Automation | Techlist.io

metaMar 13, 20262 min readCurated summary

Patch Me If You Can: AI Codemods for Secure-by-Default Android Apps

Updating security-sensitive APIs across a massive mobile codebase is difficult because vulnerable patterns may appear across hundreds of call sites and millions of lines of code. Meta’s Product Security team addresses this through secure-by-default Android frameworks and generative AI that automates migrations to those frameworks. The approach enables security patches to be proposed, validated, and submitted with minimal effort from code owners. ## Secure-by-Default Mobile Frameworks - Meta wraps potentially unsafe Android OS APIs in frameworks designed to make secure implementations the easiest option. - Developers are guided toward safer behavior by default rather than being expected to recognize and avoid every security risk manually. - This strategy helps prevent a single vulnerability class from recurring across Meta’s many mobile applications. ## AI-Assisted Code Migration - Generative AI is used to migrate existing code from unsafe APIs to the new secure frameworks. - The system operates across millions of lines of code and numerous call sites. - It can propose security changes, validate them, and submit patches for review. - This reduces the manual work required from the engineers responsible for each application or codebase. ## Security at Massive Scale - Meta’s scale—thousands of engineers, multiple apps, and billions of users—makes conventional security updates difficult to coordinate. - The initiative combines framework design, automation, and engineering ownership to reduce friction while maintaining validation. - The accompanying Meta Tech Podcast episode features Product Security engineers Alex and Tanu discussing the challenges and lessons from this effort. Meta’s approach demonstrates that large-scale mobile security improvements are most practical when safer APIs and automated migration tools work together, allowing secure changes to spread broadly without requiring every engineer to perform the migration manually.

Read original

Automation Generative AI API Design Mobile Security+3

gitlabMar 10, 20263 min readCurated summary

Automating detection gap analysis with GitLab Duo Agent Platform

GitLab’s Signals Engineering team uses GitLab Duo Agent Platform to automate detection gap analysis after security incidents. The approach replaces inconsistent manual reviews with AI agents that examine incident issues, map attacker behavior to MITRE ATT&CK, and recommend actionable detection improvements. GitLab recommends starting with the built-in Security Analyst Agent, then creating a custom agent when organization-specific context is required. ## The Detection Gap Problem - A detection gap occurs when an attacker performs an action that existing detections fail to identify. - Reviewing gaps requires analysts to: - Read incident timelines, comments, and related artifacts. - Map attacker actions to detection opportunities. - Identify missing or insufficient alerts. - Recommend concrete detection improvements. - Manual analysis is time-consuming, inconsistent across reviewers, and easy to postpone. - GitLab embeds this process in the workflow where incidents already reside: GitLab issues. ## GitLab Duo Agent Platform - Duo Agent Platform supports agents that can reason, take actions, and interact with GitLab resources such as issues, merge requests, and code. - Teams can either: - Use pre-built agents with existing domain knowledge. - Build custom agents using a name, description, and system prompt. - The system prompt defines the agent’s role, knowledge, tools, and expected behavior. ## Security Analyst Agent - The built-in Security Analyst Agent can be invoked directly from a closed incident issue. - It reviews: - Incident descriptions and timelines. - Tasks and comments. - Linked artifacts and other issue content. - It can identify missed attacker tactics, techniques, and procedures and map them to MITRE ATT&CK. - It is useful for quick, low-configuration assessments, particularly when incident documentation is thorough. - Its limitation is a lack of knowledge about an organization’s specific SIEM, log sources, detection stack, and engineering standards. ## Detection Engineering Assistant - GitLab created a custom agent to provide recommendations tailored to its environment. - Building the agent requires only: - A name. - A description. - A system prompt. - The system prompt is central to the agent’s usefulness; detailed instructions produce more consistent and relevant results. ### Defining the Agent’s Role - The prompt explicitly identifies the agent as a detection engineering assistant responsible for analyzing incidents and finding coverage gaps. - Clear framing helps anchor the agent’s responses to the team’s actual responsibilities. ### Encoding Detection Principles - GitLab describes its preferred detection characteristics: - Low false-positive rates. - High signal fidelity. - Actionable alerts with useful response context. - The prompt favors behavioral detections over indicator-of-compromise approaches when practical. - It also addresses the tradeoff between broad coverage and alert fatigue. ### Providing Environment and Telemetry Context - The agent is told which log sources are available, what SIEM is used, and what telemetry is missing. - This prevents it from recommending detections that depend on data the team cannot access. ### Structuring Findings with MITRE ATT&CK - Gap findings are organized around ATT&CK tactics and techniques. - This provides consistent reporting and supports internal coverage tracking and prioritization. ### Standardizing Output - Each finding should include: - The relevant ATT&CK technique. - What attacker behavior was missed. - The log source or data needed for detection. - A recommended detection approach. - Consistent formatting makes findings easier to triage and convert into engineering work. - GitLab’s full system prompt contains 1,870 words and 337 lines, illustrating the level of detail used to tailor the agent. ## Practical Recommendation Use the Security Analyst Agent for an immediate first pass, but build a custom detection engineering agent when recommendations need to reflect your own telemetry, tooling, standards, and detection philosophy. A detailed system prompt is the key to turning general AI analysis into repeatable, actionable security engineering work.

Read original

Automation Machine Learning Gitlab DevSecOps+4

gitlabMar 5, 20263 min readCurated summary

Extend GitLab Duo Agent Platform: Connect any tool with MCP

GitLab Duo Agent Platform can connect to Jira and other MCP-compatible tools, allowing developers to manage project data through natural-language requests inside their IDE. The post explains how to configure Atlassian OAuth, register Jira as an MCP server, and verify the connection in GitLab and VS Code. It concludes with practical workflows for backlog planning and creating or triaging issues directly from code context. ## MCP Architecture - GitLab Duo Agent Platform operates as the MCP client. - The Atlassian MCP server: - Authenticates users - Converts natural-language requests into Jira API calls - Returns structured results to GitLab Duo - Maintains security and audit controls - This integration reduces context switching between Jira, GitLab, and the IDE. ## Configure the Jira OAuth Application - Create an OAuth 2.0 integration in the Atlassian Developer Console. - Add Jira API permissions: - `read:jira-work` for issues, projects, and boards - `write:jira-work` for creating and updating issues - `read:jira-user` for user information - Configure the callback URL: - `https://gitlab.com/oauth/callback` - Copy the generated Client ID and Client Secret and store them securely. ## Configure GitLab Duo MCP - Create `.gitlab/duo/mcp.json` in the GitLab project. - Register the Atlassian MCP endpoint at: `https://mcp.atlassian.com/v1/mcp` - Configure OAuth authorization and token URLs: - `https://auth.atlassian.com/oauth/authorize` - `https://auth.atlassian.com/oauth/token` - Replace the placeholder credentials with the Jira OAuth values. - Enable **Allow external MCP tools** under **Group Settings → GitLab Duo → Configuration**. ## Verify the Connection - Ask GitLab Duo: - “What MCP tools do you have access to?” - “Test the MCP JIRA configuration in this project” - Approve access on the Atlassian MCP website and select the relevant Jira instance. - Use **GitLab: Show MCP Dashboard** from the VS Code or VSCodium Command Palette to inspect: - MCP server connection status - Available tools such as `jira_get_issue` and `jira_create_issue` - Real-time server logs and tool calls ## Planning and Backlog Prioritization - Query Jira from the GitLab Duo chat without leaving the IDE. - Find unassigned issues in a project. - Ask the assistant to: - Recommend the top issues to prioritize - Summarize their context - Assign selected issues to the current user - This supports sprint planning by combining Jira data with AI-generated prioritization. ## Issue Triage and Creation from Code - Developers can investigate bugs while reviewing code and interact with Jira conversationally. - Example workflows include: - Searching for an existing bug related to a code-level error - Creating a Jira issue if no matching ticket exists - Including relevant code context in the issue - Identifying possible blockers - Linking the issue to the current branch The integration is most useful when teams want Jira actions, planning, and issue management available directly within their development environment. Teams should configure OAuth scopes carefully, protect client credentials, and use the MCP Dashboard to monitor connections and tool activity.

Read original

Automation Machine Learning Model Context Protocol Natural Language Processing+4

githubMar 2, 20262 min readCurated summary

GitHub for Beginners: Getting started with GitHub Issues and Projects

GitHub Issues and Projects work together to organize tasks, bugs, ideas, and broader project goals. Issues capture individual pieces of work, while Projects provide visual planning and tracking through boards, views, workflows, and charts. The post introduces beginners to creating an issue, building a Kanban project, and managing progress collaboratively. ## Why Issues and Projects Matter - Issues provide a shared space for tracking bugs, tasks, and ideas. - Projects organize issues into a larger workflow for planning and prioritization. - Using both tools helps teams coordinate work, communicate progress, and avoid missed tasks. ## Creating a GitHub Issue - Open a repository and select the **Issues** tab, then click **New issue**. - Add: - A clear title. - A detailed description explaining the expected behavior or required change. - An assignee. - Labels for classification. - An issue type, such as a bug or task. - A related project or milestone. - After creation, team members can comment and collaborate. - Typing `#` followed by an issue number creates a clickable link to another issue. - Completed work can be marked by closing the issue. ## Creating a GitHub Project - Open the repository’s **Projects** tab and click **New project**. - Choose the **Kanban** template, name the project, disable bulk import, and create it. - GitHub automatically provides columns, which can be customized. - Multiple project tabs offer different ways to view and manage the same work. ## Managing and Customizing Projects Project settings allow users to: - Control access permissions. - Create or modify custom fields. - Rename the project and edit its description. - Add a README. - Copy the project board. - Change project visibility. ### Insights and Charts - The **Insights** section provides charts for analyzing project data. - Charts can be customized through the **Configure** menu, including their layout and displayed information. ### Automated Workflows - Built-in workflows can update item statuses automatically. - Examples include: - Setting new items to `todo`. - Closing issues when their project status changes. - Marking items as `Done` when an issue is closed. ### Project Status Updates - The **Add status update** feature lets teams report project health and progress directly from the project view. GitHub beginners can start with well-written issues and then connect them to a Kanban Project board. Custom fields, automated workflows, charts, and status updates make it easier to turn individual tasks into a transparent, trackable team workflow.

Read original

Automation Github Project Management Github Issues+2

grammarlyFeb 13, 2026Original article

How to Create an AI Assistant Step by Step: A Beginner’s Guide (opens in new tab)

Creating a custom AI assistant is no longer restricted to engineers, as modern no-code tools and APIs allow users to build specialized agents for specific personal or professional workflows. By focusing on a narrow scope and selecting the right platform, individuals can gain greater control over data, behavior, and task efficiency than generic tools provide. Ultimately, the shift toward custom assistants reflects a move away from one-size-fits-all software toward personalized AI teammates integrated directly into daily work. ## The Anatomy of an AI Assistant * Digital assistants utilize Natural Language Processing (NLP) to interpret user intent and tone through conversational prompts. * Large Language Models (LLMs) serve as the underlying engine, recognizing language patterns to generate contextually relevant responses. * Advanced implementations, such as the "Go" assistant, operate within existing apps like email and documents to eliminate context switching and manual data entry. ## Strategic Drivers for Customization * **Personalization:** Tailoring the assistant’s tone and behavior ensures it supports specific tasks exactly as the user expects. * **Data Control:** Building a custom solution offers transparency into how data is used, which is critical for teams handling sensitive internal information. * **Efficiency and Innovation:** Customizing an assistant for a niche problem—like summarizing specific document types or automating recurring questions—reduces manual effort more effectively than general tools. * **Independence:** Creating a proprietary tool reduces reliance on third-party platforms that may change their pricing or feature sets. ## Defining the Core Mission * The most successful assistants focus on one primary responsibility rather than trying to handle every possible task. * Effective planning requires answering who the user is and what specific problem the assistant is meant to solve consistently. * Starting with a narrow scope, such as a dedicated writing assistant or a customer service bot, simplifies the testing and refinement process during the initial launch. ## Development Paths and Lifecycles * Users can choose between no-code platforms for rapid deployment or API-based configurations for higher flexibility and integration. * The development process follows a standard lifecycle: strategic planning, technical configuration, launch, and continuous improvement. * Ongoing monitoring is essential to ensure the assistant remains responsible, accurate, and aligned with evolving user needs. To build a successful AI assistant, start by identifying a single high-impact task and selecting a tool that matches your technical comfort level. Prioritizing a narrow focus during the initial build will allow for more effective monitoring and easier scaling as your requirements grow.

Automation Large Language Models Machine Learning Natural Language Processing+3

grammarlyJan 29, 2026Original article

How to Use AI Agents: A Simple Guide to Getting Started (opens in new tab)

AI agents represent a shift from reactive, prompt-based AI to proactive, goal-oriented systems capable of planning and executing multi-step tasks with minimal oversight. By operating in a continuous loop of gathering context, selecting tools, and evaluating results, these agents can manage complex workflows that previously required manual follow-up. The most effective implementation strategy involves starting with small, repeatable processes and gradually increasing agent autonomy as reliability is proven through feedback and testing. ### The Mechanism of Agentic AI * Unlike traditional generative AI that responds to isolated instructions, agents possess "agency," allowing them to decide the next best action to reach a defined objective. * Agents function through an iterative operational cycle: they analyze relevant context, select an action, utilize available tools, and evaluate the outcome to determine if the goal is met. * Advanced writing agents, such as those integrated into workplace tools, can proactively suggest revisions for tone, logical progression, and specificity by maintaining contextual awareness across a document's lifecycle. ### Deploying Agents via Repeatable Workflows * Initial use cases should focus on contained, well-understood tasks rather than end-to-end process overhauls to ensure the agent’s logic can be easily monitored. * In research and organization, agents can be tasked with continuously gathering and categorizing sources, updating citations as new data becomes available. * Communication workflows benefit from agents that can reference historical conversation threads to draft follow-ups, summarize long discussions, and adjust meeting agendas dynamically. * Content creation agents can manage the transition from rough notes to structured outlines, applying specific tone and clarity feedback across multiple versions of a draft. ### Integration and Tool Selection * Effective deployment often requires no coding experience, as agentic capabilities are increasingly built into existing word processors, email clients, and project management platforms. * Using familiar software ecosystems reduces the technical barrier to entry and allows for easier scaling of the agent’s behavior over time. * Project management agents can be utilized to monitor task progress, adjust timelines based on changing conditions, and surface high-priority items automatically. ### Establishing Goals and Ownership * Success depends on defining specific end states rather than vague instructions; for example, asking an agent to "flag logical gaps and suggest supporting evidence" is more effective than asking it to "improve writing." * Defining clear ownership ensures the agent knows which parameters to prioritize, such as maintaining a consistent brand voice while revising for conciseness. * Testing should begin with small-scale scenarios, like a single recurring email update, to allow for the refinement of instructions and priorities based on real-world performance. ### Scaling Autonomy and Oversight * Once an agent demonstrates consistent accuracy in a narrow task, its scope can be broadened to include related steps, such as tracking data throughout the week to prepare a draft before being prompted. * Increased autonomy does not mean a lack of control; humans should remain in the loop to provide feedback, which the agent uses to refine its future decision-making logic. * The transition from prompts to progress is achieved by allowing agents to work across different tools and contexts as they prove their ability to handle more complex judgment calls. To get the most out of AI agents, treat them as collaborative partners by starting with a narrow focus and providing specific, goal-oriented feedback. Rather than handing off entire processes immediately, focus on delegating repeatable tasks where the agent’s ability to plan and adapt can yield the highest immediate value.

Automation AI Agents Project Management Communication Tools+2

grammarlyJan 29, 2026Original article

Agentic AI vs. generative AI: What’s the Difference and When to Use Each (opens in new tab)

While generative AI focuses on creating content like text and images through prompt-based prediction, agentic AI represents a shift toward autonomous goal achievement and execution. By combining the creative output of large language models with a continuous loop of perception and action, these technologies allow users to move from simply generating drafts to managing complex, multi-step workflows. Ultimately, the two systems are most effective when used together, with one providing the ideas and the other handling the coordination and follow-through. ### Distinguishing Creative Output from Autonomous Agency * Generative AI functions as a responder that produces new content—such as text, code, or visuals—by predicting the most likely next "token" or piece of data based on a user’s prompt. * Agentic AI possesses "agency," meaning it can take a high-level goal (e.g., "prepare a client kickoff") and determine the necessary steps to achieve it with minimal guidance. * While tools like Midjourney or GitHub Copilot focus on the immediate delivery of a specific creative asset, agentic systems act as proactive partners that can use external tools, manage schedules, and make independent decisions. ### The Underlying Mechanics of Prediction and Action * Generative models rely on Large Language Models (LLMs) trained on massive datasets to identify patterns and chain together original sequences of information. * Agentic systems operate on a "perceive, plan, act, and learn" loop, where the AI gathers context from its environment, executes tasks across different applications, and adjusts its strategy based on the results. * The generative process is typically a direct path from input to output, whereas the agentic process is iterative, allowing the system to adapt to changes and feedback in real-time. ### Practical Applications in Content and Workflow Management * Generative use cases include transforming rough bullet points into polished emails, summarizing long documents into flashcards, and adjusting the tone of a message to be more professional. * Agentic use cases involve higher-level orchestration, such as monitoring document revisions, consolidating feedback from multiple stakeholders, and automatically sending follow-up reminders. * In a project management context, an agentic system can draft a project plan, identify owners for specific tasks, and update timelines as milestones are met or missed. ### Navigating Technical and Operational Limitations * Generative AI is susceptible to "hallucinations" because it prioritizes probabilistic output over factual reasoning or logic. * Agentic AI introduces complexity regarding security and permissions, as the system needs authorized access to various apps and tools to perform actions on a user's behalf. * Current agentic systems still require human oversight for critical decision-making to ensure that autonomous actions align with the user's intent and organizational standards. To maximize efficiency, you should utilize generative AI for the creative phases of a project—such as brainstorming and drafting—while delegating administrative overhead and coordination to agentic AI. As these technologies continue to converge, the focus of AI utility is shifting from the volume of content produced to the successful execution of complex, real-world results.

Automation Large Language Models AI Agents Generative AI+2

grammarlyJan 28, 2026Original article

AI Assistants vs. AI Agents: What’s the Difference and When to Use Each (opens in new tab)

While AI assistants and agents often share the same large language model foundations, they serve distinct roles based on their level of autonomy and task complexity. Assistants operate on a reactive "prompt-response" loop for immediate, single-step tasks, whereas agents function as semi-independent systems capable of planning and executing multistep workflows to achieve a broader goal. Ultimately, the most effective AI strategy involves leveraging assistants for quick, guided interactions while utilizing agents to manage complex, coordinated projects that require memory and tool integration. ### Reactive vs. Proactive AI Architectures * Assistants are reactive tools that follow a "prompt-response" loop, similar to a tennis match where the user must always serve to initiate action. * Agents are proactive and semi-independent; once given a high-level goal, they can decompose it into actionable steps and execute them with minimal step-by-step direction. * In a practical scenario, an assistant might summarize meeting notes upon request, whereas an agent can organize those notes, assign tasks in a project management tool, and schedule follow-ups automatically. ### Technical Capabilities and Coordination * Both tools utilize Large Language Models (LLMs) to understand natural language, but agents incorporate advanced features like long-term memory and cross-app integrations. * Memory allows agents to retain feedback and results from previous interactions to deliver better outcomes over time, while integrations enable them to act on the user's behalf across different software platforms. * The two systems often work in tandem: the assistant acts as the front-facing interface (the "waiter") for user commands, while the agent acts as the back-end engine (the "kitchen") that performs the orchestration. ### Balancing Control and Complexity * AI assistants provide high user control and instant setup, making them ideal for "out of the box" tasks like grammar checks, rephrasing text, or answering quick questions. * AI agents excel at reducing cognitive load by managing "moving parts" like deadline tracking, organizing inputs from different stakeholders, and maintaining project states across various tools. * Grammarly’s implementation of agents serves as a technical example, moving beyond simple text revision to offer context-aware suggestions that help with brainstorming, knowledge retrieval, and predicting audience reactions. To maximize productivity, users should delegate isolated, high-control tasks to AI assistants while allowing AI agents to handle the background orchestration of complex projects. Success with these tools depends on maintaining human oversight, using assistant-led prompts to provide the regular feedback that agents need to refine their autonomous workflows.

Automation Large Language Models AI Agents Natural Language Processing+2

gitlabJan 14, 2026Original article

Get started with GitLab Duo Agent Platform: The complete guide (opens in new tab)

The GitLab Duo Agent Platform represents a shift in AI-assisted development by moving from individual chat-based interactions to a collaborative multi-agent orchestration layer. By integrating specialized AI agents throughout the software development lifecycle, the platform transforms linear DevSecOps workflows into parallel processes that leverage full project context for tasks like security scanning and code refactoring. This architecture allows development teams to delegate routine technical burdens to autonomous agents, focusing human efforts on high-level innovation and complex problem-solving. ### Orchestrating the DevSecOps Lifecycle The platform functions as a central intelligence layer that connects AI agents to the broader GitLab ecosystem. * Agents access comprehensive project context, including source code management, CI/CD pipelines, issue tracking, and security scan results. * Specialized agents can be assigned to specific technical domains such as research, refactoring, and automated testing. * The system enables asynchronous collaboration, allowing multiple agents to work on different stages of a project simultaneously. ### Evolution from Duo Enterprise to Agentic AI The Duo Agent Platform is a superset of previous GitLab AI offerings, moving beyond simple 1:1 user-to-AI interactions. * GitLab Duo Pro focused on individual IDE productivity through code suggestions and basic chat. * GitLab Duo Enterprise expanded AI to the wider software lifecycle but remained primarily a 1:1 Q&A experience. * The Agent Platform introduces a many-to-many collaboration model where teams and multiple specialized agents interact autonomously to handle production-ready workflows. ### Advanced Integration and Customization To support enterprise-grade automation, the platform provides a roadmap for scaling AI from basic interactions to production environments. * Integration with the Model Context Protocol (MCP) allows for expanded data access and agent capabilities. * The platform supports a progression from initial agent interactions to full workflow customization and production-ready automation. * Developers can leverage the eight-part guide series to move from foundational concepts to advanced technical implementations. To maximize the benefits of agentic AI, organizations should transition from viewing AI as a simple Q&A tool to treating it as an orchestration layer. Teams are encouraged to explore the complete introductory series to begin delegating routine maintenance and security tasks to specialized agents, thereby accelerating overall delivery speed.

Automation Machine Learning CI/CD Gitlab+3

gitlabJan 14, 2026Original article

Understanding flows: Multi-agent workflows (opens in new tab)

The GitLab Duo Agent Platform introduces flows as a sophisticated orchestration layer that allows multiple specialized AI agents to collaborate on complex, multi-step developer workflows. Unlike standard interactive agents, flows are designed to work autonomously and asynchronously on GitLab’s platform compute, executing tasks ranging from initial requirement analysis to final merge request creation. This architecture enables teams to offload repetitive or high-compliance tasks to a background process that integrates directly with the existing GitLab ecosystem. ## Core Mechanics of Multi-Agent Flows * Flows function as event-driven systems triggered by specific actions such as @mentions, issue assignments, or being designated as a reviewer on a merge request. * Execution occurs on GitLab's platform compute, removing the need for users to maintain separate infrastructure for their automation logic. * While standard agents are interactive and synchronous, flows are designed to be autonomous, gathering context and making decisions across various project files and APIs without constant human intervention. * The system supports background processing, allowing developers to continue working on other tasks while the flow handles complex implementations or security audits. ## Foundational and Custom Flow Categories * Foundational flows are production-ready, general-purpose workflows maintained by GitLab and accessible through standard UI controls and IDE interfaces. * Custom flows are specialized workflows defined via YAML that allow teams to tailor AI behavior to unique organizational requirements, such as specific coding standards or regulatory compliance like PCI-DSS. * Custom flows utilize a YAML schema to define specific components, including "Routers" for logic steering and "Toolsets" that grant agents access to GitLab API functions. * Real-world applications for custom flows include automated security scanning, documentation generation, and complex dependency management across a project. ## Technical Configuration and Triggers * Flows are triggered through simple Git commands and UI actions, such as `/assign @flow-name` or `/assign_reviewer @flow-name`. * The configuration for a custom flow includes an "ambient" environment setting and defines specific `AgentComponents` that map to unique prompts and toolsets. * Toolsets provide agents with capabilities such as `get_repository_file`, `create_commit`, `create_merge_request`, and `blob_search`, enabling them to interact with the codebase programmatically. * YAML definitions also manage UI log events, allowing users to track agent progress through specific hooks like `on_tool_execution_success` or `on_agent_final_answer`. To maximize the value of the GitLab Duo Agent Platform, teams should identify repetitive compliance or boilerplate implementation tasks and codify them into custom flows. By defining precise prompts and toolsets within the YAML schema, organizations can ensure that AI-driven automation adheres to internal domain expertise and coding standards while maintaining a high level of transparency through integrated UI logging.

Automation AI Agents Gitlab React+4

metaDec 19, 2025Original article

DrP: Meta's Root Cause Analysis Platform at Scale (opens in new tab)

DrP is Meta’s programmatic root cause analysis (RCA) platform designed to automate incident investigations and reduce the burden of manual on-call tasks. By codifying investigation playbooks into executable "analyzers," the platform significantly lowers the mean time to resolve (MTTR) by 20% to 80% for over 300 teams. This systematic approach replaces outdated manual scripts with a scalable backend that executes 50,000 automated analyses daily, providing immediate context when alerts fire. ## Architecture and Core Components * **Expressive SDK:** Provides a framework for engineers to codify investigation workflows into "analyzers," utilizing a rich library of helper functions and machine learning algorithms. * **Built-in Analysis Tools:** The platform includes native support for anomaly detection, event isolation, time-series correlation, and dimension analysis to identify specific problem areas. * **Scalable Backend:** A multi-tenant execution environment manages a worker pool that handles thousands of requests securely and asynchronously. * **Workflow Integration:** DrP is integrated directly into Meta’s internal alerting and incident management systems, allowing for automatic triggering without human intervention. ## Authoring and Verification Workflow * **Template Bootstrapping:** Engineers use the SDK to generate boilerplate code that captures required input parameters and context in a type-safe manner. * **Analyzer Chaining:** The system allows for seamless dependency analysis by passing context between different analyzers, enabling investigations to span multiple interconnected services. * **Automated Backtesting:** Before deployment, analyzers undergo automated backtesting integrated into the code review process to ensure accuracy and performance. * **Decision Tree Logic:** Investigation steps are modeled as decision trees within the code, allowing the analyzer to follow different paths based on the data it retrieves. ## Execution and Post-Processing * **Trigger-based Analysis:** When an alert is activated, the backend automatically queues the relevant analyzer, ensuring findings are available as soon as an engineer begins triaging. * **Automated Mitigation:** A post-processing system can take direct action based on investigation results, such as creating tasks or submitting pull requests to resolve identified issues. * **DrP Insights:** This system periodically reviews historical analysis outputs to identify and rank the top causes of alerts, helping teams prioritize long-term reliability fixes. * **Alert Annotation:** Results are presented in both human-readable text and machine-readable formats, directly annotating the incident logs for the on-call responder. ## Practical Conclusion Organizations managing large-scale distributed systems should transition from static markdown playbooks to executable investigation code. By implementing a programmatic RCA framework like DrP, teams can scale their troubleshooting expertise and significantly reduce "on-call fatigue" by automating the repetitive triage steps that typically consume the first hour of an incident.

Automation AI Machine Learning Observability+4

metaDec 15, 2025Original article

How AI Is Transforming the Adoption of Secure-by-Default Mobile Frameworks (opens in new tab)

Meta utilizes secure-by-default frameworks to wrap potentially unsafe operating system and third-party functions, ensuring security is integrated into the development process without sacrificing developer velocity. By leveraging generative AI and automation, the company scales the adoption of these frameworks across its massive codebase, effectively mitigating risks such as Android intent hijacking. This approach balances high-level security enforcement with the practical need for friction-free developer experiences. ## Design Principles for Secure-by-Default Frameworks To ensure high adoption and long-term viability, Meta follows specific architectural guidelines when building security wrappers: * **API Mirroring:** Secure framework APIs are designed to closely resemble the existing native APIs they replace (e.g., mirroring the Android Context API). This reduces the cognitive burden on developers and simplifies the use of automated tools for code conversion. * **Reliance on Public Interfaces:** Frameworks are built exclusively on public and stable APIs. Avoiding private or undocumented OS interfaces prevents maintenance "fire drills" and ensures the frameworks remain functional across various OS updates. * **Modularity and Reach:** Rather than creating a single monolithic tool, Meta develops small, modular libraries that target specific security issues while remaining usable across all apps and platform versions. * **Friction Reduction:** Frameworks must avoid introducing excessive complexity or noticeable performance overhead in terms of CPU and RAM, as high friction often leads developers to bypass security measures entirely. ## SecureLinkLauncher: Preventing Android Intent Hijacking SecureLinkLauncher (SLL) is a primary example of a secure-by-default framework designed to stop sensitive data from leaking via the Android intent system. * **Wrapped Execution:** SLL wraps native Android methods such as `startActivity()` and `startActivityForResult()`. Instead of calling `context.startActivity(intent)`, developers use `SecureLinkLauncher.launchInternalActivity(intent, context)`. * **Scope Verification:** The framework enforces scope verification before delegating to the native API. This ensures that intents are directed to intended "family" apps rather than being intercepted by malicious third-party applications. * **Mitigating Implicit Intents:** SLL addresses the risks of untargeted intents, which can be received by any app with a matching intent-filter. By enforcing a developer-specified scope, SLL ensures that data like `SECRET_INFO` is only accessible to authorized packages. ## Scaling Adoption through AI and Automation The transition from legacy, insecure patterns to secure frameworks is managed through a combination of automated tooling and artificial intelligence. * **Automated Migration:** Generative AI identifies insecure usage patterns across Meta’s vast codebase and suggests—or automatically applies—the appropriate secure framework replacements. * **Continuous Monitoring:** Automation tools continuously scan the codebase to ensure compliance with secure-by-default standards, preventing the reintroduction of vulnerable code. * **Scaling Consistency:** By reducing the manual effort required for refactoring, AI enables consistent security enforcement across different teams and applications without slowing down the shipping cycle. For organizations managing large-scale mobile codebases, the recommended approach is to build thin, developer-friendly wrappers around risky platform APIs and utilize automated refactoring tools to drive adoption. This ensures that security becomes an invisible, default component of the development lifecycle rather than a manual checklist.

Automation AI Generative AI Android+5

woowahanDec 10, 2025Original article

We refactor culture just like code. (opens in new tab)

The Commerce Web Frontend Development team at Woowa Brothers recently underwent a significant organizational "refactoring" to manage the increasing complexity of their expanding commerce platform. By moving away from rigid, siloed roles and adopting a flexible "boundary-less" part system, the team successfully synchronized disparate services like B Mart and Baemin Store. This cultural shift demonstrates that treating organizational structure with the same iterative mindset as code can eliminate operational bottlenecks and foster a more resilient engineering environment. ### Transitioning to Boundary-less Parts * The team abandoned traditional division methods—such as project-based, funnel-based, or service-vs-backoffice splits—because they created resource imbalances and restricted developers' understanding of the overall service flow. * Traditional project-based splits often led to specific teams being overwhelmed during peak periods while others remained underutilized, creating significant delivery bottlenecks. * To solve these inefficiencies, the team introduced "boundary-less parts," where developers are not strictly tied to a single domain but are encouraged to work across the entire commerce ecosystem. * This structure allows the organization to remain agile, moving resources fluidly to address high-priority business needs without being hindered by departmental "walls." ### From R&R to Responsibility and Expandability (R&E) * The team replaced the traditional R&R (Role & Responsibility) model with "R&E" (Responsibility & Expandability), focusing on the core principle of "owning" a problem until it is fully resolved. * This shift encourages developers to expand their expertise beyond their immediate tasks, fostering a culture where helping colleagues and understanding neighboring domains is the standard. * Work is distributed through a strategic sync between team and part leaders, but team members maintain the flexibility to jump into different domains as project requirements evolve. * Regular "part shuffling" is utilized to ensure that domain knowledge is distributed across the entire 20-person frontend team, preventing the formation of information silos. ### Impact on Technical Integration and Team Resilience * The flexible structure was instrumental in the "ONE COMMERCE" initiative, which required integrating the technical stacks and user experiences of B Mart and Baemin Store. * Because developers had broad domain context, they were able to identify redundant logic across different services and abstract them into shared, common modules, ensuring architectural consistency. * The organization significantly improved its "Bus Factor"—the number of people who can leave before a project stalls—by ensuring multiple engineers understand the context of any given system. * Developers evolved into "domain-wide engineers" who understand the full lifecycle of a transaction, from the customer-facing UI to the backend administrative and logistics data flows. To prevent today's organizational solutions from becoming tomorrow's cultural legacy debt, engineering teams should proactively refactor their workflows. Moving from rigid role definitions to a model based on shared responsibility and cross-domain mobility is essential for maintaining velocity and technical excellence in large-scale platform environments.

Automation Code Review Refactoring Frontend+3

tossDec 9, 2025Original article

Improving Work Efficiency: Revisiting the Small (opens in new tab)

The Toss Research Platform team argues that operational efficiency is best achieved by decomposing complex workflows into granular, atomic actions rather than attempting massive systemic overhauls. By systematically questioning the necessity of each step and prioritizing improvements based on stakeholder impact rather than personal workload, teams can eliminate significant waste through incremental automation. This approach demonstrates that even minor reductions in repetitive manual tasks can lead to substantial gains in team-wide productivity as an organization scales. ### Granular Action Mapping * Break down workflows into specific physical or digital actions—such as clicks, data entries, and channel switches—rather than high-level phases. * Document the "Who, Where, What, and Why" for every individual step to identify exactly where friction occurs. * Include exception cases and edge scenarios in the process map to uncover hidden gaps in the current operating model. ### Questioning Necessity and Identifying Automation Targets * Apply a critical filter to every mapped action by asking, "Why is this necessary?" to eliminate redundant tasks like manual cross-platform notifications. * Distinguish between essential human-centric tasks and mechanical actions, such as calendar entry creation, that are ripe for automation. * Address "micro-inefficiencies" that appear insignificant in isolation but aggregate into major resource drains when repeated multiple times daily across a large team. ### Stakeholder-Centric Prioritization * Shift the criteria for optimization from personal convenience to the impact on the broader organization. * Rank improvements based on three specific metrics: the number of people affected, the downstream influence on other workflows, and the total cumulative time consumed. * Recognize that automating a "small" task for an operator can unlock significant time and clarity for dozens of participants and observers. ### Incremental Implementation and Risk Mitigation * Avoid the "all-or-nothing" automation trap by deploying partial solutions that address solvable segments of a process immediately. * Utilize designated test periods for process changes to monitor for risks, such as team members missing interviews due to altered notification schedules. * Gather continuous feedback from stakeholders during small-scale experiments, allowing for iterative adjustments or quick reversals before a full rollout. To scale operations effectively, start by breaking your current workload into its smallest possible components and identifying the most frequent manual repetitions. True efficiency often comes from these small, validated adjustments and consistent feedback loops rather than waiting to build a perfect, fully automated end-to-end system.

Automation Productivity Process Optimization Reops+2

naverNov 25, 2025Original article

Naver TV (opens in new tab)

This session from NAVER Engineering Day 2025 explores how developers can transition AI from a simple assistant into a functional project collaborator through local automation. By leveraging local Large Language Models (LLMs) and the Model Context Protocol (MCP), development teams can automate high-friction tasks such as build failure diagnostics and crash log analysis. The presentation demonstrates that integrating these tools directly into the development pipeline significantly reduces the manual overhead required for routine troubleshooting and reporting. ### Integrating LLMs with Local Environments * Utilizing **Ollama** allows teams to run LLMs locally, ensuring data privacy and reducing latency compared to cloud-based alternatives. * The **mcp-agent** (Model Context Protocol) serves as the critical bridge, connecting the LLM to local file systems, tools, and project-specific data. * This infrastructure enables the AI to act as an "agent" that can autonomously navigate the codebase rather than just processing static text prompts. ### Build Failure and Crash Monitoring Automation * When a build fails, the AI agent automatically parses the logs to identify the root cause, providing a concise summary instead of requiring a developer to sift through thousands of lines of terminal output. * For crash monitoring, the system goes beyond simple summarization by analyzing stack traces and identifying the specific developer or team responsible for the affected code segment. * By automating the initial diagnostic phase, the time between an error occurring and a developer beginning the fix is dramatically shortened. ### Intelligent Reporting via Slack * The system integrates with **Slack** to deliver automated, context-aware reports that categorize issues by severity and impact. * These reports include actionable insights, such as suggested fixes or links to relevant documentation, directly within the communication channel used by the team. * This ensures that project stakeholders remain informed of the system's health without requiring manual status updates from engineers. ### Considerations for LLM and MCP Implementation * While powerful, the combination of LLMs and MCP agents is not a "silver bullet"; it requires careful prompt engineering and boundary setting to prevent hallucination in technical diagnostics. * Effective automation depends on the quality of the local context provided to the agent; the more structured the logs and metadata, the more accurate the AI's conclusions. * Organizations should evaluate the balance between the computational cost of running local models and the productivity gains achieved through automation. To successfully implement AI-driven automation, developers should start by targeting specific, repetitive bottlenecks—such as triaging build errors—before expanding the agent's scope to more complex architectural tasks. Focusing on the integration between Ollama and mcp-agent provides a secure, extensible foundation for building a truly "smart" development workflow.

Automation AI Large Language Models Slack+4