July 2026 Summaries

Harness has introduced the public beta of its new CLI, a unified command-line tool for the entire Harness platform, replacing the previous fragmented module-specific CLIs with a single binary, grammar, and authentication process. This development streamlines terminal workflows for developers and AI agents, allowing for consistent and predictable command outputs crucial for automation. The CLI is designed to support secure DevSecOps, enhancing the user experience by providing a cohesive environment where all platform modules can be accessed using a unified set of commands. The CLI operates with six core verbs and allows users to explore and interact with the platform's resources through a self-describing interface, ensuring transparency and ease of use. It is open-source, allowing for community contributions and verifiability, and supports a wide range of functionalities across the software delivery lifecycle, including CI/CD pipelines, governance, and audit trails. The CLI aims to facilitate faster deployments, reduce platform maintenance complexity, and provide first-class support for agents, marking a significant step in integrating AI-driven automation within DevOps workflows.

Runbooks remain essential in software systems and incident response automation due to their actionable, accessible, accurate, authoritative, and adaptable nature. While the core attributes of a good runbook have not changed, the evolution of tools like Harness AI SRE has transformed their application, enabling automated execution, ticket filing, rollbacks, and incident timeline updates without manual intervention. Runbooks are crucial when processes are too nuanced for full automation, providing structure and guidance for tasks such as incident investigation, complex business processes, and repetitive development activities. Best practices for runbooks include ensuring they are easily searchable, regularly updated, and authoritative, with a focus on adaptability to keep pace with system changes. Harness AI SRE enhances runbook functionality by integrating them into incident response, allowing direct interaction with connected systems and executing Harness pipelines without additional configuration, thereby reducing mean time to recovery (MTTR) and allowing teams to focus on tasks requiring human judgment.

The "State of AI-Driven Software Releases 2026" report highlights how AI coding tools have accelerated the pace of code production but reveals a lag in the processes needed to safely release that code into production. The report, based on feedback from over 500,000 engineers, identifies code review as a significant bottleneck, with 57% of organizations still requiring human intervention for AI-generated code, thus slowing down the release process. It emphasizes the necessity of adopting progressive delivery practices like feature flags to decouple deployment from release and mitigate risks through controlled exposure. Additionally, the report points out that only half of the organizations have implemented specific guardrails for AI-generated code, indicating a gap in adapting traditional SDLC rigor to AI-driven development. While there is an uptick in experimentation facilitated by AI tools, the lack of adequate metrics to measure the impact of these tools is a challenge, with only 29% of organizations evaluating their effect. The report concludes that to harness AI velocity effectively, teams need to integrate progressive delivery, automated guardrails, and connect experimentation with actionable insights, ensuring AI's potential does not compromise software quality and safety.

In the evolving landscape of software delivery, compliance often poses a significant challenge, leading to delays and increased workload for security and governance teams. In response, the introduction of Policy Packs offers a streamlined solution by providing a curated library of pre-written Rego policies, aiming to align the software delivery lifecycle with prevalent compliance frameworks such as SOC 2, NIST, PCI DSS, and HIPAA. These Policy Packs simplify the governance process by eliminating the need to write and maintain complex code from scratch, thus allowing teams to focus more on feature deployment rather than policy writing. They cover essential compliance domains like access control, change management, and vulnerability management by embedding checks directly into CI/CD pipelines, ensuring that compliance is a continuous process rather than a point-in-time audit. This approach addresses common challenges such as the "audit readiness" blind spot and manual approval bottlenecks, by automating compliance checks and shifting governance left, which helps accelerate audit readiness and reduce risk. The Policy Packs facilitate adherence to compliance by turning framework requirements into actionable DevOps controls, thereby reducing manual intervention and ensuring that deployments are secure and compliant with industry standards.

In June 2026, the Mastra AI framework, a widely used open-source TypeScript ecosystem, suffered a critical software supply chain attack when 144 malicious packages were mass-published under the official @mastra npm scope by exploiting a compromised contributor account. The attack cleverly exploited the default package installation behavior to execute arbitrary code, bypass static scanners, and harvest sensitive credentials, using a transitive dependency named easy-day-js. By bypassing traditional verification and leveraging the compromised contributor account, the attackers managed to exploit trust in the automated software supply chain, turning it into a malware distribution channel. This highlights a shift in threat actor tactics towards poisoning the automated software supply chain rather than directly targeting production firewalls. The incident underscores the need for stringent security measures, such as enforced Multi-Factor Authentication and proactive environment isolation, to defend against such sophisticated attacks.

The post discusses the security architecture of Autonomous Worker Agents at Harness, emphasizing the concept of inherited governance and the need for robust isolation layers to prevent breaches. The authors describe a security model that assumes agents are already compromised and detail a four-layer defense system encompassing image hardening, process isolation, secret isolation, and network isolation. Each layer functions independently, ensuring that a failure in one does not compromise the others. The approach is compared to the Swiss cheese model, where overlapping layers of security cover each other's gaps, thus mitigating the risk of a breach. The text underscores the importance of treating agents as potential threats due to their interaction with untrusted inputs and stresses the need for continuous testing and validation of security measures through real-world breach simulations.

Harness, a leading platform in cloud-native solutions and CI/CD pipelines, released 62 new features in June, driven by AI advancements in code writing, testing, and review processes. The updates include Autonomous Worker Agents that transform pipeline steps into reasoning agents, a Directed Acyclic Graph for parallel pipeline execution, and AI Engineering Insights for tracking AI adoption and productivity. Enhancements also cover faster builds, improved test management, security scanning tailored for AI-generated code, and feature flags that update without redeployments. Additionally, the platform introduced tools for more precise cloud and AI cost management, auto-discovery of developer portal entities, Infrastructure as Code governance, and AI-driven security policy generation. These innovations aim to address the demands of increased code production velocity and enhance overall operational efficiency.

Harness AI Security offers a comprehensive platform designed to help organizations meet the compliance requirements of the EU AI Act by providing a unified control plane for AI discovery, risk visibility, and runtime protection. This platform automates AI asset discovery, risk identification, and classification, allowing security and compliance teams to maintain a continuously updated inventory of AI components without the need for manual cataloging. Harness supports key aspects of the EU AI Act by identifying high-risk systems, ensuring data governance, and providing detailed technical documentation and auditability. It also includes capabilities for logging and traceability, runtime enforcement against AI threats, and post-market monitoring, thus aligning with the Act's emphasis on transparency, traceability, and ongoing risk management. By integrating real-time alerts and offering seamless integration with SOC/SIEM workflows, Harness ensures that AI systems remain secure and compliant throughout their lifecycle.