GhostApproval Flaw Featuring Decades-Old Feature Found in Six AI Coding Tools
A security flaw found in six popular AI coding agents can let attackers abuse a decades-old feature in Unix to trick an AI agent into giving them control of a developer’s system. Researchers with Google-owned Wiz said the vulnerability, dubbed “GhostApproval,” relies on symbolic links – or symlinks – a file system feature that has […]
GitHub Copilot Bills Hit $800: Visual Studio’s June Update Adds Real-Time Usage Alerts and MCP Trust Checks
Visual Studio’s June update adds real-time Copilot usage alerts and MCP server trust checks, responding to billing and agent security concerns.
Former GitHub CEO Unveils Distributed Git Network Built for AI Coding Agents
As AI coding agents become a larger part of software development, a new startup founded by former GitHub CEO Thomas Dohmke is introducing infrastructure built to address the growing pressure on centralized Git hosting. The new company, Entire, has launched a preview of a distributed Git network that allows developers to mirror GitHub repositories across […]
North Korea Expands the Reach of PolinRider Supply Chain Attack Campaign
The North Korean-sponsored threat groups behind the long-running fake interview scams targeting developers are expanding the PolinRider supply chain campaign that has escalated over the past several months. Reports from cybersecurity vendors Socket and Rescana found that two groups linked to the Democratic People’s Republic of Korea (DPRK) have published at least 108 malicious packages […]
Pentagon Campaign Seeks Engineers for Defense AI and Software Modernization
The Pentagon has announced the launch of War Force, a recruiting campaign for software engineers whose work would support multiple defense AI and modernization projects. The campaign is being run in partnership with the U.S. Office of Personnel Management as part of the federal government’s U.S. Tech Force program. OPM said the program is intended […]
‘GitLost’ Flaw Lets Attackers Trick GitHub AI Agent Into Leaking Private Repos
Noma researchers again show how easy it is to manipulate AI agents with malicious commands via indirect prompt injection attacks.
Block Details Builderbot Framework for Orchestrating AI Agents Across SDLC
The software engineers at Block have developed an orchestration layer they are using to manage artificial intelligence (AI) agents that have been trained to automate multiple tasks across their software development lifecycle (SDLC). Based on goose, an open source agent framework the company developed and contributed to the Agentic AI Foundation (AAIF), the Builderbot orchestration […]
Novee Uncovers Cordyceps: The Latest Threat to CI/CD Pipelines
A newly discovered supply chain security flaw is once again putting a spotlight on inherent weaknesses in CI/CD pipelines and the growing interest among cyberthreat actors to exploit them. Security researchers with Novee, an AI penetration testing platform provider, wrote about Cordyceps, an exploitable pattern in the open source supply chain that can allow attackers […]
Ten Great DevOps Job Opportunities
DevOps.com is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted as part of an effort to better serve our audience. Our goal in these challenging economic times is to make it just that much easier for DevOps professionals to advance their careers. Of course, the pool of […]
Mistral Releases Leanstral 1.5, an Open Model That Solved 587 of 672 Putnam Math Problems
Mistral’s open Leanstral 1.5 model solved 587 of 672 Putnam math problems and is already finding real bugs in open-source code.
Z.ai Debuts ZCode to Compete With GitHub Copilot, Cursor and Anthropic
Chinese AI developer Z.ai has introduced ZCode, a desktop application that automates software development tasks, positioning the platform to compete with established coding platforms from Anthropic, GitHub and Cursor. The company built ZCode, which it calls an Agentic Development Environment, around its recently released GLM-5.2 LLM. Rather than functioning as a traditional coding assistant that […]
Lightrun Adds Ability to Assess Impact Pull Request Will Have in Production
Lightrun is providing early access to an ability to verify whether a pull request (PR) will actually run in a production environment as part of its artificial intelligence (AI) platform for automating site reliability engineering (SRE) workflows. Company CTO Leonid Blouvshtein said the Runtime Aware PR Verifier enables DevOps teams to assess the impact a […]
Ornith Models Automate Agentic Coding With Self-Scaffolding
Ornith, a new family of open source LLM models from the DeepReinforce research collective, takes a novel approach to executing coding and debugging tasks: It generates an architectural framework to give the user’s harness a structured instruction set – a scaffold – to create an agent to complete the job. Available in a set of […]
Anthropic Adds Enterprise Gateway to Simplify Claude Code Access on AWS and Google Cloud
Anthropic’s new Claude apps gateway brings SSO, central policy, and spend caps to Claude Code on Amazon Bedrock and Google Cloud.
OpenAI Expands Into Developer Hardware With Codex Micro Keyboard
OpenAI is preparing to launch its first branded hardware product, but rather than entering the crowded consumer device market, the company is starting with a tool designed specifically for software developers. The company has scheduled a July 15 unveiling for Codex Micro, a compact input device created in partnership with keyboard manufacturer Work Louder. OpenAI […]
Mozilla Shows the Danger of Indirect Prompt Injections in AI Coding Agents
A clean GitHub repository that contains no malicious code can launch an attack and fully compromise a developer’s systems by using indirect prompt injections to trick AI-powered coding agents like Anthropic’s Claude Code into taking steps that hand control to attackers and expose a wide range of secrets. In a proof-of-concept (PoC) attack, Mozilla 0DIN […]
Harness Adds Autonomous AI Agents to Automate DevOps Workflows
Harness today is providing DevOps teams with an ability to build and deploy autonomous artificial intelligence (AI) agents that automate the delivery of code to production environments. Trevor Stuart, a senior vice president and general manager at Harness, said the Autonomous Worker Agents eliminate the need for fixed scripts with custom AI agents or ones […]
AI Coding Costs Could Exceed Developer Salaries, Gartner Warns
Enterprises rapidly adopting AI coding assistants may eventually face an unexpected financial reality: the AI tools could cost more than the developers using them. According to new research from Gartner, spending on AI coding agents is on track to surpass the average software developer’s salary by 2028, driven by the rapid growth of LLM token […]
Survey: More AI Code Running in Production Environments with Caveats
A global survey of 309 software engineering leaders, published today, finds 81% of organizations have to some degree reworked development and release processes to accommodate code generated using artificial intelligence (AI) coding tools. However, only 45% said their organization is running any of that code in production environments. Conducted by Dimensional Research on behalf of […]
Attackers Exploit SimpleHelp Flaw to Steal Info from AI Coding Assistants, Clouds
Threat actors are exploiting a known security flaw in the SimpleHelp remote monitoring and management (RMM) software to drop two previously unknown pieces of malware that can compromise a broad range of systems and steal massive amounts of sensitive data. Researchers with Blackpoint Cyber’s Adversary Pursuit Group said they detected an intrusion in which the […]
Survey Surfaces Rise in IT Incidents Attributable to AI Coding Tools
A survey of 406 IT decision makers at organizations with more than 250 employees in North America finds 93% have experienced at least one infrastructure incident caused by reliance on artificial intelligence (AI) tooling. Conducted by Panterra Group on behalf of Spacelift, a provider of a platform for automating the management of infrastructure-as-code (IaC), the […]
Ten Great DevOps Job Opportunities
DevOps.com is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted as part of an effort to better serve our audience. Our goal in these challenging economic times is to make it just that much easier for DevOps professionals to advance their careers. Of course, the pool of […]
Akrites: The Latest Attempt to Protect Open-Source From AI Attacks Has Arrived
Akrites, a new Linux Foundation initiative backed by many of the world’s largest tech and financial firms, is the industry’s latest attempt to get ahead of AI‑accelerated software supply chain risks by hardening critical open source projects before attackers can exploit them. On June 25, the Linux Foundation unveiled Akrites, a coordinated industry program designed […]