Srinivas Devaki

Co-Founder @ZenactAI | Founded Opti Owl Cloud | ex SRE Lead @Zomato | IIT Dhanbad

[Srinivas Devaki @eightnoteight]

@ponnappa what people seriously lack is mutual respect, respect for fellow humans and respect for their time

too many generations assumed that respecting elders means, young ones don't deserve respect and its a one way street

[Srinivas Devaki @eightnoteight]

alright now i'm scared to look at the code

[Srinivas Devaki @eightnoteight]

making things durable while being ultra low latency is such a hard problem

[Srinivas Devaki @eightnoteight]

claude code hooks are now a nightmare; 50 things get notified in mac each time claude complex something

#cpumaxxing

[Srinivas Devaki @eightnoteight]

this is pretty much claude using claude agents sdk

[ClaudeDevs @ClaudeDevs]

New in Claude Code (research preview): dynamic workflows.

Claude writes an orchestration script on the fly, then spins up a large fleet of coordinated subagents in parallel to take on your most complex tasks.

Use the word "workflow" in a prompt to get started.

[Srinivas Devaki @eightnoteight]

@diptanu @tensorlake you should definitely try real traffic replays at fast rate, real traffic & real usage patterns but simulated resources

should typically find more issues

too many systems have too many hidden queues and caching layers built on top of them

[Srinivas Devaki @eightnoteight]

slack seriously needs a show more kind of way to expand information

typically humans would never post pages of stuff, but agents love to do

[Srinivas Devaki @eightnoteight]

there can be a whole class of cognitive effects that humans face when it comes to how they treat agents

Agent-Dunning-Kruger Effect: overestimating what agents can do and operating on them at a very high level and ending up with so much slop.

Agent-Imposter-Syndrome: you spend too much time thinking agents don't work when controlled at high level but new models keep releasing faster than you can change your views, so it constantly feels like every agent is an imposter.

you are forever affected by one of those, and you are forever losing the best agents offer, everytime model behaviour changes singificantly

[Srinivas Devaki @eightnoteight]

The Great Unslopification

[Thomas Ricouard @Dimillian]

The Great Unslopification

[Srinivas Devaki @eightnoteight]

@Habibat456 1 & 3 ftw

[Srinivas Devaki @eightnoteight]

initially high level specs are all the rage but controlling models purely on the boundaries means internally you are giving them full freedom to slopmaxx

controlling with low level contracts is the best way to minimise slop

controlling struct fields, method signatures, method naming, each methods inputs/outputs, what problems they own is the best way to reduce slop

[Dillon Mulroy @dillon_mulroy]

my "plans" largely look like pseudo code composed of mostly types/interfaces, how they compose, and their boundaries

ive recently started including call stacks - been very helpful for both me and agents when implementing

[Srinivas Devaki @eightnoteight]

@dillon_mulroy seeing the same pattern internally

models are quite bad at proper abstractions, ownership boundaries, i wish there are solid verification strategies to this problem so that the future models keep getting better, especially with taste and all

[Srinivas Devaki @eightnoteight]

@deedydas @cbseindia29 @EduMinOfIndia @dpradhanbjp @sanjayjavin @airnewsalerts @AkashvaniAIR @DDNewslive @PIB_India @PTI_News @PIB_Edu if establishments themselves have no integrity, how can they teach students to have integrity

this is just getting sad

[Srinivas Devaki @eightnoteight]

"my cousin who works at nvidia says, claude/openai will come up with a model and your product would be out of business"

[a16z @a16z]

OpenAI and Anthropic are effectively telling the market they can't solve every problem with a generic AI coworker.

You don't pour billions into massive forward-deployed joint ventures if you think the next model release is going to take care of it.

In the cloud supercycle, semis led and software followed (and you didn't need Qualcomm or ARM to tell you the value was migrating up the stack).

In AI, the infra layer itself is telling us the application layer is a separate, massive opportunity they can't fully capture.

a16z's @joeschmidtiv on why the app layer isn't dead: https://t.co/84QN5Mj9T3

[Srinivas Devaki @eightnoteight]

Love the work the @composio does. Security incidents are brutal, especially for infra companies. Hoping they recover stronger than ever.

Problem is bad actors now have really really powerful models to hack even companies that treat security as their top priority.

Having seen some of the worst classes of production and security incidents firsthand at @zomato, we decided very early at @ZenactAI that customer data security cannot be treated as a compliance checkbox problem.

We went to uncomfortable extremes from day 0:

* Sensitive customer data is isolated into separate AWS data vault accounts altogether
* Even internally no human can access those vault accounts
* Even if we wanted to inspect customer data directly, our architecture is designed to prevent it
* Customers can bring their own AWS accounts as well. BYOC, BYOK
* Encryption at rest, in transit, and during storage pipelines
* KMS to minimize long-lived secrets and token exposure across systems
* SSO + IAM Roles + zero IAM users to eliminate developer/automation access tokens entirely
* Strong auditability boundaries around every privileged action

AI agents, automation systems, and long-running infrastructure dramatically increase blast radius when things go wrong. The industry will need much stronger primitives than just "SOC2 compliant".

This incident is another reminder that security architecture decisions made in the first few months matter far more than the security page written later. And the cost of those decisions if done in the first few months, its actually quite low.

[Karan Vaidya @KaranVaidya6]

Here’s my update on the security incident we disclosed earlier today.

On May 21, an attacker probed our systems extensively, gained a foothold in an internal agentic tool we use to monitor our infrastructure, and escalated through our automated remediation systems and sandboxed execution environment over an approximately 8-hour window. The attacker demonstrated deep knowledge of our API surface and internal architecture, and compromised a small subset of GitHub Tokens on Composio’s platform before we removed their access.

As a precautionary measure, we have revoked every user’s GitHub tokens, not only those with direct evidence of compromise. We have paused all new releases until our investigation is complete. We have thoroughly verified that our supply chain, and our Python and TypeScript SDKs and our CLI binary, remain safe. We have engaged external incident response experts to assist with investigation and remediation, and we continue to investigate for any further signs of compromise.

We have identified a small percentage of users affected via GitHub tokens, and have contacted each of them directly.

We will keep the below security bulletin updated over the coming hours and days, and we expect to ship product enhancements rapidly to help mitigate attacks of this kind in the future. All of our focus right now is on investigation, communication to customers, enhancement of security measures, and sanitization of our environments.

[Srinivas Devaki @eightnoteight]

i mean, you missing the point, even that can't be a good metric

you start finding customers that would feel happy with your product rather than trying to make product better to make customers happy

there is always more to do to make customers happy

but still, happiness shouldn't be a true metric IMO, most get happy very quickly - "value being created per customer over time"

that's something you can measure over "are you happy with our product"

[Srinivas Devaki @eightnoteight]

at this point, google cloud should just offer insurance

[Railway @Railway]

We are working to restore the Google Cloud infrastructure that powers our dashboard, API, and internal network's control plane. We are in direct contact with Google Cloud's support team. We do not have an ETA at this time.

We will continue to post updates on https://t.co/yyqjvnCDLD

[Srinivas Devaki @eightnoteight]

don't get disillusioned by high level controlling of coding agents via mermaid diagrams, architecture diagrams in the specs

you would still end up with a ton of slop

[Srinivas Devaki @eightnoteight]

fuzz testing was just having its breakthrough in terms of attention and adoption but AI came and captured all the spotlight, only problems that mattered became work time optimisation problems

no one is realising but a lot of systems level problems are taking backseat

good thing, these type of problems are back again

[Airbnb Engineering @AirbnbEng]

We built a new GraphQL engine and launched it with 0 spec conformance bugs. How? Fuzz testing — finding the edge cases we didn't know to look for. James Bellenger is sharing how at #GraphQLConf 2026 @GraphQL
https://t.co/lGSYX51bAG

[Srinivas Devaki @eightnoteight]

@MattJamesBoyle @mattpocockuk but how exactly do you evaluate? case by case basis or any set of golden metrics you keep monitoring?