News and Tech Update

OpenAI is ending Cursor’s direct access to its AI models after Elon Musk’s SpaceX acquired its parent company, Anysphere. This is the next move in the increasingly bitter conflict between Elon Musk and the company he helped found. Just because you’re filthy rich doesn’t mean you still can’t have petty fights. In the latest example of big-wig tech fusses, OpenAI said it notified SpaceX on Aug. 28 that it intends to wind down its Cursor contract with a Nov. 12, 2026 shutoff date. Why? OpenAI said, “We are making this choice because we cannot be confident that SpaceX will use our technology within our terms of service. “ After all, OpenAI continued, “After Musk acquired Twitter, now part of SpaceX, the company broke ⁠ the terms of our contract (alongside many others). Under oath earlier this year, Musk admitted ⁠ that xAI, now also part of SpaceX, had violated OpenAI’s terms of service (terms which are similar to xAI’s own).” So, OpenAI is invoki...

Broadcom today at the VMware World Explore conference a set of hardened artifacts for the open source Spring framework, including the 5,000 dependencies that are needed to run it. TrueSource Trusted Artifacts by Broadcom provides access to artifacts built in a clean room, including instances of Apache Tomcat, Kotlin, PostgreSQL, RabbitMQ, MySQL, and Valkey databases and middleware. It also extends to the Bitnami Secure Images catalog, adding hardened, verifiably built container images for hundreds of commonly used open source packages. Based on the enterprise edition of the Spring framework that Broadcom supports, TrueSource Trusted Artifacts by Broadcom includes curated artifacts written in Java, Python and Node.js. Every library and artifact is selected against a reference architecture, then built and verified by human Broadcom engineers. That aspect of the service is critical because patches generated by AI coding that have not been validated by software engineers are much more l...

GitHub is changing how organizations pay for Copilot, how Copilot chat handles data, and how code reviews run by default. None of these changes are dramatic on their own. Taken together, they signal something bigger: GitHub is treating Copilot less as a feature bundled into a developer’s toolkit and more as enterprise software that requires the same budget controls, data governance, and admin oversight as everything else IT already manages. For platform teams and engineering leaders, that shift matters more than any single line item. The most immediate change hits the wallet. Starting September 1, 2026, new Copilot Business and Copilot Enterprise seat assignments will require upfront payment before a user gains access. Existing customers get a little more runway — the same requirement kicks in October 1, 2026. GitHub says pricing itself isn’t changing, and seat revocation still won’t trigger a refund. But the mechanics are different: organizations will be charged for...

Cybersecurity researchers from Pillar Security this week revealed how a prompt injection inserted into a GitHub repository was used to gain Editor-level access to an internal Google Cloud project using a flaw in the command line interface (CLI) of an artificial intelligence (AI) coding tool that Google provides. Dan Lisichkin, a cybersecurity researcher for Pillar Security, said the flaw, since remediated, existed in Google Gemini CLI setup code that Google uses internally to automatically read and sort bug reports filed on its public GitHub page. A Pillar Security researcher was able to file a “bug report” that included hidden instructions that resulted in a prompt injection whenever an AI agent triaged issues. That prompt resulted in a legitimate credentials file being issued via the Workload Identity Federation (WIF) framework, which the researcher then copied out. Most of those credentials were low-privilege but one permitted the researcher to impersonate a far more p...

Certificate renewal is often treated as a scheduled task: run an ACME client, obtain a new certificate, and move on. In practice, that view is too narrow for production systems. A certificate is not useful because it exists on disk. It is useful because the right service is presenting it to users. Between issuance and that final state, several operational steps can fail. The more useful way to think about renewal is as a deployment workflow: renew, deploy, reload, verify, and recover when something goes wrong. Renewal Success Is Not Production Success The first failure mode is simple: a certificate authority successfully issues a new certificate, but the service continues using the old one. The renewal job is green, yet the incident clock is still running. This happens because issuance and production state are different things. The certificate may need to be copied to a specific host, mounted into a container, written to a secret, synchronized to a load balancer, or placed behind ...

Sonar today made available an artificial intelligence (AI) agent designed to discover vulnerabilities and business logic flaws that pose the greatest risk to an organization should they be exploited. The SonarQube Hunter Agent first analyzes an entire codebase to find three categories of flaws: broken access control, business-logic vulnerabilities, and authentication or session-management issues. Satinder Khasriya, a technical product marketing manager for Sonar, said that, historically, discovering these issues would have required manual testing or a penetration test. The AI agent developed by Sonar automates those investigations by tracing how code and data move through a system in a way that can now run on demand, he added. Additionally, SonarQube Hunter Agent is able to identify the developer who created any piece of code, with verified issues that are surfaced within a DevSecOps workflow via integrations with continuous integration/continuous delivery (CI/CD) platforms. That’...

AI coding agents are becoming part of everyday development work. Developers use them to find libraries, configure projects, troubleshoot installation problems, and set up new tools. An agent can search GitHub, read project documentation, and run commands without the developer having to work through every step manually. That convenience is creating another security concern for DevOps teams. An agent can encounter software and instructions during a task, decide that they are relevant, and act on them. A repository, README file or configuration file can therefore become part of the execution path. Recent attacks have shown how this can be abused. Malicious repositories have been created to attract AI coding agents, while researchers have demonstrated attacks that use project instructions to influence what an agent downloads or executes. Once an agent has access to a terminal, the filesystem, or the network, a routine development task can provide malicious code with a way into the envir...

Harness today launched a code repository service that is specifically designed for DevOps teams that are relying on artificial intelligence (AI) agents to generate code. Martin Reynolds, Field CTO for Harness, said the Agent-Ready Harness Code Repository and AI Code Review service provides an alternative to existing GitHub source code repositories that were not designed to handle the volume of pull requests and updates that are made by AI agents operating at machine speed. As a result, there are not only more outages but search and file history get slower as indexing falls behind, pull requests pile up faster than anyone can read them, and a permission system designed around a list of developers lacks the ability to identify and track an AI agent that might merge code on its own. The assumption legacy source code management tools make is that a human wrote code and opened a pull request that will be reviewed sometime later. In contrast, the Harness Code Repository has been tested t...

An AI agent that can call tools is not automatically an unsafe system. The dangerous move is smaller: Letting a workflow turn a recommendation into an external action without a durable decision record. That distinction matters in DevOps. An agent can sensibly summarize a failed deployment, draft a rollback plan or classify a dependency alert. The moment it opens a change request, modifies a feature flag, creates an incident, messages a customer or publishes a configuration, the system needs more than a high-confidence score. It needs a change-control gate. The gate below is a practical pattern for a tool-using agent. It verifies whether the policy is still current, pauses for the required human decision, makes one idempotent outbound request, then confirms the receipt. It is deliberately boring. That is the point. Figure 1: Illustration of a Workflow Moving Through Policy, Human Approval and Idempotency Gates While a Risky Duplicate Path is Stopped Why a Confidence Threshold Isn’...

In an enterprise environment, production failures are more often defined as testing failures , but they include other high-impact aspects, such as release readiness, data quality, exception handling and operational approval. However, the missing layer is not just about conducting more testing. It should include a proper, disciplined review process for the validation of business-critical data and release activity. The problem is not just about the effect of production on payroll, benefits, reporting, reconciliation or other sensitive operational functions. Production issues can also lead to payment problems, downstream reporting errors, audit concerns and operational disruption. Production readiness should be treated as a business-control question, not just as a software-quality question. What Production Validation Means Figure 1: Enterprise Release Workflow Incorporating Production Validation As illustrated in Figure 1, production validation is the operational discipline that sits...

Tricentis is providing early access to multiple artificial intelligence (AI) capabilities that it is gearing up to roll out later this year via a Tricentis Transform initiative, including an autonomous AI agent, dubbed Aida, that explores web and Windows desktop applications to surface defects, weaknesses and other potential gaps without requiring DevSecOps teams to create scripts. Additionally, Tricentis is developing a Release Risk Intelligence capability that surfaces release-scoped coverage gaps, prioritizes risks by severity, and launches AI tasks to resolve issues that are informed by context provided by the automated Tricentis testing platform. Finally, Tricentis is also readying AgentScore, a tool that enables organizations to evaluate AI agents by observing how agents behave in real-world workflows, recommending what should be measured, and generating composite quality scores that include review, block, or ship recommendations. David Colwell, vice president of AI and mach...

AI is transforming software engineering. For enterprise Java developers, the key question is whether Java and Jakarta EE are prepared to integrate AI into enterprise applications. The answer is yes . Java and Jakarta EE already support integration of Large Language Models (LLMs) and AI capabilities through existing APIs, libraries, and frameworks. Developers can continue using the enterprise Java ecosystem without waiting for new specifications. Meanwhile, ongoing initiatives are working to standardize AI programming models within Jakarta EE. AI and Software Engineering AI is changing both how developers build software and what applications can do. AI supports development through code generation, review, testing, documentation, and specification-driven tasks. In applications, it classifies information, generates content, summarizes data, assists users, and participates in business workflows. As AI becomes more autonomous, its architectural impact grows. Applications may use AI as ...