devopsy.kinsta.cloud

Tag: Spacelift

Survey Surfaces Rise in IT Incidents Attributable to AI Coding Tools

A survey of 406 IT decision makers at organizations with more than 250 employees in North America finds 93% have experienced at least one infrastructure incident caused by reliance on artificial intelligence (AI) tooling.

Conducted by Panterra Group on behalf of Spacelift, a provider of a platform for automating the management of infrastructure-as-code (IaC), the survey also finds 86% reporting that AI has increased demands on infrastructure teams, with security vulnerabilities appearing faster (40%), governance becoming harder (40%), change rates increasing (37%), more strain on pipelines experienced (35%) and growing infrastructure drift (35%) being seen.

In general, more than two thirds (67%) of respondents note application development is ahead of infrastructure in terms of AI adoption, the survey finds.

Nevertheless, 86% said they are confident in their organization’s ability to govern AI, even though only 30% currently have a formal AI governance policy in place.

More troubling still, only 15% track the volume of AI-generated IaC moving through pipelines, while just 20% track error rates of AI-generated changes.

Dimitri Vlachos, chief marketing officer for Spacelift, said the survey makes it apparent that AI is having a significant impact on DevOps teams as more code of uncertain quality is used to provision IT infrastructure.

In fact, one-third (33%) of infrastructure teams say they would apply AI-generated HashiCorp Configuration Language (HCL) code directly to production without any review, while an additional 43% only conduct a minimal review. That overreliance on AI coding becomes problematic because the tools being used often lack critical context about the runtime environment, resulting in flawed code either creating a vulnerability or simply not running at all, noted Vlachos.

In the absence of any meaningful code review, it’s not surprising that more organizations are encountering security issues that typically arise when cloud services are misconfigured, noted Vlachos. IaC is not much different than any other type of AI-generated code that DevOps teams are already struggling to effectively review, he added. Too many DevOps teams are relying on vibe coding tools to generate scripts that are all too often employed without a human scanning them for vulnerabilities and other weaknesses, said Vlachos.

The challenge is that without any ability to apply governance policies, much of that code is going to create a vulnerability that malicious actors will, with help from AI, be able to discover and exploit in a few hours, he added.

Overall, the Spacelift segments survey respondents into four categories based on their AI maturity level using IaC tools. Pioneers account for 19% of the total, followed by outpacing (25%), fragmented (32%) and exposed (24%). Pioneer organizations vibe-code IaC at a higher rate than Exposed ones (86% versus 69%), but they do it inside governed pipelines with automated validation and policy enforcement.

It may be a while yet before governance policies catch up with the rate at which AI tools are generating code, but the one thing that is certain is that as the amount of code moving through DevOps pipelines increases, so too does the probability there will be more incidents than ever that software engineers will need to investigate.

June 29, 2026
Embracing the MCP Suck: Taming the Wild West of AI Protocols

The Model Context Protocol (MCP) is moving faster than the developer community can keep up with, racing past its original design parameters and leaving teams scrambling to build clients that can match its pace. The result is an ecosystem where the protocol itself keeps shifting under everyone’s feet, and where the tooling, conventions and security thinking that should accompany a foundational standard are still being figured out on the fly.

Joey Stout, solutions architect at Spacelift, joins Mike Vizard to make the case that this is the price of being early. Stout describes an environment that increasingly resembles a Wild West, where rogue MCP servers get spun up inside organizations without anyone in leadership knowing they exist, let alone whether they have basic guardrails wrapped around them. The convenience of standing one up in a few minutes has outrun the discipline needed to govern them.

MCP servers can give AI agents broad reach into internal systems, data and APIs, and most of the early implementations were never designed with adversarial behavior in mind. Without authentication standards, scoped permissions and observability built in, every new server becomes another piece of shadow infrastructure that can be exploited, misconfigured or simply forgotten until it causes a problem.

Stout’s advice for developers is blunt: embrace the suck. The protocol is going to keep changing, the security story is going to keep evolving, and waiting for a stable, fully governed version before getting hands-on isn’t a realistic option. The teams that learn to wrangle MCP now — messy edges and all — will be the ones positioned to set the patterns everyone else ends up following.

April 27, 2026
Spacelift Intelligence Vibe-Codes Infrastructure
Whether the DevOps shops like it or not, they are feeling the pressure from AI. They’re expected to move more quickly, alongside their dev counterparts. The gruntwork that used to take weeks can be automated away, leaving time for fast prototyping, so the managers think.

According to Google Cloud’s 2025 DORA State of AI-assisted Software Development Report, 90% of developers now use AI tools, and 25% are now working alongside AI assistants.

Users of the Spacelift Infrastructure-as-Code platform now have some help with this automation, thanks to a new feature offering a conversational interface that purports to explain what is going on with their IT operations, and even make changes on the user’s behalf if necessary.

“Platform teams are expected to respond at the speed of experimentation while still maintaining security, compliance, and operational consistency,” wrote Technical Senior Product Manager Tim Davis, in a blog item posted today.

It is an application that essentially provides a spatial awareness of your infrastructure. It has access to your assets, all the building blocks inside Spacelift.

Lift Off

Spacelift’s eponymously-named flagship orchestration platform manages infrastructure-as-code (IaC)-style deployments.

Marcin Wyszynski, co-founder of Spacelift, in an interview with devopsy.kinsta.cloud, described the core Spacelift package as “multiplayer mode for infrastructure,” allowing multiple DevOps personnel to collaborate across multiple IaC tools.

When you have multiple people working on a project, there is a danger, without the proper toolset, that their changes could overwrite each other. “The moment you’re working as multiple people, you need some form of synchronization,” Wyszynski said.

Originally, Spacelift extended the capabilities of Terraform, and was grouped in an emerging set of tools known as TACOS (Terraform Automation and Collaboration Software).

Spacelift quickly expanded beyond Terraform into an IaC-agnostic platform that can also be used with other IaC deployment tools, such as Ansible, CloudFormation, Pulumi, and OpenTofu, an open source fork of Terraform (Terraform is now owned by IBM).

The new Intelligence feature builds off of a previous update from the company, the open source Spacelift Intent, released in September, provided a way to make changes in the infrastructure using conversational language. It essentially was an MCP server provisioned to execute changes on your infrastructure,” Wyszynski said.

Trust Incrementally

Spacelift Intelligence takes Intent a step further, in that it understands how your infrastructure is currently set up. It extends a new conversational interface that provides specific system-level information.

“A common theme among many of our customers is that infrastructure is a big, difficult topic, and there’s so many moving parts to it, and Spacelift is in the unique position to connect all of those dots and provide a single layer of understanding of what we’re doing, why we’re doing it,”

Leveraging Spacelift’s core platform, Intelligence can be used by DevOps to quickly spin up prototypes and testing scenarios. It uses Claude Sonnet 4.6, though users can plug in their own LLM.

With this software users can:
- Ask questions about infrastructure state, changes and issues,
- Provision and manage infrastructure using natural language, while staying within policy guardrails,
- Receive AI-generated diagnostics,
- Cut onboarding time through guided learning.
Of course, businesses are not going to initially trust AI with their infrastructure, the very lifeblood of their business. The company set up its software to adopt incrementally, allowing users to build trust over time. Start with visibility, then move towards provisioning and automation.

Less Drift, Faster Experimentation

In his post, Davis shared some lessons the company learned from customers after fielding Spacelift Intent.

Cityblock Health, for instance, used Intent to get a handle on their infrastructure. Developers already had access to self-service infrastructure, but without central guidance or policy control, the platform team found all the deployments increasingly difficult to track. Intent eliminated the need for developers to understand the company’s cloud constructs. Instead, they deployed through natural language. The platform-defined policies kept everyone on the same page.

“For Cityblock, that shift was less about replacing Infrastructure as Code and more about changing how teams reached it,” he wrote.

For Vega, an asset manager platform provider, Intent brought the ability to experiment much more quickly, without touching production systems. It allowed developers and engineers to spin up new assets within a pre-defined set of guardrails, which ultimately hastened experimentation

Other Spacelift customers include Duolingo, Figma, Moody’s, Checkout.com, 1Password, and Redfin.

Spacelift will be demonstrating Spacelift Intelligence at its booth (#796) at KubeCon + CloudNativeCon Europe 2026, being held next week in Amsterdam.
March 18, 2026
Spacelift Adds Open Source AI Vibecoding Tool to Provision Infrastructure

Spacelift today unfurled an open source agentic artificial intelligence (AI) framework for managing infrastructure that eliminates the need for a developer to write any Terraform or OpenTofu code.

Marcin Wyszynski, chief research and development officer for Spacelift, said instead of generating code Spacelift Intent translates requests directly into an application programming interface (API) that interacts with a large language model (LLM) or AI agent via the Model Context Protocol (MCP) developed by Anthropic.

That approach provides IT teams with a vibecoding tool they can use to describe in natural language what task they want an AI agent to execute on their behalf without having to know Terraform or the HashiCorp Configuration Language (HCL), he added.

While generative AI technologies are probabilistic, they can still be reliably used for use cases that are not mission critical such as, for example, provisioning a database, said Wyszynski. The overall goal is to use AI to reduce toil where the level of potential risk is relatively minimal, he noted.

In contrast, professional developers that are provisioning infrastructure for mission-critical workloads should still write and test that code themselves, said Wyszynski. However, there are plenty of instances where the level of rigor that needs to be applied to how infrastructure is provisioned doesn’t need to be as high, he added.

Terraform and OpenTofu are for production pipelines where precision and review matter most, said Wyszynski. Spacelift Intent is for everything else that requires more speed and simplicity, he added.

Spacelift is also providing early access to SpaceLift Intent within the Spacelift Infrastructure Orchestration Platform, a commercial instance of the framework it makes available for managing infrastructure as code (IaC) using a Spacelift policy engine to manage state and provide audit trails.

It’s not clear to what degree DevOps teams are adopting AI but usage of these tools is already pervasive. The issue now is determining to what degree to rely on AI tools that have a propensity to generate flawed code that may have hidden vulnerabilities or is simply too verbose to be cost-effectively deployed. There are, of course, hundreds of use cases where those issues are not going to be as much a concern as it might be when developing business logic, so each organization will need to determine the extent to which they will allow developers to use AI.

The one thing that is certain is the economics of building and deploying software are changing in a way that should enable organizations to build and deploy more software than ever assuming they have the processes and platforms that will be needed to manage building and deploying code at levels of unprecedented scale and complexity.

In the meantime, however, there is little doubt that AI will automate tasks in ways that should eliminate bottlenecks and make DevOps workflows much less tedious to manage. Hopefully, that should help reduce the current level of burnout that many software engineers have historically experienced without introducing too much instability into software development environments that are already notoriously fragile.

October 8, 2025
Scaling DevOps: Tackling Infrastructure Automation

Spacelift CEO Pawel Hytry dives into the infrastructure automation challenges DevOps teams are facing following the picking up of an additional $51 million in financing.

Infrastructure-as‑code was supposed to make provisioning easy—copy some Terraform, hit “apply,” and move on. In practice, teams soon discover that version‑controlled snippets are only half the story. Once dozens of developers start spinning up resources, you still need collaboration, security reviews, cost oversight and a reliable audit trail. Hytry explains why his biggest customers hit a wall: what used to take a day to deploy now drags on for a week because manual approvals, rollbacks and duplicated code clog the pipeline. The tipping point usually arrives when an infrastructure lead realizes the team is hiring people just to babysit scripts.

Hytry argues that the answer isn’t to lock everything down; it’s to add “guard‑railed self‑service.” A central platform team defines reusable modules and policies, then lets application squads launch infrastructure inside those boundaries. That keeps velocity high while preventing surprise cloud bills or rogue ports. He frames the approach as a natural fit for the rise of platform engineering, where one group maintains the paved road so everyone else can drive fast without veering off a cliff.

AI enters as a helper, not a takeover artist. Hytry envisions agents that trace resource drift or predict cost spikes, with a human still approving changes—at least for now. The broader lesson, he says, is to replace brittle, ticket‑based processes with automated pipelines that scale as headcount and complexity grow. Teams that ignore the sprawl will keep paying in slow deploys, mounting cloud spend and tired engineers.

July 15, 2025
Spacelift Adds On-Premises Edition of Infrastructure Management Platform

Spacelift has made available an on-premises edition of a platform for automating the provisioning and management of IT infrastructure that previously was only accessible via a software-as-a-service application.

Company CEO Pawel Hytry said the on-premises edition of the platform satisfies both the requirements of highly regulated industries and the emergence of sovereign cloud requirements that stipulate data must remain within a specific geographic region.

Regardless of whether this edition of Spacelift is deployed in a local data center or in a cloud service that ensures IT infrastructure is restricted to a single availability zone, the Spacelift observability platform can now be deployed in a way that satisfies any compliance requirement, he added.

It’s not clear how many organizations that previously relied on a SaaS edition of the platform might be required to shift toward an on-premises edition because of sovereign cloud requirements that have risen in the wake of recent globe trade tensions. Organizations in Europe have now become especially sensitive to dependence on IT infrastructure that might reside in the U.S. out of fear that the U.S. government might impose additional restrictions in the form of, for example, a tariff on digital services.

It’s also unclear how many providers of SaaS platforms might need to address similar sovereign cloud requirements, but it’s evident IT teams will soon have a lot more deployment options to consider.

In the meantime, Spacelift is making a case for a platform that makes it easier to enforce best practices across the infrastructure-as-code tools that application developers routinely use to provision IT infrastructure. The challenge organizations are encountering is that much of that infrastructure is misconfigured in ways that enable cybercriminals to exploit vulnerabilities.

Unfortunately, a recent Spacelift survey found that only 14% of respondents have fully implemented infrastructure automation best practices. The bulk of organizations, in fact, have simply created various islands of automation that they then attempt to manually integrate using multiple scripts, noted Hytry.

Hopefully, with the rise of platform engineering, more of the management of infrastructure will become automated. A recent survey conducted by Futurum Research finds that adoption of platform engineering as a methodology for building and deploying applications at scale is gaining significant traction, with more than a quarter of respondents (26%) having mastered platform engineering, compared to 41% who are still working toward applying platform engineering across multiple projects. Another 24% are still working toward operationalizing a set of best practices for platform engineering, while 7% are just getting started.

Roughly half of platform engineering teams provide cloud/multi-cloud management (52%) and dev/test/production environment support (48%). DevOps toolchains (43%), standard platform configurations (42%), and containers/Kubernetes (41%) support are also prevalent.

Regardless of the approach to IT infrastructure automation, the need to unify the management of platforms has become a more pressing issue. Each platform an organization deploys tends to increase the total cost of IT simply because an additional team of IT professionals is usually required to manage it. Hopefully, as more artificial intelligence (AI) is applied to the management of IT infrastructure, the ability to scale those teams will significantly increase in the months and years ahead.

June 27, 2025