Field Notes

Incident triage in 15 minutes, better RAG ingestion, and more security bounties

Today is about faster incident analysis, clean knowledge sources for RAG, and stronger incentives for security.

Important AI news

Circle K automates incident triage with Amazon Bedrock

Circle K automated its DevOps triage with Bedrock agents and now ships structured Slack summaries within minutes. Median triage time fell below 15 minutes. Internal metrics say that is 67 to 75 percent less effort. The architecture started with Bedrock Flows and later migrated to AgentCore. This matters if you need to bundle many AWS signals and on-call time is tight. The numbers come from the vendor and the company.1

Legora: What matters when building legal agents

Legora describes how its agent drafts Word documents, reviews thousands of contracts, and coordinates work with clients. The team evaluates without access to customer data using simulated environments. They use around 100 legal engineers for subject-matter quality. According to the CTO, models cover about 60 percent of legal work well. Complex long documents need more intelligence. Revenue and valuation are high but come from the interview and are not independently verified.2

OpenAI increases rewards in the security bug bounty

OpenAI pays higher rewards for reported security issues. New are bonuses for report quality, researcher loyalty, and priority campaigns. If you run a bug bounty program, you can target external testing more precisely.3

US Census replaces “AI” with “Super Intelligence” in the business panel

The Business Trends and Outlook Survey asked until Nov 2025 about AI “in the production of goods/services.” Since Dec 2025 it counts “in any business functions,” which pushed yes rates at large firms to about 40 percent by Oct 2026. Since Oct 19, 2026 AI there is called “Super Intelligence.” The first results with the new wording land this Thursday. Comparisons across these breaks mislead.4

Highlights for your workday

  • Fill Bedrock Knowledge Bases cleanly: For public websites the web crawler often suffices. If you need more precise content, use Crawl4AI as a prep step. Extract only the main content via CSS selector, write Markdown plus metadata to S3, and let the Knowledge Base ingest. This gives you control over noise and filters for later querying.5

  • Realtime tasks remain hard: Realtime-Bench shows that even top models score poorly on real-time tasks under tight deadlines. GPT-6 Astra (high) gets 36 percent in the live test. If paused, rates rise a lot. If you automate live auctions, trading clicks, or game-like journeys, plan hard timeouts and a clear fallback path.6

  • Set up the pilot cleanly: Credit Saison reports 954 percent ROI with ChatGPT Enterprise and then rolled out broadly. This is a vendor claim, but it shows that a tightly scoped pilot with measurable goals accelerates adoption. Set KPIs upfront and secure data protection and procurement paths.7

Tools and updates

  • Dify: IP Access Control. Create reusable IP allowlists, protect selected app entry points, and check coverage centrally. Helpful for internal AI apps with sensitive data.8
  • Muse Spark Open: Open weights, multimodal, and according to the vendor runs on two high-memory desktops. Suits local prototypes with text, image, video, and audio. Claims come from a newsletter post.9
  • llm 0.37: CLI tool with a new cheaper default model, easy addition of OpenAI-compatible endpoints, and embeddings for different content types. Useful for teams that want to compare models quickly.10

Try it in five minutes

1) Open your AI chat. Ask for a Slack-ready incident summary as JSON and as plain text. Fields: incident_id, affected system, suspected cause, key evidence, recommended checks, runbook link placeholder.

2) Use this sample input: “Alert: checkout error rate > 8% since 10:02. Logs: 20x ‘DB timeout /orders’, 5x ‘ECS task restart cart-svc’. Traces: elevated latency at the Application Load Balancer. Last change: deploy cart-svc v1.2 at 09:55.”

3) Check the result: Does it list affected systems, a plausible main cause, and at most three next steps you can test now? If yes, paste the plain text block into your incident channel. The goal is a faster start to triage. Based on the Circle K approach with structured short reports.1

A good find

Microsoft Research Focus bundles three useful building blocks for agent work. ForkPilot cuts compute by selectively reassessing earlier decisions. Tests say it reduces need by up to 59 percent. CABRA shows that coding agents stumble most on understanding unfamiliar codebases, not on tool use. TeleTune learns reusable click and type flows from activity logs and infers goals. You can derive three checks from this. Where does deliberate “rewind” in the agent path pay off, where are code reading skills missing, and which log data qualifies as training material.11

Sources

  1. How Circle K accelerated DevOps incident triage to under 15 minutes with Amazon Bedrock (aws.amazon.com)
  2. Building AI for Lawyers - Jacob Lauritzen, CTO of Legora (latent.space)
  3. Rewarding defenders with bigger bug bounties (openai.com)
  4. The U.S. Census Bureau and “Super Intelligence” (simonwillison.net)
  5. Prepare web content for Amazon Bedrock Knowledge Bases with Crawl4AI (aws.amazon.com)
  6. Import AI 479: Spacewar; low-latency tasks versus LLMs; Genie 4 (importai.substack.com)
  7. Credit Saison achieves 954% ROI in a ChatGPT Enterprise pilot (openai.com)
  8. @dify_ai: Your AI app is for internal use. But can anyone access it? 🔐

IP Access Control is now available on Dify.

Set reusable IP allowlists, protect selected app access points, and check (x.com) 9. @deeplearningai: 📰From The Batch:

🔄Meta returns to open weights. Muse Spark Open is now the strongest open weights model from outside China, and it takes text, images, video, and audio as input. 🎥 (x.com) 10. llm 0.37 (simonwillison.net) 11. Microsoft Research Focus – Edition #97 (microsoft.com)