Hey {{first name | there}}. AI is writing more code, but that doesn't mean the workaround is going away. And giving it access to your repositories comes with risks.
This week, hackers used stolen GitHub accounts to plant credential-stealing workflows in thousands of repositories. Meanwhile, Chainguard is building safer environments for AI coding agents, and Anthropic is giving outside researchers deeper access to its safety practices.
In today’s roundup:
Claude rewrites TypeScript in Rust for $24,000
How hackers targeted 30,000 GitHub repositories
Why Chainguard wants to change how AI code gets tested
Anthropic gives independent researchers access to its safety work
Is AI a tool, or just automation?
LATEST DEVELOPMENT
🧠PRESENTED BY EVERYTHINGDEVOPS
A developer pushes some code, and a few hours later, it’s running in production. How does it get there without someone manually handling every step?
That’s where CI/CD comes in. But passing your tests doesn’t guarantee your release is safe.
This video breaks down how CI/CD pipelines work, the difference between continuous integration and continuous delivery, and how rolling, blue-green, and canary deployments help teams release changes with less risk.
It also covers the tools involved and what happens when a release goes wrong.
Subscribe: @EverythingDevOpsHQ for deeper dives on agents, Kubernetes, MLOps, and AI infrastructure.
Image source: TheRegister
The Rollout: Developer and YouTuber Theo Browne used AI agents to rewrite Microsoft’s TypeScript compiler in Rust, mainly to see if they could pull it off. The result passes almost all of TypeScript’s conformance tests. The surprising part? Browne says he hasn’t even read the code himself.
The details:
An earlier attempt using OpenAI’s GPT-5.6 Sol and GPT-6 Astra spent $400,000 on tokens but got stuck at around 84% accuracy. Claude Opus 5.5 completed a working version for roughly $24,000.
Claude took a different approach. Instead of translating the original TypeScript compiler directly into Rust, it rewrote Microsoft’s Go version. It also carried over some bugs from that version, which Browne only discovered after someone else pointed them out.
According to Browne, the Rust version runs twice as fast as Microsoft’s Go version and 12.5 times faster than the original TypeScript version.
Why this matters: A faster compiler could make AI-powered development environments cheaper to run. Rust can run without a garbage collector, which could let the compiler run inside Google’s V8 JavaScript engine without a separate virtual machine or container. Cloudflare already uses V8 to isolate workloads.
Image source: The Newstack
The Rollout: Hackers used stolen GitHub accounts to plant workflows that steal credentials in more than 30,000 repositories. The GhostAction campaign targeted CI/CD secrets, cloud credentials, and AI provider API keys, putting software pipelines and connected systems at risk.
The details:
GitGuardian tracked the campaign’s biggest push on October 8 and 9, when attackers targeted roughly 28,000 additional repositories.
Malicious GitHub Actions workflows searched code and Git history for credentials, including AWS keys and OpenAI, Anthropic, and OpenRouter API tokens.
GitHub blocked most malicious workflow runs, but some executed and sent stolen credentials to an attacker-controlled server.
Why this matters: Removing a malicious workflow doesn't necessarily secure a repository. Credentials can remain exposed in Git history, and tokens may still be valid after the attack. Teams should investigate workflow changes and execution logs, revoke compromised access, and rotate any potentially exposed secrets.
Image source: InfoQ
The Rollout: Chainguard has launched two beta products to help developers run AI-generated code more safely. Workspaces provides isolated environments for coding, while Checks lets developers and AI agents test code without waiting for traditional CI pipelines.
The details:
Workspaces runs code in isolated virtual machines, keeping agents away from a developer’s local environment and sensitive credentials.
Checks runs tests in separate environments and returns failure logs to AI agents, allowing them to fix problems and try again.
Both products are available for 30-day beta trials. Workspaces currently support Claude, with other AI agents planned.
Why this matters: AI coding agents need to run commands, install packages, and test changes, which can expose company systems to security risks. Chainguard aims to give developers and agents a safer environment to work in while reducing delays caused by traditional testing pipelines.
Image source: TechCrunch
The Rollout: Anthropic is giving six researchers from AI safety nonprofit METR employee-level access to assess its models, safety practices, and risk management independently. The researchers can publish their findings without Anthropic’s approval, subject to limited redactions.
The details:
METR researchers will use Anthropic laptops, office space, and internal tools, with access comparable to the company’s own risk assessment teams.
Anthropic can request redactions for limited categories, including customer data and legally privileged information, but cannot veto publication.
METR is the first evaluator in Anthropic’s highest oversight tier, which provides the broadest access to the company’s internal systems and practices.
Why this matters: AI companies are facing growing scrutiny over agents acting beyond their instructions. Giving independent researchers deeper access could help reveal risks that internal reviews miss. The arrangement also tests whether AI companies can allow meaningful outside scrutiny while protecting sensitive information.
Image source: EverythingDevOps
The Rollout: AI is helping software developers do more than write code. As AI takes on more implementation work, the value of human judgment, system design, and reliable delivery becomes more apparent. Recent job posting data offers an interesting glimpse into this shift.
The details:
Indeed data shows U.S. software development job postings rose nearly 15% from late February 2025, even as overall postings fell 7%.
Senior roles accounted for 71% of the increase in software development postings between May 2025 and May 2026. AI-related roles accounted for 37%.
AI can generate code and tests, but engineers still need to check requirements, manage risks, secure systems, and ensure software works reliably.
Why this matters: AI could help engineering teams tackle work that has long been delayed by limited time and resources. Faster coding alone won't guarantee better software. Teams still need people who can make sound technical decisions, verify results, and ensure changes are safe to deploy.
QUICK LINKS
📅EVENTS
🇪🇺 🇬🇧Europe
Title | Date | Location |
October 19 | John McIntyre Conference Centre, The University of Edinburgh | |
October 22 | Warsaw, Poland | |
October 20–23 | Palacio de Congresos, Valencia, Spain |
🇺🇸🇨🇦North America
Title | Date | Location |
October 20-21 | San Jose, CA | |
October 21 | SFJAZZ Center, San Francisco, CA |
🇳🇬Africa
Title | Date | Location |
October 23–24 | Ho, Volta Region, Ghana | |
October 24 | Lagos, Nigeria |
🌎Asia
Title | Date | Location |
October 24 | Istanbul |