Skip to main content

Posts

Preparing Infrastructure for the Next Phase of Agentic AI

After years of exploring how AI can support agency operations and make better use of growing volumes of data, agencies are now preparing for the next phase: agentic AI. The infrastructure needed is changing along with it. Agentic AI, unlike regular AI capabilities, can coordinate multiple specialized agents to carry out complex, multistep workflows, which means agencies are no longer planning only for the compute required to run AI models. They also have to account for the orchestration between agents, the movement of data across environments, and the points where human judgment still belongs. That makes it important to start with the work itself—not the newest, shiniest technology. The following three strategies can help. Start With the Workflow, Not the Hardware Agentic AI is more sophisticated, but it also requires more orchestration and preparation. Consider a permitting process. One agent might evaluate municipal requirements while another examines state or federal statutes. A...
Post a Comment
Read more
Recent posts

Hackers Target Popular arrayref Rust Crate in Supply-Chain Attack

Security researchers are sorting through a complex, stealthy, and fast-moving supply-chain attack aimed at pushing information-stealing malware by compromising the account of the maintainer of multiple Rust crates and introducing four more attacker-owned crates. In addition, researchers with Wiz wrote that there also appears to be overlap with supply chain campaigns run by nation-state actors linked to the government of North Korea. According to multiple reports, unknown threat actors this week compromised the maintainer account behind arrayref, a widely used package with more than 245 million downloads that Sai Likhith, backend engineer with StepSecurity, described as a “tiny array-conversion utility” that is “one of the Rust ecosystem’s quiet load-bearing crates.” Over the next 23 minutes, as part of the same attack, the hackers poisoned two other crates from the same owner, append-only-vec and internment. In addition, the attackers published versions of four other crates – ...
Post a Comment
Read more

Why Cryptographic Inventory Is the First Step Toward Quantum Readiness

Post-quantum cryptography is often framed as an algorithm replacement exercise. The discussion usually moves quickly toward RSA, elliptic curve cryptography, ML KEM, digital signatures, hybrid key exchange and the question of which algorithms should replace today’s public key systems. For DevOps teams, however, selecting a replacement algorithm is only one part of the problem. The harder task is determining where vulnerable cryptography exists, which applications and infrastructure depend on it, who owns those dependencies, and how difficult each one will be to change. That makes cryptographic inventory one of the most important foundations of quantum readiness. NIST’s current Migration to Post Quantum Cryptography project specifically identifies cryptographic visibility and risk management as a core workstream and recommends building and maintaining a comprehensive cryptographic inventory to guide migration. The inventory covers algorithms, protocols, keys, certificates, ...
Post a Comment
Read more

AI Agents Are Writing Code Faster Than Anyone Can Review It. Tessl Is Betting On Standards To Close That Gap

Every team that has turned coding agents loose on real work has run into the same wall. The agents write fast. They write a lot. And somewhere between the tenth and twentieth pull request of the day, the humans responsible for reviewing that code start falling behind. That’s not a hypothetical. It’s the operating reality on teams that have adopted agentic development this year, and it’s the problem Tessl is aiming to address with the launch of Tessl Code Review, a new tool the company rolled out this week and is offering for free during its beta period. The pitch is simple: teams don’t need another reviewer catching naming nits and formatting issues. They need a reviewer that runs on its own, filters out the noise, and actually knows the team’s standards. Tessl Code Review checks pull requests against those standards, written once and stored as a skill the team owns and controls. That last part matters more than it might sound. A lot of AI code review to...
Post a Comment
Read more

Critical Flaw in isolated-vm Can Lead to Sandbox Escape, RCE Threat

Developers for years have been using vm2, an open-source Node.js library , to run untrusted JavaScript inside a secure and isolated sandbox environment. It uses Node.js’s built-in modules and JavaScript Proxies and lets developers whitelist particular built-in Node modules or limit what the script can access. During that time, vm2 has been the default for safely running untrusted JavaScript, which Cris Staicu, senior security researcher for Endor Labs, calls “one of the hardest problems in the Node.js ecosystem.” However, over the years, there have been some two dozen instances of code breaking out of the sandbox, including one Endor Labs documented earlier this year . The problem is that vm2 is used to build a security boundary inside a single V8 execution environment using proxies and prototype scrubbing, and untrusted code shares some of the same elements, according to Staicu. Another method, isolated-vm, uses stronger techniques, a key one being that each sandbox given its own V...
Post a Comment
Read more

How to Avoid Repeating the “Automate Everything” Mistake Due to AI FOMO

The DevOps community has already experienced technological extremes. You might recall the time when automation was thought of as a panacea for all possible engineering issues, and the slogan “Automate Everything” was ringing out everywhere. Over time, the industry came to an important conclusion: Automation should not become the end goal. Along with faster software delivery, companies ended up with new dependencies, more complex infrastructure, and additional tools that also needed to be maintained. Today, a similar story is unfolding around artificial intelligence. Only instead of the call to automate everything in sight, we’re increasingly hearing a different mantra: Implement AI everywhere. Is this really necessary, though? Why AI Adoption Pressure is Growing in DevOps Three principal factors can be highlighted here. The first one is the pace of change. It’s hard even to mention a week that does not bring news about some AI solution for DevOps: From Terraform generation assistan...
Post a Comment
Read more

Airlock Digital Completes Independent IRAP Assessment at the PROTECTED Level

Adelaide, Australia, August 19th, 2026, CyberNewswire Independent assessment provides Australian organisations with additional evidence when evaluating application control for sensitive, government, defence and critical infrastructure environments. Airlock Digital, a global provider of application control and allowlisting solutions, today announced that it has completed an independent Information Security Registered Assessors Program (IRAP) assessment at the PROTECTED classification level. The assessment was conducted by an Australian Signals Directorate (ASD)-endorsed IRAP assessor against the Australian Government Information Security Manual (ISM). It provides Australian organisations with additional independent evidence when evaluating Airlock Digital’s security controls and their alignment with applicable Australian Government security expectations, including the ISM and Protective Security Policy Framework (PSPF). For Australian security teams, confidence in a technology pr...
Post a Comment
Read more