Skip to content

Runtime: It's time to rethink data platforms for agents

+ Yet another massive Patch Tuesday drops, just as companies start to understand the risks of using AI to write patches.

Runtime: It's time to rethink data platforms for agents
Photo by Carlos Muza / Unsplash

Welcome to Runtime! Today: as AI agents take over the web, data tools will need to follow suit, nolabs thinks it can build a better sandbox, and more.

Please forward this email to a friend or colleague! If it was forwarded to you, sign up here to get Runtime for free every week, or level up here.


First up: So fresh and so clean

Data engineers have spent the last several years modernizing and cleaning up old data systems in preparation for enterprise AI, but the rise of AI agents is changing the game once again. Similar to how enterprise software companies are rethinking the role of the user interface in a world where agents are their primary users, data teams are starting to realize that they may need to rethink some of the architectural principles that have served them well to date.

For example, business intelligence dashboards built for humans assume a person can take in several pieces of information at a glance and make decisions based on business priorities or historical context, but that's not how agents work. Agents "go looking for information instead of asking for one specific thing. They pull context from several systems, call tools, carry state through a multistep workflow and, increasingly, act without anyone approving each step," H-E-B data engineer Aditya Ranjan wrote in a contributed piece for The Stack.

Your data platform was built for queries. AI agents are changing the contract
Enterprise data systems were designed to inform people and applications. As AI agents begin to act on that data, familiar concerns such as freshness, lineage, semantics, identity and observability become runtime controls.

In response, data platform architects need to put familiar data contexts like "freshness," and "lineage" into new buckets for agents to parse as they go about their tasks. For example, "a small refund might tolerate an hour-old record, while a bulk purchase order might need a read from the system of record within seconds;" that's the kind of decision a human would likely understand how to manage, but agents just plow ahead.

And as we've noted all year, managing agents will require new systems for identity management and observability, given how quickly a malfunctioning agent can do damage, and those tools will need to extend onto the data platform as well. "Every piece of context an agent uses to justify an action should arrive with a small contract attached," Ranjan wrote, which will allow agents to get it right the first time (theoretically) thanks to well-defined rules.


The Stack Summit: We're convening in London on November 4-5, for a series of exclusive workshops and fireside conversations on the rise of BYOC as a favoured enterprise SaaS deployment model; how many CDOs are consolidating their data estates with Apache Iceberg; how CISOs at FTSE 100 scale are handling supply chain risk (with GSK's CISO) and more. 

Ticket applications are subject to pre-vetting. Get in touch with ed@thestack.technology if you want to be in the room.

Learn more

The rest of The Stack

Get busy patchin': There was only one zero-day vulnerability in this month's Patch Tuesday dump identified by Microsoft, which is good, although this month's haul contained more patches than Microsoft shipped in all of last year. In response to the deluge of patches brought on by AI cybersecurity models Microsoft will now organize the patches into "risk cohorts" that could help companies understand which patches to prioritize.

Microsoft’s 1,413 patches in a day outstrip all of 2025
October's Patch Tuesday: 1,408 CVEs. All of 2025? 1130 CVEs.

Automatic for the patches: Keeping up with that flood of newly discovered vulnerabilties will likely require companies to use AI to write the patches themselves, and that can get tricky. "When they use AI to patch something and it patches the wrong way, the problems are getting bigger and in the end you need another patch, and another patch,” Noah Labs' Berk Yilmaz told The Stack.

AI is writing patches, how much should we trust them?
AI-generated patches are helping defenders address a tsunami of vulnerabilities, but they come with their own challenges.

Just say no: Luke Hinds founded nolabs two years ago as concerns about agentic security were starting to emerge, but the launch of OpenClaw earlier this year (that was somehow just this year) accelerated their plans and led to the development of the nolo project. In this week's One To Watch, Hinds explained how the traditional security concept of "defense in depth" is being reworked for AI agents.

One to Watch - nolabs
Co-founder and CEO Luke Hinds on isolating agentic actions, sandboxes, and open source infrastructure.

The sun never sets: Sovereign cloud remains a huge concern for European CIOs with each passing day that US AI companies continue to grow, and Starling is putting its money where its mouth is. The bank told The Stack that it plans to train its own model on Civo, with Group CIO Harriet Rees saying "UK-owned infrastructure would… give CIOs like myself the confidence that UK-owned data and proprietary AI models will fall under UK jurisdiction."

Starling trains model on sovereign UK cloud, as CIO warns over concentration risk
CIO Harriet Rees is working with Civo and NVIDIA to create a model trained on 15 billion transactions

What is time, anyway: JPMorgan's Jamie Dimon made a lot of headlines last year claiming the investment bank was pouring $2 billion a year into AI and seeing immediate results. That's not exactly the case, CFO Jeremy Barnum said on an earnings call this week, putting the number closer to $700 million a year and saying "it takes a long time to really do things that are visible at an institution of our size."

JPMorgan: Quantifying AI benefits is "wasting time"
Plus, CEO Jamie Dimon is blocking "outside agents"

Stacked up — The week ahead

All Things Open will be in Raleigh, NC, starting on Monday, featuring tech talks and workshops from across the open-source software community.

Cloudflare Connect 2026 kicks off Monday at Moscone West in San Francisco, and expect to hear a lot about how AI is changing Cloudflare's lineup of infrastructure services.

Gartner IT Symposium and Xpo will be in Orlando starting on Monday, featuring presentations from Gartner's army of analysts and Serena Williams.

PyTorch Conference North America hits San Jose next Tuesday, outlining the future of one of the most important tools of the AI era.

Nvidia GTC comes to Berlin on Tuesday, with CEO Jensen Huang expected to speak on Wednesday.


We're also reading:

Are Harnesses Worth the Cost?: Naresh Jain ran an experiment testing coding agents using behavioral harnesses, and found in many cases that the extra expense did nothing to improve outcomes.

Microsoft 365 G7 Is Here. Mostly. Sort Of: Directions on Microsoft's Wes Miller took a look at the highest-end version of Microsoft 365 available to government customers, and as in a lot of public sector software, the new version lacks several features found in the private sector edition.

AI Changed How Spotify Builds. What We Learned (and Fixed) About Quality at Higher Velocity: Spotify's Tyson Singer walks readers through several changes the company made to its engineering processes with the advent of AI.


Thanks for reading — see you Saturday!

Add The Stack on Google