The Engineering Notebook — page 12 of 32

Notes on building with AI, agents & the modern stack.

Deep dives on AI/ML, RAG systems, agent engineering, and senior-engineer architecture decisions — a new post every week.

a computer screen with a bunch of code on it AI and Machine Learning

AI Agent Memory State Management Guide [2026]

Production AI agents fail silently without proper memory and state management. Here's the four-tier memory architecture, durable resumption patterns, and framework implementations in LangGraph, CrewAI, and raw Python.

Workflow diagram, product brief, and user goals are shown. Cybersecurity

AI Agent Security Attack Surface Map [2026 Checklist]

The first developer-friendly attack surface map combining OWASP's Top 10 for Agentic Applications, Cisco's MemoryTrap disclosure, and June 2026 red-teaming benchmarks showing 70% attack success rates — with a printable security checklist.

A laptop screen displays "claude fable 5 is currently unavailable." Cybersecurity

Advanced Prompt Injection Techniques 2026: 7 Attack Chains Beyond OWASP #1

Prompt injection graduated from academic curiosity to active exploit — with CVEs filed against GitHub Copilot, Claude Code, Cursor, and AWS Kiro in a single month. Here are the 7 advanced attack chains researchers are tracking and the only defense architecture with provable security.

Server rack with blinking green lights AI and Machine Learning

LLM Latency Benchmarks 2026: 6 Levers to Hit Sub-500ms TTFT

Real TTFT and throughput data across 10+ models, where latency breaks user experience, and 6 architectural levers to hit sub-500ms budgets in production without sacrificing quality.

Woman typing on a laptop with a vase nearby Cybersecurity

Indirect Prompt Injection in AI Agents: 10-Step Red-Team Checklist [2026]

Every major AI coding agent shipped with exploitable indirect prompt injection vulnerabilities in 2025. Here's the red-team checklist to find them in your own pipeline before attackers do.

GGUF vs GPTQ vs EXL2: LLM Quantization Compared [2026] AI and Machine Learning

GGUF vs GPTQ vs EXL2: LLM Quantization Compared [2026]

A head-to-head comparison of GGUF, GPTQ, and EXL2 quantization formats with real quality, speed, and VRAM trade-offs — updated for the 2026 Hugging Face acquisition of ggml.ai.

Fine-Tune Open-Source LLMs: LoRA, QLoRA, Gemma 4 [2026] AI and Machine Learning

Fine-Tune Open-Source LLMs: LoRA, QLoRA, Gemma 4 [2026]

A practical 2026 guide to fine-tuning open-source LLMs with LoRA and QLoRA using Unsloth + Gemma 4 — including GPU requirements, hyperparameter defaults, evaluation setup, and when to just prompt instead.

How to Set Up Python for Professional AI Development in 2026: The Stack That Scales Developer Tools

How to Set Up Python for Professional AI Development in 2026: The Stack That Scales

Stop using venv + requirements.txt for AI projects. Here's the professional Python environment stack — uv, pyproject.toml, Ruff, type checking, and CI/CD — that actually scales from prototype to production.

Linux vs Windows vs macOS for Local AI [2026 Compared] AI and Machine Learning

Linux vs Windows vs macOS for Local AI [2026 Compared]

Your OS choice affects local LLM inference speed more than your model pick. Here's the benchmark-driven breakdown of Linux, Windows, and macOS for local AI in 2026.

WhatsApp AI Agent: 5 Production Walls Beyond the Tutorial [2026] AI and Machine Learning

WhatsApp AI Agent: 5 Production Walls Beyond the Tutorial [2026]

The 30-minute WhatsApp AI agent tutorial gets 2,757 views/day. Here's what happens after the demo: rate limits, API costs, conversation state, ban risk, and the architecture that actually survives production.

Loop Engineering: Stop Prompting, Start Building Agent Loops [2026] AI and Machine Learning

Loop Engineering: Stop Prompting, Start Building Agent Loops [2026]

95% of developers use Claude Code like a chatbot. Loop engineering — skills, subagents, hooks, and CLAUDE.md workflows — turns it into an autonomous coding system that iterates until tests pass.

Vibe-Code Security Nightmares Nobody Warns About [2026] Cybersecurity

Vibe-Code Security Nightmares Nobody Warns About [2026]

63% of AI-generated functions ship with a security vulnerability. Here's the OWASP-mapped breakdown of what vibe-coded apps get wrong — and the audit checklist that catches it before your users do.