Systems | Development | Analytics | API | Testing

Autonomous doesn't mean unsupervised: Trusting agentic QA without losing oversight

AI agents review code, triage incidents, summarize tickets, and draft documentation, and the industry has largely decided the help is worth having. Leadership is often pushing teams for AI productivity gains and many teams accept the mandate. The obstacle is what happens next: the agent works on the wrong thing, the time and money spent on it return nothing, and the team ends up less efficient than before it started by creating more work.
Sponsored Post

Imaginary Test Data. Real Token Bill.

Ask an AI for K-pop concert advice without saying the group, city, date, or budget. It may confidently send you to a BLACKPINK tribute night in Cleveland with a $400 resale ticket. The AI was plenty confident. It just had nothing real to go on. That is exactly what happens when developers test AI applications with invented traffic. The test may look reasonable. The result may even pass. But when real users arrive, with messy histories, incomplete inputs, odd request sequences, and unpredictable timing, the application has to improvise. And improvising is expensive.

Kong API Gateway 3.16: From Debugging to Billing to Compliance

*Kong API Gateway 3.16 is here: runtime log-level tuning, per-consumer plugin configs, credit/usage-based request blocking with the new Entitlement Enforcement plugin, and FIPS 140-3 compliance for regulated industries - all built for live production debugging and governance, no downtime or custom code required.*

Kong Gets a New Look with Electric Agentic-Era Rebrand

We're pulling back the curtain on a project we've been working on for some time now: the next evolution of the Kong brand. You may have noticed some changes recently to our site, swag, or socials. But today it's official: we're announcing Kong's rebrand and introducing our new mascot, Karl. Without further ado, let's dig in. Along the way, we'll give some insight into the "why" behind it all, while looking back at how things have changed since the early days of Kong. We were the API connectivity company.

Team-Based DLP: Give Each Group Its Own Redaction Rules

A shared Kubernetes cluster rarely belongs to one team. Payments runs checkout in one namespace, search runs search-api in another, and a risk team runs a scorer somewhere else. One Speedscale forwarder captures API traffic for all of them. Redacting that traffic before it leaves the cluster is what makes it safe to use for testing (the background is in The PII Testing Dilemma). Until now, that forwarder ran exactly one DLP rule. Every team that needed a field redacted had to edit the same JSON document.

Use AI and traffic replay to test AI-generated code

When I ask an AI agent to change code, I also want it to run the application and test what it changed. Asking it to write some tests is a start. But if it invents the expected responses from the same assumptions it used to write the code, those tests can miss the same mistake. Traffic replay gives the agent something concrete to test against: requests and responses captured from a working application.

Why Mocks Fail at Scale #softwareengineering #devops #softwaretesting #api #aicoding

Mocking for testing starts off easy, but once you scale to multiple teams and AI agents, handcrafted mocks become a serious form of technical liability. Instead of treating mocking as an individual software engineering task, shift your mindset to treat it as a platform engineering task focused on automation and continuously refreshed modern data. Watch to see how adopting technologies like traffic replay to simulate realistic backend sandboxes can transform your modern testing workflow!

eBPF: Correlating rustls Plaintext to TCP Connections Without a File Descriptor

In Under the Hood with Go TLS and eBPF, I left socket tracking as an exercise for later. The example used bpf_get_current_pid_tgid() and explicitly excluded concurrent TLS operations. Capturing plaintext was enough for that post. With rustls, later arrived: I could read the HTTP payload perfectly and still attach it to the wrong TCP connection. That’s a frustratingly convincing failure. The request looks right. The response looks right. The application works.