CircleCI Inc.

And I think that like this, these CI/CD platforms and, um, things that are available already in the market have everything they need to evolve effectively into that kind of tooling.

I mean, even CircleCI just the other day, uh, released a new version of their s- of their CLI that is agent-friendly, agent-driven, you know, JSON kinda guy.

And so, like, they, they've already acknowledged that their new user base are agents, that there needs to be opportunities to run CI/CD on loops that are happening before they hit a PR.

Um, so I think that, like, what we call CI/CD will, it will evolve.

So there's an article in the Lead Dev called Meta Tried to Shrink Engineering Teams Around AI.

How'd that work out for them? It worked out kind of exactly like the CircleCI report that you and I did an episode on a while back during the summer.

I remember that well.

That was based on data from late 2025.

So in some sense, even before the Claude Code revolution took hold, but already was showing some concerning data, if I recall correctly, around sort of the, on the one hand, explosion in volume of code written, and on the other hand, not necessarily great outcomes.

Well, you'll be happy to know that as the newer data has come in, Meta discovered that their code commits increased 220% year over year now that they're using agents.

But just like the data from CircleCI, only 36% increase in anything actually going to production.

So much less than the increase.

So all of those.

CircleCI, I think there

was a few.

Yeah.

Nobody's really touched on this yet today.

You know, from an ID&E perspective, lifecycle management controls, I think that's something that we've kind of dealt with with NHIs because we've seen it with like the CircleCI and even the Microsoft Midnight Blizzard where Secrets, we weren't rotating keys for secrets fast enough, right? So that's an example of poor lifecycle management.

I think agents, it's gonna happen even faster.

Anybody playing with loops and things like that too? Like looping in your codecs or your cloud codes? We're not really prompting agents anymore.

Very.

And the fragmented point solutions like CircleCI or SNIC, they are highly vulnerable to vendor consolidation.

Enterprises want fewer contracts right now, not more.

But here's where the AI pivot starts to really show its fangs.

We also have to look at the federal expansion.

Securing FedRAMP and GovRAMP authorizations allows them to lock in highly lucrative, deeply entrenched U.S. defense contracts.

And what about vendor consolidation? When IT budgets tighten, enterprises don't want to pay for SNCC, CircleCI and GitLab.

They want one bill.

Um, yeah, exactly.

Like, you know, even at circle CI where I, I joined, we were about, um, I think 14 people or something when, when three of us joined through that acquisition, uh, that you mentioned of distiller.

you know, we were doing sales for a long time.

And when the first, you know, proper salespeople came in, I was like, oh, thank you for being here.

But, you know, there's been players before them.

CircleCI was out there forever.

There's always Jenkins.

No.

We'll probably get into that.

Uh, a recently disclosed vulnerability in CircleCI's MCP server, and then a novel, truly novel, uh, research post on a new attack method or technique against artificial intelligence.

And with that, let's go ahead and, I don't know, generate our way in?

Circle our way in?

[laughs]

... things on the, uh, the YouTube view of this, um, moving on to the next story.

I saw a really interesting research post from Omri, uh, Dar of Remedio, I think that's how you pronounce their name, where they published a, a write-up of a critical unauthenticated remote code execution vulnerability that they found in CircleCI's MCP server integration.

Um, CircleCI, if you're not software developer, it's a populous, uh, populous, popular continuous automation tool, uh, very similar to like Jenkins or GitHub actions.

So, so configuring a workflow in GitHub to use NX Cloud, NX Agents is pretty easy, and there's even a generator for scaffolding that workflow.

Uh, even works for different providers like GitHub and CircleCI and a few others.

Hmm.

Okay.