Cloudberry Engineering

How do you do security engineering when the code is being changed in real time by a swarm of coding agents? We went all in and did the same. At Synthesia we strive to move fast and be efficient. We recently released Syren, taking it from internal proof-of-concept to external release in a very short timeframe, turning a prototype into a product-grade system that meets all our quality and compliance requirements. The product was being built the way a lot of software is built now: by engineers…

Also: The title has been editorialized for marketing purposes. My original title would have been “Teach Your Agents to Do Code Security Reviews”. Coding agents are now involved in the majority of the code shipped at Synthesia. The volume of code changes has gone up but the time humans spend reading those changes has not. The practice of doing code security reviews is especially exposed to this pressure because it depends on careful analysis. To solve this, we’ve built an agent skill that…

I just published my homebrew coding agent orchestrator I’ve been using in the last - checks calendar - three months. It’s called littlefactory (repo here) and is a cute little cli that smashes together Ralph loops and a lightweight spec driven workflow, but is not too opinionated and the workflow can be ignored as long as you get to write the implementation tasks in a properly formatted tasks.json. I mostly use the workflow this way: I start with /lf-explore to rubber duck a change Once happ...

One of the engineers behind Manus shared a bunch of interesting tips about building agents. Above all: you don’t need specialized tools, just one run(command="...") to run cli tools whose interfaces are usually familiar to the underlying model. The agentic risks are mitigated by running some of those commands inside BoxLite containers (microvms). Most commands never touch the OS. cat, grep, memory search, browser open — these look like shell commands but they’re implemented as a Go command r...