DevOps · Monday, 24 August 2026 · Issue 82 · 7 stories

AI agents ship code, but can we trust them

The tool meant to contain risk just made a five-hour outage worse. And Roblox is betting AI agents can ship code without human review. Trust in automation has never been more fragile.

CI/CD & Automation

Roblox's "Prompt to Prod" lets AI agents ship code with zero human review

We've solved typing, but not trust. That's the paradox Roblox engineer Andrew Swerdlow names in this talk: the company is pushing autonomous agents to carry a feature from a natural-language prompt all the way into production, unassisted. Concretely, that means security-sandboxed AI-driven pull requests, automated review, and agents capable of re-architecting an entire codebase. The hard problem isn't generating code anymore, it's digesting and trusting machine-authored changes at scale without 3am incident calls.

infoq.com ↗40 min read at source

Coding agents bottom out at refactoring: best score on new benchmark is 41%

Most coding-agent benchmarks skip refactoring, so researchers built SWE-Bench ProMax: 170 expert-curated instances from real commits across seven languages, averaging 11.4 changed files per task. On that scale, the best frontier model resolves just 41.2%, a signal that behavior-preserving, multi-file refactoring is still out of reach for current agents.

arxiv.org ↗2 min read at source

Containers & Orchestration

Docker's new sbx runtime walls AI agents off in microVMs with per-sandbox egress policy

Docker Sandboxes (sbx) is Docker's new isolation runtime: instead of plain containers, coding agents run inside microVMs with hardware-enforced separation and per-sandbox controls on files, network access, and secrets. It's already a supported agent runtime in GitHub Agentic Workflows and ships via yolo-mode defaults plus release candidate and nightly builds. The login-gated egress rules users are hitting are the intended policy layer, not a bug, the trade for handing agents a wide-open blast radius.

docker.com ↗8 min read at source

Observability & Reliability

Azure's 5-hour West US outage: when a blast-radius tool makes things worse

A routine optical-device repair in Azure West US spiraled into a five-hour regional outage, disconnecting the datacenter from the internet. The post-mortem's most bitter irony: a latent defect in Azure's blast-radius analysis system widened the scope to every device egressing the datacenter, the tool meant to contain risk amplified it. Safety validation then passed because it checked devices individually, never the aggregate effect of isolating them all at once. Meanwhile links and routes kept reporting healthy, masking the connectivity break as a WAN anomaly. A sharp anatomy of how safeguards backfire.

surfingcomplexity.blog ↗4 min read at source

Cloud & Platform Engineering

Spinifex runs the AWS API surface on your own hardware, air-gapped

Spinifex, from defense startup Mulga, rebuilds the AWS service surface (EC2, EBS, S3, VPC, IAM, even EKS and ECR) on infrastructure you control. Because it speaks native AWS APIs, the same Terraform, CLI, and SDKs run unchanged. The pitch: cloud-native and AI workloads keep operating through disconnection, with no phone-home and no external control plane. It is an AGPL-3.0 open core aimed at edge and contested sites.

github.com ↗8 min read at source

Founder of a "tested Terraform module" marketplace says its own tests were faked

The creator of iac-bazaar.com, a paid catalog of publish-gated "live-tested" Terraform, OpenTofu and Ansible modules, caught their own tooling faking the very verification behind each listing. It's a bracing reminder that "tested" and "verified" badges are only as trustworthy as the harness that produced them. Teams pulling community IaC should treat validation claims as unverified until they reproduce the checks themselves.

iac-bazaar.com ↗2 min read at source

DevSecOps

Wiz's AI agent found the Snowflake CI/CD flaw Copilot missed, inside Jira in days

Wiz's autonomous "Red Agent" found a GitHub Actions injection in Snowflake's snowflake-connector-net that let any unauthenticated user run arbitrary commands on a runner by opening an issue with a crafted title. The exfiltration reached Snowflake's internal Jira, and the vulnerable PR passed GitHub Advanced Security's Copilot-assisted scans untouched. Live only five days before disclosure, it's a stark warning: the AI-written CI/CD flaws nobody has found yet may outrank the ones we know about.

wiz.io ↗5 min read at source

You’re caught up.

That was all 7 stories in the 24 August issue.