devopsy.kinsta.cloud

Tag: ai

Oasis Security Identifies Security Weakness in Cursor AI Coding Tool

Oasis Security this week warned application developers of a security flaw in the Cursor artificial intelligence (AI) code editor developed by Anysphere, Inc. that potentially could be used to allow a maliciously crafted code repository to execute code as soon as it’s opened using Cursor.

Erez Schwartz, threat research engineer at Oasis Security, said that unlike other coding tools based on the open source Visual Studio (VS) Code tool originally developed by Microsoft, the Cursor AI tool disables a Workspace Trust feature by default.

Application developers as a result might inadvertently auto-execute commands to open folders in a repository that might have been deliberately created to distribute malware, said Schwartz.

It’s not clear to what degree providers of AI coding tools should be putting security guardrails in place, but DevSecOps teams should at the very least remind application developers that might be using Cursor or any other similarly configured tool of potential security issues they might encounter. Ideally, DevSecOps teams should have more control over how AI coding tools are configured to ensure best practices are being followed.

Additionally, Oasis Security is recommending that in addition to enabling Workspace Trust to run at startup, they should also consider setting task.allowAutomaticTasks to off and that any unknown repositories only be opened in a safe environment. They should also search for .vscode/tasks.json with “runOn”: “folderOpen” and monitor any spawned shells and unusual outbound requests that occur immediately after opening a project.

The team that developed Cursor plans to update the security guidance it provides but it will mainly be up to individual developers and the organizations they work for to determine and enforce cybersecurity policies, said Schwartz.

Whether usage of AI coding tools is sanctioned or not, application developers are going to be at the very least experimenting with them. While there is no doubt they improve productivity, the code being generated still needs to be reviewed for vulnerabilities. The AI coding tools are dependent on large language models (LLMs) that were trained using examples of flawed code that contains vulnerabilities that are now being similarly surfaced in code written by AI coding tools.

The code generated by these tools also tends to be a lot more verbose than code written by a human, so DevOps teams also might want to consider the amount of maintenance that might be required when that code needs to be debugged either before or after it has been deployed in a production environment.

Ultimately, most DevOps teams would be better served by defining a set of policies and best practices for using AI coding tools versus simply allowing them to become a set of shadow tools that no one has any visibility into or control over. After all, the AI coding genie at this point is not going back in the bottle. The challenge now is to find the best way forward that, in addition to providing a better developer experience, also serves the best interests of the organizations that employ them.

September 12, 2025
Sketch Coding and the Rise of MCP in DevOps

At swampUP 2025, JFrog’s Yonatan Arbel reflects on his journey inside the company and how developer DNA continues to shape JFrog’s culture. Arbel, who has spent nearly a decade with JFrog, began as a software engineer before moving into leadership and eventually into a developer relations role. But as he emphasized, “once a developer, always a developer.” He still codes daily, keeping a hands-on perspective that influences how JFrog builds and communicates its platforms.

That commitment to staying close to the keyboard led Arbel to create JFrog’s first experimental MCP (Model Context Protocol) server as an open source project. Uploaded to GitHub almost as a side experiment, the project quickly gained traction — even attracting pull requests from NVIDIA and references from Cisco. For Arbel, it was validation that MCP represents a real turning point in how enterprises will connect APIs, AI models, and DevOps workflows.

He described his process as “sketch coding,” akin to vibe coding, where ideas start as rough AI-assisted prompts before maturing into production-ready tools. That approach mirrors how many developers are now blending AI into their workflows: iterating quickly, validating ideas, and only then investing in hardening code for scale.

Arbel also highlighted the excitement — and occasional sense of magic — that comes from integrating AI into day-to-day development. Whether it’s pulling runtime insights from an IDE or rapidly prototyping new capabilities, the goal remains the same: help developers work smarter while ensuring JFrog’s platforms support security, governance, and scalability across the software supply chain.

The conversation underscored how JFrog continues to bridge its engineering roots with the demands of modern DevOps, proving that innovation often starts with developers who never stop building.

September 12, 2025
Survey Surfaces Software Engineering Challenges Following Adoption of AI

A survey of 101 senior engineering leaders published this week finds while 87% believe their organization is “prepared” or “very prepared” to adopt artificial intelligence (AI). It’s also clear that several hurdles remain, most notably making sure application development teams have the quality assurance skill and expertise needed to validate AI outputs (66%).

Conducted by Uplevel, a provider of a platform for tracking engineering metrics, the survey also finds engineering leaders are starting to focus more on performance monitoring and optimization (39%) and system architecture and integration skills (34%).

Additionally, the survey identifies technical debt (27%) and lack of clear AI strategy (22%) as the two greatest strategic threats to AI potential.

Amy Carrillo Cotten, director of client transformation at Uplevel, said the survey results suggest that while there is a lot of AI optimism, engineering leaders are also becoming more cognizant of some of the inherent challenges. For example, 30% cited data security and privacy risks as a significant issue that will need to be addressed.

Overall, engineering leaders are investing in AI to drive operational efficiency (53%), accelerate innovation (40%), improve decision-making (28%) and boost competitive advantage (23%).

Engineering leaders to achieve those goals are investing in reskilling existing employees (40%), hiring AI specialists (34%) and partnering with vendors or consultants (22%) to address those issues, the survey finds.

The challenge is, as always, determining what level of productivity gains are being made, said Cotten. While two thirds of engineering leaders (66%) say they regularly measure the business outcomes of their work their teams complete, 37% also conceded they have difficulty isolating how specific teams contributed to the effort. While the survey finds 61% of respondents prioritize key performance indicators (KPIs) are team or organizational level, many are also still tracking metrics such as how much code was produced by individual developers even though that metric has little to do with an actual business outcome, noted Cotten.

Engineering leaders will also need to have a better appreciation for systemic constraints such as complex architectures and collaboration challenges that will only become further exacerbated as the volume of code being created increases exponentially, said Cotten. In effect, many application development teams will discover they are running into the same brickwalls, only faster, she added.

In general, the survey identifies improving development tools and automation (27%), followed closely by reducing technical debt (24%) as the two things that would have the biggest impact on productivity. Obviously, AI is improving tooling but it’s not fairy dust that can be sprinkled everywhere, said Cotten. Engineering leaders need to have a strategy for operationalizing AI across the software development lifecycle (SDLC) to ensure success, she noted.

Ultimately, software development remains a team sport and no amount of wishful AI thinking is going to magically eliminate existing bottlenecks and constraints, added Cotten.

It’s not clear to what extent DevOps teams are adopting AI but there is no going back. The issue now is determining how best to set the right expectations for what can be actually achieved despite the current level of hype being created by exaggerated claims about how AI is eliminating the need for application developers.

September 11, 2025
Warp Embeds AI Agents into a CLI to Provide Better Feedback Loop

Warp has added a version of its artificial intelligence (AI) agent for writing code that integrates directly within a command line interface (CLI).

Company CEO Zach Lloyd said rather than working with AI agents within the context of an integrated development environment, Warp Code embeds AI agents with a CLI that is likely to prove more appealing to some developers and many DevOps engineers that prefer a traditional terminal-based coding experience.

Warp Code is based on the same agentic AI framework as Warp, an AI coding tool that is designed to generate code from natural language prompts in a way that provides more control and visibility into how code was developed, said Lloyd. Features such as code review and file editing enables a tighter feedback loop between developer and agent to create better code, he added.

It’s not clear to what degree application developers and software engineers are relying on AI coding tools, but while they improve productivity the code generated is often verbose and inefficient. Additionally, because application developers don’t have a deep understanding of how an AI tool constructed that code, it can be challenging to debug.

More challenging still, most of the large language models (LLMs) that are relied on to generate code were trained using examples of varying quality collected from across the web. As a result, the number of vulnerabilities being generated by AI coding tools is significant.

The only way to address those issues is to create a tighter inner loop workflow that enables developers and the AI agent to more iteratively develop applications in a way that makes it easier for human developers to provide constructive feedback to the AI agent, said Lloyd.

Each organization will need to determine what level of confidence to have in AI coding tools. In some cases, the quality of the code being generated might only be good enough to provide a place to refine it long before it ever makes it to a production environment. However, there are also going to be plenty of instances where the code created by an AI tool might be superior to what a junior or so-called citizen developer might have otherwise generated on their own. At this juncture, it’s not so much a question of whether application developers are going to use AI coding tools so much as it is to what degree.

In the meantime, DevOps teams would be well advised to continuously experiment with and test multiple AI coding tools. The pace of AI innovation continues to accelerate so a tool that only a few months ago might have only been able to reliably execute a few tasks might now be able to manage more complex workflows. The important thing is to make sure to validate the output being generated by these tools because, inevitably, mistakes will be made. The challenge is that far too many application developers are already trusting these tools too much, which ultimately leads to a lot more bad code that has to be, hopefully, weeded out a build before any of it is allowed to make it into a production environment.

September 11, 2025
Cisco to Add AI Agents to Splunk Observability Platforms

Cisco today at its Splunk .Conf25 conference previewed a series of artificial intelligence (AI) agents for the Splunk Observability platform that are capable of automating the collection of telemetry data using open source OpenTelemetry software, detecting issues, identifying root causes, and applying fixes.

At the same time, Cisco also launched Cisco Data Fabric, a platform that makes it possible to aggregate and analyze machine data at scale without having to ingest it into a specific platform. That platform will also soon be extended to add support to analyze time-series data as well using multiple AI toolkits that Cisco is making available.

Cisco also revealed it is adding application performance management (APM) capabilities to the Splunk Observability platform along with a Digital Experience Analytics (DEA) module and an ability to monitor and track specific business transactions, a capability that was originally developed for the Cisco AppDynamics platform.

Finally, Cisco also tightened integration between Splunk Observability Cloud Real User Monitoring (RUM) and Cisco ThousandEyes, a platform for monitoring Internet traffic.

Kamal Hathi, senior vice president and general manager for the Splunk business unit at Cisco, said with the rise of AI agents, the pace at which IT monitoring, observability and analytics have been converging is now about to accelerate. The overall goal is to break down the silos that currently make it challenging to adroitly respond to IT incidents.

Jeetu Patel, Cisco president and chief product officer, added that as that convergence occurs the ability to consume and analyze telemetry data will need to be optimized for both the IT staff and what will soon be large numbers of IT agents that are autonomously managing tasks alongside them.

As part of an effort to facilitate that integration, Cisco this week also publicly demonstrated Cisco AI Canvas, an agentic framework launched earlier this year that provides a generative AI user interface (UI) for unifying real-time telemetry data and AI insights in a way that promises to foster increased collaboration across network, security and DevOps teams.

Mitch Ashley, vice president and practice lead for software lifecycle engineering for the Futurum Group, also noted Cisco is increasing the reach of its observability platform via a Cisco Data Fabric that makes it possible to analyze data where it resides, versus having to always first ingest data into an observability platform. That approach will also make it easier to expand monitoring and observability to include AI agents and large language models (LLMs), he added.

Each IT organization will need to decide for itself at what pace to converge monitoring and observability as IT environments continue to become more complex to manage. However, as it becomes easier to instrument IT environments the amount of telemetry data that can now be collected continues to exponentially increase. AI agents will play a critical role in enabling IT teams to manage that volume of data at levels of scale that not too long ago would have been considered simply unattainable.

September 9, 2025
JFrog Continues Leaping at swampUP

Every year, JFrog’s swampUP conference gives us a look at what’s next in DevOps, software delivery, and increasingly, AI. This year’s event in Napa did not disappoint. If you’ve followed JFrog over the years, you know they have never been shy about leading the conversation on how software is built, secured, and shipped. At swampUP 2025, they reminded everyone once again: JFrog is not just keeping up with the industry—it’s defining it.

In the DevOps world, it’s easy to get swept up in hype. AI, compliance, automation—everyone claims to be innovating. But JFrog’s announcements this week are more than marketing spin. They represent a coherent, ambitious vision for how software supply chains must evolve in a world where AI-native development, trust, and compliance are as central as speed and scale.

The Bigger Picture: Why This Matters

The past few years have seen software supply chain security leap to the top of every CIO and CISO’s priority list. Add in the explosion of AI tools, and the stakes are even higher. Enterprises need to innovate faster, but they can’t afford to cut corners on governance, compliance, or security. That tension—between speed and trust—is what JFrog is targeting.

Their strategy is clear: build the system of record for all software artifacts and now, AI models, and extend that system with governance and compliance baked in. Partnerships with hyperscalers, NVIDIA, and ServiceNow reinforce this ambition. JFrog isn’t just integrating with the ecosystem—they’re embedding themselves into the very fabric of how modern software is created, secured, and delivered.

JFrog Fly: The Agentic Leap

Let’s start with JFrog Fly, billed as the industry’s first agentic repository. For years, we’ve heard how AI has transformed coding, with tools like GitHub Copilot and Cursor making developers more productive. But release management—the actual process of getting code into production—remains stubbornly manual and disconnected.

JFrog Fly rethinks this by creating a zero-config, AI-native repository designed for “vibe coding” and agentic workflows. It promises semantic release management, centralized sharing of artifacts, and seamless integration with AI repos. In other words, Fly aims to do for release management what Copilot did for coding: make it frictionless.

For small teams, this could be game-changing. Fly could allow startups and scrappy developer squads to scale software delivery at a pace that used to be reserved for big enterprises. It’s JFrog reminding us that innovation doesn’t just happen at the code level—it happens in how you package, release, and deliver.

JFrog AppTrust: Governance Becomes DevGovOps

The next big announcement was JFrog AppTrust, described as a “DevGovOps” solution. The name may be new, but the need is not. As JFrog CEO Shlomi Ben Haim put it, after DevOps and DevSecOps, the next big challenge is governance.

AppTrust creates a secure release management layer that signs and secures evidence, automates release quality gates, and integrates governance into platforms like ServiceNow. The promise here is clear: every release is trusted, verified, and compliant—without slowing teams down.

The most intriguing part? AppTrust doesn’t just measure code quality; it contextualizes applications with ownership, dependencies, and risk insights. It’s governance not as a speed bump, but as an accelerator, reducing friction between developers, security, and compliance teams.

JFrog AI Catalog: Governing the AI Flood

AI adoption has exploded, but governance has not kept up. That’s where the JFrog AI Catalog comes in. This is a secure hub for discovering, governing, and deploying AI/ML models—whether they’re internal, open source, or from external providers like NVIDIA and Anthropic.

With direct access to NVIDIA’s Nemotron models, one-click deployments, and continuous scanning through JFrog Xray, the AI Catalog brings the same rigor to AI models that enterprises already expect for software artifacts. Think of it as Artifactory for the AI era.

Here’s the Shimmy take: enterprises are flying blind today when it comes to AI governance. The AI Catalog offers a way to bring visibility, compliance, and trust to a part of the stack that has so far been the Wild West. That’s not just an incremental step forward—it’s foundational if AI is going to scale responsibly in the enterprise.

The Evidence Ecosystem: Compliance You Can Trust

Finally, JFrog extended AppTrust with its Evidence Ecosystem, partnering with GitHub, ServiceNow, Sonar, and others to create a centralized audit trail of cryptographically signed attestations. This is about creating a single source of truth for compliance—no more scattered logs, no more manual processes.

In an era where regulators, auditors, and even AI agents will demand verifiable proof before a release goes live, this matters. JFrog is saying: don’t just trust us—prove it. And they’re giving organizations the tools to do exactly that.

Where This Is Headed

All of this fits into a broader trend I’ve been tracking: the convergence of AI-native development, secure supply chains, and governance. The days of “move fast and break things” are over. The future is “move fast and prove trust.”

JFrog gets this. And by putting themselves at the center of that conversation, they’re not just staying relevant—they’re shaping the next era of DevOps.

Wrapping Up from Napa

JFrog swampUP isn’t over yet, and I expect more announcements as the week continues. Techstrong and Techstrong TV are here on the ground, live-streaming sessions and capturing conversations. Jon Swartz is on-site covering the event editorially, so keep an eye out for more analysis from us.

But for now, one thing is clear: JFrog continues to leap, and in doing so, they’re pulling the entire industry forward with them. If you’re in DevOps, security, or AI development, these are announcements worth paying close attention to.

September 9, 2025
Report: ChatGPT-5 Coding Gains Come at a Higher Cost

A report published this week by Sonar finds the GPT-5 platform released by OpenAI has the potential to generate better code but at significantly higher costs.

Based on over 4,400 Java tasks, the report finds that depending on which of the four levels of reasoning capabilities that OpenAI now makes available, the overall quality of the code, especially in terms of the vulnerabilities generated, significantly improves.

However, the overall volume of code being generated per task also substantially increases, which creates additional maintenance challenges for application developers that are not going to be familiar with how code might have been constructed in the first place. Overall, the report finds the minimal edition of GPT-5 produces more than twice the lines of code per tasks assigned than the previous GPT-4o edition of the platform.

There are also plusses and minuses when it comes to security. For example, the report noted that higher reasoning eliminates common, well-understood attacks such as “path-traversal & injection” vulnerabilities. However, these are replaced by subtle, harder-to-detect flaws. The percentage of vulnerabilities related to “inadequate I/O error-handling” increases to 44% in the high reasoning mode versus 30% in the minimum reasoning mode.

A similar trade-off occurs with bugs. As reasoning increases, the rate of fundamental “control-flow mistake” bugs decreases significantly. However, the percentage of advanced “concurrency/threading” bugs increases from 20% in minimal mode to approximately 38% in high mode.

Donald Fischer, a Sonar vice president, said the report makes it clear there is a tradeoff between using, for example, the minimal level reasoning capability priced at $22 per month per developer, and the highest level priced at $189 per developer per month. While there is little doubt that AI coding tools can increase productivity, DevOps teams need to make sure they verify the quality of the output being provided based on multiple dimensions, including the amount of cost being incurred, he added.

The latest ChatGPT-5 analysis builds on a previous Sonar report that assessed the code generated by large language models (LLMs) from OpenAI, Anthropic and Meta, which found each model has its own “coding personality” that affects the quality of the code created. In general, the models possess a strong foundational understanding of common algorithms and data structures and can create viable solutions for well-defined problems.

Additionally, the models are highly effective at translating code concepts and snippets from one programming language to another, which makes them a powerful tool for developers who work with different technology stacks, according to the report. However, critical flaws such as hard-coded credentials and path-traversal injections were common across all models. While the exact prevalence varies between models, all the LLMs previously evaluated produced a high percentage of vulnerabilities with high severity ratings.

It’s not clear to what degree DevOps teams have adopted AI coding tools and just how much they trust the output being generated. There is no doubt that developers will be more productive, especially when building prototypes, but how much of the code makes it into production environments is unknown. The one thing that is clear is that some of the productivity gains being made will eventually come at a cost that many DevOps teams may not realize they are already starting to incur.

September 4, 2025
Bringing Order to Chaotic Software Engineering Workflows

Software development has never been tidy, but the current landscape feels more chaotic than ever. Shannon Mason, chief strategy officer for Tempo, dives into why software engineering workflows remain chaotic and what teams should be doing to try and restore application development order.

Developers today face a relentless push to innovate while keeping complex codebases running securely and efficiently. AI has been billed as the great productivity booster, but early research paints a more nuanced picture. Cornell studies and MIT reports show that while AI tools can accelerate work for junior engineers or greenfield projects, they often slow down experienced developers working with mature, complex systems. The result? More debugging, more oversight, and sometimes more frustration than gains.

Shannon draws a useful analogy: think of AI as “the world’s smartest intern.” It’s promising, but it still needs guardrails, guidance, and plenty of supervision. Left unchecked, AI-generated code can be verbose, insecure, or just plain wrong—adding to the workload rather than reducing it. Layer in the explosion of low-code and no-code tools, plus the rise of citizen developers, and the volume of software entering pipelines is set to grow dramatically. That democratization is exciting, but it also raises hard questions about scale, security, and quality.

At the human level, the pace of change and the constant context-switching are pushing teams to their limits. Shannon highlights practical remedies: make work visible, avoid overloading teams, plan realistically (80% capacity, not 120%), and carve out focus time. Even simple steps like instituting a weekly no-meeting day can improve flow and reduce burnout.

The takeaway is clear: AI won’t magically fix software development chaos, but with smart practices, cultural shifts, and realistic planning, teams can navigate the turbulence—and maybe even rediscover some joy in building great software.

August 29, 2025
Why APIs Alone Won’t Cut It in the AI Era

Kumar Chivukula, co-founder and CEO of Codeglide.ai (a subsidiary of Upsera), explains why the rise of the Model Context Protocol (MCP) is reshaping how enterprises connect APIs to large language models. For years, APIs have served as the backbone of data access, but they were never designed with AI in mind. They lack memory, context, and intent awareness—forcing developers to bolt on brittle glue code every time models change.

Anthropic’s introduction of MCP earlier this year marked a turning point, offering a standardized way to make APIs context-aware and AI-ready. But as Chivukula points out, adopting MCP isn’t just about creating a one-off server. Enterprises run tens of thousands of APIs—many undocumented, outdated, or internally facing—and keeping pace with rapid model changes demands a lifecycle approach. That’s where CodeGlide positions itself: a continuous MCP server platform that automates creation, updates and security scanning at scale.

The comparison to cloud migration is apt. Just as lift-and-shift approaches left organizations with bloated costs, treating MCP as a quick wrapper on existing APIs won’t cut it. Instead, enterprises need a sustainable framework that refactors APIs for AI interaction, enforces security, and manages change continuously. Chivukula highlights integration with GitHub’s vast ecosystem—home to tens of millions of API repositories—as a critical lever to reach both developers and enterprises.

With more than a billion APIs in existence and an emerging AI economy valued in the tens of billions, MCP adoption isn’t optional—it’s inevitable. The question is how organizations will navigate the transition without drowning in complexity. Platforms like CodeGlide hint at one possible path forward.

August 29, 2025
Can AI Replace DevOps Engineers?

Let’s cut to the chase: no, it can’t.
Not now. Not anytime soon.

In my experience working with engineering teams across industries, I’ve seen just how fast cloud infrastructure is evolving. Automation and AI are certainly becoming more embedded in daily workflows. And yes, they can take over certain tasks, especially the tedious, repetitive ones. But if you think that means engineers are becoming obsolete, you’re missing the plot entirely.

If anything, what AI is doing is revealing how critical skilled engineers still are, and will continue to be.

The Story Behind the Hype

The industry loves a good headline. “AI is coming for your job!” “DevOps without the devs!” It’s easy to get swept up in that energy.

But the real world isn’t a press release.

Here’s a quick example from a client I worked with recently: they proudly demoed a Terraform configuration to spin up their environment. On paper, it looked solid—clean, properly formatted, no syntax issues. But it didn’t work. At all.

Turns out, the code was AI-generated. It looked polished, but it wasn’t functional. It hadn’t been validated. It didn’t reflect the actual infrastructure setup. It was all surface, no substance – a reminder that code generation without understanding is just theater.

And that’s not a one-off. I’ve seen it happen more than once.

Fast Isn’t Always Smart

Let’s be clear: tools like Copilot, ChatGPT, or Claude can be incredibly helpful. They can speed up scaffolding, suggest fixes, and help with repetitive scripting. But their knowledge comes from public data. They don’t know your stack. They don’t know your security policies. They don’t follow your team’s naming conventions or compliance rules.

In fact, I’ve heard stories of AI-generated infrastructure code that includes deprecated syntax or outdated APIs. One engineer told me he had an entire Azure policy fail silently because the AI-generated config used the wrong version schema. It took hours to debug.

That’s the risk. AI gets you there faster, but if it’s the wrong direction, you just crash sooner.

Augmentation > Automation

Where AI is making progress is in deterministic workflows — tools that operate on rules, not guesses. Think of systems that understand Policy-as-Code and can generate merge-ready fixes based on defined organizational standards.

They aren’t trying to be creative. They’re trying to be right.

This kind of AI behaves more like a very efficient junior engineer: it flags issues, prepares clean pull requests, and works quietly in the background. But it doesn’t deploy without you. It still relies on human judgment and review.

And that’s the point. It’s not replacing anyone. It’s removing friction. It’s streamlining the work so engineers can focus on harder, higher-value challenges.

Even Gartner seems to agree. In their 2024 Hype Cycle for Site Reliability Engineering, they flagged “AI Assistants for Infrastructure as Code” as a rising category, specifically because they enhance, not replace, engineering roles.

Some Things Only People Do Well

No AI tool is going to understand why your U.S. West region is under a deployment freeze due to legal concerns. Or that your team is shipping a critical feature by Friday and can’t risk a surprise regression. Or that your lead engineer is OOO and won’t be reviewing that PR until Monday.

It won’t sit through a sprint retro. It won’t handle an outage call at 2 a.m. It won’t balance trade-offs or debate system design with the team.

Even as AI gets better at writing and fixing code, it still doesn’t handle the nuance. DevOps isn’t just scripts and pipelines. It’s conversations. Decisions. Context.

And none of that’s going away.

Looking Ahead: What Might Change

Now, while I don’t believe engineers are being replaced, I do think their role is shifting. We’re seeing the rise of what I’d call “AI-aware engineers.” These are people who guide AI tooling — tuning it, checking its output, defining the rules it should follow.

Expect to see more emphasis on policy-as-code, declarative security, and infrastructure governance baked into CI/CD pipelines.

A CNCF survey recently reported that 67% of platform teams view AI-enabled automation as a top investment. Not to cut headcount but to eliminate manual toil.

This is the new path: let AI handle the routine, while humans tackle the real problems.

Final Thoughts

Trying to replace DevOps engineers with AI misses the point entirely. Automation is valuable, sure. But DevOps is fundamentally about context, coordination, and accountability – things no machine is ready to own.

What we should focus on is how to best pair engineers with the right tools. Let AI take the grunt work. Let people steer the ship.

Because the future isn’t hands-free. It’s hands-on – just with a lot more support behind the scenes

August 26, 2025