The Drupal AI Hackathon: Play to Impact 2026, held in Brussels on January 27-28, was a pivotal moment for the Drupal AI Initiative. The focus was on practical, AI-driven solutions that enhance teamwork while upholding trust, governance, and human oversight.

The most compelling challenge: creating AI Agents for Content Creators — not simple content generation, but agentic workflows where AI acts as collaborator, researcher, or reviewer.

The "Drupal Pivot" is not just another conference; it is a signal that the public sector is finally prioritizing digital sovereignty over vendor lock-in. Drupal is becoming the foundation of their strategy to escape proprietary ecosystems and guarantee data residency.

The Cloudflare 2025 Q4 DDoS threat report just dropped, and the numbers are brutal. A record-breaking 31.4 Tbps attack mitigated in November 2025, and hyper-volumetric attacks up 700%. For Drupal site owners, these are not just statistics — they represent a fundamental shift in the scale of threats your infrastructure must handle.

Simon Willison shared research on running Pydantic's Monty in WebAssembly. Monty is a minimal, secure Python interpreter written in Rust, designed specifically for safely executing code generated by LLMs. I put together a demo project to test both the Python integration and the WebAssembly build.

This is one of the few sandboxing approaches I have seen that actually addresses the real problem.

Caching is usually the answer to everything in Drupal performance, but there is a crossover point where the overhead of the cache itself -- retrieval and unserialization -- outweighs the cost of just doing the work.

If you have ever wondered how Drupal magically discovers all its breadcrumb builders, access checkers, or authentication providers, you are looking at the Service Collector pattern. It is the secret sauce that makes Drupal one of the most extensible CMSs on the planet.

As AI agents become part of the Drupal workflow, you need infrastructure that makes automation traceable, predictable, and composable. I built four small Drupal modules that together form an MCP Toolkit for agent-driven site management.

The first version of drupal-entity-reference-integrity could scan a Drupal site and report broken entity references. That was the easy part. The hard part -- actually fixing them at scale without taking the site down -- was missing. This upgrade adds auto-fix mode, batch processing, and the test coverage needed to trust both in production.

I built this proof-of-concept to explore how a codex-style agent can assist with routine Drupal maintenance tasks -- dependency updates, configuration checks, and basic cleanup. The kind of work that is constant, easy to overlook, and expensive to do manually at scale.

The original POC had three actions -- create a node, read a node, list nodes. Enough to prove the concept, not enough to be useful. A real content operations agent needs to modify, delete, query users, browse taxonomies, and handle media. It also needs to survive flaky networks without crashing.

I built drupal-content-audit as a lightweight way to inspect and report on content in a Drupal site. It focuses on surfacing what content exists and how it is distributed, giving a quick snapshot that is easy to share with stakeholders.

I built a DDEV add-on that runs Playwright checks against local MCP endpoints using internal DDEV DNS names like web. This solves flaky localhost-based testing and gives one command for repeatable MCP smoke tests.

I built drupal-ai-module-generator-deepseek-mcp to take the repetitive, error-prone parts of module setup -- info files, boilerplate, and consistent structure -- and make them fast and repeatable. It fits naturally into agent-driven workflows where you want consistent Drupal modules without losing time to manual setup.

I built drupal-ai-views-agent because Views is powerful but repetitive. Filters, relationships, display modes, and fields add up quickly. Describing what you want in plain language and getting a valid Views config back saves the clicking and lets teams focus on validating data requirements instead of wrestling with UI details.

The first version of drupal-claude-agent-sdk-runtime gave you session management and result objects, but tools were mocked. You could simulate agent workflows inside Drupal, but you could not actually execute anything. That ceiling had to go.

DDEV 1.25.0 ships experimental support for Podman and Docker rootless. This opens up corporate-friendly runtimes, but introduces trade-offs that the announcement does not emphasize enough.

I built a CLI that audits your global_config.yaml so you know before you flip the switch.

Centarro argues you can deliver a B2B portal experience on top of a standard Drupal Commerce store without spinning up a separate platform or domain. I built a demo module to test if that claim holds up in practice.

Drupal CMS recipes are the most practical building block for AI-driven site assembly: they translate a plan into installable modules and configuration with one apply step. I built a small recipe package and a PHP blueprint helper to test how well this works in practice.

Enterprise agentic systems scale when they feel less like a demo and more like a governed service. That means routing, guardrails, and budgets are first-class citizens from day one, not afterthoughts bolted on before a compliance review.

I built a lightweight playbook that turns Netomi-style enterprise lessons into code you can run and test.

If you install "skills" from a public marketplace, you are installing trust. I built a static scanner that scores a skill bundle before it touches my machine.