Operations | Monitoring | ITSM | DevOps | Cloud

The latest News and Information on Continuous Integration and Development, and related technologies.

AI finds vulnerabilities faster than you can fix them

If an AI model can find a vulnerability for an attacker, the same model should help a defender fix it. In practice, the math doesn't favor the defender. This quick video digs into the real asymmetry AI-powered vulnerability discovery creates: The goal is models acting as tools for defenders, not weapons for attackers. Getting there means rethinking how much ground your team can realistically cover on its own.

Why artifact management can't stop at npm and Python

npm and Python get all the security attention, but attackers don't limit themselves to your highest-volume formats. A Docker image, a Helm chart, or a Rust crate can all be an entry point. If your security policy is built around the formats you use most, the formats you've deprioritized become the blind spot. This video breaks down why artifact management needs to be centralized across every package format, not just the popular ones.

MCP vs API: How they work together and when to use each

Summary: An API defines how software interacts with a service. MCP defines a standard way for AI applications to discover and invoke tools exposed by a service. They usually work together: an MCP server can sit in front of APIs you already run, turning low-level operations into capabilities an agent can find and use at runtime. Your API may already expose everything an AI agent needs. The harder problem is helping the agent figure out which operations matter for the task it has been given.

Don't Break the Agent: Lessons in Token Optimization

This one is for the curious souls who wonder how somebody actually builds a harness optimizer — and, more to the point, how they know it works. When we launched JFrog Boost into public preview, we told the story of the bill that broke us and the 100 billion tokens we clawed back across JFrog R&D. What that post didn’t cover is the question that consumed most of our engineering time: how do you measure any of this?

Argo CD Deployment Failed: AI SRE Agent AURA Finds and Fixes It

A deployment fails validation and the sync stops. Argo CD hands the report to AURA, which finds the wrong version, fixes it, and re-runs the sync. Normally, a failed sync means a person opens the application, reads the hook logs, and works out which value is wrong. Here, the sync fail hook sends AURA a short failure report and an incident ID over the agent-to-agent protocol, then exits. It does not say how to investigate or what to change.

JFrog Artifactory Now Integrates Natively with Artifact Registry in Google Cloud

Teams running containerized workloads on Google Cloud have long relied on JFrog as their single source of truth for container images. The missing piece has been getting Google Cloud’s own runtime services — like Cloud Run and Google Kubernetes Engine (GKE) — to pull directly from JFrog for every container image pull. I’m happy to say that the gap is now closed. Artifact Registry in Google Cloud has introduced a new repository mode called Connector that addresses this requirement.

AGENTS.md vs. skills: How to steer a coding agent

Every team adopting coding agents hits the same question early: where do you put the instructions that tell the agent how your codebase actually works? Two answers dominate the conversation right now. One is AGENTS.md, a plain markdown file at the root of your repo. The other is skills, packaged instruction sets an agent loads on demand. Most of the debate treats this as a formatting decision. It isn’t.

Starting your engineering career in the AI era: 6 takeaways for junior developers

“We don’t need junior engineers anymore” has become one of those lines people repeat because it sounds obvious. The AI writes the code, so why pay someone to learn how to write it? On the latest Confident Commit podcast, Rob Zuber makes the case that this take is exactly backwards.