News and Tech Update

Microsoft has released Visual Studio Code 1.129, and the headline change isn’t a new feature so much as a new foundation. The update introduces the agent host, a dedicated process that runs AI coding agents like Copilot, Claude, and Codex outside the editor itself, using a new open protocol called the Agent Host Protocol (AHP). That distinction matters more than it sounds. Until now, agent sessions in VS Code lived inside the extension host, tied to the lifecycle of a single window. Close the window, and the session’s context went with it. The Agent Host Protocol is an open, agent-agnostic protocol between a host and its clients that uses JSON-RPC for communication and immutable state with pure reducers for synchronized session data. In practice, that means an agent session becomes something closer to a resource on a server than a temporary artifact of one editor window. The host owns agent sessions independently of the clients that display and control them, which gives VS...

AI coding assistants have become an essential part of developers’ work, automating many of the repetitive tasks – think boilerplate coding and scaffolding – that in the past ate up a lot of their time. More jobs can now get done faster. That said, such agents also represent a significant security risk, making developers – who were already targets of cybercriminals – even more attractive. In recent weeks, cybersecurity researchers have reported on such threats as “ HalluSquatting ” and “ GhostApproval ,” which target developers and their AI tools. That’s in part because the adoption of AI coding agents is outpacing the development of security tools to protect them. Cyberhaven Lab researchers noted in May that adoption of AI coding agents was growing faster than the use of any other AI tool, jumping 357% between February 2025 and this year. They also are the highest-risk category. “When a developer pastes a code block into a coding assistant, or when an agentic coding tool browses a ...

A developer pulls a package from a reliable repo. It is signed, has provenance, and has been scanned. And then…it contains malware. That is no longer hypothetical. When the Miasma worm tore through the @redhat-cloud-services npm namespace in June, its malicious releases carried real SLSA provenance, because they were built in Red Hat’s own GitHub Actions workflows and published with legitimate OIDC tokens minted for those runs. To a registry scanner, the poisoned versions were indistinguishable from a routine update. The closest analogy is a deepfake. On a video call, a synthetic face can pass at first glance, and you only catch it when something underneath gives it away. Software supply chain attacks have reached the same point, with one difference that makes them worse: A deepfake at least gives you something to catch. Miasma’s packages offered nothing at the level scanners look. The provenance was genuine; every signal a scanner checked was real, just worn by the wrong ...

When a certificate expires, it can take down a production system, and teams usually only find out after something goes wrong. These issues are hard to catch because they rarely trigger alerts. Expired certificates often remain unnoticed in a config file or an old key until they cause trouble. Enterprise apps are no longer single, self-contained programs. Today, a typical app includes many services, APIs, mobile clients, and new cloud workloads are added all the time. Instead of asking, “Are we secure enough?” it is better to ask whether security was built in from the beginning or added later. Most teams still add it later, which often ends up costing more. According to IBM’s 2023 Cost of a Data Breach Report, the global average cost of a data breach is $4.45 million, and credential and identity failures are a common cause.​ The Cryptographic Foundation Most Teams Overlook Much of this depends on Public Key Infrastructure (PKI), but many teams do not fully understan...

Harness today extended the reach of its core continuous integration/continuous delivery (CI/CD) platform to enable DevOps teams to build and deploy artificial intelligence (AI) agents. At the core of that capability are five additions to the Harness portfolio, including an AI Asset Catalog that automatically discovers every agent, skill, and plugin that exists within repositories and, just as importantly, who within the organization owns them. There is also a Harness AI Evals tool that measures the quality of an AI agent by creating gates that automatically catch regressions whenever an agent or model changes. Additionally, an Agent Deployments offering extends the canary releases, approvals, and Open Policy Agent (OPA) guardrails that Harness already applies to Kubernetes deployments to managed agent runtimes like Amazon Bedrock AgentCore and Google’s Agent Runtime. AI Configs, meanwhile, provides access to a feature management tool to manage prompts and model changes at runtime. ...

AI code generation has delivered on its first promise. Teams are shipping more, covering more test cases, and moving faster than they could have imagined just a year ago. The productivity gains are real and the organizations that have leaned into AI adoption have proof points to show for it. That first wave of wins is also creating a second wave of questions, and the engineering leaders who are building influence now are the ones who saw those questions coming. The Quick Wins are Real; So is What Follows Most teams start using AI code generation in low-risk, repetitive work: Documentation, unit testing, and simple functions. Data from recent research bears this out, and the productivity gains in these areas are real. The problem is what happens at scale. As AI generates more code, it creates more to review, more to maintain, and more places for issues to hide. Review load compounds. Pull requests change in size, frequency, and composition. The code looks different than it used to,...

DevOps.com is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted as part of an effort to better serve our audience. Our goal in these challenging economic times is to make it just that much easier for DevOps professionals to advance their careers. Of course, the pool of available DevOps talent is still relatively constrained, so when one DevOps professional takes on a new role, it tends to create opportunities for others. The ten job postings shared this week are selected based on the company looking to hire, the vertical industry segment and naturally, the pay scale being offered. We’re also committed to providing additional insights into the state of the DevOps job market. In the meantime, for your consideration. Greenhouse Tines Remote, US Senior Site Reliability Engineer – Government Cloud $210,000 to $220,000 Axon New York, NY Senior Site Reliability Engineer, Axon 911 $141,000 to $216,600 Rew...

HashiCorp has introduced Terraform policy (tfpolicy), a new policy-as-code framework built directly into Terraform. Now available in public beta on HCP Terraform, tfpolicy lets platform teams write governance rules in HCL, the same language they already use to define infrastructure, rather than reaching for a separate policy tool and a separate syntax. The launch addresses a problem that’s grown alongside Terraform itself. As infrastructure estates expand across hybrid cloud environments, platform teams are managing systems spanning public cloud providers, SaaS platforms, on-premises infrastructure, and internal platforms, often with multiple teams contributing changes via Terraform. That sprawl has pushed teams toward multiple tools and disconnected policy workflows just to maintain consistent governance. Why the Old Model is Straining Policy as code isn’t new. HashiCorp’s own Sentinel and the open-source Open Policy Agent (OPA) have handled this job for years, ena...

The cost curve for generating code with AI has moved in one direction, and it has moved fast. What used to require a senior engineer’s full attention for an afternoon can now be scaffolded in minutes, and the price per token for the models doing it keeps falling. By the metric that dominated every early AI productivity argument, the cost of generation, the economics are undeniably favorable and getting more so. But production deployments have surfaced a different cost that the token price does not capture and that the demo environment was never designed to reveal. The cost of giving the model the right context to generate something that is actually correct, maintainable, and safe to ship is not falling. In many organizations it is rising, and the engineering infrastructure required to manage it reliably does not exist yet in most teams that need it. Context engineering has become one of the more discussed terms in AI infrastructure circles, and the discussion has accumula...

Engineering teams have been racing for the last two years to deploy AI agents that can find bugs faster than any QA team ever could. Autonomous testing agents can crawl through codebases, identify vulnerabilities, and generate test coverage reports while developers finally get to take a breath. The irony is that while development teams enjoy that brief reprieve, the workload for testers and security researchers has exploded, because now they have to validate not just the code but the agents doing the testing. And most leaders are now facing a disturbing truth that should fundamentally change how we think about quality engineering. The agentic testing platforms we trusted to secure our applications may themselves be introducing attack vectors we have never seen before, says Ahmed Zaidi , Chief Executive Officer of Accelirate , who leads the companyʼs automation and AI-driven testing strategy. Grappling with a fundamental challenge that most QA leaders have not yet confronted, he exp...

Anaconda Inc. has acquired Kilo Code, an open-source, model-agnostic platform that embeds artificial intelligence (AI) agents directly into developer workflows. The acquisition integrates Kilo’s rapid-growth community of over three million developers into Anaconda’s expanding enterprise AI-native development ecosystem. The transaction positions Anaconda to secure the entire software development lifecycle, from the developer’s initial prompt to final enterprise deployment. Financial terms were not disclosed. The deal represents a major strategic step in Anaconda’s bid to address a critical industry bottleneck: The estimated 80% of enterprise AI projects that fail to reach production. By combining Kilo’s front-end AI agents with Anaconda’s secure package distribution and its recently acquired Outerbounds orchestration platform, Anaconda aims to create a highly secure, continuous pipeline for AI-native software development. Kilo’s platform is built for agentic engineering, where...