☕️ How Anthropic builds software with AI

Hi there, this is your daily ☕️ Devshot.

In today's Devshot:

🤖 How Anthropic builds software with AI

🌐 Cloudflare launches Internal DNS

🛡️ GitHub adds Actions approval checks

❄️ Snowflake launches Cortex AI Gateway

🏗️ Terraform AzureRM provider 5.0 ships

Plus: 🎁 13 other news you might like, 🧰 6 tools, and 📚 5 papers.

🤖 How Anthropic builds software with AI LINK

The Pragmatic Engineer toured Anthropic's San Francisco lab to document how its teams build software with AI, interviewing engineers behind Claude Platform, Bun, and Claude Code about shifting practices and what has stayed the same.

The Claude Platform team spent six months shipping Claude Managed Agents, a pre-built harness for production agents that runs on Anthropic-managed or self-hosted infrastructure, requiring heavy upfront planning, a PRD, and a mid-project re-architecture that decoupled Claude's "brain" from sandboxes and session logs.

Jarred Sumner rewrote Bun's 535K-line Zig codebase into memory-safe Rust in 11 days using Fable and roughly $165K of tokens, a mechanical port that previously would have taken a small team a full year while freezing all other development.

🌐 Cloudflare launches Internal DNS LINK

Cloudflare has made its Internal DNS generally available, delivering cloud-native authoritative and recursive DNS for private networks that consolidates private and public DNS onto a single control plane with a unified API, audit trail, and policy registry.

The service exposes three entities: internal zones holding authoritative records for apps, endpoints, and databases; DNS views that compose zones for split-horizon setups; and resolver policies that match incoming requests and forward them to a specific view.

The gateway resolver evaluates each request against policies to block, forward internally, or route to the public path, with optional fallback to public resolution, and is free to enterprise customers via dashboard, Terraform, or API.

🛡️ GitHub adds Actions approval checks LINK

GitHub now automatically pauses GitHub Actions workflow runs in public repositories when its systems flag a run as potentially malicious, holding it until a collaborator with write access reviews and approves it through an authenticated web session.

The check targets supply chain attacks where hijacked GitHub credentials modify workflows to steal CI/CD secrets or the GITHUB_TOKEN, and it applies automatically to repositories on GitHub.com but is not currently available for GitHub Enterprise Server.

Alongside the check, GitHub advises maintainers to pin third-party Actions to full-length commit hashes, limit the permissions assigned to the GITHUB_TOKEN, and avoid running untrusted pull-request code in privileged jobs that access secrets.

❄️ Snowflake launches Cortex AI Gateway LINK

Snowflake unveiled Cortex AI Gateway, a centralized control layer that governs how AI agents (including third-party tools like Anthropic's Claude Code and Cursor) access enterprise data, tools, and models, entering public preview soon.

Built on Snowflake's May 2026 Natoma acquisition, the gateway supports over 100 MCP servers, centralizes authentication, permissions, and audit logging, and lets finance teams attribute AI costs to specific agents while enforcing spending limits before bills escalate.

Security integrations with 1Password, Aembit, SailPoint, and Saviynt introduce dual attribution, logging both an agent's non-human identity and the human who authorized a task, with task-scoped access replacing inherited standing permissions evaluated in real time.

🏗️ Terraform AzureRM provider 5.0 ships LINK

Terraform AzureRM provider 5.0 has reached general availability, delivering finer control over Azure subscription interactions, opt-in preflight validation, and the removal of resources and properties deprecated across earlier releases in a major breaking change.

The provider no longer auto-registers the roughly 60 legacy Azure Resource Providers at initialization, so teams now register only what their configuration needs, retain the old behavior, or manage registration externally themselves.

New opt-in Azure Preflight Validation API support lets the provider call Azure during terraform plan to catch policy violations, quota breaches, and invalid property values, while location and Resource Provider metadata checks are now disabled by default.

Other news you might like

• Why DoorDash, Instacart, and Uber Eats Integrated LLMs Into Search Three Different WaysLINK

• The Orchestrator's TaxLINK

• Getting started with Meilisearch: A complete guideLINK

• You don't have to be smart if you can think clearlyLINK

• Diagrid Catalyst 2.0 adds durable execution to more than 10 agent frameworksLINK

• 5 expensive smart home devices you can build with an NFC-enabled ESP32 insteadLINK

• Lima v2.2: Windows guests and TPM 2.0 emulationLINK

• Developer uses AI to bring a native version of The Legend of Zelda: Ocarina of Time to iOS, no emulation required to play one of gaming's all-time greats on an iPhone or iPadLINK

• Your Kubernetes health checks are accidentally waking your services. Here’s the fix.LINK

• Distributed rate limiter with HRW in ElixirLINK

• OpenAI releases open source Codex Security CLI and TypeScript SDKLINK

🧰 Trending tools

Humalike x Hermes: provides APIs and models that give AI agents turn-taking, timing, and memory skills for more natural, human-like conversations.LINK

ZooData: converts any URL into structured JSON for AI agents, cutting LLM token usage by roughly 75% while adding pre-analyzed e-commerce insights for Amazon and TikTok.LINK

ditto.site: turns any public URL into clean Next.js or Vite code deterministically, preserving components, design tokens, and hover states via a free API or MCP server.LINK

Replay QA: records website sessions in a dedicated browser, then lets you inspect them with devtools to create detailed, shareable bug reports.LINK

FetchSandbox: simulates webhooks, retries, and async workflows against 60+ real APIs, letting developers reproduce bugs deterministically without burning quota or touching staging environments.LINK

Cekura: automates QA testing for conversational AI agents, covering pre-production simulation, evaluation, and production call monitoring with CI/CD pipeline integration.LINK

📚 Trending papers & reports

AI agents as data researchers can improve a model's training data on their own in ~58% of test settings, but in ~78% of those improvement runs they overshoot and end up worse than their best attempt, showing automated self-improvement still needs human oversight to lock in gains.LINK

Building code compliance checks can be turned into transparent, auditable software that a multi-agent system writes automatically, boosting accuracy by 82% over simple one-shot AI prompting, even when run on a fully private, in-house model.LINK

JavaScript code testability can be scored across seven structural traits, like async complexity and side effects, revealing that hard-to-test functions cluster in a small subset of files across 30 open-source projects, helping teams target testing effort precisely.LINK

Open source contributor preferences show that a survey of 208 practitioners finds project choice depends heavily on age, gender, and role, with newcomers and veterans wanting different signals like documentation quality and project maturity, guiding better contributor recruitment and retention strategies.LINK

AI-generated deployment configs can successfully launch multi-service apps from code alone, yet consistently skip security safeguards like network segmentation and production-grade build optimizations, meaning "it runs" doesn't mean "it's production-ready."LINK

See you tomorrow for a new dose of ☕️ Devshot!