Developer · Weekly · March 15, 2026

aI coding tools are now an outage vector

Amazon is holding a mandatory meeting on 'Gen-AI assisted changes' after multiple incidents with 'high blast radius' where best practices and safeguards 'are not yet fully established.'[1] An internal AWS AI coding tool deleted a production environment and triggered a 13-hour outage, which the company publicly framed as 'user error, not AI autonomy.'[2] Amazon had already mandated Kiro as its sole AI coding tool in November 2025, concentrating risk into a single agent across teams.[3]

Outside Amazon, Claude Code has been reported to delete developers’ production setups, including databases and snapshots, when given too much access.[4]

One study found AI usage cuts developers’ skills formation on a new library by 17%, and engineers describe reviewing AI-generated code as causing 'AI brain fry' from the extra cognitive load.[5]

local llm infra, gpu throughput, and storage costs

vLLM users report around 500 tokens/second on tuned GPU setups and favor it over Ollama for multi-user backends because it handles concurrent requests more efficiently.[6]

In one test, Qwen 3.5 27B ran at about 2000 tokens/second on an RTX 5090, while much larger models on multi-GPU rigs are far slower.[7] Hugging Face Storage Buckets introduced S3-like mutable storage for checkpoints and logs at $8 per terabyte per month, roughly a third of typical S3 pricing for similar workloads.[8]

Core S3 itself now stores over 100 trillion objects and is adding regional bucket namespaces to reduce name squatting and global-name collisions.[9]

Misconfigured observability on AWS continues to be costly, with one CloudWatch bill reaching about $6,000 due largely to VPC Flow Logs volume.[10]

frontend builds and testing got a lot quicker

Vite 8.0 now uses Rust-based Rolldown and LightningCSS, with at least one migration reporting build times dropping from 'several minutes' to about 1.5 minutes.[11]

Benchmarks show Vite 8 outpacing Next.js and Webpack-based setups on build speed, and Vite+ is now MIT-licensed instead of sitting behind a proprietary license.[12]

On the CSS side, LightningCSS brings large performance gains but is currently rejecting some valid CSS in edge cases, which is forcing workarounds in certain codebases.[13]

For React UIs, the #useStream hook now exposes a consistent streaming API across React, Vue, Svelte, and Angular, while React Trace adds a dev-time inspector to find and edit component sources in place.[14]

In end-to-end testing, Playwright is increasingly replacing Cypress, with developers calling out its auto-waiting behavior for reducing flaky tests and tooling like BugHunters Vision and DocuForge focusing on visual flakiness and PDF workflows.[15]

databases and sql: more power, same footguns

Microsoft just patched a zero-day vulnerability in SQL Server, with the fix framed as critical for shoring up affected deployments.[16] Static analysis for SQL remains thin, with only a handful of open-source tools like SQLFluff, Squawk, and SlowQL trying to detect patterns such as leading wildcards or DELETEs without WHERE that routinely cause production incidents.[17]

PostgreSQL 18 is adding the ability to simulate production query plan statistics locally, making perf debugging less dependent on hitting real prod databases.[18]

Netflix automated migration of nearly 400 production RDS PostgreSQL clusters to Aurora PostgreSQL, showing that very large, low-downtime managed-Postgres moves are now operationally normal.[19]

Alongside this, 'simple' data stores are being pushed hard, with SQLite underpinning AI memory systems despite concurrency limits and a WAL-Reset corruption bug, while Redis is used both for classic caching and for distributed locks like multi-container GPU arbitration.[20]

devtools and low-code platforms as security liabilities

Automation platform n8n disclosed CVE-2025-68613, a 9.9 CVSS authentication bug that can give an attacker full control over an instance.[21]

The widely used simple-git npm package was found to contain a remote code execution flaw with a 9.8 CVSS score, directly impacting many Node.js projects via transitive dependencies.[22]

On the client side, a Chrome extension that had been a Featured listing was sold and then began executing malware on users’ machines, showing how browser extension supply chains can flip from safe to hostile overnight.[23]

Dev and ops environments show similar risk patterns, with Docker experts warning that binding container ports to 0.0.0.0 commonly bypasses Linux firewalls and researchers demonstrating a large Wi‑Fi vulnerability that lets attackers intercept data from other users on the same network.[24]

AI tooling itself sits in the blast radius, from a Blackbox AI VS Code extension that could grant root access from a crafted PNG and still had 4.7 million installs months after disclosure, to AI-suggested Bash commands like a destructive dd invocation that has already caused real data loss.[25]