Guardrails First: Engineering Member-Facing Health AI — Rashi Agrawal, Hinge Health @aiDotEngineer

Uploaded August 2026 | Updated September 2026, 3 weeks ago

A healthy 60 year old man asked a popular AI assistant how to cut salt from his diet. It pointed him at sodium bromide. Three months later he arrived in an emergency room with paranoia and hallucinations, bromide at 200 times the safe level, and stayed three weeks. Rashi Agrawal stacks that against the first independent safety test of a consumer health AI, out of Mount Sinai, which under triaged life threatening emergencies half the time, and against ECRI naming chatbot misuse the top health technology hazard of 2026. Roughly 40 million people already triage themselves this way. None of it is a frontier problem. It is the production baseline.

Her argument is that most healthcare AI safety failures are architectural decisions made before a single token is generated. PHI is stripped at the pipeline boundary on ingestion, so a developer who opens a dashboard finds nothing to redact because it was never stored. Anything that can never be wrong lives in a code layer above the model rather than in its prompt: routing to 911 or 988, deciding which capability owns a turn, verifying who is on the other end. The frontier labs publish an authority hierarchy in which every layer above the user sits one prompt injection from being overridden, and her reading is blunt: if they will not treat a prompt as a security boundary, neither should you. Safety then runs as a continuous layer of judges scoring live traffic, with one discipline attached. When a score drops, first ask whether the judge is right.

Speaker info:
- linkedin.com/in/rashi283
- sessionize.com/rashiagrawal

Timestamps:
0:00 - The state of healthcare AI, and 40 million self triagers
1:04 - Poisoned by a chatbot
1:30 - Under triaging emergencies half the time
2:35 - Three non negotiable foundations
3:41 - Where PHI actually lives
5:53 - Deterministic rules belong above the model
7:27 - If the labs will not trust the prompt, neither should you
7:54 - Escalation, intent routing, identity
9:39 - Safety as a continuous evaluation layer
12:47 - Five stakeholders, five risks, five days to launch
14:02 - The five rules for deciding
18:10 - Verify the scorer before you trust the score
20:24 - The whole talk in one slide

Guardrails First: Engineering Member-Facing Health AI — Rashi Agrawal, Hinge Health

KV Cache-Aware Routing and P/D Disaggregation on Kubernetes — Yuchen Fama & Ashish Kamra, Red Hat

How to Kill the Code Review — Ankit Jain, Aviator

$DeepSWE: A Contamination-Resistant Coding Benchmark — James Shi, Datacurve DeepSWE is 113 software engineering tasks written from scratch, not scraped from pull requests, so a model cannot have seen them in training. Each one is a long horizon problem drawn from a real open source repository, authored by engineers who actually maintain that code, with isolated environments and program based verifiers that check observable behavior rather than trusting the models own account. James Shis point is that once you remove the contamination the leaderboard stops clustering: strong models pull far ahead and others, Gemini 3.1 Pro among them, fall toward the bottom. The more revealing signal is in how models fail. Some quietly expand a task beyond what was asked, a failure mode DeepSWE scores in its own right, and Claude models did this a good fraction of the time while GPT models did it less often. Stronger models also tend not to verify their own work, and there is a real gap between the ones that test what they wrote and the ones that assume it is correct. Since reward hacking is a constant temptation, the verifiers are built to be gamed as little as possible, keeping the score anchored to the objective rather than to a convincing looking rollout. Speaker info: - https://x.com/shiqyy - https://www.linkedin.com/in/jamesshi117/ - https://deepswe.datacurve.ai Timestamps: 0:00 - Introduction: the DeepSWE benchmark 1:03 - 113 original, contamination-resistant tasks 2:08 - What makes a good benchmark 3:51 - The leaderboard and model spread 5:18 - Failure mode: over-scoping the task 7:16 - Do models verify their own work? 8:45 - Tasks authored by core contributors 10:15 - Writing realistic, high level prompts 11:45 - Program based verifiers and observable behavior 13:43 - Limitations and future work 15:25 - Reward hacking and keeping it cheating proof$

Persona Engineering: A Field Guide to AI Synthetic Personas — Ishan Anand, InsightSciences.ai

Trading Desks to Clinical Trials: Parallels in Applied Vertical AI — Ayush Bhardwaj, Allos AI

Anthropics CCA Exam as a Field-Guide for Agentic Engineering — Frank Coyle, UC Berkeley

Teaching AI to Find Real Vulnerabilities — Prof. David Brumley, Bugcrowd

Building the Engine While Flying the Plane: Launching the Figma MCP Server — Jesse Lumarie, Figma

Bringing Continual Learning into Enterprises — Samuel Denton, Applied Compute

$Agent Spending Without Controls — Rodrigo Coelho & Pranav Maheshwari, Edge & Node Pranav Maheshwari ran one prompt in two terminals: find the email address of the head of crypto and blockchain at Mastercard. The terminal without a payment skill file returned the companys email format and an invitation to work the rest out. The one with it paid a fraction of a cent to a metered endpoint and came back with the address, the persons location and their handle. That gap is the whole argument. Most MCP servers are free today, and his claim is that the useful ones will not stay free, which leaves an agent only as capable as the tools it can pay for. Rodrigo Coelho sets up the longer history first: Edge & Node built The Graph, served 1.8 trillion onchain queries, and shipped a query micropayment system in 2021 that cited the HTTP 402 spec years before Coinbase released x402. What stops enterprises adopting any of this, in Coelhos telling, is compliance rather than throughput. Traditional rails assume a human somewhere in the decision loop. Agents transact around the clock at machine speed, and a counterparty arrives as a bare wallet address with no identity attached to it. Somebody carrying a title like chief legal officer has to sign off, knowing that getting sanctions screening wrong carries fines in the billions. The closing demo makes that concrete. Two agents hit a metered scraping service, one from an ordinary wallet and one from a wallet flagged as sanctioned. With screening off, both transactions authorize. Switching screening on leaves the first working and rejects the second as a blocklisted address. Speaker info: - https://x.com/rodventures - https://www.linkedin.com/in/rodrigoco/ - https://x.com/impranavm_ - https://www.linkedin.com/in/thepranavmaheshwari/ Timestamps: 0:00 - The Graph, and paying for queries before x402 existed 2:03 - Prior art: micropayments, the 402 spec, and joining the foundation 3:52 - Rails built for humans in the loop, not machines 4:49 - Why enterprises stall without a compliance layer 5:42 - A wallet address with no identity behind it 6:37 - The officer who signs off, and the size of the fines 7:35 - Agents are only as good as the tools they can pay for 8:31 - Demo: the same prompt with and without the skill file 12:16 - Demo: an agent buying a gift under a set budget 16:14 - Demo: screening a sanctioned wallet 18:04 - Compliance on, and the transaction rejects$

State of Data — Sean Cai, Independent / State of Data