AWS Launches Kiro Crew, an Open-Source AI Agent Orchestrator for Developers

·2 views

Amazon Web Services officially launched Kiro Crew on August 4, 2026, an open-source AI agent orchestration platform licensed under Apache 2.0. The tool was originally built as an internal side project called MeshClaw by three Amazon engineers who wanted a way to run multiple AI tasks simultaneously without constant supervision. It gained rapid organic adoption within Amazon, with over 39,000 builders using it and nearly 500 contributors submitting 597 updates in under six months. Kiro Crew maintains persistent memory across sessions, learns from user corrections, schedules recurring tasks, and continues working even when the user is offline. The platform is designed to reduce the manual effort developers spend acting as the connective layer between multiple tools like CloudWatch, GitHub, and Slack.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Shai-Hulud npm worm planted IDE backdoors that survived clean reinstalls

A supply chain attack called Shai-Hulud compromised the GitHub account of Node.js package maintainer Jared Wray, leading to malicious versions of widely-used caching packages — keyv, flat-cache, file-entry-cache, and cacheable-request — being published to npm. Because these packages sit in ESLint's dependency chain, any project using ESLint fell within the attack's blast radius regardless of direct installation. The malware scraped credentials from AWS, GitHub CLI, Kubernetes, HashiCorp Vault, and AI tool config files, then used stolen npm tokens to self-replicate across 868 packages and 1,381 versions. Unusually, the worm also wrote a persistence hook into .vscode/tasks.json configured to execute automatically whenever the infected project folder was opened in VS Code, meaning the payload could fire even after developers removed node_modules and ran a clean install. The attack evaded standard defenses entirely — npm audit reported nothing, no CVE was assigned, and the malicious releases carried cryptographically valid Sigstore signatures generated through the attacker's hijacked CI pipeline.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Permission Systems Are the Hardest Problem to Solve in Low-Code Platforms

Building permission systems for low-code platforms is far more complex than traditional enterprise software, where objects, fields, and workflows are fixed at development time. In low-code environments, users can dynamically create tables, add fields, configure workflows, and build automation, making business objects and org structures constantly changing. This means permissions must go beyond menu access to cover data scope, field-level controls, action rights, and audit requirements for every record. For example, a salesperson, a manager, a finance officer, and a CEO may all open the same customer module yet each see and interact with entirely different data. Field and action permissions are often treated as afterthoughts in enterprise systems, but in low-code platforms they must be foundational design decisions from the start.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Safely Automate Gmail and Calendar Using Claude AI

Anthropic's Claude AI can connect to Google Workspace tools — including Gmail, Calendar, and Drive — via Model Context Protocol (MCP) connectors, enabling users to query and summarize their data through natural conversation. The integration is most effective and lowest-risk when limited to read-only tasks such as morning briefings, inbox triage, and meeting summaries. Experts recommend starting with read-only access for at least a week before enabling any write permissions, and always manually reviewing drafts before sending. High-risk actions — including sending emails, editing calendars, deleting files, or any action affecting other people — should never be delegated to the AI without human approval. The guiding principle is straightforward: let Claude draft and retrieve, but keep all final decisions and dispatches firmly in human hands.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Polaris Brings Full PHP Authentication Stack to Univeros with Single Config Line

A developer has released Polaris, an open-source identity and authentication module built for the Univeros PHP framework, installable via Composer. The module activates with a single line of configuration, automatically wiring 52 endpoints covering authentication, user management, and organization routes. Polaris handles JWT-based access tokens, multi-factor authentication, session management, and role-based authorization without requiring manual service registration. It is designed as a portable, self-contained module so authentication logic can be reused across projects without painful extraction. The release is the first major feature built on top of Univeros since the framework was revived with AI assistance.

0 comments Read more at DEV Community