The Agent Ledger #20: Zombie processes, vibe-coded apps, and a supply chain breach

Pinterest's postmortem on CPU starvation inside PinCompute is the kind of story every platform engineer should keep bookmarked. ML training jobs were stalling on a Kubernetes fleet, and the culprit turned out to be an Amazon ECS agent that had been left running but unused, slowly leaking memory cgroups until the scheduler could no longer place work cleanly.

The lesson is not about ECS specifically. It is about the long tail of default daemons, sidecars, and node agents that ship with managed infrastructure and accumulate over years of migrations. Each one is plausible enough that nobody removes it, and each one is a candidate for the next cgroup or file descriptor leak.

For teams running AI workloads, the operational surface is wider than the model code. GPU schedulers, container runtimes, and node-level agents all interact in ways that look fine in steady state and fall apart under bursty training traffic. Pinterest's fix was a one-line disable. Finding the line took considerably longer, which is the part worth budgeting for.

Infosys and Cognizant are shifting their contract mix toward fixed-price and outcome-based deals, and the stated reason is AI automation. When a junior engineer with a coding assistant can ship what used to take a small team a week, time-and-materials billing becomes a tax on your own productivity gains.

The second-order effect matters more than the headline. If the largest services firms in the world are willing to price on outcomes, they are implicitly betting they can predict delivery timelines for AI-assisted work. That bet only pays off if internal tooling, evaluation, and rework rates are measured carefully enough to forecast margin. Expect a lot more investment in internal developer analytics at these shops.

For in-house engineers, the read-across is that the comparison point your CFO uses is changing. The question is no longer how much a contractor costs per hour. It is how much a defined deliverable costs, and whether your team's velocity with the same tools is defensible.

The recent supply chain attack hitting TanStack, Mistral AI, and UiPath packages across more than 170 components is being framed as a security incident, but most engineering orgs will only fix it by changing how they procure dependencies. The compromise vector was the usual one: maintainer credentials, downstream trust, and a registry that assumes good faith.

The uncomfortable detail for AI teams is that agent frameworks pull in long dependency trees, often from packages with one or two maintainers. A coding agent that auto-installs a library based on a vague natural-language request is a delivery mechanism for whatever happens to be trending on npm or PyPI that week. The blast radius scales with how much autonomy the agent has to touch package manifests.

Practical mitigations are unglamorous: pinned versions, internal mirrors with delay windows, signed provenance via something like Sigstore, and a hard rule that agents propose dependency changes through review rather than committing them directly. None of this is new advice. The attack just raised the cost of ignoring it.

The Verge's argument that the era of one-size-fits-all software is ending deserves a serious look from anyone building developer tools. The piece describes users generating throwaway apps for narrow personal needs: a custom recipe tracker, a bespoke invoice tool, a one-off dashboard. None of them would survive a product review. None of them need to.

What is interesting for engineers is the substrate this requires. Personal software at scale means runtimes that are cheap to spin up, auth that works without a setup wizard, and data primitives that a model can wire together without human glue. The platforms that win this category will look less like app stores and more like Postgres-plus-an-agent.

There is also a quieter implication for internal tools teams. If a non-engineer at your company can generate a working CRUD app in an afternoon, the backlog of small requests that used to justify a dedicated team starts to evaporate. The remaining work concentrates around shared data, permissions, and the boring middleware that personal software still cannot produce reliably.

ESW's launch of Microsoft 365 AI readiness audits is worth noting less for the product itself and more for what it signals about where enterprise AI spending is going. The pitch is not a model, a tool, or a workflow. It is a roadmap for adopting Copilot, agents, and governance controls without breaking compliance posture.

This is the consulting industry's tell that most large organizations are still stuck on prerequisites: data classification, permission hygiene, retention policies, and identity. The fun parts of AI adoption assume those are solved. They usually are not. A Copilot rollout that exposes the wrong SharePoint folder to the wrong vice president is a career event, and audits exist because that risk is now legible to legal teams.

For engineers, the takeaway is that the agent layer your company eventually deploys will inherit whatever access model your collaboration suite already has. Cleaning that up before agents arrive is cheaper than cleaning it up after. The audit firms are simply pricing in the gap.

Apple's 26.5 release is being covered mostly for Maps and accessory pairing, but the memory management and developer tooling changes are the parts engineers will actually notice. Tighter handling of background processes and improvements to local model runtimes matter for anyone running inference on a laptop while a build is also chewing through cores.

The broader pattern across the last few OS releases is that the local machine is becoming a serious tier of the AI stack again. Smaller models, on-device embeddings, and private agents for code review or note-taking all benefit when the OS gets better at carving up memory and scheduling GPU time predictably.

None of this is dramatic. It is the kind of incremental platform work that, two years from now, will quietly determine whether a meaningful amount of agent workload runs on the device versus in someone else's data center.

A market report on European neonatal ventilators is an unusual entry for a developer newsletter, but the framing is instructive. The vendors leading the segment are pushing closed-loop systems where AI adjusts ventilation parameters in real time, with clinicians supervising rather than driving. The growth projection assumes regulators are comfortable with that shift.

This is what serious agent deployment looks like outside of consumer chat interfaces. The model is not generating text. It is taking continuous action against a sensor stream, inside a regulatory regime that demands traceability for every parameter change. The engineering challenges, including logging, rollback, deterministic fallback modes, and human override semantics, are exactly the ones that consumer agent frameworks have mostly hand-waved.

Developers building autonomous systems in less regulated domains should watch how medical device makers solve this. The audit trails and safety envelopes required in a NICU are a reasonable preview of what enterprise compliance teams will eventually ask for when an agent has a credit card or production database access.