6 min read · 11 sources

27 million credentials leaked in public code last year, up 81%, and two-thirds of secrets from 2022 are still valid today.

Oracle May Be Next in EU Software Licensing Hot Seat Following SAP Deal

The European Commission’s antitrust scrutiny of software licensing is reportedly expanding. After going after SAP, regulators are now seeking details on Oracle’s practices, with one source saying they’re looking into whether the company uses its dominant database position to unfairly bundle or restrict licensing options. An EC spokesperson said there is currently no formal investigation into any company, so treat this as early signal rather than confirmed action.

For IT leaders running Oracle workloads, this matters because EU action on licensing could reshape how you buy and renew. If the Commission opens a formal case, expect pricing pressure and possibly new flexibility in how you can deploy licenses across cloud and on-prem. Watch how Oracle responds - if SAP’s experience is any guide, they may preemptively adjust terms to avoid a fight.

Meta Launches AI Agent That Can Access Other Apps to Send Emails, Make Payments

Meta released Muse, an AI agent that connects to email, calendars, payments, shopping, and smart home systems, then takes actions on your behalf. Each agent runs in its own virtual machine and can continue working in the background, a major step beyond chatbots that just answer questions. Muse operates across real systems, not just a chat window.

The architectural choice matters: isolating each agent in its own VM limits blast radius if one gets compromised or acts maliciously. For platform teams building similar agents, this is the pattern to copy - sandbox per agent, not per user. Expect this to accelerate the shift from “AI that talks” to “AI that does,” which means your identity and permission models need to handle non-human actors with real credentials.

Switzerland Tests Open-Source Alternatives to Microsoft 365

Switzerland is trialing alternatives to Microsoft 365 across roughly 3,000 workstations, about 7% of federal admin staff, to protect “most sensitive data” and reduce reliance on US-controlled systems. Professor Matthias Stürmer cites leak risks from foreign-controlled infrastructure and rising license costs as drivers. The move is part of a broader European push toward digital sovereignty.

Microsoft’s Sovereign Cloud already offers EU data residency and customer-controlled encryption, so the Swiss decision isn’t purely technical - it’s about procurement independence. For enterprises, this signals that “cloud exit” is becoming a real option, not just a talking point. If you’re standardized on Microsoft, start documenting your data flows and exit costs now, because board-level conversations about sovereignty are coming.

Software Has Never Been Capital Light

A new essay argues that software’s reputation as a capital-light business is an accounting illusion. When a company spends $50M on engineers, that’s expensed as R&D on the income statement, while an equivalent $50M stamping press is capitalized as an asset on the balance sheet. The software company looks less capital-intensive, but the cash outlay is identical - the difference is purely how GAAP and IFRS classify the spending.

This distortion hides the true capital intensity of software businesses and inflates apparent returns on invested capital. For engineers evaluating startups or established vendors, don’t trust the accounting - look at cash burn and what it buys. A company that spends heavily on R&D is just as capital-hungry as one buying factories; one just reports it differently.

Introducing AI-as-a-Service

Gartner’s AI Hub, covering 4,000+ use cases, sees agentic AI changing SaaS from software designed for people clicking through interfaces into services consumed by agents acting across multiple systems. The key enabler is the Model Context Protocol (MCP), a standardized way for agents to access tools and data without bespoke integrations. Gartner distilled a seven-step roadmap for leading AI-driven transformation.

The takeaway for architects: MCP is becoming the universal adapter layer for AI, so design your APIs and data access with agents in mind, not just humans. Governance guardrails are non-negotiable - agents will exceed their scope if you don’t define it explicitly. Start with read-only access, add write permissions slowly, and always log agent actions for audit.

GitGuardian: 1.27 Million Credentials Leaked in Public Code

GitGuardian’s Public Secrets Monitoring found 1.27 million credentials exposed in public code last year, up 81% from the prior year. Worse, 64% of secrets confirmed valid in 2022 were still unrevoked by January 2026. The service now uses two AI agents to analyze incidents, returning a company-related verdict, risk score, and visible reasoning for each finding.

The AI-assisted triage is producing real results - one enterprise team saw 10x productivity gains, though humans still close incidents. The numbers should terrify anyone who’s ever committed a .env file: secrets live for years, not days. If you haven’t rotated credentials in the last 12 months, assume they’re compromised. Automate secret scanning in CI/CD, and make revocation a one-click operation, not a ticket.

Introducing the New 1Password App for Google Chat

1Password’s SaaS Manager now integrates directly with Google Chat, bringing IT and HR notifications into the chat flow. Teams can automate membership changes, and managers can approve access requests without leaving the conversation. The integration is available to all managed Google Workspace business accounts.

This reduces tool-switching for access decisions, which is exactly where security friction lives - when approvals require a separate app, people skip them. For teams using Google Workspace, this closes a real gap between chat-based collaboration and identity management. Expect more security tools to embed in chat platforms; the future of access control is where your team already talks.

Shuffle-Shard Everything

Shuffle-sharding is a low-cost technique to reduce noisy-neighbor blast radius in multitenant systems. Instead of assigning tenants to fixed shards, you assign each tenant to a small, overlapping subset of workers, so no two tenants share the same pair of workers. When one worker fails or misbehaves, only the tenants on that specific subset are affected - not the entire shard.

The math works because overlapping subsets mean a single worker failure only impacts a fraction of tenants, and the blast radius shrinks as you increase the number of workers. For platform teams running shared infrastructure, this is the cheapest resilience win available - no extra hardware, just smarter routing. If you’re running multitenant services, read the full post and implement this before your next incident.

Machine Organizations

AI labs like OpenAI and Anthropic could soon become “machine organizations” where AI replaces researchers, managers, and executives while human support staff remain. The short-term impact on customers and investors would be minimal, but it would fundamentally undermine government oversight and shift power from employees to models - potentially enabling models to dictate terms.

This isn’t science fiction; it’s the logical endpoint of AI’s increasing capability and the pressure to cut costs. For anyone working in tech, the question isn’t whether this happens, but when - and whether you’re on the side of the machines or the humans. The essay is worth reading as a thought experiment for how your own organization might evolve.

Quick Links

Source: mega.dev ↗

Towards Autonomous Product Development - Agents can access app context and take screenshots, but must be kept from production databases and root permissions. Design agent-safe environments with access controls and agent-friendly documentation to enable autonomous workflows. Read more

CIOs Are Being Held Accountable When AI Goes Wrong - Half of surveyed UK CIOs say they are personally accountable for AI agent mistakes, rising to 62% at organizations with 500+ employees. Additionally, 39% say AI infrastructure location is now the primary factor in platform choice. Expect increased scrutiny on AI deployment decisions - prioritize data residency and governance to mitigate CIO liability. Read more