Docker Introduces Open Sandbox Kit Spec for AI Agent Permissions
AI agents are getting good at probing the boundaries developers put around them. Their ability to improvise makes them hard to contain. “You ask for something in a very high-level, vague-at-best way. You walk away, and you come back to a remarkable pile of mostly working software. But you then realize that you gave a […]
AWS Adds Harness to Open Source SDK for Building AI Agents
Amazon Web Services (AWS) this week revealed it has added a harness to the open source software development kit (SDK) it makes available for building artificial intelligence (AI) agents. First introduced last year, the Strands SDK makes it simpler for application developers to use AI models to build and deploy AI agents. The Strands harness […]
US District Court Decision in AI’s Favor Worries Open-Source Developers
A federal appeals court handed GitHub, Microsoft, and OpenAI an important win in the first major appellate ruling over how AI coding tools can use open-source code. As we all know, all the AI code-generating programs learned their lessons largely from open-source code. So a group of anonymous open-source plaintiffs argued that GitHub Copilot and […]
Dash0 Acquires Polar Signals for Continuous Profiling and GPU Visibility
Observability startup Dash0 announced this week that it acquired Berlin-based continuous profiling specialist Polar Signals. The deal adds continuous profiling to SignalStore, Dash0’s OpenTelemetry-native data platform. Continuous profiling has been part of the developer toolbox for years and provides teams with an ongoing view of where running applications spend CPU time, allocate memory and consume […]
Hackers Target Popular arrayref Rust Crate in Supply-Chain Attack
Security researchers are sorting through a complex, stealthy, and fast-moving supply-chain attack aimed at pushing information-stealing malware by compromising the account of the maintainer of multiple Rust crates and introducing four more attacker-owned crates. In addition, researchers with Wiz wrote that there also appears to be overlap with supply chain campaigns run by nation-state actors […]
npm v12 Shuts Down a Popular Malware Trick — But the Threat Isn’t Going Away
For years, one of the easiest ways to sneak malware onto a developer’s machine has been to hide in plain sight. Install a package from npm, and any lifecycle script bundled with it runs automatically — no review, no approval, no second look. Attackers have known this for a long time, and they’ve used it […]
Microsoft Decouples AI Agents From the VS Code Editor in Latest Release
Microsoft has shipped Visual Studio Code 1.133, and the headline change is architectural rather than cosmetic: AI agent sessions now run in a dedicated background process rather than within the editor’s extension host. The release, which rolled out August 12, moves agent execution into what Microsoft calls the Agent Host, a standalone process built on […]
Reflex’s Newly Open-Sourced XY Library Offers Faster Python Charting
A newly open-sourced Python charting library, called XY, from Reflex offers an advantage few other charting tools provide: massive scalability. The library rethinks how to render a set of points on the computer screen, and opens new possibilities for using charts in daily workflows. Most Python charting libraries today, such as Plotly, Bokeh, or Matplotlib, […]
Beyond Automation: Building Accountability for AI Agents
The conversation around AI agents has evolved remarkably quickly. Not long ago, most organisations were still experimenting with prototypes and controlled use cases, trying to understand where these systems might fit within existing operations. Today, that conversation has changed. Agents are increasingly being deployed into production environments where they can write code, interact with customers, […]
How to Automate API Testing in CI/CD Pipelines
Automating API tests and plugging them directly into your CI/CD pipeline is no longer a complex undertaking reserved for large engineering teams.
What Five Localization Pull Requests Revealed About Open Source Governance: A Field Report on Open Source’s i18n Infrastructure Gap
If you maintain an OSS (Open Source Software) project, audit your contribution workflow this week. Could a new contributor add a language without asking basic questions? If not, the next merge is not blocked by translators. It is constrained by the project’s current design.
The Future of Salesforce DevOps: Preparing for the AI Era
By establishing a robust DevOps foundation now, organizations can leverage these emerging predictive capabilities to transform reactive pipelines into proactive, self-correcting release architectures.
OpenTelemetry Achieves CNCF Graduated Project Status
The Cloud Native Computing Foundation (CNCF) today announced that the open source OpenTelemetry (OTel) project has officially graduated a little more than seven years after its initial adoption. Announced at the Observability North America Summit, OpenTelemetry was first donated to the CNCF in 2019 following the merger of separate OpenTracing and OpenCensus projects that sought […]
OpenSSF’s CRob: ‘The Runway Is Rapidly Running Out’ on EU CRA Readiness
The EU’s Cyber Resilience Act kicks into high gear this September, and companies are still clueless about how they must obey its strictures. MINNEAPOLIS — At Open Source Summit North America, Christopher “CRob” Robinson, Chief Security Architect for the Open Source Software Foundation (OpenSSF), spoke about the European Union’s (EU) Cyber Resilience Act (CRA). CRob […]
Widespread Mini Shai-Hulud Campaign Is a Matter of Trust
The latest series of attacks using the notorious Shai-Hulud worm puts into sharp focus the threats facing software developers and their CI/CD pipelines, an issue that has been raised in recent months as bad actors increasingly turn their attention to DevOps environments. That said, these most recent Shai-Hulud incidents attributed to the TeamPCP group also […]
How Open Source Dependency and Repo Attacks Compromise DevOps Pipelines and How to Stay Safe
Modern applications rely on open source components for up to 90% of their code, creating a vast attack surface dominated by inhemalicious supply chain injections. High-profile incidents like Log4j and the sabotage of colors.js highlight that traditional scanning often fails to detect sophisticated “protestware” or dependency confusion, necessitating 19 practical controls focused on strict intake governance, dependency pinning, and behavioral monitoring to secure the development lifecycle.
IBM Bob Takes AI Coding Assistants to the Next Level
IBM Bob goes beyond AI-assisted coding to support the full software development lifecycle — with governance, security, and multi-model orchestration built in.
Cyber Threats to DevOps Platforms Rising Fast, GitProtect Report Finds
The number of incidents targeting DevOps platforms grew 21% in 2025, but the amount of downtime jumped almost 95%, the security firm said.
Critical Microsoft GitHub Flaw Highlights Dangers to CI/CD Pipelines: Tenable
A critical vulnerability in a popular Microsoft GitHub repository could allow a threat actor to easily exploit its CI/CD infrastructure to run arbitrary code in the repository and gain access to secrets, according to researchers with cybersecurity firm Tenable. In an advisory issued April 21, Rémy Marot, staff research engineer at Tenable, wrote that “by […]
Claude Code Routines: Anthropic’s Answer to Unattended Dev Automation
Anthropic’s Claude Code Routines let dev teams automate scheduled tasks, GitHub events, and API-triggered workflows from managed cloud infrastructure.
Microsoft Field Engineers Built a Six-Agent Research Pipeline in VS Code That Fact-Checks Its Own Output
Azure Global Black Belts Diego Casati and Ray Kao developed Project Nighthawk, a multi-agent system that automates deep technical research for AKS and ARO with 100% source-grounding
Survey Surfaces Increased Reliance on Open Source Software to Build Apps
Open source adoption is surging, with 49% of IT teams increasing usage. However, 47% of staff spend 75% of their time on maintenance. Explore the impact of AI threats and EU regulations like CRA and DORA.
Two Malicious npm Packages Aim to Steal Credentials and Other Secrets
Bad actors took over a npm maintainer account and have published two malicious packages designed to steal credentials, API keys, and other secrets from the computers of victims who download them from the repository. Analysts with Sonatype’s Security Research Team wrote in a report that the two packages – sbx-mask and touch-adv – likely are […]
Showing the 24 most recent articles. Additional archive pages are not yet available.