The npm Attack That Turned Provenance Attestations Into Camouflage
The August 2026 npm worm compromised packages with 150M+ weekly downloads by publishing from legitimate GitHub Actions runners — making valid provenance attestations a false safety signal.
Shadow AI in CI/CD: The Six-Stage Threat Model from Laptop to Kubernetes
CNCF maps six attack surfaces where unapproved AI agents gain privileged access in the software pipeline — every enterprise has at least one gap, and CI credentials are the target.
AWS Kiro's Agent Client Protocol: The LSP Moment for AI Coding Agents
AWS rebuilt Kiro around the Agent Client Protocol, separating coding agents from editors. Here's why this LSP-like shift matters for platform teams.
Anthropic Says: One Worktree Per Agent. Your Infrastructure Says: Not So Fast.
Anthropic recommends one git worktree per agent. That solves the file layer — but platform teams running multi-agent workflows still face runtime collisions.
Bedrock AgentCore Runtime Instances: Persistent Compute for Production AI Agents
AWS launched runtime instances in Bedrock AgentCore — managed EC2 infrastructure with GPU support, multi-agent collaboration, and sessions lasting up to 14 days for long-running agent workflows.
DynamoDB Now Supports Vector Search: No Separate Database Required
Amazon DynamoDB added native vector search with single-digit millisecond latency, 99%+ recall, and support for trillions of vectors — eliminating the sync pipeline that separate vector DBs require.
AWS IaC MCP Server: What CloudFormation Development Looks Like with Unified AI Tooling
AWS's IaC MCP Server consolidates CloudFormation documentation search, syntax validation, compliance checking, and runtime troubleshooting into one conversational interface. Here's what that workflow change actually delivers.
OpenCost 1.121.0: Now You Can See What Your Self-Hosted AI Models Actually Cost Per Token
OpenCost's new inference cost tracking shows the real per-token cost of running models on Kubernetes — including the KV cache effect and why low utilization makes self-hosting more expensive than it looks.
5 AWS Updates That Matter This Week: Bedrock Price Cuts, Prometheus, IAM
AWS cut Bedrock GPT-5.6 pricing up to 80%, shipped managed Prometheus collectors for CloudWatch, and added multi-region IAM Identity Center — here's what to actually act on.
Why Queue Depth Beats CPU as a Kubernetes Autoscaling Signal
KEDA's SQS-based autoscaling replaces CPU and memory metrics with queue backlog — the metric that actually reflects whether an event-driven workload is under load.
Admission Webhooks Have a Bypass Problem — Runtime Verification Fixes It
A new NRI plugin moves supply chain verification below the Kubernetes API server, closing the static-pod and kubelet-bypass gaps that admission webhooks like Kyverno and OPA Gatekeeper can't cover.
AWS DevOps Agent + Wiz: Same Alert, Three Different Incidents
AWS DevOps Agent now queries Wiz over MCP mid-investigation, turning an ambiguous CPU spike into a confirmed security incident, an operational fix, or a coverage gap.
The Practical Guide to EC2 Image Builder and AWS CDK for Studio-Scale AMI Management
Company 3's post-production teams eliminated custom-resource workarounds for AMI versioning by adopting EC2 Image Builder auto-versioning and CDK L2 constructs.
AWS's Latest Roundup Is Really About De-Risking Agents in Production
Local Zone latency in Athens, zero data retention for Claude Opus 5, and a year-long pause window for Lambda workflows — three AWS releases with one thread: agent compliance.
The Framework for Zero-Downtime Kubernetes When a Whole Cluster Dies
Linkerd's multicluster extension turns cluster failure from a runbook into an automatic rebalance — three federation modes, chaos-tested, for $10-15/day.
Pilot Protocol Wants to Be the Network Layer AI Agents Never Had
Pilot Protocol launched a UDP-level networking stack for AI agents — with 219,000 agents already running, native wallets, and no API keys required.
AWS, Azure, and Google Cloud All Built Agent Sandboxes — None the Same Way
Every major cloud now treats isolated code execution as a native primitive for AI agents, but AWS, Google Cloud, Azure, and Cloudflare picked four different isolation boundaries.
CloudFormation's Custom Resources Have No Failover Story. AWS Just Wrote One.
AWS's reference architecture for multi-region CloudFormation custom resources solves duplicate execution and failover gaps native CloudFormation was never built to handle.
Your Personalization Problem Is an Architecture Problem, Not a Model Problem
Vespa's case for real-time personalization: most teams don't have a ranking-quality problem, they have a retrieval-then-rank pipeline that can't act on signals until it's too late.
Kubeflow + Cilium: Why Your GPUs Sit 60% Idle
GPUs sat at 40% utilization while fully scheduled: a hidden Cilium network policy was silently blocking Kubernetes gradient sync.
Pelago Shipped a Serverless AI Care Assistant in Two Weeks
Pelago used AWS Lambda, Bedrock, and DynamoDB to ship a HIPAA-compliant AI care assistant in two weeks, cutting coach response time 40% via serverless design.
Kubernetes Didn't Fix Databases. It Just Hid the Problem
Kubernetes makes deploying Postgres trivial, but a failed failover can corrupt data in minutes. See why platform teams, not app teams, must own database ops.
The Quorum Math Behind Multi-Cluster Kubernetes Databases
CNCF's architecture guide shows multi-cluster Kubernetes databases survive regional failure on vote count, not node count: an odd, cross-cluster quorum design.
Platform Engineering's Next Job: Managing AI Agents Like Any Other Workload
CNCF's case for the agentic enterprise: platforms must treat AI agents as first-class citizens alongside applications and resources, with shared context as the new primitive.