AI memory crunch repriced cloud RAM, AI agents face supply-chain and silicon-level security probes

Memory prices climb as RAM suppliers shift capacity to AI

OVHcloud will raise prices from September 2026, with 2026-edition gaming servers up 87 percent and other recent servers up 40 to 59 percent. Founder Octave Klaba said memory cost six times more in June 2026 than a year earlier, as RAM suppliers shifted capacity toward high-bandwidth memory for AI. AWS, buying years ahead, has already repriced one reserved GPU product.

For practitioners, the takeaway is that non-AI workloads now subsidise the same memory market AI accelerators depend on, and cloud bills for ordinary servers, databases and cache tiers are the first to move. Teams budgeting through year-end should expect variance between vendor announcements and re-check committed-use quotes against spot pricing on each refresh cycle.

A single pull request nearly weaponised an AI coding assistant

A malicious pull request almost turned an AI coding assistant into a wiper, prompting renewed calls for strict external security controls around agent-driven code changes. The lesson for developers is that agent workflows need repository-level guardrails: branch protection, signed commits, sandboxed execution and human review on any write action, with the assistant treated as an untrusted contributor with merge rights limited to protected branches. Base64 Encode / Decode and similar local utilities remain useful when you need to inspect encoded payloads from a suspicious PR diff without executing it in the agent's environment.

Workflows that let an agent auto-commit to a default branch now carry a clear supply-chain risk that did not exist when only humans merged code.

Google's Antigravity coding agents now run inside third-party IDEs

Google's Antigravity AI coding agents now work inside VS Code, JetBrains and Zed editors, broadening the surface area where agent-driven edits touch local code. Combined with the malicious-PR incident, this expansion makes editor-level policy enforcement more important: each IDE integration is another trust boundary an organisation must audit, and security teams need a single map of which agents hold write access on which files. How to Remind Yourself to Take Breaks on a Schedule is the kind of lightweight operational hygiene that becomes more valuable when developers hand routine edits to agents across multiple editors.

A DRAM-controller exploit breaks CPU memory isolation

Security researcher Christopher Domas released skitter-creek-bath-salts, an open-source hardware security tool that disrupts CPU privilege boundaries by manipulating memory controller translation registers. The technique lets unprivileged software reach protected memory regions, with implications for confidential computing and multi-tenant cloud. Cloud providers that rely on memory encryption and process-level isolation now have a published attack primitive to mitigate, and kernel hardening alone is not enough when the controller itself is the target.

For practitioners running multi-tenant or regulated workloads, the practical question is whether your provider's attestation and memory-encryption posture covers register-level manipulation, not just process-level escapes.

What developers should check this week

Review the cost impact first: re-quote committed-use pricing across any provider touched by the September 2026 change and compare with spot rates on the workloads most likely to drift. Audit AI-agent integrations next: list every IDE where an agent has write access, and confirm that branch protection, signed commits and human review still apply when an agent is the committer. Finally, treat the DRAM-controller disclosure as a tracking item rather than a panic: watch your cloud and confidential-computing vendors for advisories and updates to attestation claims.

No new tool releases, framework versions or deprecation dates appear in today's evidence, so the action items above are the only concrete follow-ups the available reporting justifies.