Tag

#open-source

Tagged “open-source”

8 articles

AWS releases Dogwood, an open-source policy language for the tool-call sequences agents run

AWS has published Dogwood, an open-source policy language and reference interpreter that governs sequences of AI-agent tool calls. The pitch is catching actions that are individually valid but wrong in context, and for pipelines that hand agents commit or deploy rights that is a new place to hang guardrails.

Aug 11, 2026 · Maya Okonkwo Supply-chain security

RapidFort points its hardened open-source business at what actually runs in production

At Black Hat USA, RapidFort announced RapidFort Runtime, a read-only monitor for the production environments that consume its curated open-source packages. For CI/CD teams the pitch targets the long-standing measurement gap between what a pipeline shipped and what is executing in the cluster.

Aug 10, 2026 · Maya Okonkwo Security & supply chain

CISA's new OSS guidance puts a four-letter scoreboard next to every dependency you ship

The CISA report 'Open Source Software: Security Principles and Practices' argues open source can be as safe as proprietary software, provided consumers score each component against a C4 framework (Codebase, Community, Conduct, Configuration). For any CI/CD team selling into regulated buyers, that scoreboard is going to arrive as an audit checklist.

Aug 3, 2026 · Tomás Vega Security & supply chain

xAI publishes Grok Build's source after the coding agent was caught siphoning SSH keys

Three days after a researcher demonstrated the Grok Build CLI silently uploading SSH keys and repository contents to xAI's cloud, xAI dropped the agent's full source on GitHub under Apache 2.0. The code is now inspectable. The trust model is a different question.

Jul 21, 2026 · Tomás Vega Security & supply chain

Kubernetes will let you write patches with AI. It will not let you hide it.

The Kubernetes project published an AI contribution policy on June 26, 2026 that bans AI co-author trailers, requires PR descriptions to disclose generative-AI assistance, and tells maintainers to close PRs whose authors cannot explain the code in person. For any project taking community patches, it is a usable template.

Jun 30, 2026 · Tomás Vega Security & supply chain

Cilium publishes its CI hardening playbook, gaps and all

The Cilium project's third post in its CI/CD hardening series walks through how it manages credentials and verifies what it ships, then lists the parts it has not fixed yet. The unusual move is publishing the unfinished work.

Jun 26, 2026 · Tomás Vega Platform engineering

Cursor acquires Continue and gives its users a July 15 export deadline

Cursor has bought the open-source AI coding assistant Continue in a quiet acqui-hire that disables recurring billing and sets a July 15 data-deletion date. The Apache 2.0 code stays forkable; the hosted product does not.

Jun 24, 2026 · Maya Okonkwo Security & supply chain

The 'OSS ingredients are basically safe' assumption just got a 52,000-package counter-example

Chainguard says it scanned 52,000 open-source packages used by AI-generated and 'vibe-coded' applications and concluded the long-running default, that the ingredients are safe to assume trustworthy, no longer holds. For CI/CD owners, that pushes dependency scrutiny upstream of the build.

Jun 16, 2026 · Tomás Vega