News and Tech Update

The software industry has heard plenty about how artificial intelligence will transform software development. Analysts have analyzed it. Consultants have built practices around it. Vendors have attached AI to just about every product description they could find. It is a little different when the message comes from one of the companies building the AI responsible for the disruption. Anthropic recently published “ The AI-Native SDLC Playbook ,” a detailed proposal for transforming the software development lifecycle one stage at a time. Written by Louis Claxton and drawing on practices from Anthropic’s Applied AI team and its customers, the playbook makes a deceptively simple assertion: Code is no longer necessarily the bottleneck. This is not literally Claude writing its own review of the software industry. Still, it is about as close to hearing it from the horse’s mouth as we are likely to get. The company whose AI helped accelerate software development is now telling us that the pro...

JFrog CEO Shlomi Ben Haim told approximately 500 software engineers today that in the age of artificial intelligence (AI) no one will soon care much about source code anymore. Speaking at the company’s swampUP 2026 conference, Ben Haim said AI tools are now creating executable binaries directly without relying on source code that historically existed to provide a method for humans to review code. However, in an era where AI tools are creating code that often isn’t even readable by a human application developer, the focal point for securing software supply chains is now moving to scanning application binaries, said Ben Haim. No one cares how many lines of source there are, he added. It’s not clear to what degree DevSecOps teams might be coming to a similar conclusion, but it’s apparent that the volume of code being created using AI coding tools is overwhelming existing DevSecOps workflows. An alternative approach to application security in the AI era would be to focus more on applyi...

For years, cloud infrastructure changes were mostly a mystery. An engineer would log into a dashboard, tweak a setting, run a few scripts, and that was it. Nobody worried until something broke. Suddenly, everyone wanted answers. Who changed this? Was it tested? Can we fix it? How did production end up out of sync with what’s in the repo? Modern cloud setups make it impossible to ignore these questions. Teams wrangle Kubernetes clusters, cloud services, databases, networking, app configs, security policies, all spread across different environments. Manual changes just don’t scale. Enter GitOps. Instead of using Git solely for app code, teams now treat it as the source of truth for their infrastructure. You want changes? They go through pull requests, complete with reviews, automated checks, and approvals. Once Git gets updated, automated tools sync the real environment with what’s specified. By 2026, this process goes way beyond Kubernetes deployments. Pull requests are morphing int...

CrowdStrike today at its Fal.con 2026 conference extended its reach into the realm of software supply chain security with the addition of an offering that blocks malicious open-source packages at the endpoint before their embedded code can run. Bartley Richardson, chief AI and autonomous systems officer for CrowdStrike, said Real-Time Supply Chain Attack Protection is designed to prevent both human developers and artificial intelligence (AI) coding agents from downloading malicious software packages that have been poisoned by malicious actors. The only place to effectively thwart these types of attacks is at the command line interface (CLI) running on the endpoint used to build an application, added Richardson. Based on a sensor that CrowdStrike relies on to secure endpoints, Real-Time Supply Chain Attack Protection intercepts open-source package manager transactions before any embedded script runs on a Windows, macOS or Linux endpoint. DevSecOps teams, as a result, have complete vi...

JFrog today at its swampUP 2026 conference added a zero touch remediation capability that ensures the most secure version of a binary is provided even when application developers request a version that has known vulnerabilities. Additionally, JFrog is adding tools and capabilities to secure artificial intelligence (AI) agents that have been embedded within a DevOps workflow . For example, an AI Asset Scanning tool uses semantic scanning of markdown files, skills scripts, and instruction sets found in AI models, skills, plugins and Model Context Protocol (MCP) servers to block malicious behavior. There is also now an Agent Guard that extends the company’s core Artifactory registry to apply governance policies to plug-ins for AI coding agents. It natively enforces project-scoped allow/deny policies from AI Catalog within developer tools to ensure coding agents never bypass organizational guidelines and only consume approved AI assets. JFrog also revealed today it has added support f...

Code review has always had two parts: the feedback and the sign-off. GitHub Copilot has been able to handle the first part for a while now, leaving comments, catching bugs, and flagging style issues on pull requests. The second part — the actual approval that clears a PR to merge — has stayed a human job. That changed this week. GitHub announced that Copilot code review can now submit real approvals on pull requests, not just comments. When an organization turns the feature on, Copilot’s sign-off counts toward a repository’s required-approvals rule, just as a teammate’s approval would. It’s a small-sounding change with real weight: GitHub has moved Copilot from advisory to authoritative in the one place where code review actually gates what ships. Here’s how it works. Every Copilot code review already ends with an overview comment. That comment now includes an approval assessment, Copilot’s read on whether the pull request looks ready to merge. On i...