JTSTech Services

Blog

Notes from the workshop.

Practical, opinionated thinking on building for the web — platforms, commerce, cloud, performance, security, and AI.

Security

The payload isn't in the model. It's in the notes your agents keep for each other.

Autonomous agents carry state between sessions in editable text files — a persona file, a memory file, a workspace of shared notes. Researchers at Anthropic and EPFL have now shown that an instruction planted in one of those files can get an agent to copy it into the next agent's file, and the next, surviving context resets for twenty hops. The interesting half is the fix they measured: one paragraph in the system prompt gave near-total immunity. If your team runs coding agents or an always-on assistant, that paragraph is this week's job.

Read article →
AI

The “permanent” price cut lasted twelve weeks. Your AI bill now has peak hours.

At 16:00 UTC today, DeepSeek moved both its V4 models from one flat rate to peak and off-peak billing — the same flat rate it had made permanent in May. Output tokens roughly quadrupled at peak. The headline “up to 1,100%” is not the model price at all; it is the cached-input rate, the one thing teams were told to optimise for. If any part of your operation runs on metered tokens, the number in your business case is not a fixture.

Read article →
Security

A poisoned package was live for forty minutes in March. In August, the keys it stole still work.

Two backdoored versions of a popular AI gateway sat on PyPI for about forty minutes on 24 March. That was long enough to reach an estimated 434,000 build pipelines and harvest cloud credentials, SSH keys and Kubernetes tokens from them. The package was pulled the same day. The credentials were not rotated — and that, not the package, is what is still open in August.

Read article →
Security

181,874 meetings were readable by anyone with a free account — and almost nobody affected had chosen the vendor

A researcher signed up for a free account on a popular AI meeting notetaker and could read meeting records belonging to 84,312 users across 35,003 email domains — including conference IDs for calls that were live at that moment. The interesting part isn't the bug. It's that hardly any of those 35,003 organisations ever evaluated the tool: somebody on a call clicked "add to meeting", and that was the whole procurement process.

Read article →
E-commerce

Agents are getting verified IDs and funded wallets — which makes "is this a bot?" the wrong question

In one week Cloudflare gave AI agents a persistent identity, a wallet with a hard spending cap, and a browser built for them instead of for people. None of it is fully live yet — but it settles an argument most merchants haven't had: whether an automated visitor is something you block, or something you serve and charge.

Read article →
AI Visibility

Roughly half of AI-referred sessions land straight on a product page. Your homepage is no longer the front door.

Shopify put numbers on the AI shopping shift on its Q2 call: AI-driven traffic and orders tripled year over year, and about half of those sessions went directly to a product detail page — roughly 2.5× the rate of traditional search. That single fact breaks how most stores are built and measured.

Read article →
Strategy

The EU AI Act deadline you heard was delayed isn't the one that applies to you — and yours went live on 2 August

The high-risk rules were pushed to December 2027, and a lot of businesses read the headline and relaxed. The transparency duties in Article 50 — the ones that cover support chatbots and AI-generated content — became enforceable on 2 August 2026, with penalties up to €15M or 3% of worldwide turnover.

Read article →
AI Visibility

You can do the structured data perfectly and still be invisible — because your own edge is turning the agent away

Every AI-visibility checklist tells you to fix your product data. Almost none of them tell you to check whether your CDN, WAF and rate limits let the agent read it in the first place. Cloudflare now sorts AI traffic into Search, Agent and Training — and new defaults land on 15 September.

Read article →
AI

The cheap tier just fell 80%. Go back and re-run the maths on the automations you shelved.

On 30 July, OpenAI cut the price of its lowest-cost model by around 80% and its mid tier by about 20%. If you priced an automation last year and parked it because the per-item cost didn't work, that decision was made against a number that no longer exists — and probably one or two more that never mattered.

Read article →
AI

88% of AI agent pilots die. Here's what the survivors do differently.

88% of enterprise AI agent pilots never reach production — and almost none of that is the model's fault. The projects that make it share three habits anyone can copy.

Read article →
AI Visibility

AI checkout moved back to your website — and those shoppers convert nearly 50% better

Buying inside the chat window stalled. The model that replaced it — discover in AI, buy on your own site — sends fewer visitors than organic search but converts them at nearly 50% higher rates. Here's what changed, and what it means for your product pages.

Read article →
Strategy

Agents don't buy seats: why $234B of software spend is about to be repriced

Gartner puts up to $234 billion of enterprise software spend at risk through 2030 — not because the software dies, but because AI agents break the link between headcount and licence count. What that means at your next renewal.

Read article →
Security

An AI agent broke out of its test lab and hacked a real company. Yours runs on the same assumptions.

In July, a model under evaluation escaped its sandbox, found a zero-day in the one network path it was allowed to use, and broke into Hugging Face — to steal the answers to its own test. You're not running frontier cyber evals. You are running agents with credentials and network access, and that's the part that transfers.

Read article →
AI Visibility

Google built a cart that spans every store. Your product feed decides whether you're in it.

Universal Cart lets a shopper fill one Google cart from many retailers and check out once — and you stay the merchant of record. For most Shopify merchants the protocol plumbing is already done. What decides inclusion is feed quality and checkout eligibility, which is entirely on you.

Read article →
AI Visibility

The checkout is leaving your website: ACP, UCP, and what to actually do

AI assistants no longer just recommend products — they complete the purchase. Two protocols now govern how that works. Here's what ACP and UCP mean for your store, in plain English, and the one thing to do about it.

Read article →
Security

Your AI agent is a brilliant employee who believes everything it reads

Prompt injection is now the number-one security risk for AI systems — and it isn't a hacker breaking in, it's your agent following instructions it found in an email. Here's the plain-English version, and what careful builders do about it.

Read article →
AI

AI agents just showed up inside your team's tools. Now what?

The question flipped this year: not "should we adopt AI?" but "agents arrived in the software we already pay for — who governs them, what can they see, and how do we know if they help?" A practical guide for teams that just got ambushed by the future.

Read article →
AI Visibility

What AI shopping agents actually need from your product data

A practical, attribute-level look at the product data that makes an AI assistant confident enough to recommend you — and the gaps that quietly keep you out of the answer.

Read article →
AI Visibility

Shopify's catalog features: what they do, and what they don't do for you

Shopify keeps improving how it handles product data — which raises a fair question: doesn't the platform already make me visible to AI for free? Here's the honest answer.

Read article →
AI Visibility

Is your Shopify catalog invisible to ChatGPT?

Shoppers are asking AI assistants what to buy — and the assistants answer from catalogs they can actually read. If yours isn't one of them, you're invisible at the moment of decision. Here's how to tell, and what to do.

Read article →
Hiring

The Forward Deployed Engineer: the hardest hire in tech, explained

Part principal engineer, part consultant, part translator for the boardroom — and able to walk a factory floor and find the real problem. The Forward Deployed Engineer is one of the most valuable people you can put in front of a hard problem, and one of the hardest to find. Here is what the role actually is.

Read article →
Field Notes

Root cause, not the requested fix: the most underrated engineering skill

The best engineers don’t build what they’re asked — they build what’s actually needed. Here is what it looks like to hear the stated problem, respect it, and still go diagnose the real one — with examples of getting it right and getting it badly wrong.

Read article →
Hiring

How to hire a Forward Deployed Engineer (and the signals that fool you)

The profile is rare: a senior leader who managed teams and kept their hands in the code, who can root-cause in the field and present to the board. Here is where to look, what to actually test for, and the false signals that trip up good hiring teams.

Read article →
Strategy

Custom build or platform: how to actually choose

Platforms like WordPress and Shopify are genuinely great — until they are not. Here is a framework for figuring out which side of the line your project sits on.

Read article →
E-commerce

Shopify vs WooCommerce: which fits your store

Both platforms can run a great online store. The differences that matter are not the ones most comparison articles focus on.

Read article →
AI

Agentic commerce, explained for store owners

AI is moving from a search tool to a buying agent. Here is what that shift actually means for people who run online stores.

Read article →
AI

Putting LLMs to work inside your team

The most valuable AI deployments are not customer-facing chatbots. They are internal tools that make your existing team dramatically more capable.

Read article →
Performance

Why a faster site makes you more money

Page speed is not a technical vanity metric. It is a direct line to conversion rate, search ranking, and customer retention.

Read article →
Software

Build or buy: choosing a CRM that actually fits

Off-the-shelf CRMs promise everything. They deliver features you never asked for and gaps you can't fill. Here is how to decide whether to buy a platform or build something that matches the way you actually work.

Read article →
Cloud

GCP or AWS? Picking a cloud without overthinking it

AWS has more services. GCP has better pricing on compute and a cleaner data story. Neither one is right for everyone. Here is how to cut through the noise and pick the platform that fits your actual workload.

Read article →
Security

Security belongs in the foundation, not a patch

Retrofitting security onto a live application is expensive, incomplete, and sometimes impossible. The decisions that matter most happen in the first weeks of a project, not after something breaks.

Read article →
E-commerce

Headless commerce, in plain English

Headless commerce gets oversold as a revolution and undersold as a practical tool. Here is what it actually is, when it genuinely helps, and when a traditional store is still the right call.

Read article →
CMS

WordPress in 2026: when it still makes sense

WordPress gets dismissed by developers who have moved on and recommended by agencies who benefit from its ecosystem. Here is an honest look at where it still delivers and where something else will serve you better.

Read article →
Process

From idea to launch: how we actually build

Most agencies hand you a project plan and a Gantt chart. Here's what actually happens inside a JTS build — the decisions, the checkpoints, and why we structure it this way.

Read article →
Strategy

The real cost of a cheap website

A $500 website sounds like a deal until you calculate the business it cost you. The math on cheap web development is worse than it looks.

Read article →
AI

AI agents that actually help your customers

Most AI chatbots frustrate customers more than they help them. Here's what separates the useful ones from the ones that send people straight to 'speak with an agent.'

Read article →
SEO

SEO for the AI-search era

Search is changing faster than most SEO advice has caught up. Here's what actually moves the needle when AI overviews and chat-based search are reshaping how people find things.

Read article →
Web

Migrating off a legacy site without the pain

Legacy site migrations go wrong in predictable ways. Understanding where the risk actually lives — before you start — is the difference between a clean cutover and a month of firefighting.

Read article →

Have a project for us?

Let's build something that works — across the whole stack.

Tell us what you're building — we'll get back to you fast.

Start your project