AI Code & Doc Guardrails

Rapid adoption of large language models (LLMs) in enterprise settings has introduced operational, security, and governance risks. As generative AI applications move from pilot to production, manual harm identification and mitigation are becoming difficult to scale. Although many tools support model evaluation, adversarial testing, runtime guardrails, and observability, the tooling landscape remains fragmented. Tools are typically designed for specific engineering tasks and described in technical terms that do not align with governance frameworks or risk taxonomies, making it difficult to determine which tools address which risks and where critical gaps remain. This paper proposes a structured protocol to automate AI risk mitigation through a taxonomy-driven analysis of open-source LLM evaluation and security tools. We map the capabilities of 21 prominent open-source tools to the 32 subcategories of the extended MIT AI Risk Mitigation and Response Taxonomy. An LLM-assisted retrieval-augmented generation pipeline analyzes source code and documentation to extract capabilities for each taxonomy category. Reliability assessment yielded moderate agreement (Fleiss' Kappa = 0.509) among three independent reviewers. The analysis reveals a highly skewed landscape in which tools cluster around technical and operational controls, while governance, legal and regulatory, and financial and market controls remain largely unaddressed. This motivates a layered risk-mitigation architecture combining tool-based controls with organizational and regulatory processes. The mapping protocol achieved an F1 score of 75.5% after majority voting. Overall, the study provides a practical mapping between enterprise AI risk categories and open-source mitigation capabilities, identifies where human oversight remains necessary, and presents a taxonomy-driven framework applicable to open-source and proprietary solutions.

Mid-training is increasingly recognized as a critical stage for shaping the capabilities of large language models. Recent work has shown that targeted mid-training can strengthen reasoning-intensive abilities such as math and science, and can also improve agentic capabilities in software-engineering settings. In this work, we study the parallel but less explored agentic capability: general tool use. We present MidTool, an open corpus construction pipeline for agentic tool-use mid-training that combines large-scale web, PDF, and code data with synthesized supervision from real-world tool APIs, MCP skills, and document-grounded workflows. MidTool is designed to teach models how to recognize tool affordances, ground arguments from context, compose tool call workflow, and recover from incomplete information. We mid-train Qwen3-4B-Base and Qwen3-8B-Base on MidTool-Mix, and then apply follow-up post-training with both supervised fine-tuning and reinforcement learning. Compared with baselines, MidTool-Mix consistently improves downstream performance under both SFT and RL on BFCL, tau2-Bench, and MCP Universe. These results suggest that general tool use, like other important LLM capabilities, benefits from dedicated mid-training rather than being left entirely to post-training.

Remove multi-vendor AI provenance traces: Unicode text sanitization, statistical rewriting techniques, and C2PA/metadata stripping from PNG/JPEG/SVG/PDF/DOCX/HTML/MD files

Agents deployed in enterprise settings must reason across structured APIs and document collections, yet existing benchmarks evaluate these capabilities in isolation. We introduce VAKRA (e\textbf{V}aluating \textbf{A}PI and \textbf{K}nowledge \textbf{R}etrieval \textbf{A}gents), a benchmark of over $8{,}000$ executable APIs across $62$ domains with tasks spanning three settings of increasing difficulty: diverse API interaction styles, multi-hop reasoning over structured APIs, and multi-source reasoning with natural-language tool-use policy constraints. Correctness is verified by re-executing predicted tool calls against live APIs, accommodating multiple valid paths. Using a fixed ReAct harness to isolate model capabilities from agent architecture, we evaluate frontier and open-weight models and find that even the best model achieves only 70.4\% on single-hop endpoint-style tasks and drops to 50--51\% on compositional APIs; performance degrades by over 50\% as reasoning depth increases, and policy-constrained questions expose severe failures (as low as 2.4\% on unanswerable queries). Trace analysis shows failures concentrate at language-mediated reasoning - entity disambiguation, cross-source grounding, rather than tool invocation mechanics. Code is available https://github.com/IBM/VAKRA. Dataset is available https://huggingface.co/datasets/ibm-research/VAKRA

<strong>Introduction</strong> <p><a href="https://lobste.rs" rel="ugc">https://lobste.rs</a> – at the time of writing – has a javascript error on load for logged in users:</p> <pre><code>Uncaught ReferenceError: qS is not defined at new _LobstersFunction (user-c27ac03d.js:144:34) at user-c27ac03d.js:665:17 </code></pre> <p>This error is causing much of the site functionality to not work, an easy way to check is to try and <code>[preview]</code> a comment, if that does not work – most likely you have an error in the js-console.</p> <p>If you provide the missing definition for <code>qS</code> and <code>qSA</code> site functionality is restored in full-effect.</p> <p>Known to fix:</p> <ul> <li>story / comment upvotes</li> <li>comment preview</li> <li><code>$things_you_have_spammed_click_wondering_why_it_doesnt_work</code></li> </ul> <hr> <strong>Override using Dev Tools =&gt; Sources =&gt; Override</strong> <p>For those with webdev experience it is easy to fix the error yourself by simply patching the faulty script with the below:</p> <pre><code> const qS = (a, b) =&gt; b === undefined ? document.querySelector(a) : a.querySelector(b); const qSA = (a,b) =&gt; b === undefined ? [...document.querySelectorAll(a)] : [...a.querySelectorAll(b)]; </code></pre> <p>If the above is ran before the faulty line (665 in this case), all is well and things start working again.</p> <hr> <strong>Use an extension such as TamperMonkey</strong> <p>An easier alternative is to use <a href="https://www.tampermonkey.net/" rel="ugc">TamperMonkey</a> to automatically run custom javascript for the site, below is what I use:</p> <pre><code>// ==UserScript== // @name lobste.rs undefined qS/qSA fix // @namespace http://tampermonkey.net/ // @version 2026-07-27 // @description try to take over the world! // @author You // @match https://lobste.rs/* // @icon https://www.google.com/s2/favicons?sz=64&amp;domain=lobste.rs // @grant none // ==/UserScript== (function() { 'use strict'; window.qS = (a, b) =&gt; b === undefined ? document.querySelector(a) : a.querySelector(b); window.qSA = (a,b) =&gt; b === undefined ? [...document.querySelectorAll(a)] : [...a.querySelectorAll(b)]; })(); </code></pre> <hr> <strong>end-of-transmission</strong> <p>Personally I used the override approach after discovering this, but I assume there are more than me who want to use our beloved features while waiting for a redeploy of lobste.rs</p> <pre><code>(\_/)_00_(\_/) ^- me previewing my own comments like crazy with the mitigation </code></pre> <p>Happy browsing!</p>

The European Union (EU) has emerged as a leading regulatory body in the development of sustainability and privacy regulations. While new regulation requirements vary, many include a documentation artifact to ensure compliance. Notably, the Ecodesign for Sustainable Products Regulation (ESPR) introduces Digital Product Passports (DPPs) for life cycle transparency, while the General Data Protection Regulation (GDPR) mandates Data Protection Impact Assessments (DPIAs) to mitigate privacy risks. Creating these compliance artifacts, however, is challenging. Industrial data, which often exists in heterogeneous formats and is scattered across company and supplier systems, is required for DPPs and can be difficult to extract into compliant DPP formatting. Furthermore, DPIA documents require interdisciplinary expertise and follow no standardized format, making development difficult for novel systems. To address the particular complexity of compliance artifact creation for both regulations, researchers have proposed the use of LLMs in the generation process; however, the impact of the aforementioned problems on the output of these systems is largely unaddressed. This work investigates the existing research gap by exploring how data extraction instructions and regulatory vagueness impact the quality and consistency of LLM-produced compliance artifacts. The resulting artifacts are evaluated by benchmarking different models against manually created ground-truth schemas. The results reveal that less strict guidelines, such as DPIA formatting, require higher context prompts to maintain consistency and completeness. Stricter guidelines, such as formatting for Digital Battery Passports (DBP), result in consistent results regardless of prompt context, but may lead to more hallucinations in the output

The Idea This article documents my thought process while system-designing a simple...

One universal AI agent sounds convenient. One agent to read tickets, write code, generate tests,...