Hey {{first name | there}}. AI is finding its way into more of the tools developers use, from coding assistants to systems that can manage work independently.
But as these tools become more capable, questions about security, infrastructure, and how we build software are becoming harder to ignore. This week's stories offer a look at some of those changes.
In today’s roundup:
CNCF report finds 75% of cloud-native developers use AI.
A 14-year-old builds a team of AI agents.
LinkedIn replaces Argo CD with a custom GitOps engine.
Hugging Face warns cyberattacks threaten open-source AI.
4,837 hijacked GitHub accounts used in a CI secret-stealing attack.
LATEST DEVELOPMENT
🧠PRESENTED BY EVERYTHINGDEVOPS
You could memorise 40 Linux commands and still struggle when something goes wrong on a server. The real skill is knowing how to put them together.
In this video, Divine breaks down some of TechWorld with Nana’s most useful Linux commands using a real-world scenario: tracking down errors across months of application logs.
You’ll see how find, grep, sort, uniq, and xargs work together to turn hundreds of log lines into a much shorter list of distinct errors. He also covers useful commands for counting, comparing files, managing permissions, and backing up data.
It’s a practical walkthrough of Linux skills you’ll keep reaching for in DevOps.
Subscribe: @EverythingDevOpsHQ for deeper dives on agents, Kubernetes, MLOps, and AI infrastructure.
Image credit: TLF
The Rollout: CNCF's Q3 2026 report, released with SlashData, finds that 75% of cloud-native developers use AI to write code, compared with 50% of developers outside the cloud-native ecosystem.
The details:
The report estimates 21.2 million cloud-native developers, representing 41% of the global developer population.
CNCF Executive Director Jonathan Bryce says cloud-native developers are drawn to AI to experiment with new technologies and gain a career edge.
CNCF is expanding its project ecosystem, with tools such as KubeRay, Agent Substrate and OpenShell entering the sandbox, while KubeVirt, Karmada and Kubeflow graduate.
Why this matters: AI adoption is particularly strong among cloud-native developers, but the report also points to a growing ecosystem of open-source tools supporting that work. As Bryce argues, understanding open-source technologies gives organisations more options and leverage.
Image credit: The Register
The Rollout: Austrian teenage developer Stanislaus Hees has built Autark, an open-source tool that lets AI agents operate like a virtual team. A manager agent assigns tasks to other agents, which work independently, report results, and ask questions when instructions are unclear.
The details:
Autark supports coding agents including OpenAI Codex, Claude Code, Gemini CLI, and GitHub Copilot CLI, as well as local models.
Agents can wake up in response to scheduled tasks, messages, timers, and other events, then decide what to work on next.
The tool has no sandboxing or technical permission gates. Agents can access files, repositories, and credentials available to the machine's user.
Why this matters: Autark offers an interesting glimpse into AI systems that manage ongoing work rather than simply respond to prompts. But its lack of technical safeguards makes unrestricted access risky, particularly on machines containing sensitive files or credentials.
The Rollout: LinkedIn replaced Argo CD for application deployments with an internal GitOps engine that manages 100,000+ deployments weekly across 250+ Kubernetes clusters and 4,000 services.
The details:
Deployment infrastructure failures fell from 925 to 63, despite a 3.7x increase in deployment volume.
The new engine runs each deployment in an isolated, temporary pod, avoiding the shared controller state that caused scaling problems with Argo CD.
Median time to detect and conclude a failed deployment dropped from 16.1 minutes to 2.45 minutes.
Why this matters: LinkedIn's experience shows that tools designed for general-purpose deployments can encounter architectural limits at massive scale. Its solution offers useful lessons for platform teams dealing with Kubernetes performance, deployment reliability, and operational complexity.
Image credit: TechCrunch
The Rollout: Hugging Face's policy chief, Irene Solaiman, warns that growing cyberattacks against open AI platforms could force companies to restrict access and participation. Recent incidents involving OpenCode, Hugging Face, and AI infrastructure provider Fireworks highlight the security risks.
The details:
Attackers have targeted valuable assets including third-party API keys, model weights, datasets, and billing information.
Hugging Face is strengthening monitoring, rotating administrative access tokens more frequently, and tightening network controls.
Possible industry responses include stricter identity checks and limits on who can upload models or datasets, potentially excluding independent developers and hobbyists.
Why this matters: Open participation is a major reason open-source AI thrives, but it also creates security challenges. If platforms respond to attacks by restricting access, the wider developer community could lose some of the openness that makes these ecosystems valuable.
Image credit: TheHacker News
The Rollout: An attacker used stolen credentials from 4,837 GitHub accounts to push a secret-stealing tool into at least 1,806 repositories. The tool targeted CI workflows, collecting credentials that could provide access to cloud accounts and other developer infrastructure.
The details:
The attacker tested access with pull requests titled docs: dependency audit notes before pushing malicious workflow changes.
The stealer collected GitHub tokens, cloud credentials, API keys, SSH keys, and other secrets accessible to CI runners.
It could also create persistent access through AWS role changes and Azure federated credentials, meaning rotating stolen secrets alone may not be enough.
Why this matters: A compromised GitHub account can expose far more than its repository. CI workflows often hold credentials to critical infrastructure, making them valuable targets. The incident also shows why teams need to monitor repository changes and investigate cloud access, not just rotate passwords and tokens.
QUICK LINKS
📅EVENTS
🇪🇺 🇬🇧 🇩🇪 Europe
Title | Date | Location |
November 19 -20 | Copenhagen | |
November 19 -20 | Sweden |
🇺🇸🇨🇦North America
Title | Date | Location |
November 17 & 20 | New York |
🇳🇬 🇰🇪 Africa
Title | Date | Location |
November 13-14 | Ikorodu, Nigeria | |
November 13-14 | Nairobi, Kenya | |
November 13-14 | Banjul, Gambia | |
November 19 -20 | Nairobi, Kenya |
🌎Asia
Title | Date | Location |
November 18 | Bengaluru, India | |
November 20 | Bengaluru, India |