Hey {{first name | there}}. This issue is about who does the building, who checks the work, and what happens when agents start taking on more of both.
NVIDIA's CEO thinks junior engineers have a limited window. Microsoft spent $120,000 getting an agent to port a runtime to Rust, then had to deal with what the rewrite broke. And a leaked GitLab address shows how one small oversight can give people access to your code.
In today's roundup:
Jensen Huang's two year prediction for junior engineers
Microsoft's $120K Rust port and the regressions it introduced
AWS makes building an AI agent almost a one-line job
A messaging app built around agents as coworkers
The GitLab address that exposes commit and CI access
LATEST DEVELOPMENT
🧠PRESENTED BY EVERYTHINGDEVOPS
Companies cut staff in the name of AI, then started hiring some of those same people back. The problem wasn't always the technology. Sometimes it was what happened when companies removed the people who understood how their systems actually worked.
This video breaks down the three reasons these AI experiments went wrong, from hidden costs and buggy code to the loss of experience that automation couldn't replace.
It also looks at the uncomfortable truth behind many AI layoffs: how much was genuine automation, and how much was ordinary cost cutting with a better press release?
Subscribe: @EverythingDevOpsHQ for deeper dives on agents, Kubernetes, MLOps, and AI infrastructure.
The Rollout: Nvidia CEO Jensen Huang rejects the idea that AI writing most code means the industry stops needing software engineers. Asked what happens to juniors entering the field now, he said, "wait two years," arguing AI-native graduates will arrive around 2028 as a wave of stronger engineers.
The details:
His framing separates a job's purpose from its tasks. Engineering, inventing products and solving problems, existed before code and survives it; the lower-level task work is what AI absorbs.
He treated the recent OpenAI-agents-hacking-Hugging-Face incident as a containment problem, not something new: "software breaks out of sandboxes all the time," which is why you need watchdogs and VMs.
He noted Nvidia already spends 80% of engineering effort on verification and 20% on design, and expects that split to spread as agents write more of the code.
Why this matters: The gap in Huang's timeline is the apprenticeship. Junior devs traditionally build judgment through task work, reading stack traces, chasing bugs, resolving conflicts, which agents now absorb. A Stanford study already shows employment of 22-25-year-olds in AI-exposed roles running 19% below trend. If that early-career work disappears faster than universities replace it, the industry gets better agents but fewer engineers able to check them.
The Rollout: The runtime behind GitHub Copilot and a growing list of Microsoft products is now written entirely in Rust, with AI agents doing most of the porting. The job cost about $120,000 in tokens plus roughly three weeks of a developer's time, and produced dozens of regressions along the way.
The details:
Agents converted 430,000 lines of TypeScript into 800,000 lines of production Rust, module by module, across 135 releases over 14.5 weeks, at about 1.3 port pull requests per day.
On one benchmark, the Rust runtime ran 15.9x faster than the TypeScript version, and a 10-client agent batch used 126 MB of memory against 1,383 MB before.
The agents spent far more time investigating than writing code, and spawned child sessions that messaged each other to coordinate. One 30,000-line file took 25 hours and 15 child sessions.
Why this matters: A production port that would have taken years by hand happened in about three months, which shows how far agent-driven migration has come. The speedup and memory gains are the payoff; the dozens of regressions are the reminder that a clean compile is not the same as a correct program.
The Rollout: AWS has added a harness to Strands, the open-source SDK it introduced last year for building AI agents. The harness is a fully assembled, customizable agent that developers can use as a foundation, rather than wiring together the primitives themselves.
The details:
It bundles shell, file, and web tools the model can reason across, auto-loads any provided skills, keeps long-term memory across runs, and resumes an earlier conversation from a session ID.
It delegates open-ended subtasks to a built-in helper agent and tracks multi-step workflows with a checklist.
A context-window feature offloads bulky tool results to files and reusable caches, which AWS says can cut token consumption by as much as 28%.
Why this matters: As building an agent gets closer to one line of code, the work shifts from building to operating, deploying, observing, and proving an agent did what it was asked. One analyst notes the harder scaling problem ahead: organizations may soon run thousands of agents that all need deploying and continuously updating, which most existing engineering workflows were not designed for. Preparing for that operational load is the real task.
The Rollout: Ando came out of stealth with a team messaging platform designed for both human and AI workers, pitched as a full replacement for Slack. Founder Sara Du's premise is that Slack and Teams treat agents as installed apps, when they are becoming participants on the team. It raised $20 million in pre-seed and seed funding.
The details:
Agents get their own identities and inboxes and join channels, DMs, group chats, and transcribed live calls. They can browse channels, pick which to join, and enter conversations without being tagged.
The goal is to remove what Du calls "meat proxies," the human who relays an agent's work to everyone else. An agent that thinks a person needs to know something can message them directly.
Du says agents did more than expected; one noticed two channels discussing the same problem and, unprompted, pulled everyone into a group chat with context and a suggested decision.
Why this matters: The bet is that agent-native messaging beats bolting agents onto tools built for humans, and Ando is not alone; Slack, Microsoft Teams, and Jack Dorsey's Buzz are chasing the same idea. The open question is whether teams want agents acting this autonomously in their comms, messaging people unprompted and joining conversations on their own, or whether incumbents' network effects make a standalone app a hard sell.
🧠PRESENTED BY EVERYTHINGDEVOPS
Companies cut staff in the name of AI, then started hiring some of those same people back. The problem wasn't always the technology. Sometimes it was what happened when companies removed the people who understood how their systems actually worked.
This video breaks down the three reasons these AI experiments went wrong, from hidden costs and buggy code to the loss of experience that automation couldn't replace.
It also looks at the uncomfortable truth behind many AI layoffs: how much was genuine automation, and how much was ordinary cost cutting with a better press release?
Subscribe: @EverythingDevOpsHQ for deeper dives on agents, Kubernetes, MLOps, and AI infrastructure.
The Rollout: The private email address GitLab gives you for filing issues by email is a credential. Anyone who obtains it can email a patch that GitLab commits in your name to any branch you can push to, including main, and can start CI/CD jobs that run as you. Security firm Aikido reported the behavior.
The details:
By switching the address suffix from -issue to -merge-request, a holder can open a merge request, attach a patch, name a target branch in the subject, and GitLab applies it as a commit authored by you, creating the branch if needed.
If the patch edits .gitlab-ci.yml and your role permits, GitLab runs the attacker's job as you. The token does not expire, GitLab does not check who sent the email, and it covers every project your account can open.
Incoming email is exempt from IP allowlists and skips 2FA. Aikido locked a project to one IP, GitLab refused a browser and git clone, but accepted the email, and the commit landed on main.
Why this matters: The damage scales with the victim's role; a Guest's address is near-useless, a Maintainer's reaches protected branches and CI/CD secrets. The fix is to reset your incoming email token, which rotates every project address at once, and to check your own READMEs and contributing guides, since Aikido found around a dozen live addresses posted publicly as bug-report contacts. GitLab treats this as a normal leaked credential and has not changed the behavior.
QUICK LINKS
📅EVENTS
🇪🇺 🇬🇧Europe
Title | Date | Location |
30 September - 1 October 2026 | Convene Sancroft, St. Paul's, London | |
September 30 - October 2 | TAP1, Copenhagen |
🇺🇸🇨🇦North America
Title | Date | Location |
September 28 - October 2, 2026 | New York Marriott at the Brooklyn Bridge | New York and Online | |
September 29, 2026 | Trade Centre Office Tower |
🌎Asia
Title | Date | Location |
September 26-27 | Nimhans Convention Center, Bengaluru |
🇳🇬Africa
Title | Date | Location |
October 24 | Lagos, Nigeria |