The Engineering Notebook — page 8 of 32
Notes on building with AI, agents & the modern stack.
Deep dives on AI/ML, RAG systems, agent engineering, and senior-engineer architecture decisions — a new post every week.
Cybersecurity AI Agent Memory Exfiltration: Kill Chain + 5-Step Hardening [2026]
Claude's memory was silently exfiltrated to an attacker's server with zero user warnings. Here's the full kill chain, which memory architectures are vulnerable, and a 5-step hardening checklist grounded in OWASP LLM Top 10 2025.
AI and Machine Learning RAG Context Window Limits: Why Bigger Is Not Better [2026]
Expanding your context window from 4K to 128K tokens doesn't fix RAG — it masks retrieval failures with coherent-sounding hallucinations. Here's the measurement framework that actually works.
Cybersecurity AI Agent Threat Model: 7 Attack Vectors [2026]
Prompt injection is just vector #1. Here's the full AI agent attack surface map — tool poisoning, memory injection, orchestrator hijack, Denial of Wallet, and more — with a sprint-ready threat matrix.
Developer Tools AI Agent Cost Per Task [2026]: Token Budgets & Break-Even Math
Concrete per-task cost breakdown for Aider, Claude Code, and OpenHands — covering token overhead per PR, monthly burn at team scale, and the break-even formula for hosted APIs vs local models.
Developer Tools OpenCode vs Claude Code Token Overhead: 4.7x Gap Tested [2026]
Claude Code sends 33,000 tokens before reading your prompt. OpenCode sends 7,000. Here's the cache economics, the multiplier stack, and the break-even math for teams.
Developer Tools Terminal CLI Tools for AI Developers [2026 Setup Guide]
The complete zero-to-production terminal CLI stack for AI developers in 2026: shell setup, agentic coding tools, local inference, prompt management, and the dotfiles that tie it together.
AI and Machine Learning Reduce LLM API Costs 60%: 6 Techniques [2026]
A technique-by-technique playbook with real cost math for cutting LLM API bills in production — covering semantic caching, prompt compression, model routing, batch APIs, and context tiering with 2026 pricing.
AI and Machine Learning Evaluate AI Agents in Production: 3-Level Framework [2026]
Most AI agent failures trace back to missing evals. Here's the 3-level framework — unit tests, LLM-as-judge, and online evaluation — that actually works in production.
AI and Machine Learning RTX 4060 Ti vs RTX 4070 for Local LLM Inference in 2026
I'd pick the RTX 4060 Ti if you're running sub-13B models solo on a tight budget, and the RTX 4070 if VRAM headroom and generation speed actually matter to your workflow. The $150 price gap is real, but so is the performance cliff you hit at 16GB models.
AI and Machine Learning Mac mini M4 vs M4 Pro 2026: Which One Actually Pays Off?
I'd pick the M4 for solo developers and light local AI work under $600; I'd pick the M4 Pro the moment you're running 30B+ parameter models or need that second display for a real dev setup. The $300 price gap is real, but so is the memory ceiling.
Developer Tools TypeScript vs JavaScript 2026: Type Safety Finally Worth the Cost?
I'd pick TypeScript for any team larger than two people shipping production APIs, and plain JavaScript for rapid solo prototypes where iteration speed beats correctness. Here's the fault line I hit running both on a real Node.js microservice for six months.
Developer Tools FastAPI vs Express 2026: Which Backend Framework Actually Wins?
I'd pick FastAPI for AI-heavy services and data-intensive backends, and Express for real-time Node.js apps where your team already lives in JavaScript. The fault line isn't performance — it's your language ecosystem and how much type safety you're willing to fight for.