AI Agents Move Into Execution, Secure Build Infrastructure Becomes the New Control Plane

AI Control Planes Move From Assistance to Execution

Vercel’s acquisition of Stakpak, AWS’s expansion of its DevOps Agent, and Unity’s new CLI all point to the same shift: AI is moving from advisory tooling into production control planes that execute, verify, and govern operational work. Stakpak brings an autonomous DevOps agent stack and open-source codebase for cloud infrastructure management, with reported results cutting infrastructure work from about four hours to 50 minutes. AWS is extending its agent to 24/7 incident triage, root-cause analysis, and release-readiness workflows that can start from CloudWatch alarms or ServiceNow tickets and feed findings back into Slack, PagerDuty, and ITSM systems.

The strategic bottleneck is no longer access to AI features; it is safe orchestration across deployment, security, and incident response. ServiceNow remains focused on incident and change workflows, while AWS also pushed AI-based multicloud security controls and AlgoSec launched a unified hybrid cloud policy platform. OutSystems says 96% of enterprises already use AI agents and 97% are exploring system-wide strategies, but Deloitte finds only 21% have mature agent governance. That gap makes verification, policy design, and auditability the new competitive moat for vendors and the new operating requirement for enterprises.

Secure Build Infrastructure Becomes a Control Plane

BellSoft this week released a hardened Paketo builder image for Cloud Native Buildpacks that works as a drop-in replacement for existing Paketo builders, requiring only a builder configuration change. The image swaps standard stacks for BellSoft Hardened Images on Alpaquita Linux, enforces non-root execution, reduces mutable packages, and ships with signed images, SBOMs, and verifiable provenance. BellSoft also said it will continuously patch under an SLA, with updates published about 24 hours after CVE disclosure.

The release lands alongside Insignary’s on-demand SBOM compliance tool, Codenotary’s free security platform for AlmaLinux, the U.S. mandate for full defense supply chain mapping, and Booz Allen’s expansion of Chainguard across federal agencies. Together, these moves show secure-by-default build infrastructure becoming a distinct DevOps layer, not just a downstream scanning add-on.

For operators, the implication is clear: internal developer platforms need consistent, auditable build substrates across Java, Python, Node.js, Go, Ruby, and GraalVM on x86-64 and ARM64. For vendors and investors, value is shifting toward the secure build layer itself, where trusted artifacts, remediation speed, and compliance packaging can create durable differentiation and recurring spend.