Qwen‑3.8‑Max ran autonomously for 16 days, creating the ‘oh‑my-cli’ tool from scratch. It generated 265 commits, opened 127 pull requests, and closed 151 issues, with a full audit trail visible on GitHub. The demo proves large‑scale AI agents can produce production‑ready code while staying transparent.
The New Stack argues that while LLMs like Claude, Gemini, and GPT‑5 can technically generate code, tests, and docs, handing them every software‑delivery task is a recipe for cost overruns, governance headaches, and fragile systems. Treat AI as a modular supply chain, dedicated models for planning, coding, testing, validation, compliance, and governance.
Cloudflare released the Flue‑based triage bot that cut Astro’s open GitHub issues from over 200 to under 30, on track for zero, the first time in five years. The tool runs as GitHub Actions, reproduces, diagnoses, and verifies bugs automatically, and is now available for anyone to adopt.
HashiCorp just opened public beta on vault‑kube‑kms, a KMS‑v2‑compatible plugin that lets the Kubernetes API server delegate envelope encryption to Vault Enterprise. By moving the key‑encryption keys out of etcd into Vault’s trust domain, clusters get centralized key management, auditability and easier key rotation. The feature is ready for any supported Kubernetes version but remains beta‑only.
Instead of CPU or memory, KEDA watches Amazon SQS queue depth and drives the HPA for worker pods on EKS. The article walks through installing KEDA via Helm, configuring pod‑identity, and tuning queueLength and cooldowns, so you can scale out instantly during spikes and shrink back when the backlog disappears.
Traditional SLOs track latency and error rates, but they can’t verify that an AI agent delivered the right business outcome. Because identical inputs now produce varied outputs, teams must add layers for inference reliability and behavioral correctness, treating decision points as the core observation unit and assigning separate error budgets.
Attackers compromised the maintainer of the popular keyv library, used stolen tokens to push signed malicious releases, and now the worm is infecting over 1,280 npm packages that together see more than 2 billion installs each month. It silently harvests GitHub, AWS, Kubernetes, Slack and other secrets, spreading to fresh packages every few minutes.
Amazon Threat Intelligence traced compromises of npm packages axios, debug, chalk and typo‑crypto to a DPRK‑linked group known as Sapphire Sleet (also BlueNoroff). The actors socially engineered maintainers to publish malicious updates, so any system auto‑updating these libraries could be infected. This shows a state‑backed supply‑chain risk for millions of apps that rely on open‑source code.
Chris Richardson shows how a platform built on Team Topologies lets development teams skip plumbing and focus on domain logic, cutting the overhead of microservice pattern implementation. He outlines six concrete platform patterns that turn microservice chaos into a faster, more reliable delivery pipeline.
You’re caught up.
That was all 9 stories in the 4 August issue.