Hackers Inject Credential-Stealer, RAT Into LiteLLM
Attackers compromised a version of LiteLLM this week by injecting malicious code into all seven of its published Python wheels on PyPI, delivering a package that included an infostealer to exfiltrate credentials and secrets and a remote access trojan (RAT) that could let bad actors run arbitrary code on infected machines. The compromised version – […]
Linux Foundation: AI Speeds Development, but Low-Quality Code Strains Maintainers
A new Linux Foundation study finds that generative AI is delivering big productivity gains for open source software developers, but AI is also creating an influx of low-quality code submissions that need time-consuming human review. The research found that an estimated 25% of incoming pull requests, which are proposed changes to software projects, are considered […]
How Dependency Mocking Affects CI/CD Pipeline Reliability
Stale dependency mocks can make CI/CD pipelines pass while production integrations fail. Learn how mock drift undermines reliability and how to prevent it.
When the Agent is the Incident
When AI remediation agents make the wrong infrastructure decisions, automated fixes can quickly escalate into major incidents. This seven-step incident response playbook explains how to stop unsafe agent actions, block tool access, preserve forensic evidence and restore services without triggering further damage. A Kubernetes simulation demonstrates why stopping an agent worker alone is not enough.
OpenAI Puts COBOL Migration to the Test, and Its Newest Models Mostly Pass
OpenAI’s latest coding benchmarks show substantial improvements in handling COBOL, Fortran and other low-resource languages. But for DevOps teams modernizing legacy applications, translating code is only half the challenge. The real test is preserving business logic, arithmetic precision and production behavior.
Survey: AI Coding Tools Increase Open Source Software Dependencies
A survey of 307 enterprise technology leaders finds that as organizations rely more on artificial intelligence (AI) coding tools to build applications, they are simultaneously increasing the amount of open source software they are dependent on. Conducted by the market research firm Moving Horizon on behalf of ActiveState, a provider of a platform for accessing […]
mabl Adds Harness to AI Testing Automation Platform
Mabl today extended its test automation platform with a harness that, in addition to enforcing guardrails and testing standards for artificial intelligence (AI) agents, enables application development teams to better understand the impact of code changes before a pull request (PR) is made. Announced at a mabl Experience event, the extensions to the test automation […]
GemDB Extension Uses Code to Update Database
GemDB has introduced a Visual Studio Code extension that enables developers and AI coding agents to create, modify and persist database objects directly through Python code. With integrated Jupyter Notebook and MCP support, GemDB Code aims to eliminate traditional schema migrations, simplify database management and accelerate DevOps workflows.
Coding Agents Moved the Bottleneck From Writing to Reviewing PRs
AI coding agents are generating more pull requests than developers can review. Learn why review bottlenecks create quality debt and how DevOps teams can respond.
Navigating AI Infrastructure Incidents: Bridging the Critical Gap Between Detection and Response
AI systems can appear healthy while response quality, latency and data freshness deteriorate. Advanced observability tools can detect these issues, but identifying a problem is only half the battle. Engineering teams must close the gap between detection and response with persistent alerts, intelligent routing and automated escalation to reduce downtime and restore output integrity.
GitHub Puts a Firewall Between npm and Your CI Runners
GitHub’s new package firewall puts enterprise security policies between npm registries and the developers, CI runners and AI coding agents consuming packages. With malware detection, attestation checks and package-age restrictions, it aims to stop malicious dependencies before installation.
Beyond SLSA and Sigstore: Securing the Developer Origin in the Age of Agentic Coding
SLSA, Sigstore and SBOMs have strengthened software supply chain security, but attackers are increasingly targeting developer workstations before code reaches the CI/CD pipeline. With autonomous AI coding agents installing dependencies, executing commands and accessing sensitive credentials, endpoint security is becoming a critical cloud-native concern. Securing the software supply chain now requires protection from the developer’s IDE all the way to Kubernetes production workloads.
AI Agents Can Now Take Software Apart. DevOps Teams Need a Plan
AI-powered reverse engineering is making it easier to understand and rebuild software without source code. Tools such as REA and increasingly capable AI models create opportunities for legacy modernization while raising fresh concerns about intellectual property, application security and functional correctness.
Microsoft Foundry Puts AI Agents on a Schedule and Under Watch
Microsoft’s September Foundry updates focus on making AI agents production-ready with automated routines, lower token costs, trace-based insights and improved resilience. For DevOps teams, the changes bring agent operations closer to familiar CI/CD and observability practices.
GitHub Brings AI Security Scanning to Pull Requests CodeQL Can’t Cover
GitHub’s AI Scan brings AI-powered vulnerability detection to pull requests involving languages, scripts and infrastructure files beyond CodeQL’s existing coverage. Paired with the general availability of agentic autofix, the release expands security automation across the development lifecycle. But advisory-only findings, coverage gaps and AI credit consumption mean DevOps teams still need clear review policies.
Cohere Plans to Acquire Aisle to Add AI-Powered Code Security
Enterprise AI platform provider Cohere announced it has signed a letter of intent to acquire Aisle, a cybersecurity startup whose AI agent platform discovers source-code vulnerabilities and generates proposed fixes. The proposed acquisition would also establish a dedicated cybersecurity business called Cohere Cyber. Aisle’s platform analyzes software for previously unknown vulnerabilities, validates potential findings, evaluates […]
Chainguard Debuts a Security-First Agent Platform
Open source security company Chainguard has released Workspaces, a service designed to provide a safe space for agents to do their thing without disrupting the security of existing operations. The market for platforms to host agents is large and growing daily, though Chainguard’s expertise in security solves a major problem with running agents, namely managing […]
Ten Great DevOps Job Opportunities
DevOps.com is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted as part of an effort to better serve our audience. Our goal in these challenging economic times is to make it just that much easier for DevOps professionals to advance their careers. Of course, the pool of […]
From Static Scans to Runtime Awareness: The Next Phase of Software Supply Chain Security
A growing wave of software supply chain attacks, including Shai-Hulud, Axios and LiteLLM, is exposing weaknesses in conventional security tooling. Malicious open-source packages can execute harmful code during installation, often before traditional security checks take effect. Despite high confidence in existing defenses, many organizations lack proactive controls such as package cooldown periods, pre-ingestion scanning and continuous threat intelligence evaluation.
OpenCode Breach Puts Spotlight on AI Distillation Threats
An attack using the technique on the open source coding agent’s Console hub exposed third party API keys from OpenAI, Anthropic, and Google
Dean Hall Open Sources Brutal to Give Game Studios a Way Out of Engine Lock-In
DayZ creator Dean Hall has unveiled Brutal, a free C# framework designed to give game developers greater control over their technology and reduce dependence on commercial engines. Already used in projects including RimWorld’s new engine, Brutal promises flexibility and performance while raising familiar questions about licensing, maintenance and open source sustainability.
Blitzy Adds Chat-to-Prompt Interface to Agentic AI Engineering Platform
Blitzy this week added a chat interface to a platform that enables DevOps teams to employ artificial intelligence (AI) agents by expressing their intent in natural language. Dr. Neeraj Deshmukh, Field CTO for Blitzy, said the Chat to Prompt interface makes it possible for a software engineer to describe a desired outcome that is then […]
ScienceLogic Extends Observability Reach and Control Deeper into AI Agents
ScienceLogic has added additional tools and capabilities to its observability platform that provide deeper visibility and control over artificial intelligence (AI) agents that are being used to automate IT operations. The latest 2.7 update to the Skylar AI platform provides visibility into agent routing and tool selection via a catalog that uses traces to surface […]