Latest from Tom
GitLab Bets Context, Not Bigger Models, Will Fix AI Agent Costs
GitLab has launched Orbit, a context graph designed to give AI coding agents a more complete view of the software development lifecycle. With claims of up to 45x fewer hallucinations and 4.5x fewer tokens, GitLab is betting that better context, rather than bigger models, is the key to more reliable agentic development.
Nov 2, 2026 · 3 minAll articles by Tom Smith
Showing 1–24AI Coding Assistants’ Built-In Browsers Open a Path to Developer Secrets
Security researchers uncovered a class of embedded-browser vulnerabilities affecting five popular AI coding tools, including Cursor, Copilot, Codex, VS Code and Claude Desktop. The findings reveal how malicious pages can exploit trusted AI workflows to steal credentials, access local files and even persuade agents to disable their own safeguards.
DeepSeek Wants Coding Agents to Stop Waiting for Instructions
DeepSeek’s open-source Super-Agent prototype replaces isolated coding sessions with an always-on system that coordinates multiple AI workers, responds to development events and can initiate bug fixes without direct prompting. For DevOps teams, the promise of autonomous development brings new challenges around permissions, pipeline security, observability and code verification.
Two GitHub Campaigns, One Weak Point: Stolen Developer Credentials
Two separate GitHub attack campaigns, Gheist and Testmetest, exploited stolen developer credentials to steal secrets, compromise workflows and target software supply chains. The attacks reveal dangerous blind spots in GitHub Actions security, repository scanning and AI coding assistant configurations.
Reddit’s r/opensource AI Ban Targets the Wrong Problem
Reddit’s largest open-source community is cracking down on AI-generated projects, prompting criticism over sweeping restrictions that could exclude legitimate developers. As Linux takes a different approach, DevOps teams face a more important question: How can they enforce code quality and accountability without banning the tools developers use?
Recursive Flint Puts a Fast Agentic Coding Model on Developers’ Laptops
Recursive has unveiled Flint, a 40-billion-parameter, open-weight coding model designed to run locally on developer hardware. Built with help from the company’s Eureka Machine research system, Flint promises faster inference, greater source-code privacy and freedom from per-token API fees. For DevOps teams, the launch raises fresh questions about AI agent governance, code quality and continuous model evaluation.
Claude Writes 180 Million Lines of Proofs to Verify 123 Open Source Libraries
Formal verification has long been the gold standard for software correctness. It has also been too expensive for almost everyone. New research from Anthropic suggests that’s changing. Anthropic’s Frontier Red Team, working with formal methods company Theorem, used Claude to prove security properties in the compiled code of 123 open-source libraries from Google’s OSS-Fuzz project. […]
OpenAI Puts COBOL Migration to the Test, and Its Newest Models Mostly Pass
OpenAI’s latest coding benchmarks show substantial improvements in handling COBOL, Fortran and other low-resource languages. But for DevOps teams modernizing legacy applications, translating code is only half the challenge. The real test is preserving business logic, arithmetic precision and production behavior.
GitHub Puts a Firewall Between npm and Your CI Runners
GitHub’s new package firewall puts enterprise security policies between npm registries and the developers, CI runners and AI coding agents consuming packages. With malware detection, attestation checks and package-age restrictions, it aims to stop malicious dependencies before installation.
AI Agents Can Now Take Software Apart. DevOps Teams Need a Plan
AI-powered reverse engineering is making it easier to understand and rebuild software without source code. Tools such as REA and increasingly capable AI models create opportunities for legacy modernization while raising fresh concerns about intellectual property, application security and functional correctness.
Microsoft Foundry Puts AI Agents on a Schedule and Under Watch
Microsoft’s September Foundry updates focus on making AI agents production-ready with automated routines, lower token costs, trace-based insights and improved resilience. For DevOps teams, the changes bring agent operations closer to familiar CI/CD and observability practices.
GitHub Brings AI Security Scanning to Pull Requests CodeQL Can’t Cover
GitHub’s AI Scan brings AI-powered vulnerability detection to pull requests involving languages, scripts and infrastructure files beyond CodeQL’s existing coverage. Paired with the general availability of agentic autofix, the release expands security automation across the development lifecycle. But advisory-only findings, coverage gaps and AI credit consumption mean DevOps teams still need clear review policies.
Dean Hall Open Sources Brutal to Give Game Studios a Way Out of Engine Lock-In
DayZ creator Dean Hall has unveiled Brutal, a free C# framework designed to give game developers greater control over their technology and reduce dependence on commercial engines. Already used in projects including RimWorld’s new engine, Brutal promises flexibility and performance while raising familiar questions about licensing, maintenance and open source sustainability.
Figma Gives AI Agents a Spec Sheet and Developers a Shared Canvas
Figma introduces Specs, code layers and expanded MCP tools to connect AI agents, designers and developers while improving design-to-code workflows.
Claude Platform Now Sends Agent Traces Straight to Your Observability Stack
Anthropic is making it easier to see what Claude-based agents do in production. The company has added OpenTelemetry trace export to the Claude Platform. Developers can now send traces from the Messages API, Claude Managed Agents, and the Claude SDKs to the observability tools they already use. The feature launched in public beta on October […]
Apple Brings Whole-Program C++ Hardening to Clang
Apple has added a new tool to the upstream LLVM project that could change how teams harden large C++ codebases. The clang-ssaf-driver, merged into LLVM Git this week, analyzes an entire project as it builds and then rewrites source code based on what it finds. The driver is part of Clang’s Scalable Static Analysis Framework […]
One Bill for Grok, Cursor, and X: What SpaceX’s Bundle Means for Developers
SpaceX wants to be the single line item for your AI coding tool, your chatbot, and your social media account. On October 12, SpaceX Super Intelligence (SpaceXSI), the AI unit formerly known as xAI, introduced The X Subscription. It folds Grok, the Grok Bot agent, the Cursor AI code editor, and X Premium into one […]
GitLab Fixes CVSS 10 Flaw in CI/CD Regex Engine, Plus 23 Other Vulnerabilities
GitLab is telling every self-managed customer to upgrade now. On October 12, the company shipped versions 19.4.2, 19.3.5, and 19.2.8 of GitLab Community Edition (CE) and Enterprise Edition (EE). The releases fix 24 security vulnerabilities. One has a CVSS score of 10.0, the highest rating possible. GitLab.com already runs the patched code. GitLab Dedicated customers […]
GitHub Narrows App Permissions to Pull Teams Off Classic PATs
GitHub is giving DevOps teams more ways to limit an automation job to only the access it needs. A batch of GitHub Apps updates released Oct. 13 adds narrower permissions, relaxes a long-standing install restriction for repository administrators, and makes it easier to move users to expiring tokens. GitHub says the goal is to help […]
npm Puts a 48-Hour Clock on Unused Trusted Publishing Configurations
GitHub has added an expiration date to unused npm trusted publishing configurations. Any configuration that doesn’t complete a successful publish within 48 hours of creation now expires and can no longer authorize a release. It’s a small change. But it closes a gap that matters to anyone who publishes packages from a CI/CD pipeline. How […]
Anthropic Builds Its Own Source Control After AI Agents Outgrow Git
Anthropic has moved its internal monorepo off Git and onto a version control system it built from scratch. The reason is simple. Its AI agents now write code faster than Git-based infrastructure can handle it. In a post on its engineering blog, the company said it averaged about 2,500 merged code changes a day in […]
GitHub Ties Every Commit to the Account That Pushed It
GitHub has introduced push attribution in limited public preview for Enterprise customers, adding authenticated pusher identities to commits alongside author and committer information. A new repository rule can also block pushes when committer details don’t match the authenticated account, helping DevOps teams combat identity spoofing, improve audit trails and strengthen software supply chain security.
Cloudflare Brings the Deno Team In to Make Self-Hosted Workers Practical
Cloudflare brings Deno’s team aboard to expand self-hosted Workers and Durable Objects as Deno Deploy winds down and runtime support enters its final year.
Coding Agents Broke Git’s Scaling Math. GitHub Is Rebuilding to Keep Up
GitHub is rebuilding its Git infrastructure as AI coding agents drive billions of commits, promising up to 35x faster writes while exposing new DevOps bottlenecks.