DEVOPSdigest

Sonar announced the general availability of SonarQube Hunter Agent, an AI-powered security agent built to catch high-impact vulnerabilities that traditional pattern-based scanning was never designed to find. SonarQube Hunter Agent analyzes a project's entire codebase to find three categories of flaws that require reasoning, not pattern-matching: broken access control, business-logic vulnerabilities, and authentication or session-management issues.

The latest disruption with Anthropic's Fable 5 and Mythos 5 AI models is a cautionary tale. Their latest AI models were praised for their ability to handle agentic tasks, including coding and cybersecurity workflows ... Then the US government issues an export-control directive requiring companies to suspend access to Fable 5 and Mythos 5 to foreign nationals. To ensure compliance, Anthropic was forced to disable these two models. This presents a new kind of risk to AI customers ...

The speed of artificial intelligence (AI) adoption is driving the creation of new AI models that are faster and more efficient. Just as Moore's Law predicted that computer chips would double in processing power every two years, the release of new AI models every few months leaves AI adopters scrambling to keep pace. And as AI becomes part of daily operations, businesses become dependent on specific AI models they do not control.

It's understandable that security and DevOps teams are focused on fixing product flaws and suspect development practices. But governance needs to go beyond these potential pitfalls, to address what cyber criminals are targeting as a much more dangerous and too-often overlooked entry point: Who — or what — is controlling the code throughout the development lifecycle ... Much of the discussion around AI hallucinations focuses on the model itself.

It's understandable that security and DevOps teams are focused on fixing product flaws and suspect development practices. But governance needs to go beyond these potential pitfalls, to address what cyber criminals are targeting as a much more dangerous and too-often overlooked entry point: Who — or what — is controlling the code throughout the development lifecycle ... Much of the discussion around AI hallucinations focuses on the model itself.

It's understandable that security and DevOps teams are focused on fixing product flaws and suspect development practices. But governance needs to go beyond these potential pitfalls, to address what cyber criminals are targeting as a much more dangerous and too-often overlooked entry point: Who — or what — is controlling the code throughout the development lifecycle ... Much of the discussion around AI hallucinations focuses on the model itself.

With 98% of organizations experiencing a breach from vulnerable code according to Checkmarx — up from 78% in 2023 — it's understandable that security and DevOps teams are focused on fixing product flaws and suspect development practices. But governance needs to go beyond these potential pitfalls, to address what cyber criminals are targeting as a much more dangerous and too-often overlooked entry point: Who — or what — is controlling the code throughout the development lifecycle.

Much of the discussion around AI hallucinations focuses on the model itself. Teams debate benchmarks, retrieval techniques, guardrails and governance frameworks, all in pursuit of more accurate outputs. Those conversations matter, but what I've seen in my time in tech and research is that they can create a blind spot. AI products are not experienced in evaluation environments. They are experienced by people, operating in real workflows, under real pressures, making real decisions ...

Much of the discussion around AI hallucinations focuses on the model itself. Teams debate benchmarks, retrieval techniques, guardrails and governance frameworks, all in pursuit of more accurate outputs. Those conversations matter, but what I've seen in my time in tech and research is that they can create a blind spot. AI products are not experienced in evaluation environments. They are experienced by people, operating in real workflows, under real pressures, making real decisions ...

Much of the discussion around AI hallucinations focuses on the model itself. Teams debate benchmarks, retrieval techniques, guardrails and governance frameworks, all in pursuit of more accurate outputs. Those conversations matter, but what I've seen in my time in tech and research is that they can create a blind spot. AI products are not experienced in evaluation environments. They are experienced by people, operating in real workflows, under real pressures, making real decisions ...