Gheist Hackers Abuse GitHub Tokens to Steal Repository Secrets
The evolving Gheist campaign uses stolen GitHub tokens and malicious Actions workflows to extract repository secrets and cloud credentials. While GitHub protections have blocked observed attacks on public repositories, private environments remain exposed.
Reddit’s r/opensource AI Ban Targets the Wrong Problem
Reddit’s largest open-source community is cracking down on AI-generated projects, prompting criticism over sweeping restrictions that could exclude legitimate developers. As Linux takes a different approach, DevOps teams face a more important question: How can they enforce code quality and accountability without banning the tools developers use?
AI Made Building Apps Easy, but Who Really Runs Them?
A few months ago, a product manager at an agency reached out to us. They had built a client reporting app over a weekend using an AI coding tool and made it live so customers could try it. It worked great until we found that authentication was broken and the app’s admin interface was accessible […]
Ten Great DevOps Job Opportunities
DevOps.com is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted as part of an effort to better serve our audience. Our goal in these challenging economic times is to make it just that much easier for DevOps professionals to advance their careers. Of course, the pool of […]
What Session-Level Tracing Taught Me About LLM Applications
I work on observability tooling for LLM-backed applications and the thing that surprised me most wasn’t a technical problem; it was how confidently wrong these systems can be while every dashboard stays green. Here’s a scenario that makes the point concrete. The Call That ‘Succeeded’ Picture an AI phone agent handling insurance calls. A customer […]
Stop Overlapping Cron Jobs With a File Lock
At 10:00, a report job starts rebuilding a shared working directory. At 10:05, its next scheduled run begins. The first process is still uploading. Now two processes can delete, replace or publish each other’s files. Moving the schedule to every 10 minutes buys time. It does not establish who may enter that directory. For a […]
Running Experiments on a Busy Backend Without Taxing a Single Request
Once a product reaches a certain scale, A/B testing and cohort targeting stop being a nice-to-have. There are plenty of good commercial platforms for this, but at scale they push you into a trade-off: Pay a big vendor bill, or send your customers’ data to a third-party API just to figure out which button someone […]
Implementing OPA with Terraform the Easy Way
Terraform compliance doesn’t have to mean complicated policy pipelines. By combining TFLint with OPA and Rego, developers can enforce infrastructure guardrails directly in their editors, pre-commit hooks and CI/CD workflows, catching violations before deployment.
Recursive Flint Puts a Fast Agentic Coding Model on Developers’ Laptops
Recursive has unveiled Flint, a 40-billion-parameter, open-weight coding model designed to run locally on developer hardware. Built with help from the company’s Eureka Machine research system, Flint promises faster inference, greater source-code privacy and freedom from per-token API fees. For DevOps teams, the launch raises fresh questions about AI agent governance, code quality and continuous model evaluation.
Claude Writes 180 Million Lines of Proofs to Verify 123 Open Source Libraries
Formal verification has long been the gold standard for software correctness. It has also been too expensive for almost everyone. New research from Anthropic suggests that’s changing. Anthropic’s Frontier Red Team, working with formal methods company Theorem, used Claude to prove security properties in the compiled code of 123 open-source libraries from Google’s OSS-Fuzz project. […]
Report: AI Agents Increase Observability Costs
Cisco has released its Splunk State of Observability 2026 report, revealing that companies face growing costs and operational challenges as they deploy AI agents without sufficient monitoring capabilities. The report found that 57% of organizations spend more on telemetry, the data used to monitor IT systems, than on the infrastructure being monitored. Additionally, 55% of […]
When 200 OK Isn’t OK: Observability for LLM Systems
Traditional monitoring can show an LLM-powered application as healthy even when it delivers incorrect answers. Drawing on experience at Varo Bank, this article explains why AI observability must go beyond the four golden signals and how automated evaluation, groundedness checks and CI pipelines can catch silent failures before they reach customers.
The Automation Confidence Gap: When Should AI Be Allowed to Change Production?
AI-generated infrastructure recommendations can look convincing, but production execution requires more than a plausible runbook. A seven-factor confidence index helps platform teams determine when AI should recommend, seek approval or execute changes within strictly enforced boundaries.
Hackers Inject Credential-Stealer, RAT Into LiteLLM
Attackers compromised a version of LiteLLM this week by injecting malicious code into all seven of its published Python wheels on PyPI, delivering a package that included an infostealer to exfiltrate credentials and secrets and a remote access trojan (RAT) that could let bad actors run arbitrary code on infected machines. The compromised version – […]
Linux Foundation: AI Speeds Development, but Low-Quality Code Strains Maintainers
A new Linux Foundation study finds that generative AI is delivering big productivity gains for open source software developers, but AI is also creating an influx of low-quality code submissions that need time-consuming human review. The research found that an estimated 25% of incoming pull requests, which are proposed changes to software projects, are considered […]
What Comes After the Pull Request?
We’ve spent plenty of time figuring out how to fit agents into the existing software development lifecycle. But the pull request was designed for humans to coordinate with other humans. If agents can generate, review, and validate changes continuously as they work, why do we need a separate interaction point at all? I’m not convinced […]
How Dependency Mocking Affects CI/CD Pipeline Reliability
Stale dependency mocks can make CI/CD pipelines pass while production integrations fail. Learn how mock drift undermines reliability and how to prevent it.
When the Agent is the Incident
When AI remediation agents make the wrong infrastructure decisions, automated fixes can quickly escalate into major incidents. This seven-step incident response playbook explains how to stop unsafe agent actions, block tool access, preserve forensic evidence and restore services without triggering further damage. A Kubernetes simulation demonstrates why stopping an agent worker alone is not enough.
OpenAI Puts COBOL Migration to the Test, and Its Newest Models Mostly Pass
OpenAI’s latest coding benchmarks show substantial improvements in handling COBOL, Fortran and other low-resource languages. But for DevOps teams modernizing legacy applications, translating code is only half the challenge. The real test is preserving business logic, arithmetic precision and production behavior.
Survey: AI Coding Tools Increase Open Source Software Dependencies
A survey of 307 enterprise technology leaders finds that as organizations rely more on artificial intelligence (AI) coding tools to build applications, they are simultaneously increasing the amount of open source software they are dependent on. Conducted by the market research firm Moving Horizon on behalf of ActiveState, a provider of a platform for accessing […]
mabl Adds Harness to AI Testing Automation Platform
Mabl today extended its test automation platform with a harness that, in addition to enforcing guardrails and testing standards for artificial intelligence (AI) agents, enables application development teams to better understand the impact of code changes before a pull request (PR) is made. Announced at a mabl Experience event, the extensions to the test automation […]
GemDB Extension Uses Code to Update Database
GemDB has introduced a Visual Studio Code extension that enables developers and AI coding agents to create, modify and persist database objects directly through Python code. With integrated Jupyter Notebook and MCP support, GemDB Code aims to eliminate traditional schema migrations, simplify database management and accelerate DevOps workflows.
Coding Agents Moved the Bottleneck From Writing to Reviewing PRs
AI coding agents are generating more pull requests than developers can review. Learn why review bottlenecks create quality debt and how DevOps teams can respond.