Open source software underpins virtually every modern application. That ubiquity is a superpower for developers, but it is also an expanding attack surface. Software supply chain attacks were once rare but are now happening daily, with malicious actors exploiting the trust developers place in public registries, package managers, and CI/CD pipelines.

Chainguard is a secure software supply chain platform. The company started with hardened container images and has expanded to cover domains including VMs, language libraries, GitHub Actions, and agent skills.

Matt Moore is a co-founder and CTO of Chainguard, and a veteran of Google’s open source, container, and security infrastructure work. In this episode, Matt joins Gregor Vand to discuss lessons from recent supply chain attacks, why CI/CD pipelines are now a primary attack surface, the challenge of meaningful software inventories, the EU Cyber Resilience Act, and what the arrival of Anthropic’s Mythos model means for the pace of vulnerability discovery and the urgency of patching at machine speed.

Sponsorship inquiries:
[email protected]

The post AI-Powered Threats to the Software Supply Chain appeared first on Software Engineering Daily.

The most useful coding agents can mutate their environments by downloading packages, writing files, and connecting to services across the network. However, that freedom also presents dangers, and promises to usher in a new wave of security threats.

Docker recently announced Docker Sandboxes, which give each agent its own isolated micro VM while preserving the familiar ergonomics of a container. A standard container shares the host’s kernel, but a micro VM emulates hardware and runs its own kernel, giving a stronger security boundary around code that cannot be trusted.

Mark Cavage is the President and COO of Docker, and he previously worked at companies including Stripe, AWS and Oracle. In this episode, Mark joins Gregor Vand for a wide-ranging conversation that includes why agents break the immutability assumptions containers were built on, how micro VMs differ from both containers and traditional VMs, and the still-unsolved challenge of giving agents scoped, trustworthy access to sensitive services and data.

Sponsorship inquiries: [email protected]

The post Docker and Sandboxing AI Agents appeared first on Software Engineering Daily.

Golden Gate Ventures is one of Southeast Asia’s most established early-stage venture firms, having backed companies across the region since 2011. They have invested in companies that are now household names in the region. Examples include Gojek, which started as a motorcycle taxi service in Indonesia and grew into a super app spanning payments, food delivery, and logistics, and Grab, which began as a ride-hailing service in Singapore and similarly expanded across Southeast Asia into food delivery and financial services.

Jeffrey Paine is a co-founder and partner at Golden Gate Ventures. In this episode, Jeffrey joins Gregor Vand to discuss how the Southeast Asian startup ecosystem has evolved, why the regional copycat model is giving way to globally ambitious technical founders, what companies like Manus and Supabase reveal about Singapore’s emerging role in the global tech landscape, and what advice Jeffrey gives founders today who want to build something that matters beyond their home market.

Sponsorship inquiries: [email protected]

The post The Startup Scene in Southeast Asia appeared first on Software Engineering Daily.

AI agents have shown remarkable potential to function as persistent digital assistants that are capable of monitoring data, managing communications, and taking action autonomously over long periods. OpenClaw was one of the first serious attempts to fulfill that vision, connecting frontier coding agents to messaging platforms like Slack and WhatsApp and letting them run continuously in the background. However, OpenClaw largely set aside questions of security to pursue that vision, leaving credentials exposed in the agent’s environment and giving agents broad access to data and services far beyond what any given task required.

NanoClaw is an open source project that takes a zero trust approach to agent orchestration. Rather than relying on instructions to constrain agent behavior, it isolates each agent in its own Docker container, keeps credentials entirely outside the agent’s environment, and enforces human-in-the-loop approval for sensitive actions.

Gavriel Cohen is the founder of NanoClaw and he joins Kevin Ball to discuss the security architecture behind NanoClaw, how the agent sandbox and proxy model work in practice, how agents communicate with each other and with the host orchestration process, how the project approaches context window management and long-lived agent sessions, and more.

Sponsorship inquiries: [email protected]

The post NanoClaw and the Rise of Personal AI Agents appeared first on Software Engineering Daily.

AI agents have become capable of reasoning across large amounts of data, calling tools, and taking sequences of actions autonomously. These qualities make them well suited to some of the most persistent pain points in DevOps, including the on-call engineer woken at 3 AM to diagnose an incident, the build failure that takes hours to trace back to a root cause, and the operational toil of modern software delivery. Agentic DevOps is the emerging paradigm that applies these capabilities to the full software lifecycle, with the goal of matching the velocity of modern software delivery with an equally capable operational layer.

Neha Gaswamy leads Agentic DevOps at AWS and has been at Amazon for over twenty years. In this episode, she joins Matt Merrill to discuss the AWS approach to agentic DevOps, how Amazon dogfoods its own DevOps tooling, how their DevOps agent works from alarm to root cause, why determinism still matters in an agentic world, creative MCP integrations customers are building, and what the future holds for SRE engineers as agents take on more of the operational work.

Sponsorship inquiries: [email protected]

The post Agentic DevOps at AWS appeared first on Software Engineering Daily.

AI agents have transformed how software gets written, but the operational side of running software in production has not yet experienced a similar revolution. The same teams responsible for keeping systems healthy, investigating incidents, and managing reliability are still doing much of that work manually.

Mezmo is a Production AI company that makes autonomous operations fast, efficient, and safe. Their open source project, AURA, is a declarative agent framework specifically designed for SRE and platform engineering workflows. It takes a Kubernetes-inspired approach where teams define what they want agents to do rather than scripting every step of how to do it.

Andre Elizondo is the head of product at Mezmo, and he has a background in systems engineering, SRE, and observability. In this episode, Andre joins Kevin Ball to discuss what makes SRE agent workflows fundamentally different from coding agents, how AURA handles context engineering, AURA’s declarative configuration model, the spectrum of agent autonomy, and where the role of the SRE is headed as agents take on more of the operational work.

Full Disclosure: This episode is sponsored by Mezmo.

Kevin Ball or KBall, is the vice president of engineering at Mento and an independent coach for engineers and engineering leaders. He co-founded and served as CTO for two companies, founded the San Diego JavaScript meetup, and organizes the AI inaction discussion group through Latent Space.

Please click here to see the transcript of this episode.

Sponsorship inquiries: [email protected]

The post AURA and Open-Source Agents for Production Operations appeared first on Software Engineering Daily.

Eric Ries is the creator of the Lean Startup method and the author of the New York Times bestseller The Lean Startup, which transformed how a generation of founders and engineers think about building products. It introduced concepts like the MVP, the pivot, and build-measure-learn that are now so widely adopted they feel obvious. Over two decades of working with founders, CEOs, and investors, Eric has observed that some companies built on those principles eventually betray the very customers and engineers who made them great. His new book, Incorruptible: Why Good Companies Go Bad and How Great Companies Stay Great, is his attempt to answer the question of whether it is possible to build a company that resists that fate.

In this episode, Eric joins Gregor Vand for a wide-ranging discussion about why so many great companies lose their way, and what software engineers and founders can do today to build or find companies that are genuinely resistant to corruption.

Sponsorship inquiries: [email protected]

The post Eric Ries on Why Good Companies Go Bad appeared first on Software Engineering Daily.

SED News is a monthly podcast from Software Engineering Daily where hosts Gregor Vand and Sean Falconer break down the biggest stories shaping software engineering, Silicon Valley, and the broader tech industry.

In this episode, Gregor and Sean dig into the growing tension around restricted AI models, including Anthropic‘s Fable being pulled from the Claude platform days after launch. They explore what Sean calls “vibe regulations” and the risk foreign governments and enterprises face when a model they depend on can be cut off. They also cover the FT’s reporting on London’s “DeepMind mafia,” a vibe-coding clone controversy involving YC-backed Corgi and Papermark, SpaceX‘s acquisitions of Cursor and Mesh, and Anthropic’s launch of Claude Science.

They also take on the latest round of the IDE wars, and explore who owns your dev toolchain, the vendor lock-in that now comes from context and memory rather than the model itself, and the widening cost gap between frontier tools and open weight models. As always, the episode wraps up with a few standout Hacker News threads.

The post SED News: Restricted Models, IDE Wars, and the DeepMind Mafia appeared first on Software Engineering Daily.

Advanced software systems have long been more complex than any single engineer can fully understand. Observability is the established solution to this problem, but with AI agents now generating code, deploying changes, and operating autonomously, the challenge of understanding large software systems is entering a new dimension.

Grafana is an open source observability platform, and one of the most widely used in the world. The company builds tools that help teams collect, visualize, and act on telemetry data across logs, metrics, and traces. They are now extending that capability into the agentic era with AI-powered investigation and monitoring tools.

Anthony Woods is a co-founder of Grafana Labs. In this episode, he joins Matt Merrill to discuss how AI-generated code is straining software operations, why telemetry data volume has become as much a problem as a solution, how Grafana is adapting to a world where agents are the primary consumers of observability data, and what keeps him up at night about where the industry is headed.

Sponsorship inquiries: [email protected]

The post Grafana’s Approach to AI-Native Observability appeared first on Software Engineering Daily.

Building great software always involves technical problem solving, but the best software goes beyond function. It feels fluid, coherent, and genuinely fun to use. This quality lives at the intersection of engineering and design, and very few teams know how to reliably produce it.

Metalab is an engineering and design studio that has worked with some of the most successful companies in tech, including Apple, Slack, Uber, and Instacart. The studio is known for bringing together software engineering and design craft in a way that few studios can match.

Wesley Yu is the VP of Engineering at Metalab, where he leads the teams that design and build digital products for early-stage companies. In this episode, Wesley joins Josh Goldberg to discuss how Metalab approaches tech stack selection for client projects, why agency work demands a bias toward boring and stable technology, how iterative development and deliberately ugly apps lead to better final products, and how AI tools are changing the boundary between design and engineering.

Sponsorship inquiries: [email protected]

The post Building Software That People Love appeared first on Software Engineering Daily.

Yacht Club Games is the studio behind the acclaimed Shovel Knight franchise. Their latest release is Mina the Hollower, which is a top-down action RPG inspired by classic Zelda and Castlevania titles. After many years in development, the game recently launched to widespread critical acclaim.

David D’Angelo is a lead programmer at Yacht Club Games. In this episode, David joins Joe Nash to discuss the custom C++ engine built for Mina the Hollower, how the team approached Game Boy Color art constraints and audio in a modern rendering pipeline, the game’s Castlevania-inspired combat philosophy, how the open world manages saving and collision without load screens, and more.

Sponsorship inquiries: [email protected]

The post Mina the Hollower appeared first on Software Engineering Daily.