🔥 Top Story
Kubernetes teams trust automation to ship code but not to touch CPU, and AI is raising the stakes
This piece examines a trust asymmetry in Kubernetes operations: teams happily automate deployments but rarely let automation adjust resource settings like CPU and memory. CI/CD pipelines ship code dozens of times a day and autoscalers change replica counts automatically, yet container requests and limits are still set by hand. The reason is that bad resource values lead directly to OOM kills, throttling, and wasted spend, so engineers are reluctant to hand that lever to automation. The article argues this reluctance has become a bottleneck for both productivity and cost optimization. It also notes that AI agents are starting to touch not just code but infrastructure configuration, raising the stakes for deciding what to automate versus what humans must verify. Building justified trust in automated resource tuning emerges as the next challenge.
💡 Why it matters: A reminder that automated request/limit right-sizing (VPA-style tooling) only pays off when guardrails and observability are in place first.
🔗 Read more · The New Stack
Kubernetes & Cloud Native
Faster nodes, smarter scaling: What’s new inside Amazon Elastic Kubernetes Service (Amazon EKS) Auto Mode
AWS Containers
AWS detailed performance and scalability improvements to Amazon EKS Auto Mode across four pillars: runtime, compute, storage, and networking. EKS Auto Mode is the mode where AWS automatically manages cluster infrastructure such as node provisioning and scaling, relieving users of data-plane management. The update centers on making nodes come up faster and scaling behave more intelligently by improving each pillar. Concretely, it raises efficiency in runtime startup, compute acquisition, storage attachment, and network setup to respond faster when workloads spike. That helps reduce cold-start and scale-out latency for workloads with volatile traffic. Operators get the benefits of these managed-automation improvements without hand-tuning.
💡 For clusters with spiky traffic, EKS Auto Mode's faster node bring-up and smarter scaling cut both scale-out latency and operational toil.
Agent Auth: A lawyer’s day in court
CNCF
This CNCF blog post tackles agent authentication and authorization by treating AI agents as 'microservices plus.' An agent needs everything a traditional microservice needs — identity, permissions, secure communication — plus the delegated authority to act on a user's behalf. Using the analogy of a traffic lawyer the author once hired, the piece illustrates how an entity acting on someone's behalf must operate within a defined scope of authority. The core challenge is the boundary — delegation and scope — of what an agent may do and how far when acting for a user or service. That leads to rethinking OAuth-style delegation, least privilege, and auditability for the agent context. As agents proliferate in cloud-native environments, standardizing identity and delegation models becomes increasingly important.
💡 Treating agents as 'microservices plus' — designing delegation scope, least privilege, and auditability up front — is what prevents on-behalf-of agents from over-reaching.
Building Jaeger’s ClickHouse backend: 8.6× compression on 10 million spans
CNCF
A Jaeger maintainer recounts finally delivering a long-requested ClickHouse storage backend in Jaeger v2.18.0. Distributed tracing spans are voluminous, so storage cost and query performance are perennial concerns, and using ClickHouse — a columnar analytics database — as the backend brings advantages in compression and analytical query performance. The headline result is 8.6x compression achieved on 10 million spans. That means the same trace data can be retained with far less storage, which helps with long-term retention and operating costs. Users had requested ClickHouse support consistently over the years, and this release fulfills that demand. The post is a practitioner's retrospective sharing the design and implementation experience from a maintainer's vantage point.
💡 If trace-retention cost is a pain, Jaeger v2.18.0's ClickHouse backend (8.6x compression on 10M spans) is a path to cheaper long-term storage and faster analytical queries.
AI & ML
How GPT-5 helped immunologist Derya Unutmaz solve a 3-year-old mystery
OpenAI
OpenAI highlighted a case in which immunologist Derya Unutmaz used GPT-5 Pro to crack a research puzzle about T cell behavior that had stumped him for three years. The model's hypotheses and interpretations reportedly provided the breakthrough. The researchers believe the insight could support cancer and autoimmune disease research. The example positions large language models as research partners that help experts form hypotheses and reason, not just summarize literature. Crucially, the model's suggestions still had to be validated by expert judgment and experiment, underscoring the human-AI collaboration involved. The announcement fits OpenAI's broader emphasis on the usefulness of reasoning-focused models in scientific work.
💡 Shows reasoning-focused models can accelerate expert hypothesis search — but the practical catch is that outputs still require domain-expert validation.
Helping build shared standards for advanced AI
OpenAI
OpenAI said it is helping build shared standards for advanced AI. The emphasis is on supporting evaluation frameworks, safety practices, and global cooperation through the Appia Foundation. The aim is to create evaluation and safety standards used across the industry and institutions — not by a single company — to improve the reliability and interoperability of AI systems. Standardized evaluation provides a common language for comparing models, measuring risk, and meeting regulatory expectations. OpenAI frames such shared standards as necessary for safe AI progress and international cooperation. The announcement sits within a broader move of AI governance expanding from individual products to shared industry infrastructure.
💡 Shared evaluation/safety standards would give teams common benchmarks for model selection, risk assessment, and compliance — simplifying AI adoption decisions.
Build real agentic apps using CUGA: two dozen working examples on a lightweight harness
Hugging Face
IBM Research published, on the Hugging Face blog, an agent harness called CUGA along with about two dozen working example apps built on it. Most agentic apps burn a week on plumbing — picking a framework, wiring a model client, writing tool adapters — and CUGA pre-assembles that orchestration so you configure it instead of building it. CUGA plans before it acts, executes with a mix of tool calls and generated code (CodeAct), holds intermediate state, and runs a reflection step that catches bad calls and re-plans — machinery credited with topping agent benchmarks like AppWorld and WebArena. Tools bind uniformly whether they're OpenAPI, MCP, or LangChain functions, and the generated apps are wrapped in ordinary FastAPI routes, so 'if you've written a FastAPI route, you can read every line.' Governance lives in the runtime rather than a bolted-on wrapper, via a policy system (six policy types such as an Intent Guard), and it supports multi-agent setups (a supervisor over specialists) and Agent Skills. Examples include an IBM Cloud advisor agent and Ouroboros, a lead-generation app coordinating seven specialist agents.
💡 Underscores that the real cost of agents is plumbing and governance — a harness that bakes tool binding, state, and policy into the runtime shortens the path from prototype to production.
How Omio is building the future of conversational travel
OpenAI
OpenAI highlighted how Omio, a European travel-booking platform, is building conversational travel experiences with its models. The conversational interface lets users ask in natural language about destinations, itineraries, and transport options and get recommendations, simplifying the complex search-and-booking process. Omio says this improves customer experience while also accelerating product development and transforming the company into an AI-native organization. In other words, AI is being embedded across the product and development process rather than as a single feature. The case illustrates traditional search-and-filter travel services shifting toward conversational, agent-style interfaces. The announcement underscores the trend of LLMs becoming the primary interface for consumer-facing products.
💡 For teams replacing search-and-filter UX with conversational interfaces, it shows that going 'AI-native' across product and development — not bolting on one feature — is the real differentiator.
Shipping huggingface_hub every week with AI, open tools, and a human in the loop
Hugging Face
Hugging Face shared how it shortened releases of its core Python library, huggingface_hub, from every 4-6 weeks to weekly, driven by a single GitHub Actions workflow. The approach splits the work in two: mechanical steps (version bumps, tagging, pushing, opening downstream test branches) are fully automated by CI, while judgment-heavy steps (writing release notes, choosing highlights, drafting announcements) have AI produce a first draft that a human reviews and approves — a human in the loop. The biggest risk — the model silently dropping a PR or inventing one — is handled by a deterministic guardrail: before the model runs, a Python script gathers all PRs in the release as ground truth, then checks the model's output against it. If anything is missing or extra, the workflow doesn't fail or ship a wrong file; it hands just those PRs back to the agent to fix. To stop the model from inventing code examples from PR titles alone, it also pulls the actual documentation diffs from each PR for accuracy. The entire pipeline uses open tools and open-weight models with no closed model or paid platform, so other maintainers can adopt it as-is.
💡 The 'wrap a non-deterministic model in deterministic guardrails' pattern — ground-truth PR checks, doc-diff verification, human final approval — is a directly reusable recipe for safely automating releases and docs with AI.
Experimenting with the proposed Cross-Origin Storage API in Transformers.js
Hugging Face
Hugging Face shared an experiment using the proposed Cross-Origin Storage (COS) web API in Transformers.js, which runs transformer inference in the browser. The core problem: even when different sites (origins) load the identical Wasm/model file from the same CDN (e.g., a ~4,733 kB ONNX Runtime Wasm), the browser cache is partitioned by a Network Isolation Key per origin, so there's no cache hit and the same file gets downloaded and stored redundantly. COS identifies files by a cryptographic hash (e.g., SHA-256) rather than URL so they can be shared across origins, and because files are verified by hash on write, you also get integrity verification that the CDN served the right bytes. Developers control sharing scope via an origin list, though visibility can be upgraded but never downgraded, and the privacy risk of probing the cache to infer browsing history is mitigated by two mechanisms — including making an error not a definitive 'not stored' answer so apps simply fall back to the network. COS isn't natively implemented in any browser yet, but you can experiment via a polyfill, and Transformers.js is already piloting COS at the library level behind a flag.
💡 For in-browser ML (Transformers.js), redundant model/Wasm downloads inflate load time and storage; a hash-based Cross-Origin Storage standard would cut that via cross-origin sharing plus built-in integrity checks.
Cloud Updates
Log Analytics is now Observability Analytics: Query logs and traces with SQL
Google Cloud
Google Cloud announced that Log Analytics is becoming Observability Analytics, adding the ability to query not just logs but also traces using SQL. Operating and troubleshooting applications requires the full context of system behavior, and keeping logs and traces separate slows down root-cause analysis. The key change is that the same SQL interface can now query and join logs and traces together for correlation. SREs and developers can analyze across signals using familiar SQL, performing root-cause analysis without learning a separate query language. It reflects a push to treat observability data as a unified analytics surface rather than siloed stores. The capability is offered within Google Cloud's logging and observability tooling.
💡 Joining logs and traces in one SQL interface cuts root-cause-analysis time by enabling cross-signal correlation without learning a separate query language.
Verifiable, private AI: Google Cloud expands Confidential Computing frontiers
Google Cloud
Google Cloud announced an expansion of its Confidential Computing capabilities for AI workloads. Confidential Computing cryptographically protects data while it is in use inside hardware-based Trusted Execution Environments (TEEs) and makes data integrity verifiable. Beyond encrypting data at rest and in transit, it extends protection to computation time so that data and models aren't exposed during processing. The expansion focuses on delivering verifiable, private handling of sensitive data for AI inference and training. This helps regulated industries and organizations handling sensitive data run AI more safely in the cloud. The announcement underscores Google Cloud's security commitments around trustworthy AI infrastructure.
💡 For regulated teams running AI on sensitive data, TEE-based Confidential Computing protects and attests data even while in use, easing compliance burdens.
Open models, global networks: How AT&T and GSMA are accelerating telecom innovation with Gemma
Google Cloud
Google Cloud showcased how AT&T and the GSMA are using its open Gemma models to accelerate telecom innovation. Telecommunications is highly complex and specialized: modern mobile networks are multi-vendor and full of diverse, proprietary data structures that are hard to handle with off-the-shelf models. The point is that a lightweight, open model like Gemma can be adapted to domain data and applied to telecom-specific tasks such as interpreting network data and automating operations. Open models give carriers more control over on-prem/private deployment, fine-tuning, and data sovereignty. The involvement of an industry body like the GSMA and an operator like AT&T hints at broader telecom-sector adoption. The announcement underscores the practicality of open models in regulated, specialized industries.
💡 In data-sovereignty-constrained sectors like telecom, tuning an open, lightweight model (Gemma) on domain data can beat closed APIs on control and fit.
DevOps & Infrastructure
Anthropic gives @Claude a permanent seat in your Slack channels
The New Stack
Anthropic announced Claude Tag, a product that places Claude permanently inside Slack channels rather than as a private one-on-one bot. The idea is to treat Claude as a shared, persistent team member that anyone can summon with an @mention. Because the channel's conversation context is shared, Claude can summarize threads, answer questions, and assist with tasks at the team level. It reflects a broader move to shift AI assistants from personal tools to participants in collaborative workflows, using Slack — where work context already accumulates — as the entry point. The launch is another example of agents living inside human workflows rather than in a separate app. Living in shared channels, however, brings operational considerations around access control, data exposure, and auditability.
💡 A shared agent living in team channels boosts productivity, but channel scope, sensitive-data exposure, and audit-logging policy are decisions to settle before rollout.
OpenClaw and Hermes agree on what an agent is. They disagree on what controls it.
The New Stack
Against the backdrop of Satya Nadella's Microsoft Build framing of a platform shift away from operating systems and apps, this article compares two agent harnesses, OpenClaw and Hermes. Both largely agree on what an agent is — a loop in which a model calls tools and iterates toward a goal. Where they diverge is on what controls the agent: where the orchestration and policy layer lives and how planning and tool calls are governed. The takeaway is that agent standardization is being contested less at the execution-model level and more at the governance and control layer. The real fork in the agent ecosystem, the piece argues, is the location of control rather than the definition of an agent. For adopters, choosing a harness effectively means choosing a control and extensibility model.
💡 When picking an agent harness, evaluate the control and policy layer — who governs tool calls and permissions — rather than the execution loop, since that's where they actually differ.
Developers are now validating code they didn’t write — and may not understand
The New Stack
As AI coding tools generate code at scale, developers increasingly have to review and approve code they didn't write and may not fully understand. GitLab, eyeing this downstream pressure on engineering teams, introduced a governance push aimed at AI-generated code. The core point is that as generation speeds up, review, validation, and accountability become both the bottleneck and the risk. Merging code whose context the author doesn't grasp can quietly accumulate security flaws, regressions, and technical debt. So making validation trustworthy matters as much as generating the code in the first place. The article frames policy, gates, and traceability as the way to manage the quality and ownership of AI-written code.
💡 As AI-generated code grows, baking governance — merge gates, ownership, traceability — into the pipeline is what keeps regressions and security risk under control.
Nx debuts Polygraph, taking aim at what’s stalling AI coding agents
The New Stack
Nx, the company behind the open-source monorepo build system, launched Polygraph on Tuesday, a service aimed at what stalls AI coding agents. In large monorepos, agents often stumble because they work without a full grasp of the codebase's structure and dependency relationships. Polygraph is positioned to expose the project-graph information Nx is known for — how projects depend on one another and what a change affects — so agents can understand the blast radius of edits and work more safely. The bet is that the limiting factor for agents isn't a smarter model but accurate context about the codebase. It reflects build-system and tooling vendors repositioning themselves as context providers for the agent era. For the exact feature scope, readers should consult the original announcement.
💡 Suggests the bottleneck for coding agents is codebase context, not model quality — wiring a monorepo's project graph into the agent can be the practical fix.
AI can write the code. Your team still owns the debt.
The New Stack
Pushing back on an industry that frames AI mostly as a speed play, this piece argues that accountability and technical debt for generated code still belong to human teams. Models and agents can produce code quickly, but guaranteeing its correctness, maintainability, and security doesn't come for free. AI code merged without verification looks like short-term productivity but returns as technical debt and regression risk over time. The article stresses that the key question isn't that AI writes code but who verifies and owns it. The real payoff comes from investing in verification, review, and testing capacity rather than chasing speed metrics alone. In essence, generation got cheap while verification stayed expensive — or got harder.
💡 Generation got cheap but verification didn't, so investment in the testing/review/static-analysis pipeline is what actually determines AI's ROI.
GitLab just surveyed 1,500 developers. Here’s why it matters for your codebase.
The New Stack
GitLab released findings from a survey of 1,500 developers, showing that the AI-assisted development conversation is shifting from speed toward governance and infrastructure. After two years dominated by how fast AI makes development, the survey suggests organizations now weigh the quality, security, and governance of AI-generated code more heavily. The focus is moving from 'are we using AI' to 'how do we use it under control and safely.' That points to agentic infrastructure and AI governance having a direct impact on codebase health. Drawing on the survey data, the article argues teams need policies, standards, and verification in place. For the specific breakdowns, readers should consult the original survey results.
💡 Signals that organizational AI adoption is shifting from speed to governance — teams that set up code standards, security gates, and auditing now will be ahead.
Can DNS become the basis for AI agent identity?
The New Stack
The Linux Foundation declared its intent on Tuesday to launch the Agent Name Service (ANS), an open standard for giving AI agents identifiable identities. Just as the internet's DNS attaches identity and addressing to domain names, ANS aims to provide a naming-and-identity layer for agents. The motivation is that for agents to discover, authenticate, and interact with one another, they need a common layer linking human-readable names to verifiable identity. Modeling itself on DNS — a proven distributed naming system — ANS would provide a foundation for trust, discovery, and routing in the agent ecosystem. It's a move to standardize identity, authentication, and authorization as agent-to-agent communication grows. Since this is a declaration of intent, the concrete specification and adoption remain ahead.
💡 As agent-to-agent traffic grows, an identity standard becomes essential — a DNS-based ANS could turn agent discovery, authentication, and authorization into a common layer instead of bespoke glue.
This digest was collected from RSS feeds and summarized by AI (Claude). See the original links for full details.