Report: Claude Code Exceeds GitHub Copilot for Merging Pull Requests
An analysis of pull requests published today by Jellyfish, a provider of an engineering intelligence platform, finds that Claude Code is the artificial intelligence (AI) coding tool used most often to merge pull requests (31%), followed by GitHub Copilot at 23%. Based on analysis of 100 million pull requests made in September by 276,000 developers […]
Gheist Hackers Abuse GitHub Tokens to Steal Repository Secrets
The evolving Gheist campaign uses stolen GitHub tokens and malicious Actions workflows to extract repository secrets and cloud credentials. While GitHub protections have blocked observed attacks on public repositories, private environments remain exposed.
Ten Great DevOps Job Opportunities
DevOps.com is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted as part of an effort to better serve our audience. Our goal in these challenging economic times is to make it just that much easier for DevOps professionals to advance their careers. Of course, the pool of […]
Recursive Flint Puts a Fast Agentic Coding Model on Developers’ Laptops
Recursive has unveiled Flint, a 40-billion-parameter, open-weight coding model designed to run locally on developer hardware. Built with help from the company’s Eureka Machine research system, Flint promises faster inference, greater source-code privacy and freedom from per-token API fees. For DevOps teams, the launch raises fresh questions about AI agent governance, code quality and continuous model evaluation.
When 200 OK Isn’t OK: Observability for LLM Systems
Traditional monitoring can show an LLM-powered application as healthy even when it delivers incorrect answers. Drawing on experience at Varo Bank, this article explains why AI observability must go beyond the four golden signals and how automated evaluation, groundedness checks and CI pipelines can catch silent failures before they reach customers.
The Automation Confidence Gap: When Should AI Be Allowed to Change Production?
AI-generated infrastructure recommendations can look convincing, but production execution requires more than a plausible runbook. A seven-factor confidence index helps platform teams determine when AI should recommend, seek approval or execute changes within strictly enforced boundaries.
Hackers Inject Credential-Stealer, RAT Into LiteLLM
Attackers compromised a version of LiteLLM this week by injecting malicious code into all seven of its published Python wheels on PyPI, delivering a package that included an infostealer to exfiltrate credentials and secrets and a remote access trojan (RAT) that could let bad actors run arbitrary code on infected machines. The compromised version – […]
When the Agent is the Incident
When AI remediation agents make the wrong infrastructure decisions, automated fixes can quickly escalate into major incidents. This seven-step incident response playbook explains how to stop unsafe agent actions, block tool access, preserve forensic evidence and restore services without triggering further damage. A Kubernetes simulation demonstrates why stopping an agent worker alone is not enough.
OpenAI Puts COBOL Migration to the Test, and Its Newest Models Mostly Pass
OpenAI’s latest coding benchmarks show substantial improvements in handling COBOL, Fortran and other low-resource languages. But for DevOps teams modernizing legacy applications, translating code is only half the challenge. The real test is preserving business logic, arithmetic precision and production behavior.
GemDB Extension Uses Code to Update Database
GemDB has introduced a Visual Studio Code extension that enables developers and AI coding agents to create, modify and persist database objects directly through Python code. With integrated Jupyter Notebook and MCP support, GemDB Code aims to eliminate traditional schema migrations, simplify database management and accelerate DevOps workflows.
Coding Agents Moved the Bottleneck From Writing to Reviewing PRs
AI coding agents are generating more pull requests than developers can review. Learn why review bottlenecks create quality debt and how DevOps teams can respond.
GitHub Puts a Firewall Between npm and Your CI Runners
GitHub’s new package firewall puts enterprise security policies between npm registries and the developers, CI runners and AI coding agents consuming packages. With malware detection, attestation checks and package-age restrictions, it aims to stop malicious dependencies before installation.
Beyond SLSA and Sigstore: Securing the Developer Origin in the Age of Agentic Coding
SLSA, Sigstore and SBOMs have strengthened software supply chain security, but attackers are increasingly targeting developer workstations before code reaches the CI/CD pipeline. With autonomous AI coding agents installing dependencies, executing commands and accessing sensitive credentials, endpoint security is becoming a critical cloud-native concern. Securing the software supply chain now requires protection from the developer’s IDE all the way to Kubernetes production workloads.
AI Agents Can Now Take Software Apart. DevOps Teams Need a Plan
AI-powered reverse engineering is making it easier to understand and rebuild software without source code. Tools such as REA and increasingly capable AI models create opportunities for legacy modernization while raising fresh concerns about intellectual property, application security and functional correctness.
Microsoft Foundry Puts AI Agents on a Schedule and Under Watch
Microsoft’s September Foundry updates focus on making AI agents production-ready with automated routines, lower token costs, trace-based insights and improved resilience. For DevOps teams, the changes bring agent operations closer to familiar CI/CD and observability practices.
OpenCode Breach Puts Spotlight on AI Distillation Threats
An attack using the technique on the open source coding agent’s Console hub exposed third party API keys from OpenAI, Anthropic, and Google
Figma Gives AI Agents a Spec Sheet and Developers a Shared Canvas
Figma introduces Specs, code layers and expanded MCP tools to connect AI agents, designers and developers while improving design-to-code workflows.
One Bill for Grok, Cursor, and X: What SpaceX’s Bundle Means for Developers
SpaceX wants to be the single line item for your AI coding tool, your chatbot, and your social media account. On October 12, SpaceX Super Intelligence (SpaceXSI), the AI unit formerly known as xAI, introduced The X Subscription. It folds Grok, the Grok Bot agent, the Cursor AI code editor, and X Premium into one […]
Noma Security Discloses Claude Code Desktop Exploit
Security researchers at Noma Security uncovered SneakPeek, a vulnerability in Anthropic’s Claude Code Desktop that allowed malicious JavaScript embedded in large HTML files to bypass sandbox protections and silently steal sensitive local data. The flaw exposed credentials, API tokens and Kubernetes configurations through the application’s preview pane. Although Anthropic has released a security update addressing the exploit, the discovery highlights growing software supply chain risks as AI coding tools become embedded in developer workflows without sufficient security oversight.
GitHub Ties Every Commit to the Account That Pushed It
GitHub has introduced push attribution in limited public preview for Enterprise customers, adding authenticated pusher identities to commits alongside author and committer information. A new repository rule can also block pushes when committer details don’t match the authenticated account, helping DevOps teams combat identity spoofing, improve audit trails and strengthen software supply chain security.
AI Is Automating Code. The Job Is Engineering
AI is automating coding, but software engineering still requires human judgment. Explore what shifting developer demand means for DevOps, QA and software delivery.
Cloudflare Brings the Deno Team In to Make Self-Hosted Workers Practical
Cloudflare brings Deno’s team aboard to expand self-hosted Workers and Durable Objects as Deno Deploy winds down and runtime support enters its final year.
Secrets Sprawl and Rotation: A Practical Vault Management Playbook
In 2025 alone, security firm GitGuardian detected 28.65 million new hardcoded secrets exposed in public GitHub commits — a 34% increase year over year and the largest single-year jump the company has recorded in five years of publishing its annual State of Secrets Sprawl report. Since 2021, that number has grown 152%, far outpacing the […]