Tag

#open-source

Tagged “open-source”

5 articles

xAI publishes Grok Build's source after the coding agent was caught siphoning SSH keys

Three days after a researcher demonstrated the Grok Build CLI silently uploading SSH keys and repository contents to xAI's cloud, xAI dropped the agent's full source on GitHub under Apache 2.0. The code is now inspectable. The trust model is a different question.

Jul 21, 2026 · Tomás Vega Security & supply chain

Kubernetes will let you write patches with AI. It will not let you hide it.

The Kubernetes project published an AI contribution policy on June 26, 2026 that bans AI co-author trailers, requires PR descriptions to disclose generative-AI assistance, and tells maintainers to close PRs whose authors cannot explain the code in person. For any project taking community patches, it is a usable template.

Jun 30, 2026 · Tomás Vega Security & supply chain

Cilium publishes its CI hardening playbook, gaps and all

The Cilium project's third post in its CI/CD hardening series walks through how it manages credentials and verifies what it ships, then lists the parts it has not fixed yet. The unusual move is publishing the unfinished work.

Jun 26, 2026 · Tomás Vega Platform engineering

Cursor acquires Continue and gives its users a July 15 export deadline

Cursor has bought the open-source AI coding assistant Continue in a quiet acqui-hire that disables recurring billing and sets a July 15 data-deletion date. The Apache 2.0 code stays forkable; the hosted product does not.

Jun 24, 2026 · Maya Okonkwo Security & supply chain

The 'OSS ingredients are basically safe' assumption just got a 52,000-package counter-example

Chainguard says it scanned 52,000 open-source packages used by AI-generated and 'vibe-coded' applications and concluded the long-running default, that the ingredients are safe to assume trustworthy, no longer holds. For CI/CD owners, that pushes dependency scrutiny upstream of the build.

Jun 16, 2026 · Tomás Vega