Latest from Tom
Claude Writes 180 Million Lines of Proofs to Verify 123 Open Source Libraries
Formal verification has long been the gold standard for software correctness. It has also been too expensive for almost everyone. New research from Anthropic suggests that’s changing. Anthropic’s Frontier Red Team, working with formal methods company Theorem, used Claude to prove security properties in the compiled code of 123 open-source libraries from Google’s OSS-Fuzz project. […]
Oct 23, 2026 · 3 minAll articles by Tom Smith
Showing 1–24OpenAI Puts COBOL Migration to the Test, and Its Newest Models Mostly Pass
OpenAI’s latest coding benchmarks show substantial improvements in handling COBOL, Fortran and other low-resource languages. But for DevOps teams modernizing legacy applications, translating code is only half the challenge. The real test is preserving business logic, arithmetic precision and production behavior.
GitHub Puts a Firewall Between npm and Your CI Runners
GitHub’s new package firewall puts enterprise security policies between npm registries and the developers, CI runners and AI coding agents consuming packages. With malware detection, attestation checks and package-age restrictions, it aims to stop malicious dependencies before installation.
AI Agents Can Now Take Software Apart. DevOps Teams Need a Plan
AI-powered reverse engineering is making it easier to understand and rebuild software without source code. Tools such as REA and increasingly capable AI models create opportunities for legacy modernization while raising fresh concerns about intellectual property, application security and functional correctness.
Microsoft Foundry Puts AI Agents on a Schedule and Under Watch
Microsoft’s September Foundry updates focus on making AI agents production-ready with automated routines, lower token costs, trace-based insights and improved resilience. For DevOps teams, the changes bring agent operations closer to familiar CI/CD and observability practices.
GitHub Brings AI Security Scanning to Pull Requests CodeQL Can’t Cover
GitHub’s AI Scan brings AI-powered vulnerability detection to pull requests involving languages, scripts and infrastructure files beyond CodeQL’s existing coverage. Paired with the general availability of agentic autofix, the release expands security automation across the development lifecycle. But advisory-only findings, coverage gaps and AI credit consumption mean DevOps teams still need clear review policies.
Dean Hall Open Sources Brutal to Give Game Studios a Way Out of Engine Lock-In
DayZ creator Dean Hall has unveiled Brutal, a free C# framework designed to give game developers greater control over their technology and reduce dependence on commercial engines. Already used in projects including RimWorld’s new engine, Brutal promises flexibility and performance while raising familiar questions about licensing, maintenance and open source sustainability.
Figma Gives AI Agents a Spec Sheet and Developers a Shared Canvas
Figma introduces Specs, code layers and expanded MCP tools to connect AI agents, designers and developers while improving design-to-code workflows.
Claude Platform Now Sends Agent Traces Straight to Your Observability Stack
Anthropic is making it easier to see what Claude-based agents do in production. The company has added OpenTelemetry trace export to the Claude Platform. Developers can now send traces from the Messages API, Claude Managed Agents, and the Claude SDKs to the observability tools they already use. The feature launched in public beta on October […]
Apple Brings Whole-Program C++ Hardening to Clang
Apple has added a new tool to the upstream LLVM project that could change how teams harden large C++ codebases. The clang-ssaf-driver, merged into LLVM Git this week, analyzes an entire project as it builds and then rewrites source code based on what it finds. The driver is part of Clang’s Scalable Static Analysis Framework […]
One Bill for Grok, Cursor, and X: What SpaceX’s Bundle Means for Developers
SpaceX wants to be the single line item for your AI coding tool, your chatbot, and your social media account. On October 12, SpaceX Super Intelligence (SpaceXSI), the AI unit formerly known as xAI, introduced The X Subscription. It folds Grok, the Grok Bot agent, the Cursor AI code editor, and X Premium into one […]
GitLab Fixes CVSS 10 Flaw in CI/CD Regex Engine, Plus 23 Other Vulnerabilities
GitLab is telling every self-managed customer to upgrade now. On October 12, the company shipped versions 19.4.2, 19.3.5, and 19.2.8 of GitLab Community Edition (CE) and Enterprise Edition (EE). The releases fix 24 security vulnerabilities. One has a CVSS score of 10.0, the highest rating possible. GitLab.com already runs the patched code. GitLab Dedicated customers […]
GitHub Narrows App Permissions to Pull Teams Off Classic PATs
GitHub is giving DevOps teams more ways to limit an automation job to only the access it needs. A batch of GitHub Apps updates released Oct. 13 adds narrower permissions, relaxes a long-standing install restriction for repository administrators, and makes it easier to move users to expiring tokens. GitHub says the goal is to help […]
npm Puts a 48-Hour Clock on Unused Trusted Publishing Configurations
GitHub has added an expiration date to unused npm trusted publishing configurations. Any configuration that doesn’t complete a successful publish within 48 hours of creation now expires and can no longer authorize a release. It’s a small change. But it closes a gap that matters to anyone who publishes packages from a CI/CD pipeline. How […]
Anthropic Builds Its Own Source Control After AI Agents Outgrow Git
Anthropic has moved its internal monorepo off Git and onto a version control system it built from scratch. The reason is simple. Its AI agents now write code faster than Git-based infrastructure can handle it. In a post on its engineering blog, the company said it averaged about 2,500 merged code changes a day in […]
GitHub Ties Every Commit to the Account That Pushed It
GitHub has introduced push attribution in limited public preview for Enterprise customers, adding authenticated pusher identities to commits alongside author and committer information. A new repository rule can also block pushes when committer details don’t match the authenticated account, helping DevOps teams combat identity spoofing, improve audit trails and strengthen software supply chain security.
Cloudflare Brings the Deno Team In to Make Self-Hosted Workers Practical
Cloudflare brings Deno’s team aboard to expand self-hosted Workers and Durable Objects as Deno Deploy winds down and runtime support enters its final year.
Coding Agents Broke Git’s Scaling Math. GitHub Is Rebuilding to Keep Up
GitHub is rebuilding its Git infrastructure as AI coding agents drive billions of commits, promising up to 35x faster writes while exposing new DevOps bottlenecks.
Open Source Mod Brings Rate Limits, Costs and CI Status Into View for Claude Code Users
Claude Statuspane gives developers real-time visibility into Claude Code context use, rate limits, costs and CI status, highlighting a growing need for agent observability.
IBM Moves Its Bob Coding Agent Inside the Firewall
Plenty of enterprises want AI coding agents. Fewer are willing to send their source code to someone else’s cloud to get them. That tension has slowed adoption at banks, insurers, government agencies and other organizations that build software under strict rules about where code and data can live. IBM is betting a self-hosted option will […]
Git 2.56 Takes Aim at Messy Merges, Slow Diffs and Branch Sprawl
Git 2.56 improves merge safety, speeds up large-repository operations and adds cleanup tools that could prove especially useful for AI coding agents and busy DevOps teams.
GitHub’s Security Autofix Agent Now Remembers What It Fixed
GitHub’s agentic autofix now uses Copilot Memory to reuse repository-specific security fix patterns, helping Copilot apply lessons from past vulnerabilities across future alerts, reviews and coding workflows.
GitHub Gives Enterprises a Full Count of Who Holds the Keys
GitHub Enterprise Cloud now lets organizations export a full inventory of credentials, helping security teams identify stale, overprivileged and forgotten access across users, apps and automation.
Your AI Coding Assistant Has the Keys to the Repo. Z.ai Just Showed Why That Matters
ZCode’s default-on indexing feature reportedly uploaded entire developer workspaces to cloud storage, highlighting why AI coding assistants should be treated as privileged software and closely monitored.