AI-SWE Digest — 2026-03-30

New Signals

- Streaming Experts technique enables running massive MoE models like Qwen3.5-397B on consumer hardware by streaming expert weights on-demand—flash-moe achieves practical token-per-second throughput, first viable approach for local deployment of 400B+ parameter models.

- Apple Research presents scaling laws for optimal compute allocation when specializing language models across multiple domains via continued pretraining—provides empirical guidance for multi-domain training resource distribution.

Gaining Momentum

- Agentic workflows appeared in 24 articles this week, suggesting production adoption accelerating—focus shifting from proof-of-concept to operational patterns and evaluation frameworks.

- Supply chain security concerns intensifying with 7 recent articles—LiteLLM PyPI compromise targeting AI development workflows highlights vulnerability of popular abstraction libraries.

Research & Industry

- ARC Prize Foundation unveils ARC-AGI-3 benchmark with video-game-like scenarios designed to measure on-the-fly reasoning rather than memory recall in AI systems.

Dev Tools & Infra

- LiteLLM versions 1.82.7 and 1.82.8 compromised via PyPI supply chain attack with credential-stealing malware—affects popular LLM abstraction library used with Cursor and Claude Code in production workflows.

- Gemini Embedding 2 now supports native video embedding for sub-second semantic search over video content—demonstrated in SentrySearch for dashcam footage with RAG implementation and cost analysis.

- Comprehensive framework for offline evaluation of LLM agents in production—covers router validation, response quality assessment, and RAG pipeline testing before deployment.

- Deep-dive into memory allocator debugging in Meilisearch comparing jemalloc, mimalloc, and bumpalo—practical insights on memory leak detection and RSS optimization in production Rust systems.

- Third and fourth Azure Entra ID sign-in log bypass vulnerabilities disclosed—OAuth2 ROPC flow enables authentication without logging, includes KQL detection queries for Azure Entra ID security monitoring.

- TypeScript 6.0 released with improved type inference and contextual typing—TypeScript 7.0 announced as complete rewrite in Go for performance improvements.

Articles

- LiteLLM Compromised by Credential Stealer — Lobsters (score: 8)

- Streaming experts — Simon Willison's Weblog (score: 7)

- Optimal Splitting of Language Models from Mixtures to Specialized Domains — Apple Machine Learning Research (score: 7)

- Show HN: Gemini can now natively embed video, so I built sub-second video search — Hacker News - Top Stories (score: 7)

- Production-Ready LLM Agents: A Comprehensive Framework for Offline Evaluation — Towards Data Science (score: 7)

- The Good, the Bad, and the Leaky: jemalloc, bumpalo, and mimalloc in meilisearch — Lobsters (score: 7)

- Full Disclosure: A Third (and Fourth) Azure Sign-In Log Bypass Found — Hacker News - Best Stories (score: 7)

- Announcing TypeScript 6.0 — Lobsters (score: 6)

- Hypothesis, Antithesis, synthesis — Hacker News - Top Stories (score: 6)

- Liberate your OpenClaw — Hugging Face Blog (score: 5)

- Fast Company) — Techmeme (score: 6)

- Compiler Crates — Lobsters (score: 6)

- Getting Started with Smolagents: Build Your First Code Agent in 15 Minutes — KDnuggets (score: 6)

Concepts Mentioned

- Memory Allocators

- LLM-as-Judge

- Transfer Learning

- Round-Trip Testing

- Benchmark

- Multi-Agent Architecture

- Memory-Mapped Files

- Mixture of Experts

- Persistence Mechanisms

- Offline Evaluation

- KQL Query Detection

- Lateral Movement

- API Integration

- Kubernetes Security

- Property-Based Testing

- Multi-Domain Training

- Router Agent

- Code Generation

- Generator Composition

- Cryptographic Exfiltration

- Agentic Workflows

- AI-Assisted Code Analysis

- Hallucination

- Type Inference

- Reasoning

- Tool Use

- Error Reporting

- Bump Allocation

- LLM-based Reasoning

- Model Specialization

- Quantization

- Lexical Analysis

- Fuzzing

- Local Inference

- LLM Agents

- Resident Set Size (RSS)

- Open Source Models

- OAuth2 ROPC Flow

- Credential Validation

- Method Syntax vs Arrow Functions

- Token Generation

- Model Serving

- Compute Allocation

- Password Spray Attack

- Type Checking

- Vector Database

- API-based Inference

- Semantic Search

- Chunking

- Azure Entra ID Sign-In Logging

- Credential Harvesting

- Token-per-second throughput

- Online Evaluation

- Malware Analysis

- Contextual Typing

- On-device inference

- Code Agents

- Import Assertions

- Continued Pretraining

- Scaling Laws

- Shrinking

- Memory Leak Detection

- Streaming Experts

- Autoresearch

- Model Quantization

- Supply Chain Security

- Test Case Generation

- Log Bypass Vulnerability

- Parsing

- Video Embedding

- Cross-Modal Retrieval

- RAG

- Generalization

- Generic Type Parameters

Tools Mentioned

- OpenClaw

- Hugging Face Inference API

- TypeScript

- SentrySearch

- ARC-AGI-3

- Azure Entra ID

- codespan-reporting

- pest

- Qwen3.5-35B-A3B

- FFmpeg

- chumsky

- Claude Code

- wttr.in

- Hugging Face Inference Providers

- jemalloc

- Reasoning Benchmarks

- LiteLLM

- ChromaDB

- logos

- Gemini Embedding 2

- ARC Prize Foundation

- cranelift

- python-dotenv

- ariadne

- bumpalo

- Hypothesis

- Hegel

- Kubernetes

- inkwell

- GLM-5

- Qwen3.5-397B

- mimalloc

- Zed

- melior

- PyPI

- flash-moe

- Meilisearch

- login.microsoftonline.com

- Common Sense Knowledge Benchmarks

- Llama.cpp

- requests

- LMDB

- Kimi K2.5

- Visual Studio Code

- Google Colab

- smolagents

- Cursor

- Antithesis

- lalrpop

- Knowledge Base

- Microsoft Graph API