June 2026 Summaries

Groundcover's recent launch of Agent Mode Connectors aims to enhance AI observability by integrating seamlessly with tools such as Slack, Linear, and Jira, thus improving the flow of data and reducing the "knowledge wall" often faced by new employees and AI agents. This update allows teams to maintain high-fidelity telemetry data within their existing workflows, making investigation and decision-making processes more efficient. The integration supports custom skills and connectors, enabling agents to access and utilize the necessary context for more structured and consistent behaviors aligned with team practices. This launch also emphasizes the importance of governance, with strict controls over tool access and user-specific rules to ensure data security and integrity. Groundcover's Bring Your Own Cloud approach offers scalability advantages over traditional observability platforms, allowing users to maintain comprehensive data without the constraints of metered, cloud-hosted pipelines. The update is part of broader platform improvements that focus on enhancing dashboards, easing migrations, and ensuring the reliability of monitors, ultimately enabling teams to transition more smoothly from signal to understanding to action.

The blog post explores the topic of AI observability and agentic development, focusing on building an AI-powered SLO remediation workflow with tools like Groundcover, Claude Code, and MCP, while addressing the security risks associated with AI agent setups known as the "lethal trifecta." This framework identifies potential vulnerabilities when AI agents have access to private data, exposure to untrusted content, and the ability to externally communicate. The post discusses projects like Gas Town and Wasteland that exemplify these risks and presents a demo that illustrates how such risks can be managed in a controlled environment. The demo involves deploying a buggy microservice to EKS, using Groundcover for observability, and running Claude Code to autonomously detect, diagnose, and file incident tickets for SLO breaches. It emphasizes the importance of human oversight in AI workflows to mitigate potential security threats. Additionally, the post highlights the need for careful consideration of network boundaries and security measures when integrating observability solutions with external tools, especially in regulated sectors.

In "We Need to Talk About Context," Adam Hicks discusses the critical role of context in understanding and solving problems, particularly in the realm of AI observability. Hicks shares a personal anecdote about receiving a vague message that led to anxiety due to lack of context, paralleling this experience with how AI models operate. He emphasizes that while AI can be adept at tasks like coding, its effectiveness is limited without contextual grounding, as it lacks inherent state or understanding of specific environments. Hicks introduces groundcover's approach to enhancing AI's problem-solving capabilities through the use of Connectors, which integrate various data sources such as Slack, coding agents, and telemetry to provide a comprehensive context. This integration allows AI to more accurately diagnose and propose solutions to issues by connecting contextual dots that humans typically have to piece together manually. The new Connectors, available from June 29, 2026, aim to transform AI from a reactive tool to a proactive partner in incident management, allowing users to focus on directing work rather than manually compiling information.

eBPF (extended Berkeley Packet Filter) is transforming observability by capturing system-level data that traditional instrumentation methods might miss, offering a comprehensive view into software behavior without requiring code changes. Operating at the kernel level, eBPF tracks network traffic, file reads, and process activities, providing a detailed network topology even in uninstrumented areas. This capability complements OpenTelemetry (OTel), which structures and deepens insights where intentional instrumentation is applied. However, eBPF increases data volume, which can lead to higher costs with SaaS vendors that charge by volume, making the Bring Your Own Cloud (BYOC) strategy appealing for cost control. Groundcover's recent launch of connectors enhances the utility of eBPF and OTel data by allowing seamless sharing with various productivity tools, enabling faster incident resolution and reducing the need for manual context gathering. This integration allows engineering teams to leverage complete telemetry data effectively, facilitating a more efficient workflow by automatically investigating and addressing issues within the engineering stack.

OpenTelemetry (OTel) has become the standard for observability, aiming to solve interoperability issues among various telemetry formats and reduce vendor lock-in, but it falls short in addressing data completeness and the complexities introduced by AI workloads. While it allows for vendor-neutrality and easier switching between observability tools, incomplete telemetry and the cost of data sampling remain significant challenges, as many engineering leaders report. To enhance observability, eBPF is suggested as a complementary technology to OTel, providing network-level insights without prior instrumentation, thereby filling gaps in data collection and offering a more comprehensive view when combined with OTel's deep trace capabilities. Groundcover's upcoming connectors aim to leverage the combined strength of high-fidelity OTel and eBPF data, enabling seamless integration with tools like Slack and Jira to proactively manage incidents and improve developer workflows. The adoption of OTel is recommended to avoid vendor lock-in, but reliance solely on it for observability should be approached critically, with eBPF acting as a necessary supplement to capture uninstrumented network activity and guide further instrumentation efforts.

Groundcover's journey to develop a custom dashboard engine for full-fidelity observability illustrates the challenges faced by startups in handling large volumes of time-series data without data sampling or rate limiting. Initially using ECharts, the team encountered limitations in customization and performance, prompting them to build their own SVG-based charting library, which later proved inadequate for handling complex dashboards. The company's journey involved decomposing performance issues into five distinct contracts, leading to the development of a hybrid rendering approach using both SVG and Canvas to optimize throughput and interaction. This evolution was underpinned by a year-long maturation of their chart components' API and extensive automated testing, allowing a swift transition to a more scalable and responsive system. The narrative highlights the iterative growth process, where each phase of development built on the learnings and capabilities acquired from the previous challenges, culminating in a system that significantly improved data rendering capabilities and user interaction, setting a new standard for observability tools.

Groundcover has successfully transformed OpenTelemetry (OTel) from merely a trace source into a comprehensive Application Performance Monitoring (APM) producer, allowing for accurate service metrics, dashboards, and alerts without the need for eBPF. This advancement enables users to access APM data directly from their OTel spans, providing a complete observability solution that integrates seamlessly with existing infrastructures. The company has addressed the challenge of having two data producers—eBPF and OTel—by tagging the data source, ensuring accurate aggregation and preventing double-counting in metrics. Groundcover's approach includes a query system that requires specifying resource type and traffic direction, enhancing the precision and reliability of APM queries. This development allows users to build detailed dashboards and alerts based on real service telemetry, making APM a crucial data source within groundcover's observability ecosystem.

Groundcover's latest product update introduces Agent Mode, a tool designed to capture and automate the expertise of system engineers, allowing incident investigations and resolutions to occur without direct human intervention. By encoding an engineer's judgment and playbooks into the system, Agent Mode enables on-call engineers to resolve issues using previously gathered insights without needing immediate knowledge of the service in question. This system leverages eBPF for baseline data collection and integrates with OpenTelemetry, ensuring comprehensive monitoring without extensive instrumentation. The platform respects user-defined access boundaries and retains the audit trail within the user's cloud environment, enhancing security and compliance. Groundcover's approach transforms the role of platform engineers by reducing the reliance on individual expertise for incident management and enabling systems to self-improve based on past resolutions, aligning with the trend of AI-native operational tools.

Groundcover has introduced significant updates to its Real User Monitoring (RUM) capabilities, focusing on improving session replay and integrating it seamlessly with client-side traces. These enhancements allow users to navigate directly from a trace to the corresponding RUM session, facilitating faster identification and debugging of front-end issues by visualizing the user's experience alongside telemetry data. The session replay feature is now interleaved with telemetry, providing a comprehensive view of user interactions, network requests, and custom events, which aids in understanding the root causes of issues. Additionally, the session summary tables have been redesigned to prioritize important user and session details, improving the triage process. Upcoming features include the ability to obfuscate personal data, support for mobile native RUM, and a new logging API with custom attributes. These developments aim to enhance user experience and data control while maintaining data within the user's cloud environment.

Privilege escalation in Kubernetes occurs when resources, such as Pods or service accounts, gain unauthorized permissions due to configuration errors, posing significant security risks including disruption of workloads, data manipulation, and host takeovers. This issue often arises from misconfigurations in Role-Based Access Control (RBAC), Pod Security Standards, and Security Contexts, as well as vulnerabilities in the Linux kernel and container runtime. Detecting privilege escalation is challenging because Kubernetes lacks built-in mechanisms to spot these incidents, but auditing tools and eBPF can help monitor suspicious activities like unexpected role changes or containers running in privileged mode. Mitigation strategies include hardening RBAC permissions, enforcing Pod Security Standards, configuring secure Security Contexts, and using admission controllers to block risky configurations, while best practices such as applying the principle of least privilege and isolating privileged workloads further reduce risks. Groundcover offers runtime observability that enhances detection capabilities by monitoring all cluster components for anomalous behaviors indicative of privilege escalation attempts.

Groundcover has introduced its Agent Mode feature to the Microsoft Azure ecosystem during the Microsoft Build event, expanding its observability capabilities for production AI. Agent Mode acts as an expert user, providing engineering teams with real-time insights into production incidents by analyzing infrastructure and correlating logs and traces. This feature allows data privacy by operating within the customer's own cloud infrastructure, leveraging the bring-your-own-cloud (BYOC) model, which ensures that all data remains within the client's environment. The use of eBPF technology enables access to performance data without requiring full instrumentation, making it beneficial for applications that lack manual telemetry setups. Groundcover offers this service without additional data volume or query frequency costs, basing its pricing on node count instead. The platform's ability to query data without external routing enhances privacy and security for engineering teams, and it integrates seamlessly with existing Azure services, even for those not fully instrumented.