Skip to main content

Posts

GitLab Tightens Rate Limits as Coding Agents Drive Demand

GitLab is introducing new rate limits for its cloud-based DevOps platform as growing demand from AI agents and automated development tools increases pressure on its infrastructure. The changes , which begin October 19, will restrict the volume of requests users can send to GitLab.com based on their subscription plans. Free-tier customers and users making unauthenticated requests will face the new restrictions first, while Premium and Ultimate customers will see changes in January 2027. The restrictions address a challenge facing developer platforms as AI coding agents generate vast volumes of automated requests. GitLab forecasts several times more traffic on its infrastructure for 2026, prompting the company to establish usage limits designed to maintain service performance. GitLab is certainly not alone in addressing this issue. GitHub and Anthropic have also introduced rate limits as AI-powered development tools greatly boost the use of computing and network resources. Automated ...
Post a Comment
Read more
Recent posts

GitHub Separates Who Writes Code From Who Runs Your CI

Anyone with write access to a repository can trigger a GitHub Actions workflow. That has been the default since Actions launched. It’s convenient. It’s also a problem when a compromised account or a malicious pull request can turn your CI into an attack path. Attackers have noticed. GitHub’s own 2026 Actions security roadmap points to incidents involving tj-actions/changed-files, Nx, and trivy-action as examples of the same pattern. Go after the automation, not the application. Steal a token, and you own the pipeline. Mitch Ashley, vice president and practice lead for CIO & technology buyers and software lifecycle engineering at The Futurum Group , puts the stakes plainly. “A single compromised developer account can mean the difference between a well-running pipeline and compromised software.” GitHub’s latest answer is now generally available. On September 17, the company made workflow execution protections GA for GitHub Enterprise, organizatio...
Post a Comment
Read more

US District Court Decision in AI’s Favor Worries Open-Source Developers

A federal appeals court handed GitHub, Microsoft, and OpenAI an important win in the first major appellate ruling over how AI coding tools can use open-source code. As we all know, all the AI code-generating programs learned their lessons largely from open-source code. So a group of anonymous open-source plaintiffs argued that GitHub Copilot and OpenAI Codex were built using code from public GitHub repositories, including open-source licensed code. They argued the AI tools had generated code without the author attribution, copyright notices, and license terms that came with the original work. Now, the Ninth Circuit has returned a verdict in Doe vs. GitHub siding with Big AI. Ouch! But it may not be as troublesome as it first appears. The Ninth Circuit’s September 16 decision turns on a technical but consequential distinction: AI-generated code that lacks author names, copyright notices, and license information is not necessarily the same as code from which that information has been...
Post a Comment
Read more

Why Your CI/CD Pipeline Is Your Most Unprotected Attack Surface

Your team probably spends considerable effort securing your application. WAFs, rate limiting, input validation, penetration testing. Then code passes through a CI/CD pipeline that runs with privileged credentials, executes arbitrary code from third-party actions, has broad network access to internal systems, and logs secrets in plain text if someone makes one configuration mistake. The pipeline that builds and deploys your secure application is itself the least secure system in your infrastructure. Think about what a CI/CD pipeline actually is from an attacker’s perspective. It is a system that automatically executes code, often with administrative access to your cloud accounts, container registries, databases, and production environments. It pulls dependencies from the public internet. It runs plugins and actions written by strangers. It often has access to every secret needed to deploy to every environment. If you designed a system specifically to be an attractive target for s...
Post a Comment
Read more

Anthropic Adds a Coordinator to Claude Projects for Running AI Work in Parallel

Anyone who has run more than one Claude Code session at a time on the same codebase already knows the drill. You split the work yourself, decide which session touches which files, track what each one is doing, and then stitch the results together by hand. The model can write good code in parallel. Coordinating that parallel work has been left entirely to humans. Anthropic is trying to close that gap. On September 17, the company rolled out a redesign of Claude Projects that moves it from a static container for files and chat history into something closer to a project manager: A coordinator that breaks a stated goal into parallel threads, delegates the work, and assembles the results. The mechanics are straightforward once you see them. A user states a goal and connects the relevant repositories or context, and a coordinator thread scopes the work and spins up worker threads to handle pieces of it. Each of those threads runs as a full Claude Code cloud session on its own branch, and c...
Post a Comment
Read more

Anthropic Brings Parallel Coding Workflows to Claude Projects

Anthropic announced it has redesigned Claude Projects to coordinate multiple coding sessions in parallel, with the new experience debuting in beta for Claude Code users. In the redesigned Projects, a coordinator can break a development goal into separate threads, assign them to individual Claude Code cloud sessions and track their progress from one shared project. The beta is initially available to select Claude Pro and Max subscribers using Claude Code cloud sessions, with wider Pro and Max access coming over the next week. Updated Projects across the rest of Claude and on Team and Enterprise plans will follow. The naming may be confusing because Anthropic already uses “Projects” for its general-purpose Claude workspaces. Anthropic describes this as a new version of that existing feature, rather than a separate Claude Code product. The redesign is debuting in Claude Code, while existing Projects in chat and Cowork will continue to work for now and be upgraded as the rollout expands....
Post a Comment
Read more

StackHawk Delivers Wingman to Fix Vulnerabilities as Developers Write Code

StackHawk this week launched Wingman , an artificial intelligence (AI) tool that makes it possible for application developers to automatically fix vulnerability issues as code is being written. Wingman is designed to install into Claude Code, Cursor, GitHub Copilot, Codex, and Antigravity. It scans the live application, interprets findings, and fixes vulnerabilities in a way that makes it simpler for application developers to maintain context as they write code. At the core of those capabilities, StackHawk’s application testing platform is made available through a set of AI skills, hooks and rules that Wingman invokes. Once an AI coding agent finishes a feature, Wingman auto-configures and boots the running application to run a series of security tests with no manual steps required. Findings are then shared with the AI coding agent that wrote the code to fix any issues discovered. Wingman then rescans that application to confirm the fix held before reporting back to the continuous in...
Post a Comment
Read more