Slopsquatting: the AI supply chain attack you haven't patched
Eighty percent of new developers on GitHub start using Copilot within their first week. How many really know what it's pulling in?
Operations | Monitoring | ITSM | DevOps | Cloud
The Place Where Modern Operations & Technology Come Together
The latest News and Information on Continuous Integration and Development, and related technologies.
The most underrated use case for AI
Code generation gets all the attention, but one of AI's biggest strengths might be helping non-engineers prototype ideas, explore solutions, and get work done that otherwise never would have happened.
Automate all the things: How to use Grafana Cloud's AI to relieve the operational burden
Continuous integration and continuous delivery (CI/CD) have dramatically changed how we ship software. But once code reaches production, the operational work is still surprisingly manual. Engineers continually monitor systems, investigate unexpected behavior, and decide which issues require action. And that is where the next opportunity for AI-driven automation lies. For example, in today's CI/CD workflows, someone refreshes the pipeline page to see whether the queue has moved.
Code review was already broken before AI
"We'll spend weeks shaving 10 minutes off CI, then let code sit waiting 18 hours for review." Luca and Rob discuss why AI isn't just changing how we write code, it’s forcing teams to rethink the entire software delivery process.
How to Connect Cursor to CircleCI: AI-Powered CI/CD Debugging with MCP
Stop context-switching between your IDE and CI dashboard. This video shows you how to connect Cursor to CircleCI using the CircleCI MCP server so your AI agent can read pipeline failures, validate configs, and trigger builds without leaving your editor. In this demo, we introduce a bug, let CI catch it, and watch the agent diagnose and fix it autonomously through a full green pipeline. No manual log hunting required.
Golden paths: how to ship securely without slowing developers
The secure path and the easy path should be the same path. Ralph McTeggart (Principal Engineer), Alex Franzmann (Customer Onboarding Team Lead), and Claire McDyre (Product Manager) at Cloudsmith lay out how platform teams can deliver supply chain security as a capability rather than a checklist. The argument runs from first principles: make a private registry the default, automate policy enforcement at the global level, and extend that same logic to compliance – so SBOM generation happens in the pipeline, not as a developer's manual task.
What is an AI sandbox? A developer's guide
An AI sandbox is an isolated environment where code from an AI coding agent runs without direct access to your machine or your production systems. If the agent runs a destructive command or a mistaken script, the damage stays contained inside the sandbox. Developers use AI sandboxing to let agents execute code freely while keeping the host and its credentials out of reach.
Supply chain hit: the first hours are about "am I affected?"
The first two to three hours after a supply chain compromise aren't about remediation – they're about figuring out whether you're affected at all. That requires two things: a feed of compromised packages you can cross-reference against what you're using, and an audit trail showing which developers pulled which packages and when. Teams that can answer "are we affected?" in 30 minutes have that data pre-built into their platform. Teams that don't are still piecing it together at hour three. Protect your supply chain with Cloudsmith.
The Hidden Cost of Validating AI-Generated Code
For a 50-developer team operating at agentic pace, validation-related delivery costs can approach $900K a year.
What is a remote MCP server?
As development shifts toward agentic workflows, an AI agent is only as capable as the systems it can reach. Local MCP servers allow desktop CLI and IDE agents to execute multi-step tasks on your machine. But remote MCP servers (also called hosted MCP servers) extend that reach to cloud-based and background agents, allowing an agent running in a web browser, a CI runner, or a backend service to access external tools over HTTP without needing a developer’s machine running local child processes.