5 min Devops

JFrog brings order back to a software supply chain under AI pressure

JFrog brings order back to a software supply chain under AI pressure

Generative AI and AI agents are rapidly changing the way software is developed. Tools such as Cursor, Claude Code, and GitHub Copilot are enabling a leap in productivity that was previously unthinkable. Developers are working faster, generating more code, and switching between tasks more easily. But the downside of this acceleration is that the development chain is becoming overloaded. Organizations are seeing an explosion of commits, builds, and releases that existing systems can barely keep up with.

JFrog wants to facilitate the adoption of AI and address the pressure on developers, as we learned at the recent European swampUP conference. Currently and in the future, developers and AI agents will both produce code. There are countless examples of multinationals that already extensively support software development with AI. Some tech companies even claim to have already handed over a significant portion of development to agentic AI systems.

Within development teams, all this leads to a faster pace of building and releasing. For example, JFrog’s customers are seeing their CI systems explode under the increased load. Where there used to be weeks or months between releases, releases are now rolled out daily, sometimes several times a day. But due to the acceleration, developers using AI assistants are getting stuck in slow or manual release processes that were never designed for this scale.

End of meaningless version numbers

One of JFrog’s answers is Fly, which the company describes as “software delivery with agentic wings.” JFrog recognizes that with dozens or hundreds of releases in a short period of time, traditional version numbers lose their value. A release such as “1.2.3” says little when it is the twentieth update of the week. Fly therefore shifts from static version numbers to semantic releases. The system automatically assembles metadata to indicate what a release entails. It collects pull requests, commits, builds, and linked issues, and then generates a meaningful summary. Fly eliminates the need for developers to write release notes. The context comes directly from the development chain itself.

To leverage AI’s productivity, a release platform must support developers’ tools. Fly therefore works directly within the existing workflow. The desktop application automatically configures package managers (npm and Maven) so that developers can work without additional setup. In addition, there are integrations with modern IDEs, including the increasingly popular Cursor. Via the Model Context Protocol (MCP), developers can communicate with Fly from their IDE. They can request releases, check builds, and start production deployments without leaving the editor.

Fly is currently still in private beta and is expected to be generally available in early 2026.

Een spreker staat op het podium voor een groot scherm met de tekst "software release EXPLOSION" op een technisch evenement.

The demand for trust is growing

An automation step, such as Fly, can solve many challenges in the release chain. However, there is a critical point of discussion: trust. JFrog sees this as an “agentic gap,” or the difference between what AI agents can technically do and the degree of trust teams are willing to place in them. It forces organizations to rethink their foundations. JFrog wants to serve as a basis for this with tools for end-to-end visibility, traceability, and governance over everything that enters the software chain, is built, or goes into production, including AI models.

The agentic gap is obvious in release management, JFrog explains. After all, an error goes straight into production. Fly tries to lower that threshold by offering complete transparency. Each release is enriched with detailed provenance information: all commits, the artifacts used, the builds that have run, and the tests that have been performed.

For organizations that must comply with compliance requirements, this transparency is essential. It simplifies auditing and ensures that decisions remain traceable, even when AI controls part of the process.

DevGovOps: governance as a new bottleneck

As the software chain undergoes fundamental changes and more requirements and regulations are introduced, governance is also becoming a bottleneck. New demands are being placed on developers. CIOs, often under pressure from the board, are demanding the accelerated introduction of AI. This creates the risk that the right governance structure will be lacking. This is where the somewhat newer term DevGovOps comes into play, which focuses primarily on risk management and regulatory compliance.

The concept takes into account that the modern software chain no longer consists exclusively of handwritten code. Open source libraries, container images, and AI-generated snippets are the building blocks of modern applications. This also shifts the threat. The recent supply chain attack via a malicious npm package shows how vulnerable the chain can be.

According to JFrog, the evolution from DevOps to DevSecOps to DevGovOps is a logical step. Whereas DevOps focused on speed and DevSecOps on security integration, DevGovOps is now all about control and visibility as AI increases complexity.

Creating order in an AI-driven software chain

Fly is a new building block in JFrog’s vision of a software chain to which people and machines contribute. By combining automation with transparency and semantic context, the platform aims to make the release explosion manageable. At the same time, it fits into a broader movement towards DevGovOps, in which control, governance, and visibility are becoming the most critical conditions for leveraging AI.

The coming months will show how organizations experience Fly in practice. What is clear is that the software chain needs to be reinvented under AI pressure. JFrog is emphatically positioning itself as one of the parties that wants to shape that reinvention.

Tip: JFrog brings Shadow AI Detection to platform