#devsecops

Google Antigravity agents get full context with GitLab Orbit

GitLab Orbit, a lifecycle context graph that indexes GitLab projects, pipelines, merge requests, vulnerabilities, and source code into a knowledge graph, is now available in the Google Antigravity MCP Store. Developers using Google's agent-first platform can install Orbit directly from settings and give their AI agents structured access to GitLab data via two MCP tools: query_graph and get_graph_schema. This integration enables agents to answer complex questions about software dependencies, in-flight merge requests, and code ownership without manual context switching. Early internal tests showed agents grounded with Orbit responded up to 11x faster, used 4.5x fewer tokens, and produced 45x fewer hallucinations. Orbit is available for GitLab Premium and Ultimate tiers and uses the same knowledge graph that powers the GitLab Duo Agent Platform.

The AI Remediation Bottleneck: Why the Software Supply Chain Demands Radical Openness

Các công cụ phát hiện lỗ hổng bằng AI đang phát triển nhanh hơn khả năng khắc phục của con người, gây tắc nghẽn trong quy trình DevSecOps do các image container công cộng quá nặng nề, chứa hàng trăm CVE ngay từ đầu. Bài viết đề xuất giải pháp sử dụng kiến trúc distroless, tái xây dựng liên tục upstream, SBOM ký mã hóa và tích hợp image bảo mật sẵn vào workflow của developer để biến bảo mật thành tiêu chuẩn mặc định thay vì tính năng cao cấp.

Lập trình viên nên đọc bài này để hiểu cách tối ưu hóa công cụ phát hiện lỗ hổng AI và giảm thiểu rủi ro an ninh trong chuỗi cung ứng phần mềm bằng cách áp dụng kiến trúc container nhẹ, tự động hóa và công nghệ mở.

A Note to Our Customers and Partners

Snyk CEO Ken MacAskill announces an organizational restructuring aimed at accelerating the company's AI security strategy. The changes include team size reductions, a flattened leadership structure, and a unified R&D focus on four areas: AI-written code, autonomous agents in production, chained vulnerabilities, and persistent adversaries. Snyk highlights its AI Security Platform (Evo), including AI-SPM, Agentic Development Security, and Continuous Offensive Security products, along with partnerships with Cursor, Anthropic, and OpenAI.

Your developers are the attack surface now and vibe coding as a vulnerability | Tanya Janca

Tanya Janca, OWASP Top 10 Project Leader, explains why vibe coding has become a critical security risk and why developers themselves are now the primary attack surface. The newsletter also covers Meta's controversial restructuring (mandatory keystroke tracking, reassigning engineers to AI data labeling), Charity Majors' argument that AI-generated code demands more engineering discipline, the rise of domain-specific open-weight models like GLM-5.2, Microsoft potentially self-hosting DeepSeek for Copilot, and Anthropic's analysis of 400K Claude Code sessions showing humans drive 70%+ of planning while models handle 80%+ of execution.

Minimus Makes Hardened Container Images Freely Available to All Developers

Minimus is making its full catalog of hardened container images freely available to all developers with no registration required. The images are drop-in replacements for commonly used containers, built continuously from source with known vulnerabilities removed. A CLI tool called minicli lets developers and AI agents discover images and automate migrations. The move aims to reduce software supply chain risk at a time when AI is accelerating vulnerability discovery and exploitation. Minimus will monetize through enterprise support services rather than image access fees.