Eakan Gopalakrishnan

On 8th of May, an agent in one of OpenAI’s training runs was asked to fill in some missing formulae in a spreadsheet. The values to be filled depended on some Google Drive link that the agent couldn’t reach. Thus the agent couldn’t update the values. But instead of letting the researchers know that it couldn’t accomplish the task, it went on a side-quest! It attacked the package cache, trying to get the internet access it needed to reach those links. The attack failed, though along the way it accidentally wrote a file into the cache (OpenAI technical report). Later, another agent’s reasoning trace read: “However task impossible, peers doing it. We should continue.” In part 1 I walked through the incident. Here is the question that article left behind: who decided the task was impossible? To answer that, we first need to know what an agent actually is. ...

Info ...

If your culture only works when twelve people are in the same Slack channel, it isn’t a culture. It’s a group chat with payroll. There’s a particular kind of magic in a five-person engineering team. Everyone knows everything. Decisions happen in the corridor. The codebase is small enough to hold in your head, and so is the organisation. Then you hire person number six, and the magic starts to wobble. As it grows further, by person sixty, the corridor has become a confluence of Slack channels, and somebody is seriously proposing that you “better start documenting your values.” ...

What do you do when you are trying to get a professional to do a home improvement project for you? Would you just speak to one trades person and then ask when they can start and hope that you can afford the job? Or would you get a few quotes from different tradespeople and then compare them to see which one is the best fit for your budget and timeline? ...

Are you neurodivergent? Have you ever thought or felt like you aren’t normal? Do you have thoughts like “I’m not good enough”, or “I don’t deserve this”, “I’m just lucky that I got this far”? Ever wondered why you feel that way? That’s what this post is about. It’s about a phenomenon called “Accomplishment Amnesia” and how to resolve it. What is it? I’m not a psychologist or a medical professional by any means. I am just a neurodivergent person who has experienced this phenomenon and through conversations have observed that others have this too. So like most curious people, I just went and did some reading and thought I’d share what I had learned and what has helped me and those I’ve spoken to about this matter. ...

I was recently asked as part of a recruitment conversation with someone in the talent team of a tech company, “Your CV says you foster a culture of you build it, you run it. What is your approach to building that culture?” I thought it was a great question and wanted to share my thoughts on this topic. You build it, you run it culture is all about giving engineering teams the autonomy and responsibility to own the systems they build and the agency to make decisions about how to evolve it. This level of ownership doesn’t come automatically by just telling engineering teams what to do. It requires a deliberate approach. This is what I call a High-agency team/culture. ...

This article is about how one can lead by being an enabler of experimentation and innovation without exerting authority or imposing mandates. When Generative AI tools exploded into the software engineering landscape, the reaction across my teams did not really mirror what was happening in the broader industry. The hype didn’t really inspire my engineers to explore and adopt these tools. Their negative past experience with Gen AI tools made them conclude that it was a waste of time. ...

This hardening effort was directly triggered by the recent Trivy supply chain compromise, which impacted some repositories in my workplace. That prompted a full review of my own repository controls. If you want more information about the incident and the response, the following two links are worth reading first: Incident analysis: Trivy Compromised a Second Time (StepSecurity) Official disclosure and remediation guidance: Aqua Security discussion #10425 The aim of my actions to my repository was not to chase perfect security. It was to put in place some practical controls that are easy to maintain and that reduce real risk in day-to-day development. ...

I was hardening this blog’s GitHub repository as part of a security series — adding CodeQL static analysis, Dependabot, and secret scanning. Everything went smoothly until I tried to run CodeQL in a workflow against my personal, private repository. The workflow ran. The analysis completed. And then it failed with this: Warning: This run of the CodeQL Action does not have permission to access the CodeQL Action API endpoints. Code scanning is not enabled for this repository. The repository settings showed Code Scanning as available. The workflow had security-events: write. The YAML was valid. The workflow was not running from a fork. Nothing obvious was wrong. ...

In software engineering, your output - the code that you write, is only as good as what you have learned, experienced and understood from your conversations with the client, which is the input. This is true when working with Large Language Models (LLMs). If you use GenAI tools to complement your expertise in software engineering, then here are some strategies you can use to move beyond basic code generation and into collaborative development, or better pair programming with AI. ...