Operations | Monitoring | ITSM | DevOps | Cloud

Run a few prompts. Looks good. Ship it. According to Laurie Voss, that's still how a surprising amount of AI software gets tested.

People want to support your community. Sometimes you just have to invite them in.

AI is accelerating both sides of the supply chain problem. Developers ship faster using it. Attackers use it to find vulnerabilities, create malicious packages, and automate social engineering.

The real unlock is flagging what actually needs human review, not shipping 5,000-line PRs and hoping for the best.

Devs have a habit of solving their own problems before anyone else's and the AI boom is repeating that pattern.

Every dependency pull is a trust decision. Public registries don't vet what they serve. Cooldown policies give you a gate at the moment that matters most: when a package first enters your environment. Dan McKinney (Solutions Engineering Manager) walks through how Cloudsmith's cooldown policies work and how to configure one in under five minutes. What Dan covers.

Your agent writes code fast, but you shouldn't have to see it until it's right. Chunk sidecars are lightweight microVMs that work inside the agent loop, requiring agents to pass pre-push validation in a CI-like environment before they declare they're "done." That means no massive CI pile-ups, no long round-trips that risk resetting your agent's context. You're sending code you already know is good.

Most AI applications in production right now were shipped on vibes. A developer ran a few queries, liked what they saw, and pushed to prod. Laurie Voss argues that's the core reason so many AI products feel broken, and the fix is simpler to name than it is to do: write the tests.

Miasma has already hit Red Hat and 73 Microsoft GitHub repos. Here's how it works and what your team can do right now. Nigel Douglas, Head of Developer Relations at Cloudsmith, breaks down the Miasma worm – a self-replicating supply chain attack and evolved variant of Mini Shai-Hulud from threat group TeamPCP. Learn how Miasma uses the yo-yo attack method to move laterally across registries and workstations, why conventional scanners missed it, and the practical steps security teams can take today, including cooldown policies and continuous risk assessment.

Catch failing tests before they ever leave the machine with just two hooks and Chunk sidecars.

Hywel Carter on the mental model that travels with you no matter what ships next.

AI agents write code fast, but the feedback loop usually can't keep up. In this tutorial, you'll see how to wire Chunk sidecars into your agent's hooks so basic failures get caught before they ever reach your CI pipeline. We'll walk through the two hooks that chunk init writes automatically: Both hooks return exit 2 on failure, blocking the commit or keeping the turn open so the agent can fix its own mistakes with no manual prompting required.

Chunk sidecars give your agent CI-grade feedback in seconds. No push, no pipeline wait. Catch failures and fix them while the agent is still in context.

Your schema changed. Did your masking rules keep up? Here’s how Flyway and Test Data Manager can catch gaps and prevent PII exposure in dev and test. Tony and Tonie discuss how Flyway and Redgate Test Data Manager can work together in a CI pipeline to detect schema changes that introduce unmasked sensitive columns, helping teams keep production-derived test data protected as the database evolves.

If 90% of code is now AI-generated, what happens to the engineers who never had to write it themselves? The ability to review code well, to catch what the LLM missed, depends on mental models that only come from practice. That tension sits at the center of this conversation.

AI coding agents write code faster than your pipeline can catch mistakes. What if the agent could validate against CI before you ever push? In this 5-minute demo, we set up CircleCI's Chunk CLI and run a microbuild using Chunk sidecars, secure Linux microVMs that spin up in ~1 second in your CircleCI account, mirror your working directory (no git push required), and give your agent CI-grade feedback while it's still in context.