смята гръцкият дизайнер. А когато усилието изчезне, рискуваме да останем в капана на бързата, лесна и дълбоко посредствена заблуда за липсата на смисъл. Ето защо Константинидис е противник на използването на изкуствен интелект в дизайна.
Кампанийното видео, създадено за WWF от студиото NOMINT, използва сложен и трудоемък формат, за да разкаже за проблемите на затоплящите се океани
По време на лекциите дизайнът стана и поле на противоречие. Тъкмо в сблъсъка на противоположни мнения по екзистенциални въпроси се ражда интересният дебат. Веднага след Янис Константинидис на сцената излезе Мария Тодорова от Next-DC, която от години изследва дигиталната трансформация и иновациите. Пред зала, пълна с утвърдени дизайнери, тя сподели, че трябва да прегърнем трансформацията, защото в противен случай ще останем зад борда. И хвърли тежка ръкавица:
Изкуственият интелект вероятно ще заличи средната класа дизайнери.
Фестивалът SHAPESHIFT празнува трансформиращата сила на творчеството, науката, технологиите и иновациите.
Никой не може да предвиди бъдещето с абсолютна точност, но тревогата от подмяната е съвсем реална. Когато си прекарал голяма част от живота си в учене и усъвършенстване на занаят, мисълта, че уменията ти могат изведнъж да се окажат остарели исторически артефакти, предизвиква сериозна криза. Криза, която усещам както в себе си, така и в цялата гилдия. И все пак чувството след този сблъсък не беше пораженческо, а по-скоро мобилизиращо – желание да останеш в играта, дори това да изисква пълна лична трансформация.
Изборът да останеш
Дизайнът може да бъде и позиция. За пловдивското студио Punkt (Красимир Ставрев и Светла Тодорова) той е поредица от решения, дълбоко свързани с концепцията за дома. Във времена, когато е най-лесно да бъдеш глобален номад, Красимира и Светла избират да останат. В Пловдив, където впоследствие постепенно променят визуалната култура на града, привличайки ключови културни институции, чийто публичен образ преработват и осъвременяват.
Визуалната идентичност за „Пловдив – Европейска столица на културата 2019“, разработена от студио Punkt и прераснала в идентичността на града
Техен е и визуалният език на „Пловдив 2019 – Европейска столица на културата“, както и проектът за дигиталния шрифт на града Plovdiv Typeface, сглобен от почерците на самите пловдивчани. Когато проследиш развитието на подобен визуален език, си даваш сметка за суперсилата на дизайна: способността му да укроти нещо толкова голямо, шумно и абстрактно, като едно общество, и да го разкаже чрез образи и форми.
Представителите на Beetroot се припознаха в наратива на Punkt, защото според тях също „да останеш е активен избор“, както се изразиха. Простираща се между Атина и Солун, творческата вселена на студиото Beetroot обединява дизайн студио, концептуално кафене, арт галерия, гурме ресторант и собствен бранд за деликатеси в едно вдъхновяващо градско пространство.
Освен че поддържа тези знакови места, Beetroot създава своя собствена линия продукти. Тоест от подизпълнител трансформира себе си в „свой собствен клиент“. Мечта за много дизайн студиа, сигурна съм.
За съжаление, в една статия не може да се събере всичко от двата наситени дни на фестивала.
Дизайнът, както и архитектурата ни изграждат и могат да оказват влияние върху нас в продължение на дълги периоди. България изпитва силна потребност от разговор за визуалния език. Рекламите, неоновите табели, застарелите знаци и въобще голяма част от заобикалящата ни среда могат да бъдат тема на този разговор. Радвам се, че все повече хора се занимават с тази проблематика. Макар и невинаги да е ясно защо и какво може да донесе визуалният подход. Понякога не всички имат ресурс да оценяват или търсят високо ниво, но както казва и Янис Константинидис от Nomint, би било тъжно, ако колективно спрем да полагаме усилия, защото няма търсене.
Нужни ли са тогава усилията?
Ако възприемем дизайна като „просто комуникация“, тогава изкуственият интелект може да я свърши по-бързо, по-евтино и по-мащабно. Но ако дизайнът е позиция; ако той е съзнателният избор на Мирослав Живков и Пол Вогенрайтер да оставят мегаполиса и да се потопят в своето творчество в габровското село Баланите; на студио Punkt – да остане и изгради визуалния дом на Пловдив; или на Янис Константинидис – да снима филми с истински топящ се лед, тогава вложените усилия са всичко, което имаме.
Защото формата без усилия е просто празна, бездушна опаковка. Именно подходът, усилията, желанието да провокираш отвъд функционалното разбиране приближават занаята до изкуството. Точно това автентично присъствие с отворено сърце и изцапани с мастило ръце е единственото нещо, което никой алгоритъм не може да репликира.
Смисълът винаги се ражда в детайла, в укротяването на хаоса и в смелостта да се довериш на самия процес. Тъкмо в тези споделени и трудни усилия се крие имунитетът ни срещу посредствеността. Докато има автори, готови да платят тази цена, и публика, която да я разчете, бъдещето на разказването на истории – и в дизайна, и в живота ни – остава нужно. Поне засега.
Абсолютното мнозинство е най-големият политически лукс. То дава възможност да промениш държавата, без да търсиш оправдания в коалиционни партньори. Затова първите 100 дни са най-добрият тест за истинските намерения на едно управление.
През април двама нови европейски политици спечелиха огромни мнозинства на парламентарни избори. Партия ТИСА взе 138 мандата от 199 (конституционно мнозинство) в унгарския парламент, а „Прогресивна България“ – 131 от 240 в българския. Лидерите на двете формации Петер Мадяр и Румен Радев оглавиха правителства. Първият обяви, че ще разгражда мафиотския модел на Орбан, вторият – олигархичния модел „Борисов–Пеевски“. И тук свършват приликите.
Още в първите седмици кабинетът на Петер Мадяр започна да изпълнява предизборните си обещания – демонтаж на институционалната архитектура, изграждана от Виктор Орбан в продължение на 16 години. С конституционни промени мандатите на министър-председателя и депутатите бяха ограничени до два, започна и чистка на политическите назначения на Орбан по върховете на държавата. Създадени бяха нови антикорупционни механизми, а в резултат на административната реформа министерствата на образованието, здравеопазването и околната среда отново станаха самостоятелни. В сферата на образованието започват значими промени, като сред първите са открити конкурси, а не назначавани от властта директори на училищни окръзи.
Преместването на премиерския кабинет от пищния Кармелитски дворец в сграда, близо до парламента, беше ясен знак за дистанциране от разточителното управление на автократа Орбан.
Мадяр извърши и още нещо, което ще се помни дълго в Унгария. След като той дойде на власт, унгарската обществена телевизия (канал M1) поднесе официално извинение за дългогодишната пропаганда. Рупорът на политиката на Орбан излъчи надпис с извинение на черен фон за лъжите си:
Обществените медии не трябва да лъжат. Извиняваме се, че въпреки това сме го правили в продължение на много години! В момента обществените медии се преструктурират, за да станат отново независими и достоверни. Излъчването на новини е временно прекъснато. Моля, останете с нас!
А в България властта се кани да въведе задължителна учебна дисциплина добродетели и религия от учебната 2027–2028 година, подобно на руския модел за патриотично образование, основано на традиционни ценности, и на Орбановия модел на „християнска демокрация“.
Сравнението с България е показателно.
Румен Радев дойде на власт с обещание да разгради стария модел на властта, но през първите 80 дни по-скоро го пренареди около себе си. Смени политическата реторика и външнополитическия курс, но запази основните механизми на управление – зависимостта на общините от централната власт, кадровото разпределение между познати партийни мрежи и отсъствието на реален удар срещу икономическите и задкулисните центрове на влияние.
Първите месеци са достатъчни, за да покажат посоката. Най-значимите действия се оказаха бюджет с дефицит 5,7% от БВП, заради който България е поставена в процедура по свръхдефицит, и разрешение за поемане на нов държавен дълг до 10 млрд. eвро. Според плановете на „Прогресивна България“ размерът на държавния дълг ще нарасне до над 50,5 млрд. евро, или 35,2% от БВП към края на 2028 г.
Наред с това винетките поскъпват с 30%, минималните осигурителни прагове за част от професиите се увеличават, а максималният осигурителен доход достига 2300 евро. През ноември Европейската комисия ще направи нова оценка на дефицита, тогава ще са ясни и параметрите на новия бюджет за 2027 г. Но Брюксел отново предупреди за ръста на разходите в тазгодишния.
Там, където са най-големите притеснения на хората – ръста на цените, корупцията, здравеопазването, пътната безопасност – промяна няма. „Кошницата с грижа“ (основни храни на по-ниски цени в големите вериги) се оказа обещание, което бързо се изпразни от съдържание. Жертвите по пътищата се увеличават – за първите 6 месеца на годината те са 261, с 33-ма повече от същия период на 2025-та.
Замислената отпреди четири десетилетия Национална детска болница пак няма да я има, но пък се предприемат действия за нейния „рестарт“. В здравеопазването управляващите не показват намерения да променят системата с приетия бюджет за 2026 г., нито декларират такива намерения за следващия, който ще бъде внесен след три месеца. Увеличеният с 8,5% бюджет на НЗОК (до 5,256 млрд. евро) ще се разпределя така, както си върви от години – в услуга на безконтролното нарастване на болнични легла и с нисък дял публични средства за профилактика.
Това става на фона на разкрития от бивш служител на ДАНС в предаването „Извън ефир“ за схеми за източване на Здравната каса и спрени проверки за милиони. В същото време в годишния си доклад, който трябва да бъде приет от правителството и парламента, българското контраразузнаване отчита като критична зона проблемите със: достъпа и качеството на здравните услуги и опитите за посегателства срещу публични ресурси за здравеопазване; дефицитите на фармацевтичния пазар, свързани с логистични затруднения и неравномерно разпределение; схемите за паралелен износ.
За 69,2% от българите здравеопазването и спирането на изтичане на средствата в сектора е сред трите най-големи проблема пред управлението и само 14% смятат, че правителството предлага успешни мерки в сектора. Социологическо проучване на агенция „Алфа Рисърч“ за нагласите в навечерието на стоте дни на кабинета „Радев“ показа, че „Прогресивна България“ е все така фаворит и при избори днес ще получи над 40% от гласовете, но обществото вече е критично и се съмнява, че ще се справи с големите проблеми.
Ако във вътрешната политика обаче промените са формални, то във външната настъпиха още през първите седмици.
Смяна на посоката
Подкрепата за Украйна отдавна не се възприема единствено като солидарност с държава, станала жертва на руската агресия, нито само като въпрос на геополитическа ориентация. Тя се превърна в тест за мястото на всяка страна в новата система за европейска сигурност, която се изгражда след руската инвазия през 2022 г. Подкрепата за Киев е част от тази архитектура – редом с общите европейски програми за превъоръжаване, увеличаването на отбранителните разходи и укрепването на източния фланг на НАТО.
В Бялата книга за европейската отбранителна готовност до 2030 г. подкрепата за Украйна е поставена редом с военната мобилност, увеличаването на производството и преодоляването на критичните дефицити във въоръжението.
Най-непосредствената и най-належаща заплаха идва от Русия, която след пълномащабното си нахлуване в Украйна през 2022 г. се превърна в основния дестабилизиращ фактор в Европа. Войната в Украйна доведе до стотици хиляди жертви и масово разселване на населението. Русия премина към икономика на военни релси, като 40% от федералния ѝ бюджет (9% от БВП) са насочени към военни разходи. Тя увеличи капацитета на своята военна индустрия и задълбочи отношенията си с авторитарни съюзници като Беларус, Северна Корея и Иран. Все по-често Русия разчита на ядрени заплахи и хибридни стратегии. В същото време последователно допринася за нестабилността по периферията на Европа, особено в Грузия, Молдова, Армения и Западните Балкани.
Joint White Paper for European Defence Readiness 2030
На срещата на върха на НАТО в Анкара съюзниците поеха ангажимент за 70 млрд. евро военна техника, помощ и обучение за Украйна през 2026 г. и за запазване поне на същото равнище през 2027 г.
Какво направи Радев? Заяви, че България ще помага „според своите възможности“, подчертавайки приоритета да се изграждат собствените отбранителни способности на страната.
На 7 юли, още преди срещата на лидерите, в Анкара се проведе NATO Summit Defence Industry Forum, посветен именно на отбранителната индустрия, инвестициите, производството и новите технологии. България отсъстваше от него.
Най-видимият знак за промяната дойде през юли в Париж. България не участва в срещата на т.нар. Коалиция на желаещите – формата, в който европейски държави координират военната подкрепа за Украйна и обсъждат бъдещите гаранции за сигурност, включително сътрудничество в областта на противовъздушната и противоракетната отбрана. Въпреки че премиерът Румен Радев получи лична покана от президента Еманюел Макрон, той отказа участие с аргумента, че „мястото на България не е там“, защото страната не участва в коалиция, която настоява за продължаване на финансовата и военната помощ за Украйна
Правителството свежда възможната подкрепа до сферата на енергетиката и хуманитарните действия, но без да спира продажбите на оръжие и така да лиши военната индустрия от значителни приходи. За предоставената на Украйна помощ България е получила над 203 млн. евро по различни механизми на ЕС.
Като премиер Радев продължи с миротворческите призиви, които отправяше и като президент, Европа да смени политиката си спрямо войната.
Решението на този конфликт не е в удължаването му с военни средства, а в силна дипломатическа мисия, която най-накрая ще сложи край на ескалацията.
България изрази резерви и към трима от руските граждани в 21-вия пакет санкции срещу Русия. За да не бъде блокиран целият пакет от евентуално вето, бяха извадени съоснователят и най-голям акционер в „Лукойл“ Вагит Алекперов, руският патриарх Кирил и милиардерът Искандар Махмудов. Управляващите пазеха до последно в тайна олигарха Махмудов, като единствената информация беше, че е „свързан с метрото“. Узбекът е сред акционерите на руската компания „Трансмашхолдинг“, чието дъщерно предприятие „Метровагонмаш“ е доставчик на най-старите влакове на метрото в София (линия 1). Двете компании са под американски санкции, защото произвеждат части за военна техника.
Въпреки че е избегнал европейски санкции благодарение на България, а преди това – на унгарския премиер Орбан, Махмудов е обект на санкции от САЩ, Великобритания, Канада и Нова Зеландия заради подкрепата за руския режим.
За всеки от спасените от eвропейски санкции бяха намерени аргументи. За Алекперов – инвестициите в бургаската рафинерия, за Махмудов – метровлаковете, а патриархът (някога агент на руските служби) бил измъкнат, защото „сме едно семейство с Руската църква“.
Радев обяви, че България няма да подкрепя санкции, които създават риск за българската икономика. Формално кабинетът не прекъсва общата европейска линия, но ограничава икономическия натиск върху Москва. Стигна се дотам Европейската комисия да изпрати в София българската еврокомисарка Екатерина Захариева, в опит да се изясни позицията на България относно подкрепата за Украйна.
Няма друга област, в която правителството да е толкова последователно, колкото раздалечаването от общата политика на ЕС и НАТО за подкрепа на Украйна.
Към разнопосочните сигнали се добави и темата за американските военни самолети цистерни и протестите срещу тяхното пребиваване в авиобаза „Безмер“. Правителството не обясни ясно нито характера на мисията, нито ангажиментите на България, оставяйки вакуум, бързо запълнен от страхове и антинатовска реторика. Иран предупреди, че ще държи отговорни държави, които подпомагат действията на САЩ. От информация за телефонен разговор между външната министърка Петрова-Чамова и иранския ѝ колега Абас Аракчи се разбра, че той е използвал остър тон, предупреждавайки България, че съдейства за агресията на Вашингтон.
Объркване възникна и около проекта с „Райнметал“. След първоначалните внушения за ревизия или отказ от джойнтвенчъра за завод за барут и за 155-милиметрови снаряди, впоследствие се оказа, че съвместната работа с германската компания продължава.
Решения на тъмно
Не по-малко показателен от самите решения е начинът, по който се вземат. Най-важните външнополитически и енергийни решения остават без публично обсъждане и без комуникация от страна на правителството.
По БНР политологът доц. Огнян Минчев коментира, че „Прогресивна България“ като културен код, кадри и наследство е всъщност бившата БКП и от тази гледна точка „нейното поведение е свързано с опитите на свръхконцентрация на власт“.
Управленските решения от първите месеци трудно могат да опровергаят подобно впечатление, а комуникацията и публичното говорене на депутати от „Прогресивна България“ звучат доста арогантно и обидно.
Показателен пример е развитието около 13-годишното споразумение между „Булгаргаз“ и „Боташ“, което също беше сключено на тъмно от служебния кабинет на президента с премиер Гълъб Донев (сега вицепремиер и министър на финансите). Срещу какви обещания от българска страна турският президент Ердоган се е съгласил да замрази двустранните договорености, по които България дължи над 360 млн. долара заради скъпия и неизползван капацитет, за който не се плаща от юли 2024 г.?
Темата е от особено значение за енергийната сигурност на ЕС. Украйна разполага с близо 32 млрд. куб. м подземни газови хранилища – едни от най-големите в света. В условията на отказ от руски тръбен газ те се превръщат в ключов елемент от европейската енергийна сигурност.
За сравнение, българското газохранилище „Чирен“, чийто проект за разширение стана обект на разследване на Европейската прокуратура, би трябвало да увеличи обема си до 1 млрд. куб. м спрямо сегашните 550 млн.
Причината да се заговори за газ в отношенията България–Украйна са доставките на aмepикaнcки втeчнeн пpиpoдeн гaз (LNG) зa eвpoпeйcкo пoтpeблeниe в yкpaинcкитe xpaнилищa. За да стигне до Украйна, този газ няма как да заобиколи България, а трасето му зависи от това дали танкерите ще пристигат на гръцки терминал, както беше с първите доставки, или на турски (което би включило вече и споразумението с „Боташ“).
Към решенията, вземани на тъмно, спада и кадровата политика на правителството. Вместо обещаното скъсване с партийния модел, първите назначения показаха добре познатата практика ключовите позиции да се разпределят между хора с политическа лоялност или дългогодишни връзки с някои от управляващите, пък били те ГЕРБ, „Има такъв народ“ или БСП. Вместо да демонстрира нов стандарт на управление, кабинетът пренарежда дялани камъни. В държавните дружества и администрацията започна да се оформя управленски микс от кадри на БСП, хора от служебните кабинети на президента и фигури от предишни управления.
След като отстрани уличената в неправомерно високи възнаграждения и скандални договори шефка на НДК Андрияна Татарова, министърът на културата Евтим Милошев назначи съпругата на заместник-председателя на Народното събрание от парламентарната група на „Прогресивна България“ Иван Ангелов. С аргумента, че Ия Петкова-Ангелова e с доказан опит и професионализъм. Макар и новоизлюпен политик, университетският преподавател Ангелов се учи бързо и по bTVнарече войната в Украйна „специализирана военна операция“ – така, както я определя официално режимът в Кремъл.
Цялата тази непрозрачност и подмяна на предизборните обещания с realpolitik се превръща в отличителен белег на първите 80 дни – решенията се обявяват, но мотивите и договорките, поети от името на държавата, остават неизвестни. Правителството продължава да работи без управленска програма, макар че в края на май вицепремиерът Иво Христов обеща да е готова до месец и половина.
Най-голямото мнозинство в най-новата история на България засега произведе най-малко промени в начина на управление.
* През 2001 г. Симеон Сакскобургготски каза, че му трябват 800 дни, за да „се почувства осезаемо повишение на жизнения стандарт на българина“.
The NTPsec Project is pleased to announce the tagging of version 1.2.5
Note: Python 2 and OpenSSL 1.1.0 support will be removed in the next release.
A new ntskelog statistic file has been added to the stats file collection. NTS-KE transactions are now routed here to reduce clutter in the main system log.
Link-Time Optimization (LTO) is now enabled by default on Linux and FreeBSD when --disable-debug-gdb is configured. It remains disabled on NetBSD due to upstream toolchain breakages.
The pool configuration command now natively supports the nts security flag (pool <server> nts).
The server counting logic for maxclock (tos maxclock) has been corrected to skip dynamic POOL slots as well as any remote servers configured with the noselect flag.
The HPGPS reference clock driver received a major update, featuring a new configuration option for listen mode, a fix for the Z3801A GPS Week Number Rollover (WNRO) glitch, the removal of the raw scpi > string from clockstats, and the addition of several new internal tracking variables to clockstats.
Security Fixes:
Fixed a buffer overflow in the Zyfer reference clock driver that could occur when processing continuation chunks (CVE-2026-18321).
Fixed a NULL-pointer dereference crash in the NTS-KE client when SSL_new() fails.
ntpd now uses a cryptographically strong RNG instead of the weak libc random() for association IDs, poll-time dispersal, and mode6 response padding.
Fixed an off-by-one boundary error in ntp_RAND_bytes() that could cause an out-of-bounds read.
Fixed an out-of-bounds read in NTS client extension parsing caused by unchecked nonce/ciphertext lengths.
Fixed NTS pool peers losing their NTS-KE hostname and NTS configuration on cookie renewal, which caused certificate validation to run against the peer’s bare IP address instead of its configured hostname.
Administrative and Scripting Changes:
The ntpleapfetch tool has been hardened with parameter quoting to prevent potential shell execution vulnerabilities.
The statistics directory argument (-s PATH) has been fixed and its default behavior adjusted.
ntpd now explicitly logs a syslog entry when searching for supplemental configuration files inside /etc/ntpsec/ntp.d.
ntpd now logs an explicit message when extra pool servers are actively dropped.
ntpleapfetch now correctly parses the leapfile directive with quoted paths and tab/space-delimited values (NTPsec/ntpsec#883).
waf has been upgraded to 2.1.9, fixing a bug where libntpc.so was installed to the default library path instead of the location given via --libdir (NTPsec/ntpsec#870).
Added missing i386 time64 and mDNS/DNS-SD syscalls to the seccomp sandbox allow-list, fixing potential sandbox kills on i386 and mDNS-enabled builds.
Added missing clock_nanosleep, readlink, and readlinkat syscalls to the AMD64 seccomp sandbox allow-list, fixing SIGSYS crashes.
NTS and NTS-KE Fixes:
NTS-KE requests and responses split across multiple TCP/TLS reads are now correctly reassembled instead of failing on the first partial chunk (NTPsec/ntpsec#858).
Fixed the NTS client failing to reset cookie length when switching to a new cookie length from a key-exchange response (NTPsec/ntpsec#877).
The NTS-KE client now sets the TLS SNI field during the handshake, improving compatibility with name-based TLS proxies and load balancers.
Fixed NTS-KE hostname parsing to strip brackets from IPv6 literal addresses before certificate hostname validation.
Fixed an NTS-KE response containing more cookies than the client can store being misparsed and the entire response rejected, instead of just discarding the extras.
Fixed an NTS-KE connection that completes synchronously (rather than asynchronously) being wrongly treated as a connection failure.
NTS-KE certificate hostname/IP validation now uses the non-deprecated OpenSSL 4.0 APIs (SSL_set1_ipaddr/SSL_set1_dnsname).
The NTS-KE client no longer rejects a server response solely for an unrecognized non-critical record type.
ntpd now validates the aead parameter in both per-server and global NTS configuration and logs an error instead of silently accepting an invalid value (NTPsec/ntpsec#880).
NTS-KE client logging has been improved to emit one detailed message per connection attempt; the client now parses bracketed IPv6 literal addresses, applies a send timeout in addition to the existing receive timeout, and skips already-tried addresses from multi-homed NTS-KE servers.
Fixed a bug where a failed DNS-lookup thread creation or join could leave a peer’s DNS/NTS resolution permanently stuck, blocking further lookups.
Bug Fixes and Protocol Refinements:
Fixed a critical issue where NTPsec failed to declare itself out of sync under specific error and drift conditions.
Fixed a state machine bug (NTPsec/ntpsec#848) where the STA_UNSYNC flag was prematurely cleared at system startup.
Fixed an interactive interface crash in ntpmon triggered by hitting the minus (-) key.
Added native .webp image encoding support to the ntpviz graphing tool.
Fixed ntpd silently ignoring mode 1 (symmetric active) requests, e.g. from Windows clients; they are now answered like ordinary client requests.
Fixed a regression where ntpd failed to clear peer state on interface change, delaying resynchronization after network changes.
Fixed NTP extension-field parsing to stop treating unrecognized non-critical fields as fatal; they are now ignored instead of causing packet rejection.
socktoa() no longer formats AF_UNSPEC addresses as IPv4, correcting address display in ntpq and ntpmon.
mode6 control protocol responses now omit peer addresses that are empty or otherwise unprintable instead of emitting malformed data.
Fixed ntpdig to build a fresh request packet (timestamp/MAC) for each destination address tried, instead of resending the same packet.
Fixed ntpdig crashing with an unhandled UnicodeError when a configured server name with non-ASCII characters fails DNS resolution.
Fixed a crash in ntpq’s interactive `noflake command (NTPsec/ntpsec#863).
Fixed a crash (NameError) in ntpq under Python 2 caused by referencing the Python-3-only BrokenPipeError.
Fixed a crash in ntpq and ntpmon when a peer’s source address is empty, e.g. NXDOMAIN or a POOL association.
sys_var_list is no longer marked as a default variable, so it is excluded from ntpq’s default `rv (readvar) output.
Removed:
Removed the undocumented -s/--srcname and -S/--srcnumber display options, and the hostname/hostnum arguments to ntpq’s hostnames command, from ntpq and ntpmon. This shipped in 1.2.4 but was never documented in NEWS and has now been fully reverted.
Стихотворение по желанията на Юлиян, на две и половина. Забележка: Правописът на желанията е запазен така, както са произнесени от Юлиян.
Искам Сатурн 5, най-любимото ми. Артемидката ми искам да лети. Искам тати Стефан да дойде с мен в Пловдив и горската къща. Искам събуждане. Не искам тъмното. Искам супермного сняг. Искам деца в клетки да гледат „Блуи“. Искам самолети падат. Да кацат ли? Не, да падат. Искам ракета отгоре на самолет до Юпитер. Смешка, тати. Искам сам, тати. Сам. Искам захар на пишото и на дупето. Искам махай се, тати. Искам махай се, мама.
Искам за подарък пет кули кубчета ракети. Искам гушна замъка и снежното куче. Имам кръв (нямам, тати, не). Искам играем на хак с шайба от мандарина. Искам никога да не ядеш аз. Искам ресторант пет етажа и да готвят слонове със сос маслинка, тати. Автобусите се клатушкат повече от трамваите, защото се смеят.
Обичам Атлас 5, най-малката ракета.
Искам къпя друг ден, тати. След малко искам големия чайник. Искам притежавам багер. Искам си камъците от трамвая. Смешка, казах.
Искам таблета, вземем върнем, гледаме само. Искам на протест на джипиеса. Само бели шоколадове обичам аз.
Искам друг ден мама с мазол маже крем, не захар.
Искам купиш си нов портофел. Искам обичам стара генерация.
Веднага искам супердълго клипче. Искам хеликоптери скачат на вода. Искам люспички. Искам боговете също спят. Искам да играем на лъкове с Робин Худ. Искам чуя човека Воев пее. И Робин Худ музика. Искам мамутове във водата. Искам минотавър като динозавър. Искам си ушната кал. Искам НДК на Лего. Искам Арес, бог на самолетите.
За Коледа искам бакпулвер.
Искам всички цветя да са червени, за да станат всички хора на огън. Искам Антивенъм да има много приятели. И жабешко парти. Аз съм Антивенъм. Искам пушиш обикновен фас. Искам моята пушка стреля само целувки. Искам вали само на къщите, не на улиците. Искам да карам тротинетката отгоре на самолета. Искам да хвърля тати през прозореца към автобуса и да се качи към работа.
И така и стана.
Стефан Иванов
Стефан Иванов(р. 1986, София) е aвтор на стихосбирките „4 секунди лилаво“ (2003), „Гинсбърг срещу Буковски в публиката“ (2004), „Списъци“ (2009), „Навътре“ (2014) и „Без мен“ (2024) и на диалогичното издание „Разговори с Маргарита Младенова“ (2024). Съавтор е на пиесата „Медея – майка ми“, спечелила „Икар“ (2013) за най-добро представление. Пиесата „Между празниците“ е номинирана за „Икар“ (2014) за драматургия. Пиесата „Нечовек“ е номинирана за „Аскеер“ (2025). Носител на наградата „Хр. Г. Данов“ (2025) за принос в представянето на българската книга. Драматург на Театрална работилница „Сфумато“. Съосновател на издателство „Кота 0“. Блогът му е на http://siv.sofiascape.com/.
Според Екатерина Йосифова „четящият стихотворение сутрин… добре понася другите часове“ от деня. Убедени, че поезията държи умовете ни будни, а сърцата – отворени, в края на всеки месец ви предлагаме по едно стихотворение. Защото и в най-смутни времена доброто стихотворение е добра новина.
At Advancing AI 2026, AMD laid out their plans for a comprehensive product stack for physical AI hardware. From SoCs to modules to dev kits, AMD is eyeing physical AI as their next big growth opportunity
AI coding agents are part of the developer toolchain. Tools like Kiro and Claude Code generate features, tests, and code refactors from natural-language prompts. A single agent can open dozens of pull requests (PRs) across your repositories in an afternoon. That productivity comes with a trade-off: agents optimize for task completion at machine speed with no understanding of your organization’s risk.
Through protocols like the Model Context Protocol (MCP), agents also reach beyond the integrated development environment (IDE) to call APIs, query databases, and modify infrastructure and even entire environments, expanding the scope of resources your application security team defends.
This post lays out an application security (AppSec) control framework for AI coding agents. Two pillars organize the framework: author-time controls shape what the agent produces in the IDE; build-time controls verify and gate what reaches production. Your existing secure software development lifecycle (SDLC) controls still apply and are critical to a defense-in-depth security strategy. The framework shows where to layer additional guardrails so AppSec scales with agent-driven development. The framework is tool-agnostic and cloud-agnostic. Throughout, we use AWS services—Kiro in the IDE and AWS CodePipeline in the build—as a running example that you can adapt to your own toolchain.
Risks
Each of the following risks includes a treatment summary. The control framework section later in this post provides implementation details. The risks are ordered by severity with the highest impact risks first.
R001. Prompt and context injection
Agents read untrusted content, such as issue descriptions, web pages, MCP responses, and README files in third-party packages. Text from outside parties can redirect the agent to disclose secrets, open unauthorized PRs, or invoke tools without user consent. This risk, known as prompt injection, is the top risk in the OWASP Top 10 for LLM Applications. Any agent that reads content from outside parties is exposed, with or without MCP, so connecting tools widens the scope of impact.
Treatment: Treat non-developer input as untrusted. A large language model (LLM) can’t reliably separate instructions from data in a single context window, so architect for it: keep the agent that orchestrates trusted actions separate from the one exposed to untrusted content and grant the exposed agent only read-only, least-privilege access. Require human approval for irreversible actions. Use version-control steering files to prevent silent tampering.
R002. Inadvertent data disclosure and overly permissive configurations
Agents optimize for getting work done. Left unchecked, the code they generate can default to wildcard identity and access management policies, open security groups, and unencrypted storage, or embed sensitive values in code rather than referencing a secrets manager. Most coding agents now include safety mechanisms that make these outcomes less likely, but they remain imperfect, so you still need controls to account for the possibility.
Treatment: Security requirements in a steering document, plus policy-as-code scanning (Checkov, cfn-nag) in the IDE and pipeline. See Context as a security control.
R003. Uncontrolled changes reaching production
Ungated code reaching production isn’t new, but AI agents amplify it. Machine-speed generation can propagate a flawed pattern across repositories before it’s identified.
Treatment: Branch protection rules requiring PR approval (a human-in-the-loop checkpoint), pre-commit hooks for security checks, and sandboxed agent runs that prevent direct pushes to protected branches. The right balance between human review and automated speed depends on the risk profile of the change. For many low-risk paths, automated checks alone might suffice, while higher-risk changes warrant a human checkpoint.
R004. Supply chain risks
Agents don’t always distinguish current best practices from outdated patterns. They might recommend deprecated packages, reference library versions with new Common Vulnerabilities and Exposures (CVEs), and hallucinate package names that don’t exist, which can introduce risks of dependency confusion issues.
Treatment: Software Composition Analysis (SCA) in the pipeline (for example, Amazon Inspector code scanning or Dependabot) to flag vulnerable or unexpected dependencies. For additional control, resolve against a scoped registry like AWS CodeArtifact. Even without a fully curated registry, lockfile validation and allow-listing critical packages reduce exposure.
R005. Uncontrolled external access
Through MCP and tool integrations, agents query databases, call APIs, and modify infrastructure. Without constraints on which tools and data an agent can reach, a single misconfigured integration provides unintended access to sensitive resources.
Treatment: Scope MCP servers to least-privilege tools and resources, enforce authn or authz on external connections, and audit tool invocations. The control point is the configuration file. Review it the same way you review AWS Identity and Access Management (IAM) policies.
R006. Hallucinations and incorrect code
Agents produce plausible-looking output. Code that compiles, passes linting, and looks reasonable can still be functionally wrong: misusing APIs, introducing subtle logic errors, or implementing security-sensitive operations incorrectly. Code that passes continuous integration (CI) but is wrong slips through review; code that fails to build is caught immediately.
Treatment: Layer deterministic verification (static application security testing (SAST), unit tests) with non-deterministic review (LLM-assisted screening against the specification). Neither catches everything alone.
R007. Scope creep
Given a bug-fix prompt, an agent might also refactor surrounding code, disable an unreliable test, or reorganize imports. Unrequested changes introduce regressions and complicate review.
Treatment: A reviewed specification document that defines what must change and what must not, paired with a targeted review of the proposed changes. See Specifications as scope boundaries.
The preceding risks share a common thread: agents produce output faster than humans can review it, and they lack context to self-correct.
The following framework addresses this gap. It organizes controls into two pillars: author-time (pre-generation and post-generation of code) and build-time (in the pipeline, before code reaches production). Author-time controls shape what the agent produces. Build-time controls verify it. Neither is sufficient alone; together they reduce the volume and severity of issues that reach human reviewers.
Deterministic compared to non-deterministic mitigations
Deterministic mitigations[D] produce the same result every time. Linters, SAST scanners, secrets detection, and policy-as-code match patterns against rules and define security invariants: no critical findings, no hardcoded secrets, and no wildcard IAM policies. Use them when the condition can be expressed as a rule. Organizations already have these and must continue enforcing them.
Non-deterministic mitigations [ND] use model judgment. They include steering documents, LLM-as-judge review, specification compliance checks, and scope-creep detection, and they evaluate intent rather than patterns. They catch novel issues that rules miss, but are probabilistic. Use them when evaluation requires context or reasoning across files. This is the new layer that AI-generated code demands, because agents produce code that can pass every deterministic check yet remain functionally wrong.
Human review[H] provides the final layer for the risk-based decisions neither tool type can make. Apply it where judgment is needed, not everywhere: routing every change to a person invites consent fatigue, where reviewers approve by reflex and the control loses its value. The default reflex is to route everything back to a human, but that isn’t always the right response—reserve human judgment for the decisions that genuinely need it.
The control framework
The framework organizes controls into two pillars. Author-time controls (Pillar 1) shape what the agent produces in the IDE, before code is generated and just after. Build-time controls (Pillar 2) verify and gate that output in the pipeline, before it reaches production. The controls within each pillar are tagged deterministic [D], non-deterministic [ND], or human [H].
Pillar 1: Author-time controls (pre- and post-generation of code)
Author-time controls work inside the IDE, where the developer and agent still hold full context. They shape the prompt and the generated output before it ever reaches a pull request. The following controls apply at this stage.
Context as a security control [ND]
Control statement: Encode security invariants as natural-language constraints in a steering document that every developer environment consumes at session start. Addresses R002. Many AI coding agent risks share one root cause: the agent lacks the security context an experienced developer carries implicitly. Your security team sets the policies, such as Amazon Simple Storage Service (Amazon S3) buckets require encryption, API gateways require mutual TLS, and credentials must come from AWS Secrets Manager. Developers don’t always have these requirements available when they’re building. They build what works, not what’s compliant. An AI agent amplifies this gap because it defaults to whatever pattern dominated its training data, with no awareness of your organization’s security posture.
A key mitigation is steering. Security teams write these invariants once as natural-language guidance in a steering document, then distribute them as shareable resources that developers consume in their IDE. The agent loads the file at session start and treats the contents as standing requirements:
IAM policies must follow least-privilege principles; no wildcard Amazon Resource Names (ARNs).
No hardcoded credentials in source code; use a secrets manager.
Security groups must not allow unrestricted inbound access.
This shifts security left, before code generation begins. Steering biases generation toward secure defaults; it doesn’t guarantee them. Treat it as a strong default, paired with the following deterministic gates that block non-compliant code from merging. Security teams define the rules once and every developer environment inherits them automatically. Steering reduces the volume of issues that reach the pipeline, though it doesn’t replace downstream scanning.
How to write effective steering rules: Keep each rule specific and testable, scope it to a concrete risk class, keep the rule set concise so the agent can hold it in context, and iterate from the issues your scanners and reviewers surface.
Specifications as scope boundaries [ND]
Control statement: Require a reviewed specification before code generation begins. Define what must change and what must not. Addresses R007.
Spec-driven workflows turn vague prompts into reviewable specifications before code is generated. This creates a human checkpoint at the design phase, where security decisions are made:
Requirements use testable notation that’s auditable before the agent writes a line of code. For example, the Easy Approach to Requirements Syntax (EARS): WHEN [condition] THE SYSTEM SHALL [behavior].
Tasks are ordered in implementation steps, each mapped back to a requirement.
For bug fixes, specifications add a critical element: unchanged behavior documentation. This is an explicit list of behaviors that must continue working, giving the agent a written boundary against scope creep.
In this model, the specification becomes the primary artifact, code is a derivative of it. Human review effort concentrates on whether the specification solves the right problem with the right constraints, not on reading implementation diffs line by line.
Controlled tool access using MCP [D + ND]
Control statement: Scope each MCP server to the minimum set of tools the agent needs, and give it a dedicated, scoped-down credential rather than the developer’s own. Maintain an allowlist of reviewed MCP servers. Addresses R005.
MCP servers act as controlled gateways between the agent, the external tools, and data:
Dependency management – An MCP server fronting your private package registry resolves dependencies against curated packages, not the public internet. This is a deterministic constraint on supply chain risk.
Infrastructure tooling – Visibility into current resource configurations prevents templates that conflict with existing infrastructure.
Scoped permissions – Each MCP server exposes a defined set of tools and resources. You choose exactly what the agent can access, supporting least-privilege at the integration layer. You supply that credential through the agent’s configuration (in Kiro, the env block of .kiro/settings/mcp.json). Avoid autoApprove: ["*"], which removes the human approval prompt on every tool call.
IDE code scanning [D]
Control statement: Run real-time static analysis in the IDE so security issues surface while the developer (and agent) still have full context. Addresses R002, R006.
Real-time diagnostics catch syntax errors, type mismatches, and configuration issues as the developer types. A malformed IAM policy is flagged before the agent builds further on it. Security-focused extensions (ESLint security plugins, Checkov, SAST) layer on top for immediate feedback while code is fresh in context.
Hooks: Automated guardrails at the point of action [D + ND]
Control statement: Attach deterministic checks to file-save events and non-deterministic verification to task-completion events. Addresses R002, R007.
Shell command hooks [D] – Triggered on file save, these run a linter, formatter, or security scanner and produce the same result every time. They enforce hard rules.
AI-powered hooks [ND] – Triggered on task completion. These prompt the agent to verify that the implementation matches the specification and check for any untested edge cases or files that were modified outside the task’s scope.
Pillar 2: Build-time controls (in the pipeline)
Build-time controls run in the pipeline after code is committed and before it reaches production. They verify and gate what the agent produced, catching what author-time controls did not. The following controls apply at this stage.
Layered security scanning [D]
Control statement: Run secrets detection, static analysis, dependency scanning, and infrastructure-as-code scanning in sequence. Fail the build on any critical finding. Addresses R002, R003, R004.
Secrets detection runs first because it’s cheapest and addresses a high-severity class of issue. It scans for hardcoded API keys, database connection strings, and credentials that AI agents might inadvertently include.
SAST scans source code for injection issues, insecure deserialization, and resource leaks. Custom rules can target AI-specific anti-patterns including overly broad exception handling, deprecated APIs, placeholder credentials, dynamic code execution through eval().
Software Composition Analysis (SCA) identifies known CVEs in dependencies. This is critical for AI-generated code, which might reference deprecated packages or hallucinate package names that open you to dependency confusion issues.
Infrastructure as code (IaC) scanning validates AWS CloudFormation, Terraform, and AWS Cloud Development Kit (AWS CDK) templates against security policies before deployment. Catches overly permissive IAM roles, unencrypted storage, and public-facing resources the agent created.
Each stage halts the pipeline on failure. Results export to a standard format (Static Analysis Results Interchange Format (SARIF)) for compliance auditing and flow downstream to human reviewers. The open source Automated Security Helper (ASH) bundles secrets, SAST, SCA, and IaC scanners behind one command that you can run locally and in AWS CodeBuild, emitting SARIF for the gates that follow.
Quality gates [D]
Control statement: Define pass/fail thresholds for each scan type. Block deployment on any critical or high-severity finding. Addresses R003.
Quality gates convert scan results into go/no-go decisions. Define thresholds for each severity: block on critical findings, require justification for highs, and track mediums. The gate is deterministic: if a threshold is breached, the pipeline stops. Exceptions require documented approval.
Differentiate blocking compared to advisory modes: hard failures on main, advisory on feature branches. Avoid gates becoming a friction that teams route around.
AI-assisted review [ND]
Control statement: Use an LLM reviewer to pre-screen every pull request for specification compliance, scope creep, and security anti-patterns before human review. Addresses R001, R006, R007.
Specification compliance – Does the implementation match the requirements document?
Scope verification – Were files modified outside the task’s stated scope?
Security pattern review – Are there logic errors, misused APIs, or insecure patterns that pass SAST but violate intent?
This pre-screening focuses human reviewer attention on genuine risks rather than formatting or obvious issues. On AWS, AWS Security Agent (code review in preview at publication) checks pull requests against AWS-managed and custom security requirements. The reviewer screens and surfaces findings; the merge decision stays with a human.
A critical principle: the agent that wrote the code should not be the agent that reviews it. A separate session helps avoid self-confirmation bias, but a separate session alone doesn’t always avoid the generator’s blind spots, because two sessions of the same model can share them. Where practical, use a different model for review so the reviewer is less likely to inherit the same systematic weaknesses.
Human-in-the-loop review [ND + H]
Control statement: Require human approval on most pull requests, especially those touching security-sensitive or high-blast-radius code. Lower-risk changes might be eligible for agent-assisted or fully automated approval as tooling matures. Provide reviewers with scan results, LLM pre-screening output, and specification context to enable fast, informed decisions. Addresses R003.
Scale review depth to the risk of the change. Low-risk or boilerplate changes can take a lighter-touch review, while security-sensitive or novel-logic changes warrant mandatory deep review and a second reviewer.
Scanners catch known patterns but can’t judge whether code implements the intended business logic. Human review also serves to calibrate trust: teams build intuition about where agents excel (boilerplate, test writing) and where they’ve tended to struggle (novel business logic, security-sensitive operations), recognizing that this frontier shifts as models improve.
Place two approval gates: after security scans (reviewer focuses on correctness and business logic, with scan results as context) and before production deployment (final sign-off after integration testing). Treat human review as a secondary control, not a guarantee: reviewers are themselves non-deterministic and can miss issues, so human review layers on top of the deterministic gates rather than replacing them.
Putting the framework into practice on AWS
The framework is tool-agnostic, but AWS gives you building blocks for each pillar. The following services map directly to the controls described previously: Kiro for author-time guardrails, and CodeBuild and CodePipeline for build-time gates.
Kiro: Structured AI development
Kiro maps to Pillar 1: It puts the author-time controls in the IDE, where the developer and agent still share full context. Each feature in the following list implements one of those controls, configured in-repo under .kiro/ so the guardrails are version-controlled and shared across the team rather than set per developer.
Steering documents – Markdown files in .kiro/steering/ load into the agent’s context at session start. Conditional inclusion using fileMatch (for example, ["**/*.tf"]) loads IaC-specific rules only when relevant.
Specification-driven workflows – Three-phase specifications (requirements in EARS, design, and tasks) with review checkpoints. Bug-fix specifications capture unchanged behavior explicitly.
Agent hooks – Triggered on file save, tool invocation, or task completion. Shell hooks run deterministic checks (linters, tests); Ask Kiro hooks run AI prompts for non-deterministic review. For example, a security pre-commit scanner hook can flag hardcoded credentials when the agent finishes a task.
Property-based testing – Guided by a specification or hook, Kiro can generate property-based tests (for example, using the hypothesis library) that exercise hundreds of randomized inputs, probing edge cases a hand-written test suite would miss.
MCP integrations – Connect Kiro to private package registries, internal docs, issue trackers, and infrastructure tooling, creating the controlled tool access pattern.
AWS CodeBuild and AWS CodePipeline: Pipeline controls
CodeBuild runs each scanning tool (checking for secrets, SAST, SCA, and IaC) as a build action. A non-zero exit code fails the action, and the stage halts or rolls back according to its OnFailure setting. Findings export as SARIF to Amazon S3 for compliance, and CodePipeline action variables pass results to downstream approval actions.
CodeBuild exit codes halt the pipeline on scan failures
AWS Lambda invoke actions evaluate scan results against configurable thresholds and return pass/fail decisions
Manual approval actions halt the pipeline, send Amazon Simple Notification Service (Amazon SNS) notifications, and link to review artifacts; decisions and reviewer identity are logged for audit
The following table consolidates the framework into a single view that includes each stage of the SDLC and the deterministic [D] and non-deterministic [ND] controls that apply there. Every stage carries both, a reminder that neither control type is sufficient on its own.
Full security scan suite, integration tests, and policy-as-code
AI-assisted review for human approvers
Post-deploy
Runtime monitoring and anomaly detection
AI-powered incident triage
Conclusion
This post laid out a framework for adopting AI coding agents at machine speed without letting unreviewed risk reach production. It layers guardrails at two points:
Author-time controls – Steering, specs, and scoped tools shape what the agent generates in the IDE.
Build-time controls – Scanning, quality gates, and layered review verify it before it reaches production.
No single layer is enough: deterministic gates enforce hard rules, non-deterministic review catches what they miss, and human judgment is reserved for the decisions that need it. Together, they let AppSec scale with agent-driven development.
Where to start this week:
Start with steering and specs – Encode security requirements as steering and use specifications for new features. Highest impact, lowest effort. For a ready-made starting set, the open source Project CodeGuard (a Coalition for Secure AI project under OASIS Open, of which Amazon is a contributing member) publishes reusable steering rules for common risk classes—hardcoded credentials, IaC misconfiguration, supply chain, and MCP security—that you can adapt to your AWS environment.
Add deterministic pipeline gates – Integrate SAST, SCA, and secrets detection. Table-stakes regardless of AI usage.
Calibrate and iterate – Review what controls catch, adjust steering for recurring issues, and expand agent autonomy as trust builds.
Accountability – Developers remain accountable for the security of what they ship. AI agents accelerate development; they don’t transfer ownership.
Recommendations sit at the heart of the Netflix experience. Our current production models rely on thousands of hand‑crafted features over users, items, and interactions, along with specialized architectures for sequence modeling, feature interactions, and multi‑task objectives. This stack has evolved over many years to support diverse content types (movies, series, games, live, podcasts) and product surfaces, but its complexity makes it costly to onboard new use cases: adding a content type or surface can require significant feature engineering, architecture change, infrastructure work, and experimentation.
At the same time, large language models (LLMs) are changing how we think about recommendation, as shown by recent work such as PLUM, GLIDE, and OneRec-Think. Their broad world knowledge and strong language understanding make it possible to represent user histories and item metadata directly as text, capture rich relationships in a shared semantic space, and steer recommendations via natural‑language prompts. However, off‑the‑shelf LLMs are still far from production‑ready recommenders: they often over‑recommend globally popular content, hallucinate out‑of‑catalog items, ignore business constraints, and provide only limited personalization.
To address this, we built GenRec, an LLM‑backed recommendation ranker that post‑trains an internal foundation LLM on Netflix‑specific data and objectives. GenRec shows that an LLM‑based ranker can match or exceed a mature production system while relying on far fewer labeled examples and input signals.
Figure 1: GenRec pipeline. Raw logs of user history, item metadata, and context are transformed via context engineering into natural-language prompts and fed into the GenRec, which runs on vLLM in prefill-only mode and outputs scores for each catalog item, yielding a recommendation ranking.
At a high level, GenRec:
Verbalizes user histories, item metadata, and context as text.
Post‑trains a Netflix‑adapted foundation LLM for ranking.
Adds a catalog‑aware scoring head over Netflix titles.
Uses reward signals to align with long‑term member value and business goals.
Runs in prefill‑only mode on Netflix’s LLM serving stack for cost efficiency.
In a large‑scale A/B test against a well‑tuned production ranker, GenRec achieves statistically significant improvements in both short‑term and long‑term online metrics, while using only a small fraction of the Phase‑2 labeled data and input signals. It reduces our reliance on hand‑engineered features and shifts the focus from feature engineering to context engineering. In this blog post, we will describe how GenRec works, how it performs, and why we believe it points toward a more LLM‑centric future for recommendation at Netflix.
Problem Setting
We focus on a full‑catalog rankingtask (or top‑K ranking when a candidate set is provided).
Given a user 𝑢, their interaction history 𝐻, and the current context 𝜏 (device, surface, locale, time, etc.), GenRec scores each item and produces a personalized ranking that can directly power recommendations or serve as input for downstream personalization systems.
Formally, we map a request (u,τ,t,H) — user, context, time, and history — to a ranking 𝜋 over the catalog C, where π(i) is the position assigned to item i. We optimize π for expected long‑term member utility (a proxy for satisfaction and retention), not just short‑term engagements.
From Foundation LLM to Recommendation Ranker
GenRec follows a two‑phase training framework (Figure 2):
Figure 2: Two Phase Framework. Phase 1 trains a foundational LLM on Netflix data for user and content understanding, and Phase 2 post-trains on ranking-specific data and objectives.
Phase 1 — Netflix-AdaptedFoundation LLM.
We start from an open‑source LLM and adapt it on proprietary Netflix corpora, so it learns foundational capabilities such as
Netflix content understanding
Member behavior and preference patterns
General language understanding and generation.
Phase 1 is updated relatively infrequently and serves as a shared, Netflix‑aware backbone for many applications.
Phase 2 — GenRec.
We then turn this foundation model into a high‑quality ranking model by post‑training on ranking‑specific data and objectives. Phase 2:
Focuses on ranking quality and steering
Incorporates multiple reward signals via reward‑weighted losses
Is refreshed more frequently to track new content and evolving tastes
Is explicitly optimized under serving cost constraints.
Training Data as Conversations
Netflix members generate hundreds of billions of interaction events spanning many surfaces (views, plays, durations, thumbs up/down, add to list, abandons, etc.). We convert this log data into single‑turn or multi‑turn “conversations” between a user and a recommender. Each turn contains:
User message: verbalized context, profile, history, item metadata, and task (e.g., recommend what the user will watch or thumb next).
Assistant message: the member’s actual engagement (e.g., which titles were played, for how long, what feedback they provided).
During Phase‑2 training, the LLM learns how assistant messages depend on user messages. This allows us to express rich recommendation signals as text, jointly supporting both the language-modeling (LM) and ranking objectives.
At inference time, we feed in the verbalized context and apply a catalog‑aware scoring head to rank items; we do not decode assistant messages. The conversational format is primarily used during training to support the LM objective and preserve strong language understanding over the verbalized text.
Verbalization and Context Engineering
Traditional recommenders operate on dense features and embeddings. GenRec takes a different approach: it verbalizes rich user histories and context as natural language, encoding raw interaction signals directly in the LLM’s semantic space. In doing so, it relies on the model to discover higher‑level patterns — such as item relationships and evolving user interests — rather than on manual feature engineering.
Naively verbalizing every interaction in a user’s history can quickly exceed the token budget and be too expensive at Netflix scale. The context window becomes our new “feature budget”, so we apply contextengineering:
Retain in full: high‑signal engagements (e.g., long plays, thumbs‑up) with richer details
Omit: low‑signal events (e.g., very short plays or quick hovers)
Summarize or compress: repetitive behaviors (e.g., binge‑watching )
Elaborate selectively: important or cold‑start items (e.g., new releases)
Within a fixed token budget, we prioritize recent, high‑signal history and compress or drop older history. We also structure the prompt to maximize shared prefixes for better prefix caching. The goal is a compact, high‑information prompt that preserves ranking quality without prohibitive costs.
Objectives: Ranking, Language, and Rewards
The overall GenRec model is trained with a multi‑objective loss that combines a recommendation ranking objective, language modeling objectives, and alignment via reward‑weighted training.
1. Catalog‑Aware Ranking Objective
The primary task is a ranking objective that teaches the model to score items by engagement quality. We label positives using high‑value engagements (e.g., sufficiently long plays, strong explicit feedback), with thresholds and denoising logic, and train the model — via a cross‑entropy loss over the catalog or candidate set — to assign higher scores to these positives given a verbalized context.
2. Language Modeling Objective
We also retain a language modeling (LM) objective over the verbalized inputs and outputs. This helps preserve the model’s general language understanding, improves its ability to interpret rich natural‑language histories and item metadata, and keeps the door open for text‑generation use cases such as recommendation explanations.
3. Reward‑Weighted Loss for Alignment
Beyond raw ranking accuracy, GenRec must (1) respect business requirements — for example, balancing movies, series, games, live, and podcasts — and (2) optimize long‑term member satisfaction rather than just immediate clicks or plays.
Training only on raw interaction sequences can lead to undesirable behaviors, such as over‑favoring binge‑watching or over‑focusing on a single content type. To address this, we weight the ranking loss usingsignalsfrom separate reward models. Each training example receives a scalar weight derived from two types of signals:
Long‑term satisfaction proxies: estimate how much a short‑term engagement contributes to long‑term outcomes, such as return behavior, catalog exploration, or sustained engagement.
Behavior rebalancing: adjust behaviors across content types and launch stages (for example, games vs. movies, new releases vs. evergreen titles) to better align with business goals.
The example’s ranking loss is then scaled by this weight: high‑value engagements receive larger weights, and low‑value ones are down‑weighted. This reward‑weighted approach is simpler and more cost-efficient than full reinforcement learning, yet provides effective alignment in practice. We have seen additional gains from RL‑style methods (e.g., GRPO), but leave them to future work due to their higher cost.
Model Architecture and Serving
Backbone and Scoring Head
GenRec’s architecture closely follows our foundational LLM: a decoder‑only Transformer trained with next‑token‑prediction style objectives, augmented with a catalog‑aware ranking head that scores only Netflix in-catalog items. The scoring pipeline works as follows:
Verbalization: A verbalizer V serializes user history H, context 𝜏 , and relevant item metadata into a single text sequence x.
Pooled representation: The LLM processes x, and we extract a pooled hidden state h that summarizes the user’s current preferences and context.
Catalog‑aware scoring: Each catalog item i has a learned embedding eᵢ. A scoring head ϕ combines h and eᵢ (e.g., via dot product or small MLP) to produce a score sᵢ. Applying a softmax over scores yields a probability distribution which we convert into a ranking π.
All parameters — the backbone, scoring head, and item embeddings — are trained jointly. For very large catalogs, we can use sampled softmax or candidate sets for efficient training and inference. This architecture constrains recommendations to the Netflix catalog while supporting efficient scoring over large candidate sets.
Serving and Cost Optimization
GenRec is served on Netflix’s internal LLM stack using vLLM. At Netflix scale, serving cost is driven primarily by 1) Model size; 2) Context length; 3) Inference mode (prefill vs. autoregressive decoding). We control cost through three strategies:
Smaller / distilled models: We train GenRec on smaller or distilled foundation models, often with larger or more targeted datasets, to capture most of the quality of larger models at lower serving cost.
Aggressive context compaction: Using the context engineering described earlier, we minimize tokens while preserving ranking quality.
Prefill‑only inference: Autoregressive decoding over large candidate sets would be prohibitively expensive. Instead, we run in prefill‑only mode: the model consumes the prompt once and scores the entire candidate set in a single forward pass, with no token‑by‑token decoding.
Together, these choices make it feasible to serve GenRec on high‑volume workloads within compute budgets.
Offline and Online Experiments
We evaluated GenRec against a mature production ranker that has been tuned over many years. The baseline model relies on thousands of engineered dense and embedding features, as well as custom architectures for modeling feature interactions and sequences. We assessed performance using both offline evaluation metrics and a large‑scale online A/B test.
GenRec vs Production Baseline
Offline, GenRec outperformed the production ranker on ranking metrics despite using far fewer input signals and labeled examples. With roughly 40× fewer Phase‑2 labeled training examples, GenRec achieved about +1.6%improvement in Mean Reciprocal Rank (MRR). As we increased Phase‑2 training data and enriched the input signals, GenRec’s offline metrics continued to improve.
Online, we ran a large A/B test on batch‑compute recommendation surfaces, covering ~10% of Netflix traffic over ~4 weeks. In this low‑data, low‑signal configuration, GenRec delivered statistically significant gains over the production baseline on both short‑term and long‑term online metrics (Figure 3).
These results indicate that a properly post‑trained and aligned LLM‑backed ranker can be a strong alternative to traditional recommendation models, with substantial headroom as we further scale data and input signals.
Figure 3: Online metrics of GenRec vs. production model. GenRec achieves statistically significant improvements on both short-term and long-term online metrics.
Data, Model, and Phase Contributions
We ran ablations to understand where GenRec’s gains come from.
Data and Model Scaling
Data scaling: For both ~1B and ~10B parameter backbones, offline MRR improves as we increase Phase‑2 post‑training data. Larger models reach higher absolute MRR but follow a similar scaling curve (see Figure 4).
Model scaling: Under a fixed training budget, we post‑trained GenRec variants from ~1B to ~10B parameters. Within this budget, larger backbones consistently achieved higher offline MRR than smaller ones.
Figure 4: GenRec Phase-2 data scaling for the∼10B model.
Phase-1 vs. OSS, Phase-2 vs. Phase-1
Phase-1 vs. OSS: Using the Phase‑1 Netflix‑adapted foundation LLM as the base model improves offline ranking metrics by roughly 10–20% compared to starting directly from an off‑the‑shelf LLM.
Phase-2 vs. Phase-1: Phase‑2 post‑training adds another 35–50% gain in offline ranking metrics when evaluated near the Phase‑1 training cutoff (i.e. when Phase‑1 model is the freshest). As time passes and Phase‑1 becomes stale with new content and shifting tastes, the relative benefit of Phase 2 grows to about 80% after 2 weeks.
Data efficiency vs. production ranker
Starting from a strong Phase‑1 model, GenRec matches or exceeds the production ranker using 10–40× fewerPhase‑2 labeled examples, depending on configuration. This marginal data efficiency is especially valuable because Phase 2 is refreshed far more frequently than Phase 1.
Context Length Optimization
Context length drives both quality and cost: longer verbalizations expose more behavior and context but increase training and serving cost. To study this trade‑off, we varied context length and verbosity and optimized them in three steps:
Clean and compress events: drop low‑signal engagements and compress repetitive behavior to form a cleaned sequence of events.
Find the “elbow point”: vary how many historical events we include and plot MRR vs. number of events to identify an elbow beyond which additional context yields diminishing returns (see Figure 5).
Optimize verbosity: for the retained events, test different levels of details and simplified wordings, measuring MRR each time.
In our experiments, we can reduce the context tokens to roughly one-third of the original budget with negligible degradation in offline ranking metrics. Since serving cost is approximately proportional to context length, we observed a similar reduction in serving cost.
Figure 5: Offline ranking metric (MRR) vs. number of user engagement events included in the prompt. The dashed line marks the elbow point: increasing the number of events beyond this yields diminishing returns.
Towards LLM‑Native Recommendation
GenRec is more than “swapping in a Transformer” for an existing ranker. It hints at a broader shift toward LLM‑native recommendation at Netflix. A few notable changes:
From Feature Engineering to Context Engineering
Traditional RecSys stacks revolve around large feature sets and heavy feature infrastructure. LLM‑centric systems instead revolve around constructing rich textual contexts from raw logs, metadata, and tools. The “prompt” becomes the new feature vector.
Modeling effort shifts from designing features to deciding which signals to include, how far back in time to go, how to compress or summarize history within a token budget. Our experiments on verbalization compaction illustrate this shift: careful context design can preserve quality while dramatically reducing serving cost.
From Customized Architectures to Foundation Backbones
Historically, each recommendation task often had its own custom architecture (two‑tower models, DLRM‑style networks, bespoke attention blocks). In an LLM‑centric world, many tasks share a common foundation backbone, with differentiation coming from data and verbalization strategies, post‑training objectives and rewards, and inference optimization.
GenRec leverages the same backbone as our foundation LLM rather than introducing a new architecture built from scratch. This makes it easier to share learnings across applications, and opens the door to natural‑language steering for future experiences.
Scaling Laws as Design Guides
Traditional RecSys can hit diminishing returns due to sparse IDs, heavy engineering objectives, and task‑specific architectures. With an LLM‑backed backbone, recommendation inherits clearer data and model scaling behavior: within cost limits, more data and larger models consistently improve quality. This brings RecSys design closer to the broader LLM paradigm, where scaling laws help guide model and data investment.
From RecSys Infra to LLM Infra
LLM‑backed recommenders push us toward LLM‑style infrastructure: GPU‑accelerated, vLLM/Triton‑based, with careful batching and caching. Over time, recommendation serving infra starts to look more like general LLM infra than classic RecSys stacks built around MLPs or factorization models.
Conclusions
We have presented GenRec, an LLM‑backed recommendation ranker at Netflix that adapts an internal foundation LLM for large‑scale personalization. By verbalizing user histories, context, and item metadata, adding a catalog‑aware ranking head, using reward‑weighted objectives aligned to long‑term satisfaction and business goals, and serving efficiently on our LLM infrastructure, we obtain a model that improves on a strong production ranker while using far fewer Phase‑2 labels and input signals.
GenRec is an early but promising step toward a more LLM‑centric recommendation stack at Netflix. Our results suggest that, with careful attention to cost, infrastructure, and alignment, LLM‑backed recommenders can play a central role in large‑scale personalization.
Acknowledgments
GenRec is the result of close collaboration among multiple teams and organizations across Netflix. The contributors to this work (in alphabetical order):
AI for members: Arjun Rao, Ashish Rastogi, Baolin Li, Fernando Amat Gil, Grace Huang, Justin Basilico, Kamelia Aryafar, Linas Baltrunas, Moumita Bhattacharya, Ogheneovo Dibie, Rein Houthooft, Shradha Sehgal, Sejoon Oh, Sergi Perez, Sourabh Medapati, Thea Wang, Yaochen Zhu, Yesu Feng, Ying Li, Yun Li, Yucheng Shi, Yunan Hu
AI platform and serving: Abhishek Agrawal, Adam Singer, Binh Tang, Daneo Zhang, Derek Olejnik, Ed Maddox, Erik Osheim, Lingyi Liu, Liping Peng, Meghana Chilukuri, Nicolas Hortiguera, Shaojing Li, ZQ Zhang
Product: Ilke Kaya, Michelle Kislak, Scarlet Chen, Si Cheng
Today, we are announcing delivery to streaming tables on Apache Iceberg for Amazon Managed Streaming for Apache Kafka (Amazon MSK) Express brokers, a fully managed capability that continuously materializes your streaming data as queryable Apache Iceberg tables on Amazon S3 Tables, a capability of Amazon Simple Storage Service (Amazon S3). With delivery to streaming tables, you no longer need to deploy, scale, or maintain Kafka connectors, Flink jobs, or custom consumers to make your streaming data available for analytics. You select a Kafka topic, choose S3 Tables as your destination, and your data becomes a read-only Iceberg table queryable from Amazon Athena, Amazon Redshift, and Apache Spark within minutes. Delivery to streaming tables provides up to 60% cost savings compared to self-managed alternatives. It also reduces downstream query costs by up to 30% through optimized file sizing, without writing a single line of code or managing any infrastructure. Because this capability delivers to S3 Tables registered in AWS Glue Data Catalog, your tables are automatically discoverable through Glue Data Catalog Business Context and Semantic Search (preview). Data stewards can enrich streaming tables with business descriptions, glossary terms, and skill assets. AI agents can then discover and reason in real time using semantic search grounded in trusted business definitions rather than raw schema inference.
In addition to S3 Tables, you can deliver Amazon MSK streaming data to general purpose Amazon S3 buckets in source data format. Data delivery to general purpose Amazon S3 buckets enables workloads like archival, backup, or ML training data delivery. This provides a price-performant, serverless, and scalable way to deliver streaming data as-is to your general purpose Amazon S3 buckets.
Challenges with delivering streaming data to Apache Iceberg
Customers today face three critical challenges when integrating streaming data with Apache Iceberg. First, ease of use: customers must manage complex Kafka Connect deployments, handle frequent pipeline failures, maintain custom configurations, handle data format conversions, and manage pipeline infrastructure for data delivery. These operational tasks consume significant engineering time and introduce ongoing risk of downtime. Second, resiliency: without proper coordination, simultaneous writes from multiple high-throughput Kafka partitions can conflict with each other, leading to failed commits, data freshness delays, and performance issues. Streaming ingestion of high-volume data creates large numbers of small Parquet files in Iceberg tables, significantly degrading query performance and forcing a difficult trade-off between data freshness and query efficiency. Third, price performance can become a bottleneck to enriching your data lake with streaming data into. With delivery to streaming tables, pricing is predictable, and up to 60% lower than self managed Kafka deployments, lowering the barrier to getting real-time context to your data agents.
How delivery to streaming tables solves these challenges
Delivery to streaming tables is a native capability built directly into Amazon MSK Express brokers. It addresses each challenge directly: it eliminates operational complexity by removing the need to deploy, configure, or maintain pipeline infrastructure, you enable it with a few clicks. It provides built-in write coordination and exactly-once delivery semantics, resolving concurrent writer conflicts and supporting data integrity without manual intervention. And it performs intelligent inline compaction during ingestion, producing query-optimized Parquet files that eliminate the small-file problem while maintaining minute-level data freshness. The capability automatically scales to process gigabytes per second of throughput.
With delivery to streaming tables, you now have a fully managed end-to-end real-time data architecture from data ingestion through storage to analytics. Your producers publish events to Amazon MSK Express brokers, which continuously deliver data as optimized Iceberg read-only tables in S3 Tables, registered automatically on AWS Glue Data Catalog. From there, you can query your streaming data using analytics engines like Amazon Athena, Amazon Redshift, Amazon EMR (Apache Spark), or Apache Flink . You can also let AI agents discover and reason over your data through Glue Data Catalog semantic search. This managed experience eliminates the intermediate infrastructure that customers previously assembled, no separate connector clusters, no compaction jobs, no custom consumers, replacing it with a single, serverless pipeline from stream to insight.
The following diagram illustrates this end-to-end architecture.
Getting started
To get started, log into the Amazon MSK console, navigate to your Amazon MSK Express cluster, and enable delivery to streaming tables with a few clicks. Specify the Kafka topic you want to deliver, configure your schema settings using AWS Glue Schema Registry, and choose your destination. Destinations can be either fully managed Iceberg tables in S3 Tables or self-managed Iceberg tables in general purpose S3 buckets. Once enabled, delivery to streaming tables immediately begins materializing your Kafka data as queryable Iceberg tables in S3 with no further intervention required.
Additionally, you can use Amazon MSK APIs to programmatically set up, update, or delete delivery to streaming tables configurations for your Kafka topics. This allows teams to build agentic workflows and infrastructure-as-code patterns for teams managing configurations across multiple clusters and topics at scale.
Getting started with the streaming tables Agent Skill
The streaming tables Agent Skill provides AI-assisted guidance for setting up streaming tables integrations for your existing or new topics in Amazon MSK Express cluster. The skill helps you configure delivery to S3 Tables (Iceberg) or S3, including schema registry setup, IAM role configuration, and validation.
Installing as an Agent Skill
Agent Skills are discovered automatically by compatible tools through the SKILL.md file. Refer to the Agent Toolit for AWS Skill Installation Guide to install the managing-amazon-msk Agent Skill. We also recommend you install the AWS MCP Server in your developer tool of choice, which exposes tools for searching AWS documentation, blogs, and Skills dynamically at runtime. These capabilities make agents more accurate and powerful for AWS related development and operational tasks, and make skill discovery and installation more flexible. Refer to Setting up the AWS MCP Server for guidance on installing the AWS MCP Server in your environment.
To verify the installation, interact with the skill in your preferred tool.
To start delivering data from your Kafka topics to Apache Iceberg tables in real time, for example, prompt “Create me a streaming table on my MSK cluster for my events topic” to your agent of choice:
The agent will dynamically load the managing-amazon-msk skill, and start by gathering the available resources in your AWS account to use for the streaming tables integration. Once it gathers that data, it will confirm the resources to use or create, and create the integration:
After creating the integration, the agent will summarize the status and can then help with any other operational tasks with your data. For example, the agent can help you set up AWS Lake Formation permissions for you to query the data in S3 Tables with Athena, or configure your table maintenance behavior in S3 Tables:
Conclusion
Delivery to streaming tables and general purpose S3 buckets is available in all AWS Regions where Amazon MSK Express brokers are available. To learn more about delivery to streaming tables, visit the documentationandpricing pages.
Amazon Inspector is an automated vulnerability management service that continually scans Amazon Web Services (AWS) workloads for software vulnerabilities. The vulnerability management capabilities of Amazon Inspector are powered by an asset inventory engine known as the Amazon Inspector SBOM Generator (inspector-sbomgen), a standalone command-line tool that produces a software bill of materials (SBOM) from container images, directories, archives, local systems, compiled binaries, and more. Over the past two years, we’ve expanded inspector-sbomgen’s coverage across dozens of programming language ecosystems, operating systems, and widely deployed applications.
We’re pleased to announce a new capability for builders using inspector-sbomgen: a plugin system for writing your own custom package collectors that you can use right away, without requiring source code compilation nor waiting for an official release.
In this post, we walk you through what the inspector-sbomgen plugin system does, why we built it, and how you can write your first plugin in a few minutes. Along the way, we also cover how plugin-generated package components integrate with Amazon Inspector for vulnerability scanning, and we explore the plugin safety model, which helps ensure security-hardened and predictable plugin behavior.
Why we built a plugin system
Software ecosystems are dynamic. New language package managers, lockfile formats, and end user applications ship constantly, and many are adopted quickly, in some cases with little security scrutiny. That leaves security teams with a visibility gap: production workloads running software that their SBOM tooling doesn’t yet recognize. Customers have asked us to inventory many of these ecosystems directly, and until recently, the only path to support was to open a feature request and wait for the inspector-sbomgen team to onboard the ecosystem and deploy a new release.
The inspector-sbomgen plugin system changes that. With plugins, you can:
Onboard ecosystems that inspector-sbomgen doesn’t support out of the box. New open source ecosystems, niche or fast-moving package formats, and internal or proprietary tooling can all be inventoried without modifying inspector-sbomgen.
Prototype detection for an ecosystem quickly. We designed a plugin system that is friendly to developers and AI coding assistants alike. Plugins are written in Lua, loaded at runtime, and require no Go toolchain nor compilation. You can use the built in test harness to iterate on a plugin and see results immediately.
Build on a stable foundation. The plugin API abstracts away artifact-type differences, so you write your detection logic once and it works seamlessly across container images, archives, local systems, and more. And because plugins stay decoupled from the internals of sbomgen, the core tool’s regression surface stays small.
Internally, we’ve used the plugin system to ship new ecosystem coverage faster than before. In our 1.13 release, more than 20 ecosystems that were previously implemented in Go, including Apache Tomcat, NGINX, MySQL, Redis, WordPress, and the OpenSSH toolchain, are now embedded as plugins inside the sbomgen binary. The same release also added more than ten brand-new ecosystems as plugins, including Apache Cassandra, Apache Struts, Conda, Swift packages, and AI-agent collectors (Amazon Q Developer, Kiro CLI, Claude Code, GitHub Copilot, and Ollama).
How inspector-sbomgen plugins work
Sbomgen plugins follow a two-step pipeline:
Discovery – Scan the artifact’s file system to identify files that contain installed package metadata.
Collection –Open each discovered file, parse file contents, and publish findings into the SBOM.
Under the hood, an event bus connects discovery and collection plugins. Discovery plugins publish events listing discovered files, and one or more collection plugins subscribe to these events, triggering package collection. Developers might recognize this behavior as the observer pattern.
This decoupling lets a single discovery plugin feed multiple collectors, for example, one extracting package metadata, another scanning for secrets, and another checking policy. Each collection plugin works from the same file list without re-walking the artifact filesystem, a computationally expensive operation.
Write your first plugin in 5 minutes
Inspector-sbomgen makes it straightforward to bootstrap a plugin environment. The plugin new command tells sbomgen to create a new plugin workspace, and the —-with-example flag populates the workspace with a discovery-collection plugin pair, that you can run immediately.
inspector-sbomgen plugin new --with-example
After invoking the preceding command, you will be prompted to provide a plugin name and a directory that will contain your plugin workspace. You can provide custom values or use the default values:
Plugin name (identifies the software ecosystem your plugin will inventory, e.g. debian-dpkg, rhel-rpm, python-pip, cmake) [my-custom-ecosystem]: <enter>
Project directory [my-sbomgen-plugins]: <enter>
Created plugin "my-custom-ecosystem" in my-sbomgen-plugins/
Note that you can skip interactive prompts by specifying the plugin name and directory using the corresponding command line interface (CLI) arguments:
After creating your plugin workspace, inspector-sbomgen will display a next steps screen, which guides developers and AI code assistants to the source files they need to change and to supporting documentation:
Next steps:
Get started:
1. Open plugin folder in a code editor (VS Code recommended)
2. Add test files that your plugin will discover and parse
(e.g., config files, lockfiles, binaries, etc.):
my-sbomgen-plugins/discovery/cross-platform/extra-ecosystems/my-custom-ecosystem/_testdata/
Develop:
3. Edit discovery: my-sbomgen-plugins/discovery/cross-platform/extra-ecosystems/my-custom-ecosystem/init.lua
4. Edit collection: my-sbomgen-plugins/collection/cross-platform/extra-ecosystems/my-custom-ecosystem/init.lua
Test:
5. Write unit tests: my-sbomgen-plugins/discovery/cross-platform/extra-ecosystems/my-custom-ecosystem/init_test.lua
6. Run unit tests: inspector-sbomgen plugin test --path my-sbomgen-plugins
Deploy:
7. Distribute your plugin directory wherever you run inspector-sbomgen:
inspector-sbomgen <arguments> --plugin-dir /path/to/my-sbomgen-plugins
Example:
inspector-sbomgen container --image alpine:latest -o /tmp/sbom.json --plugin-dir /path/to/my-sbomgen-plugins
For code completion, install the VS Code Lua language server extension:
https://luals.github.io/#vscode-install
For more information:
- Plugin guide: my-sbomgen-plugins/docs/sbomgen-plugin-developer-guide.md
- Testing guide: my-sbomgen-plugins/docs/sbomgen-plugin-testing-guide.md
- API reference: my-sbomgen-plugins/docs/sbomgen-plugin-api-reference.md
- Documentation: https://docs.aws.amazon.com/inspector/latest/user/sbom-generator.html
Now that you have a plugin workspace, let’s explore its contents in greater detail:
The scaffolded project includes a working discovery and collection plugin pair, passing unit tests with test fixtures under _testdata/, a .vscode/settings.json for integrated development environment (IDE) integration, and a local copy of the developer documentation.
The scaffolding is deliberately succinct and complete, so it reads well for both humans and AI coding assistants. Every file has clear comments that explain what each function does and what the plugin author needs to fill in.
To test a plugin, you first need something to scan, such as a package lock file or a compiled binary. The example plugin inventories a fictional example.lock with the following contents:
The provided discovery plugin knows how to look for instances of example.lock within the artifact file system:
-- my-custom-ecosystem discovery plugin
-- Discovers example.lock files in the artifact file list.
function discover()
return sbomgen.find_files_by_name({"example.lock"})
end
And the provided collection plugin knows how to parse the contents of example.lock and publish package findings to the output SBOM.
-- my-custom-ecosystem collection plugin
-- Parses example.lock files and extracts package name and version.
function collect(file_path)
local content = sbomgen.read_file(file_path)
if content == nil then
return
end
for line in content:gmatch("[^\n]+") do
local name, ver = line:match("^(.+)==(.+)$")
if name and ver then
sbomgen.push_package({
name = name,
version = ver,
purl_type = "generic",
namespace = "my-custom-ecosystem",
component_type = sbomgen.component_types.APPLICATION,
})
end
end
end
Run the tests
Plugins ship with a built-in test framework so you can validate your logic before scanning a real artifact. Tests are written in Lua, live next to the plugin in init_test.lua, and reference fixture data in _testdata/:
function test_discovers_packages()
local result = testing.scan_directory("_testdata")
testing.assert_equals(3, #result.findings)
testing.assert_equals("my-package-alpha", result.findings[1].name)
testing.assert_equals("1.0.0", result.findings[1].version)
end
function test_no_findings_for_empty_directory()
local result = testing.scan_directory("_testdata/empty")
testing.assert_equals(0, #result.findings)
end
Run the tests with the following command:
inspector-sbomgen plugin test --path my-sbomgen-plugins -v
=== RUN my-custom-ecosystem/discovery/init_test/test_discovers_packages
--- PASS: my-custom-ecosystem/discovery/init_test/test_discovers_packages (0.04s)
=== RUN my-custom-ecosystem/discovery/init_test/test_no_findings_for_empty_directory
--- PASS: my-custom-ecosystem/discovery/init_test/test_no_findings_for_empty_directory (0.04s)
ok 2 tests passed
This is the tightest development loop we could design: no Go toolchain, no rebuild, no container spin-up. Write a test, run it, iterate.
Scan a real artifact
For plugins to produce findings, inspector-sbomgen needs an artifact that contains the files your plugin looks for. For the example plugin, any directory with an example.lock file works. The fixture we generated earlier is a good stand-in:
The --plugin-dir flag tells inspector-sbomgen where to load your Lua plugins from. The resulting SBOM contains a CycloneDX component for each of the three packages in example.lock, for example:
Every plugin-generated component carries an amazon:inspector:sbom_generator:source_path property that records the file the component was collected from, so you can always trace a component back to the artifact that produced it.
Vulnerability scanning with Amazon Inspector
Plugin-generated findings are first-class SBOM components. They work with every downstream consumer that reads CycloneDX SBOMs, including Amazon Inspector. To send an SBOM to Amazon Inspector for vulnerability analysis, add the --scan-sbom flag (this requires an active AWS account):
An important caveat when you onboard a brand-new ecosystem: Plugin authors can inventory arbitrary ecosystems, but Amazon Inspector can only report vulnerabilities for components it has advisories for. When you point Amazon Inspector at a component whose ecosystem isn’t in its advisory feeds yet, Inspector will return the component with a property, Component skipped: no supported rules found. For example:
This is expected behavior, not an error. The SBOM is still generated correctly, the component is still tracked, and the source_path tells you exactly which file produced it. If and when Amazon Inspector adds advisory coverage for the ecosystem, the same SBOM will start producing vulnerability findings without any change to your plugin. For ecosystems Inspector already supports, plugin-generated components are indistinguishable from components produced by built-in scanners.
First class IDE support
We care about productivity and efficiency when writing plugins. Writing Lua without modern conveniences such as autocomplete isn’t fun, so every plugin project scaffolded with the plugin new command ships with a library/sbomgen.lua definition file and a .vscode/settings.json that automatically wires it up to the Lua Language Server extension for VS Code.
For code completion and IDE support, first install the sumneko.lua extension, open your plugin project in VS Code, and every sbomgen.* function will get:
Parameter hints with types.
Hover documentation.
Autocomplete for constants (sbomgen.component_types.*, sbomgen.groups.*, sbomgen.platform.*).
Type checking on function calls.
Inline warnings when required fields are missing from push_package().
The same definition file makes plugin development work well with AI coding assistants. The types and documentation are embedded in a form that tools can read, so assistants can generate correct plugin code with far less monitoring than writing against a raw language would require.
A safe foundation
Plugins run real code inside the same process as inspector-sbomgen, so we designed the execution environment to keep that code stable and security-hardened. Every Lua plugin runs in an isolated sandbox. Every Lua virtual machine (VM) has access to a restricted subset of the Lua standard library to ensure only safe operations are permitted:
No direct filesystem access. The Lua io library isn’t loaded. All file operations go through sbomgen.* functions, which route through sbomgen’s internals so your plugin behaves identically whether it’s scanning a directory on disk, a container image, a compressed archive, or a mounted volume.
No subprocess execution or environment mutation. The Lua os library is blocked, so plugins can’t spawn processes, modify environment variables, or touch files outside the artifact.
No VM introspection. The Lua debug library is blocked.
No unbounded code loading.dofile, loadfile, and loadstring are removed. require() is available but restricted to the plugin’s own directory tree, so plugins can share helper modules with themselves but cannot load code from other plugins or system paths.
If a plugin raises an unhandled Lua error, inspector-sbomgen logs a warning and continues with the next file or plugin; one faulty plugin does not prevent other plugins from running. Plugins never override inspector-sbomgen’s built-in package collectors. Every plugin must declare a unique name. If a custom plugin uses a name that’s already claimed by an official built-in plugin, the custom plugin is skipped with a warning. Built-in plugins always take precedence, so a custom plugin can never silently replace or shadow the tool’s own detection behavior.
Whether you’re adding support for an internal lockfile format, prototyping detection for a new open source ecosystem, or replacing a home-grown scanner with something your whole organization can run at scale, the plugin system is designed to make the path from idea to working SBOM as short as possible. We can’t wait to see what you build with it. If you have feedback about this post, submit comments in the Comments section below. If you have questions about this post, contact AWS Support.
He’s being prosecuted for giving border officials a code that wiped his phone:
The case centers on a feature included in GrapheneOS, a custom Android operating system that runs in place of the software on most modern Google Pixel devices. Tunick’s attorneys confirmed GrapheneOS was running on his phone.
The software feature allows the device owner to set a passcode that deliberately wipes the contents of that device if entered instead of the user’s unlock passcode.
Tunick’s case also raises ongoing questions about what constitutional rights can be invoked at the border, which the U.S. government has long asserted is not U.S. soil until a person is authorized to enter.
GrapheneOS is completely legal. We have no obligation to weaken any of the security protections it provides. Creating and using GrapheneOS is strongly protected by the US constitution. Laws attempting to make it illegal or require weakening the security would be unconstitutional.
It’s hard to know how much the Constitution matters in the US right now.
Modern organizations processing vast amounts of data on Amazon EMR with Apache Spark face a growing cost challenge. As the number of encrypted Amazon Simple Storage Service (Amazon S3) objects grows, AWS Key Management Service (AWS KMS) decrypt API calls multiply rapidly, driving up operational costs. Consider a retail organization processing hundreds of terabytes of customer transaction data daily in S3 encrypted with AWS KMS. Each Spark task accessing an encrypted S3 object triggers an AWS KMS decrypt API call. At scale, these calls accumulate into significant and often unexpected cost increases. This is especially true for workloads that require key auditability and cannot switch to S3 Bucket Keys. S3 Bucket Keys reduce AWS KMS request costs by decreasing the number of calls from S3 to AWS KMS. However, S3 Bucket Keys limit per-object key auditability in AWS CloudTrail, which might not meet the compliance requirements of some organizations.
This post introduces practical techniques to reduce AWS KMS decrypt costs. You can reduce API call volume and lower costs without compromising encryption. It covers three techniques: optimizing file formats (including Apache Iceberg), aggregating data, and using AWS Glue Data Catalog partition indexes.
Optimization techniques
The following sections describe three techniques you can apply independently or together to reduce the number of AWS KMS decrypt API calls.
Use data aggregation
Data aggregation reduces redundant AWS KMS decrypt API calls by consolidating smaller files into larger blocks. When Spark reads many small files from S3, each file triggers its own decrypt call. By combining multiple small files into fewer, larger files, you can reduce the total number of AWS KMS API invocations. This technique is effective for read-heavy workloads that involve numerous small files stored on S3.
You can use AWS CloudTrail to monitor changes in API call frequency and validate the effectiveness of data aggregation in reducing costs.
Step 1: Benchmark baseline performance
Before applying optimizations, establish baseline metrics to quantify improvements.
The following figure shows the number of AWS KMS Decrypt API calls captured in AWS CloudTrail. Use these baseline metrics to compare against optimized results in subsequent steps.
The following figure shows the AWS CloudTrail logs after reading the aggregated data.
AWS CloudTrail logs in Amazon Athena showing AWS KMS Decrypt API call count after data aggregation
CloudTrail metrics comparison
Track the number of API calls and observe the direct impact of data aggregation on reducing AWS KMS decrypt API calls for the same amount of data.
The following figure compares the AWS KMS Decrypt API call count before and after data aggregation for the same dataset.
AWS KMS Decrypt API call comparison before and after data aggregation
Aggregating small files into fewer large files reduces decrypt calls and shortens load time.
Optimize file formats and compression
Selecting appropriate file formats and applying compression minimizes the amount of data read from S3 and the number of AWS KMS decrypt operations.
Columnar formats (Parquet/ORC)
Columnar file formats like Parquet and ORC let Spark read only the required columns for analysis, which improves performance for analytical queries. For example, you can convert raw CSV data to Parquet to benefit from better I/O efficiency and query optimization.
df = spark.read.format("csv") \
.option("header", "true") \
.option("inferSchema", "true") \
.load("s3://emr-kms-demo/data/")
# Set compression for Parquet files
spark.conf.set("spark.sql.parquet.compression.codec", "snappy")
df.write.format("parquet").save("s3://amzn-s3-demo-bucket/parquet-data/")
Iceberg format
Apache Iceberg is a modern table format designed for large-scale analytic datasets. It supports schema evolution, snapshot isolation, and time travel, making it an excellent choice for data lakes on S3. When used with PySpark, Apache Iceberg simplifies data management by automatically optimizing file layouts, handling partitions, and integrating with Spark catalogs.
The following PySpark example uses Iceberg with Amazon EMR and S3:
df = spark.read.format("csv") \
.option("header", "true") \
.option("inferSchema", "true") \
.load("s3://amzn-s3-demo-bucket/data/")
spark.conf.set("spark.sql.parquet.compression.codec", "snappy")
# Write data to Iceberg table
df.writeTo("iceberg_from_emr_data").using("iceberg").create()
# Read from Iceberg table
spark.read.table("iceberg_from_emr_data").show()
Compression
Using compression reduces data size and speeds up reads and writes between S3 and Spark. Note: ZSTD is the recommended and default compression codec for Iceberg, offering better compression ratios. For this demonstration, we use Snappy to illustrate the concept.
Compression not only minimizes I/O and network overhead but also accelerates job execution in distributed Spark environments.
CloudTrail comparison on API calls
The following figure shows the reduction in AWS KMS Decrypt API calls when using optimized file formats with compression.
AWS KMS Decrypt API calls on optimized file formats with compression
The following table illustrates the reduction in AWS KMS decrypt calls when moving from raw, uncompressed CSV data to optimized Parquet files with compression enabled.
AWS KMS Decrypt API call comparison for CSV and compressed Parquet with Snappy
AWS Glue Data Catalog partition index
Partitioning data helps Spark jobs retrieve subsets of relevant data, reducing scan ranges, and decrypt operations. Using AWS Glue Data Catalog partition indexes reduces scanning overhead and the number of AWS KMS API calls.
Without a partition index, when Spark queries a partitioned table, AWS Glue Data Catalog returns all partitions by calling the GetPartitions API. Spark then reads every S3 object across all returned partitions. Because each S3 object is individually encrypted, Spark must call the AWS KMS Decrypt API once per object. More objects mean more decrypt calls and higher costs. With a partition index, AWS Glue performs server-side partition filtering, returning only matching partitions.
Step 1: Baseline query without partition index
Using an Amazon EMR Spark job:
spark.sql("SELECT * FROM default.`kms-demoevents` WHERE year='2000' AND month='04'").count()
Then check CloudTrail for the kms:Decrypt call count.
The following figure shows the AWS KMS Decrypt API call count when running the baseline query without a partition index. Spark scans all partitions, resulting in a higher number of decrypt calls.
AWS KMS Decrypt API call count without a partition index
Step 2: Add partition index and rerun the baseline query from Step 1
In the AWS Management Console or through the AWS Command Line Interface (AWS CLI), create partition indexes and rerun the same baseline query from Step 1. Create partition indexes on the year and month columns. Then check CloudTrail for the kms:Decrypt call count.
The following figure shows the AWS KMS Decrypt API call count after adding a partition index. With the partition index, AWS Glue filters partitions server-side, resulting in fewer S3 objects read and fewer decrypt calls.
AWS KMS Decrypt API call count with a partition index
Conclusion
Optimizing EMR Spark jobs ensures cost-effective and efficient processing of encrypted data at scale. S3 Bucket Keys is the most effective way to reduce AWS KMS Decrypt API calls. The techniques covered in this post are additional optimizations that you can use together with S3 Bucket Keys for further cost reduction. You can also use them independently when S3 Bucket Keys cannot be used because of per-object auditability requirements in CloudTrail. Start implementing these strategies today to improve your Spark workload efficiency and achieve cost savings.
We welcome your feedback. If you have questions or suggestions about this post, leave a comment below.
On July 29, 2026, the Ruby on Rails project published a security advisory for CVE-2026-66066, a critical vulnerability affecting Active Storage image processing when used in conjunction with the libvips image processing library. The vulnerability has a CVSSv4 score of 9.5 and is classified as Initialization of a Resource with an Insecure Default (CWE-1188). An unauthenticated attacker may be able to leverage CVE-2026-66066 and read files accessible to the Rails application process, potentially exposing secrets that could enable remote code execution (RCE) or access to connected systems.
An application is affected when it uses libvips for Active Storage image processing and accepts image uploads from untrusted users. Rails notes that generating image variants is not a separate requirement for exposure. Vips is the default Active Storage variant processor for applications configured with Rails 7.0 or later defaults. According to Ethiack, only the Vips processor is affected; applications using Magick are not affected through the reported vector.
As of July 30, 2026, Rapid7 is not aware of exploitation in the wild. Ethiack and GMO Flatt Security, who independently reported the vulnerability, have withheld proof-of-concept code and details of the full attack chain. Public code claiming to exploit CVE-2026-66066 exists, but it is unclear how closely it corresponds to the full attack chain reported privately to Rails. According to the Rails Security Announcement, additional details will be disclosed no later than August 28, 2026. Rapid7 recommends remediating affected applications on an urgent basis, outside of normal patch cycles.
Technical overview
libvips uses operations to load and save image formats, including operations backed by third-party libraries. Some are marked “unfuzzed” or “untrusted” because they are unsafe for untrusted content. According to Rails, Active Storage did not disable these operations before processing user-supplied files, which may allow a crafted upload to trigger an unsafe operation and disclose files readable by the application.
The Rails patch that remediates CVE-2026-66066, disables untrusted operations during Active Storage initialization. When ruby-vips is installed, patched versions prevent the application from starting if ruby-vips or libvips is too old to support that protection.
Mitigation guidance
Organizations running affected Ruby on Rails applications should upgrade to a fixed Active Storage release and ensure libvips is 8.13 or later. Updating Rails or Active Storage alone is not sufficient when an older libvips version is installed.
The Rails advisory identifies patched Active Storage releases 7.2.3.2, 8.0.5.1, and 8.1.3.1. The corresponding Rails releases are:
Rails branch
Affected versions
Fixed version
Rails 7.x
7.0.0 through 7.2.3.1
7.2.3.2
Rails 8.0.x
8.0.0 through 8.0.5
8.0.5.1
Rails 8.1.x
8.1.0 through 8.1.3
8.1.3.1
Ethiack reports that Rails 6.0.0 through 6.1.7.10 may also be affected when Active Storage is configured to use Vips; Rails 6.x does not use Vips by default. Rails has not published a fixed 6.x release, so affected Rails 6.x applications should migrate to a supported fixed branch or apply the applicable workaround below.
When ruby-vips is installed, organizations should ensure it is 2.2.1 or later. Rails advises affected organizations to replace secret_key_base and other secrets accessible to the application process, including the Rails master key and the credentials it decrypts, storage service credentials, database credentials, and third-party service tokens or keys. Replacing secret_key_base expires active sessions and affects encrypted and signed cookies, signed global IDs, and Active Storage URLs.
As a temporary workaround on libvips 8.13 or later, organizations can set VIPS_BLOCK_UNTRUSTED or, with ruby-vips 2.2.1 or later, call Vips.block_untrusted(true) from an initializer. For libvips versions earlier than 8.13, Rails states that the only workaround is to remove the libvips dependency.
Exposure Command, InsightVM, and Nexpose customers can assess exposure to CVE-2026-66066 with vulnerability checks expected to be available in the July 31 content release.
Updates
July 30, 2026: Initial publication.
The collective thoughts of the interwebz
Manage Consent
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
