Building an AI SDLC on Thin Ice: What Worked and What Backfired
Writing code was never the hard part of software engineering. That was true before LLMs and it’s still true now. The hard parts were always understanding the problem, choosing an approach you won’t regret in six months, and keeping a system comprehensible to the people who have to maintain it. Code was the mechanical part. […]
Your AI Patches Still Break Production? The Fix Isn’t a Better Model, It’s a Better Workflow.
In our previous post, we showed how general-purpose AI coding assistants produce vulnerability patches that compile, pass tests, and still break production. The data was clear: a persistent ~20% defect rate across compatibility, correctness, and precision – not because the models can’t code, but because they skip the critical step of understanding the APIs deltas. […]
CVE-2025-68664: A Case Study in How AI Agent Velocity Is Stress-Testing Vulnerability Management
The proliferation of AI Agents is creating a “Vulnerability Gold Rush.” While developers are racing to ship features using LangChain, LiteLLM, and the new Claude/OpenAI SDKs, the underlying libraries are evolving so fast that security patches are frequently entangled with massive breaking changes. For an organization running dozens of agents, this isn’t just a maintenance […]
Stop the whack-a-mole game: Turning npm Supply-Chain Chaos into Automated Remediation
In the span of a few weeks, the JavaScript ecosystem has been hit by back-to-back software supply-chain incidents. First came the s1ngularity/Nx compromise in late August. Then, this week, the Shai-Hulud campaign arrived with a twist: a self-replicating, worm-style payload that moved quickly through the npm ecosystem. Public write-ups from SCA and CNAPP vendors have […]