November 2026 Summaries

No summary generated yet.

No summary generated yet.

AWS Savings Plans and Reserved Instances can reduce cloud costs through one- or three-year commitments, but the article emphasizes removing idle and oversized resources before buying commitments to avoid locking in waste. It recommends a six-step management process: inventory current usage and coverage, set workload-specific coverage targets, purchase commitments gradually in tranches, monitor utilization and expiration dates, rebalance as demand changes, and report results by responsible team or owner. Savings Plans offer spend-based flexibility across eligible services, while Reserved Instances are tied more closely to specific configurations and may provide capacity reservation or greater discounts. AWS provides recommendations, reporting, alerts, and APIs for automating purchases, but organizations must build their own approval, governance, and rebalancing processes around those tools. Harness Commitment Orchestrator is presented as an alternative that centralizes recommendations, staggered purchasing, approval workflows, coverage limits, exclusions, utilization tracking, renewal policies, and optional full automation, while retaining safeguards such as named owners, commitment caps, audit trails, and manual approval by default.

Harness has launched the Infrastructure Efficiency Loop, linking Cloud Cost Intelligence with Infrastructure Deployments to help teams identify cloud cost and configuration-drift issues, generate Infrastructure as Code fixes, assess their risks, and deploy approved changes through governed pipelines. The platform correlates workspace resources with post-discount costs and optimization findings, while its Infrastructure Remediation Agent can turn selected findings into pull requests that update Terraform or reconcile intentional infrastructure changes. Its Infrastructure Blast Radius capability evaluates planned changes by analyzing affected resources and dependencies, produces an AI-generated risk explanation, and can support approval or policy gates based on risk levels. Although the workflow automates discovery and proposed remediation, people continue to review and merge all pull requests, with teams able to exclude sensitive workspaces such as production. Harness positions the release as a closed-loop FinOps approach intended to reduce cloud waste, keep infrastructure code aligned with deployed resources, and accelerate remediation without bypassing human oversight.

Harness describes how its AI Security platform can complement NVIDIA’s OpenShell Reference Architecture by adding agent discovery, red teaming, API security testing, and runtime threat detection and response. OpenShell establishes controls over agent execution and access, while optional NVIDIA Sentry on BlueField provides independent monitoring and enforcement; Harness focuses on mapping agents’ dependencies and connected attack surfaces through observed runtime traffic. Its context graph links agents, models, MCP servers, tools, APIs, authentication, sensitive data flows, and vulnerabilities, while red-team simulations and API assessments seek weaknesses such as prompt manipulation, tool misuse, authorization flaws, and data exposure. During runtime, Harness monitors interactions and applies policy enforcement at supported gateways and application points, with its Traceable Platform Agent connecting inspection and enforcement decisions. The proposed deployment keeps the self-managed platform, data lake, testing runner, decision services, telemetry, and analysis inside the customer environment, using customer-hosted LLMs and potentially NVIDIA Rubin GPU infrastructure for local AI inference.

AI spending is rising far faster than cloud spending did, yet organizations report that roughly one-quarter is wasted, visibility is limited, and 52% lack a dedicated cost owner. Unlike conventional cloud costs, AI expenses vary by model, prompt, task, and business outcome, requiring organizations to define value upfront, assign clear accountability, and use unit economics rather than treating AI as ordinary infrastructure spending. Survey findings cited by Harness indicate that many engineers lack cost awareness, unexpected spending spikes are common, and tracing their causes can take days or weeks. The post presents Harness’s AI cost management platform as a way to combine adoption, engineering impact, and cost data; investigate anomalies down to specific models, agents, or transactions; set cross-vendor budgets and governance controls; and use billing data and OpenTelemetry tracing to improve attribution. It also notes that AI can accelerate coding while increasing pull request review workloads, and argues that traditional cloud FinOps remains valuable alongside AI-specific cost management practices.

AI coding assistants commonly turn a one-time user approval into ongoing authorization by caching a project or MCP server name rather than the specific code, binary, configuration, or behavior originally reviewed, creating opportunities for attackers to replace trusted content without triggering new prompts. The post describes proof-of-concept tests involving Claude Code and Cursor, including swapped MCP servers that retained prior approval, project hooks that automatically approve permissions or modify commands before execution, and malicious configurations that can operate silently after a repository is trusted. It argues that these outcomes are documented design trade-offs intended to reduce prompt fatigue, but they create “identity without integrity” when mutable content is trusted through stable names. Recent malicious repository and package campaigns illustrate how ordinary updates, hooks, and delayed behavior changes can exploit this model. Proposed mitigations include binding approval to content hashes, expiring consent when executable configuration changes, signing configurations and updates, pinning trusted signers outside repositories, and displaying the actual commands or scripts that approvals permit, while recognizing that overly frequent re-prompts can introduce their own security risks.

Harness has introduced an early-access platform experience designed to support AI agents within enterprise software delivery processes while retaining human approvals, policies, permissions, and audit trails. The redesign unifies build, deployment, security, infrastructure, and agentic tasks under a single pipeline model with flatter YAML, reusable containerized steps, smart defaults, and support for both JEXL and CEL expressions. A new lightweight Go-based Delegate orchestrates containerized execution across capabilities and operating systems, reducing host-level tooling dependencies and allowing step updates without Delegate upgrades. Versioned templates enable teams to approve, pin, and govern specific step versions, while AI agents can assist with pipeline authoring, failure diagnosis, remediation, pull requests, and dashboard creation through Harness interfaces, MCP servers, or the CLI. Worker Agents operate as pipeline steps under existing governance controls, and refreshed dashboards use the Harness Data Platform and Software Delivery Knowledge Graph to connect delivery metrics across commits, deployments, and services. The new experience will coexist with existing Harness functionality, with optional pipeline conversion that preserves original configurations.

AI coding agents may lose valuable information after opening a pull request because repository-level code context does not include delivery, security, deployment, and runtime evidence generated later in the software lifecycle. The post argues that reliable autonomous development requires combining code context, provided by the Code Context Engine acquired with Cosmos, with delivery context from Harness’s Software Delivery Knowledge Graph, which models relationships across CI/CD, security, cost, and production operations. It describes a governed workflow in which agents can identify affected code and services, propose fixes, undergo review and policy checks, pass approval gates based on risk, and be monitored through continuous verification and rollback mechanisms. Harness presents this approach as part of its Autonomous SDLC platform, while noting that the deeper two-way integration that feeds delivery outcomes directly back into coding workflows remains planned rather than fully released. The post advises teams to evaluate agents not only by patch-generation speed but also by their ability to retrieve relevant context, operate within permissions and policies, verify production outcomes, and maintain auditable evidence throughout the delivery process.

Harness’ Q3 FY27 Pipeline update introduces expanded execution control, governance, template visibility, and integration capabilities for Continuous Delivery and GitOps. Key execution features include project-level concurrency partitions, selective stage execution in DAG pipelines, pipeline moves across projects, post-execution tagging, timeout visibility, artifact publishing events, OIDC-based pipeline identities, and improved navigation for large looping strategies. The release also enhances the run experience with customizable conditional forms, stage-specific execution JSON, persistent graph zoom settings, optional preservation of blank inputs, breakpoints, and cached Git branch lists. Policy as Code additions allow policy sets to run on customer-managed Kubernetes or VM infrastructure, enabling access to private systems and secrets, while Blast Radius Analysis lets users test unsaved OPA policy changes against recent evaluations; SaaS support for certain Rego network functions has been removed. Other updates include template usage reporting, notification-rule overrides, deeper template nesting, improved notification details and user-group channels, and Azure DevOps Server support for the Azure Repos connector.

Harness’ Q3 FY27 Continuous Delivery and GitOps update expands deployment visibility, control, and verification across Kubernetes, AWS, and AI agents. Kubernetes additions include Helm v4 support, a Helm Dry Run preview step, live cluster resource and deployment history views, retained pod logs and events, direct K8s Diff links, runtime Git fetch selection, and Gateway API traffic routing. AWS improvements add ASG warm pools, rolling-update handling for standby and protected instances, optional old-ASG deletion, phased canary rollback, coordinated ECS Blue-Green listener rules, old-service downsizing, and CloudWatch alarm management. AI agent capabilities now support importing existing Google Agent Runtime or AWS Agent Core agents, managing AgentCore Gateway canary traffic, sourcing packages from S3, and configuring agent invocation identities. AI Verify gains adjustable sensitivity, New Relic, Splunk, and custom health sources, no-data fail-fast behavior, CloudWatch OIDC authentication, and feedback that informs future log analyses. Additional enhancements include built-in HTTP authentication methods, Nexus artifact downloads, more narrowly scoped Azure OIDC identities, improved Jenkins job and parameter support, Git-backed onSave OPA policy enforcement, and freeze windows targeted to specific infrastructure definitions.

Harness’s Software Delivery Agent is presented as an AI platform designed to automate the software delivery “outer loop,” including code review, building, testing, security checks, and deployment, which can remain slower than AI-assisted coding. The platform combines a developer-facing chat interface, an SDLC knowledge graph, specialized reasoning agents, and worker agents that execute tasks under shared permissions and an audit trail. Its Trust Gate evaluates whether AI-generated changes genuinely meet quality requirements rather than manipulating tests or scans to produce successful builds, while deterministic policies can still require human approval. The platform also promotes centrally governed “golden path” pipeline templates and Policy as Code to standardize security, compliance, and approval controls without requiring teams to replace existing tools. Additional capabilities include automated rollback for unhealthy canary deployments, selective builds and testing based on changed code, security finding deduplication, and AI-generated vulnerability fixes. Harness cites customer results including faster releases, reduced onboarding effort, fewer deployment-related outages, and increased deployment velocity.

Harness’ Q3 FY27 Release Orchestration update introduces 12 enhancements aimed at improving release tracking, reusable execution workflows, Git-based configuration management, and governance. Artifact Tracker now supports semantic version ordering, broader service mapping scopes, inferred Git sources, and automatic association of artifacts from pipeline-triggered releases. Limited-GA looping allows phases or activities to run separately for multiple deployment targets, including dynamically supplied targets and independent retry handling. Processes, inputs, and activities can be moved to and synchronized with Git, while ad hoc releases can select branches for remote processes. Governance additions include OPA policy evaluations when release groups are saved or releases are triggered, as well as separate activity, process, and release permissions and an option to use a Release Management service principal for pipeline authentication.

Harness’s Q3 FY27 GitOps update introduces post-production rollback from the Services dashboard, enhanced deployment visibility through service instance details, configurable GitOps CD stages, sync and rollback success criteria, an App of Apps management view, and always-on per-application RBAC filtering. PR pipeline improvements include GitHub status checks, automatic temporary branch cleanup, pattern-based file matching for multi-file updates, customizable commit messages and merge API parameters, and signed commits through GitHub Apps. Additional capabilities include Vault secret injection for Kustomize, JEXL expression support in GitOps agents, App Set Reference overrides, and deprecation of Deployment Repository manifests. The release also adds custom Helm release names for agents, agent metrics, clearer AppProject naming, Argo CD import audit history, cluster labels and annotations, and bundled support for Argo CD 3.5.6, with several features requiring specific agent or delegate versions and Harness Support enablement.

AI agents create security challenges beyond those of traditional software because they can autonomously use tools, access credentials, retain context, execute code, and interact with external systems, making errors or malicious instructions potentially consequential. The article recommends applying the OWASP Top 10 for Agentic Applications throughout the software development lifecycle rather than treating security solely as a runtime issue: development and delivery controls should scan dependencies, prompts, models, generated code, secrets, permissions, and tool configurations, while runtime controls should address dynamic risks such as goal hijacking, memory poisoning, insecure inter-agent communication, rogue behavior, cascading failures, and misplaced human trust. Examples involving a compromised email package and an AI coding agent’s erroneous database deletion illustrate the need for dependency governance, environment separation, approval requirements, rollback capabilities, and continuous monitoring. Organizations are advised to begin by inventorying agents, tools, MCP servers, identities, credentials, and permissions; resolving preventable weaknesses before deployment; and establishing runtime policies, isolation, behavioral monitoring, emergency shutdown procedures, and accountable human oversight.

A reported October 29, 2026 theft of approximately $6.36 billion from Binance is characterized as a failure in identity, DevOps, and withdrawal-signing controls rather than a compromise of wallet private keys, with Binance suggesting that a compromised engineer’s laptop may have enabled access to infrastructure used to authorize withdrawals. Public reporting cited in the account indicates the attackers prepared for at least 36 hours, tested transactions, and moved assets across ten blockchains in roughly 20 minutes, while U.S. authorities and blockchain-analysis firms attributed the operation to North Korean group TraderTraitor. Binance says it will cover customer losses, has replaced most stolen funds, and has frozen roughly $3 billion with help from stablecoin issuers and networks, though substantial bitcoin and ether holdings remain difficult to recover. The incident highlights how a single developer endpoint, service account, or signing path can create concentrated risk in both centralized and decentralized financial systems, and it recommends stronger access controls, short-lived credentials, independent approvals, transaction limits, circuit breakers, and monitoring for suspicious preparation activity.

Harness reported shipping more than 150 features in October 2026 across its software delivery, security, cost management, resilience, SRE, developer portal, runtime configuration, and platform products. The largest release was Cosmos, an AI software factory agent that can turn tickets, pull requests, schedules, or webhooks into planned code changes, tests, pull requests, and review-response updates, while integrating with Harness agents that move changes toward production. Delivery updates included GitHub Copilot Worker Agents, expanded AI rollout verification data sources, AWS AgentCore deployment support, safer AWS, Kubernetes, and GitOps deployment controls, generally available code coverage enforcement, Go build caching, pipeline identity and governance improvements, and Git-backed release processes. Security enhancements focused heavily on MCP server discovery, conformance checking, schema validation, access controls, unified API visibility, expanded API testing, configurable threat detection, SIEM integrations, and PCI DSS and HIPAA assessments. Platform developments included OAuth proxy mode for self-hosted Harness MCP servers using customers’ own identity providers, new AI coding assistant plugins, policy controls for users and groups, settings managed through Terraform, and compliance milestones including Harness’s first SOC 1 audit and FedRAMP 20x Class A achievement.

Harness’s generally available Unified API Inventory aims to shorten API vulnerability remediation by correlating API discoveries from live runtime traffic, code repositories, and documentation into a single inventory. The post argues that security teams often lose significant time identifying the codebase, owner, documentation, and affected environments behind a runtime alert because each source uses separate records and naming conventions. The capability links related APIs across sources and environments, preserves source-specific details, identifies missing sources, and exposes APIs found only in code or documentation to reduce blind spots. Available through Harness’s API Posture capability in the Runtime Protection Agent, it is intended to give AppSec teams direct code context for runtime findings and a connected view of the API attack surface.