Fully automated CI/CD pipelines let a slice of commits flow to production without a human eyeball. The New Stack outlines how to shift from code review to a ‘human‑on‑the‑loop’ factory model, using AI agents, automated verification, and domain‑specific harnesses. Teams that master the first 1 % can cut bottlenecks and scale delivery.
Microsoft unveiled a three‑layer reference architecture for routing AI‑agent traffic on Azure Kubernetes Service. It selects the appropriate LLM per call, applies policy and auth via an OpenAI‑compatible gateway, then routes to the optimal GPU replica, letting cheap self‑hosted models handle simple steps while reserving Azure OpenAI for complex reasoning. The design cuts cost and latency while staying fully observable.
Perplexity built SPACE, a sandbox platform that lets AI agents pause, resume, and fork sessions that run for days or weeks, using Firecracker microVMs and Btrfs snapshots. The approach yields three‑plus times faster performance and lower costs, making large‑scale, stateful AI assistants practical.
Linkerd’s multicluster extension can run federation, flat mirroring, and gateway mirroring together across three GKE clusters. The setup presents a service as a single load‑balanced endpoint, so when any cluster disappears traffic instantly shifts to the remaining pods, achieving zero‑downtime failover. All scripts are in the companion GitHub repo.
Terraform's AzureRM provider 5.0 stops auto‑registering dozens of Azure Resource Providers, letting ops teams dictate exactly which services are enabled. It also introduces optional preflight validation and strips deprecated resources, creating a leaner, faster provider that readies Azure for upcoming services. The changes cut startup friction and tighten subscription permissions.
The team used a pull‑based migration where every new feature or fix was delivered as a new domain service, avoiding changes to the monoliths. Key platform investments, self‑service provisioning, an API gateway, and a feature‑flag layer, kept cost low and ensured data durability for payroll workloads.
NanoClaw has partnered with Echo to ship a hardened agent runtime that secures the browser, tools, and libraries agents use, closing the two‑way attack surface exposed by the Hugging Face breach. The open‑source runtime is now on GitHub, giving developers a vetted, auditable environment for AI agents.
The guide details Traefik Hub’s “Triple Gate” defense‑in‑depth model for MCP gateways, combining On‑Behalf‑Of token exchange, fine‑grained task‑based access, and gateway‑level policy enforcement. By delegating identity and restricting privileges, it eliminates a single point of compromise and ensures agents can only act within their own permissions.
AGT provides a language‑agnostic library for policy enforcement, identity management, and tamper‑evident audit logging for autonomous AI agents, supporting Python, TypeScript.NET, Rust, Go, and integrates with popular agent frameworks. It lets teams restrict tool usage, attribute actions to specific agents, and produce immutable logs, addressing governance gaps as agents act independently.
PortSwigger’s new Burp AT adds a deterministic control layer that forces every AI‑driven testing action through scope, permission and approval checks, letting human pentesters stay in the loop. By sandboxing the agentic model, the company aims to harness AI creativity without risking uncontrolled exploits in production environments.
AI models are now surfacing vulnerabilities at a tidal‑wave pace, Broadcom’s Spring team saw community reports jump from seven a month to 112 in April, plus 370 internal findings. That explosion forces DevSecOps teams to depend on vendor‑supplied support and rapid curation to stay secure.
You’re caught up.
That was all 11 stories in the 29 July issue.