News and Tech Update

For nearly a decade, cybersecurity has been dominated by one overarching concern: securing the software supply chain. Organizations invested heavily in Software Bills of Materials (SBOMs), artifact signing, provenance frameworks, reproducible builds, and vulnerability scanners capable of identifying compromised dependencies before software reached production. The software supply chain became the industry’s focal point, accelerated by incidents such as SolarWinds, Log4Shell, XZ Utils, and the increasing sophistication of nation-state attacks targeting open source ecosystems. Today, however, the spotlight has shifted once again. AI models, autonomous agents, prompt injection attacks, model poisoning, insecure MCP servers, and malicious agent interactions have become the new security frontier. Vendors are rapidly introducing AI security platforms capable of monitoring prompts, identifying unsafe agent behavior, validating tool usage, and detecting model vulnerabilities. This trans...

Plenty of enterprises want AI coding agents. Fewer are willing to send their source code to someone else’s cloud to get them. That tension has slowed adoption at banks, insurers, government agencies and other organizations that build software under strict rules about where code and data can live. IBM is betting a self-hosted option will help close the gap. This week, the company announced that IBM Bob, its agentic software development platform, can now run on-premises, in private clouds, in sovereign clouds and in fully air-gapped environments. IBM made Bob generally available as a SaaS offering in April. At the time, it said on-premises deployment would come in a future release. That release is now here. Bob is meant to do more than complete code. IBM pitches it as a partner across the software development lifecycle, from planning and design through coding, testing, deployment, and modernization. It coordinates specialized agents for code, tests, documentation, and pipelines. ...

Amazon Web Services (AWS) today made available a preview of an artificial intelligence (AI) agent that surfaces recommendations to optimize cost, security, performance and resilience based on the business objectives an organization defines. Jill Fariss, vice president of AWS Support, said the AWS Well-Architected Agent generates code that can be implemented via a command line interface (CLI), an infrastructure-as-code tool or some type of runbook automation. The overall goal is not to eliminate the need for humans to manage IT infrastructure but rather make it simpler for engineers and IT administrators to manage workloads at much higher levels of scale, added Fariss. That capability is critical because most organizations today simply don’t have enough IT staff to effectively manage and optimize the workloads they currently have deployed, an issue that is only going to be further exacerbated as advances in AI make it possible to build and deploy even more applications, she noted. Th...

I am a builder. My career has spanned the rise of the commercial internet, web hosting, application service providers, managed infrastructure, security, DevOps, cloud native computing, platform engineering and now AI. Through all of it, I have been a builder and a leader. I didn’t think, after all these years, I would be building again quite like this. But in the age of AI, we can all be builders. I am happy to be doing this. Today, The Futurum Group is launching Futurum Media , bringing Techstrong, Tech Field Day and Visible Impact together into a go-to-market execution business. It becomes the umbrella for Futurum’s editorial properties and media services, backed by the broader organization’s research, intelligence and expertise. For those of you who read DevOps.com and our other publications, participate in our programs or work with us, here is why I believe this is a significant next step. A Community Worth Building On DevOps.com grew alongside a community changing how softw...

A global survey of 705 developers and IT leaders finds 42% of respondents reporting that artificial intelligence (AI) now writes at least half their code, with only 21% of developers now spending more than half their week writing new code from scratch. Conducted by BairesDev, a provider of software development services, the survey also finds nearly 80% of developers now spend less than half their week coding. As a result, developers on average are saving 13 hours a week on coding, allowing them to devote more time to reviewing AI output (67%) and debugging it (52%). Developers are also now spending, on average, nine hours a week learning AI tools and new technologies. That investment appears to also be paying off, with AI tool fluency (29%), system architecture (20%), and human skills (15%) expertise driving pay increases for developers, the survey finds. A full 86% of respondents also report they now find their role in their organization more fulfilling, according to the survey. I...

AI coding agents don’t just suggest code anymore. Tools like OpenAI’s Codex spin up a real container, clone a real repository, and authenticate with a real GitHub credential to get the job done — which means every agent your team wires up is also a new privileged identity, holding real access, running with comparatively little of the scrutiny a human with that same access would get. A Branch Name Was the Whole Attack In March, BeyondTrust’s Phantom Labs disclosed a critical command injection vulnerability in Codex. The flaw was almost absurdly simple: when Codex creates a task container, it passes the target branch name into a shell command without sanitizing it first. Characters like ; && | $() and backticks get interpreted literally by Bash. The proof-of-concept needed nothing more exotic than that. Set the branch to main , append a semicolon to terminate the intended git command, then inject a second command that writes the output of git remote get-url o...