---
collection: observability
collection_name: Observability & Monitoring
week_start: 2026-10-12
title: Security patches, AI SRE models, and agent-aware tracing
release_count: 18
generated: 2026-10-19
canonical: https://releases.sh/collections/observability/digest/2026-10-12
---

# Security patches, AI SRE models, and agent-aware tracing

Datadog patched a tracing security vulnerability across its Python SDKs and launched Scout 1.0, an AI model built to investigate incidents, while Sentry modernized its bundler plugins and added native-module and navigation insights for mobile apps.

### Security and safeguards under the tracing hood

The week's most serious thread ran through Datadog's tracing libraries. A security vulnerability in tracing, described in GHSA-3633-r77q-h3v3, got patched in [dd-trace-py's stable line](https://github.com/DataDog/dd-trace-py/releases/tag/v4.16.0), which also closed a quiet evaluation gap in AI Guard: LangChain model responses were never checked for unsafe output, so they were neither reported nor blocked. The release candidate that preceded it [stopped AI Guard credentials from leaking](https://github.com/DataDog/dd-trace-py/releases/tag/v4.16.0rc2) into debug logs, exception messages, and span error tags along the way. Both stabilized and extended the Python SDK with tracing stats cardinality limits, Trio trace-context support, Azure Durable Functions tracing, and LLM Observability sampling rules. On the JavaScript side, [dd-trace-js picked up the same Test Optimization work](https://github.com/DataDog/dd-trace-js/releases/tag/v6.21.0) on its 6.x line — WebdriverIO failure videos and Cypress suite TIA skip counts — plus per-trace snapshot sampling for Dynamic Instrumentation and a fix so LLM Observability events reach the Lambda extension before the sandbox freezes; the [5.x maintenance line](https://github.com/DataDog/dd-trace-js/releases/tag/v5.132.0) carries the identical changes for teams still on the older major.

Elsewhere in Datadog's stack, the [Agent locked down Private Action Runner Kubernetes access](https://github.com/DataDog/datadog-agent/releases/tag/7.84.3) by default, requiring an explicit allowlist of custom resources, and stopped overwriting customized script configuration on upgrades — plus a small but welcome fix for NVML's packed bit-error-rate encoding, which had been reporting 4095 for perfectly healthy GPU links. The [Browser SDK turned its attention to WebSockets](https://github.com/DataDog/browser-sdk/releases/tag/v7.16.0), collecting vitals for them and firing a point-in-time RUM action on the first hit of browser and EXIT probes.

### Datadog's AI SRE gets its own model

The headline launch was [Scout 1.0](https://www.datadoghq.com/blog/ai/introducing-scout-sre-specialized-model-bits-ai/), Datadog's first AI model trained specifically for investigating production issues, now powering Bits Investigation. Trained with reinforcement learning over historical incidents and telemetry simulations, Scout is a cost play as much as an accuracy one: Datadog claims its medium mode matches top-tier general models at a fraction of the inference cost, making it cheap enough to run investigations far earlier in an incident. Two follow-on posts rounded out the week: [RUM Operations Monitoring](https://www.datadoghq.com/blog/rum-operations-monitoring/), free with RUM, lets teams instrument application-controlled steps like "process payment" with their own availability and latency SLOs, and Datadog shared [how it judges service criticality across roughly 6,000 internal services](https://www.datadoghq.com/blog/how-datadog-defines-service-criticality-at-scale/) by blending postmortem history, error traces, traffic, and on-call data. For the infrastructure-minded, there's a [walkthrough of how Kubernetes DRA lifts GPU utilization](https://www.datadoghq.com/blog/how-kubernetes-dra-can-improve-gpu-utilization-and-cut-costs/) past the limits of the legacy device plugin model.

### Sentry's plugins, mobile, and Python surface all shift

Sentry's biggest structural change was [releasing its bundler plugins from the SDK repo](https://github.com/getsentry/sentry-javascript/releases/tag/11.8.0), which jumps their version from 5.4.1 to the SDK's and raises the floor to Node 20.19. New projects should import the re-exported `@sentry/bundler-plugins` entry point. The surrounding releases added [Cloudflare cron monitoring and Neon DB spans](https://github.com/getsentry/sentry-javascript/releases/tag/11.7.0), and quieted a duplicate process session that Node servers were sending once request sessions were tracked. Mobile got attention too: the [React Native SDK records Turbo Module calls](https://sentry.io/changelog/react-native-sdk-turbo-module-insights), capturing which native module and method were live at a native crash, and the [Android SDK began experimental Jetpack Navigation 3 support](https://sentry.io/changelog/nav3-support-on-the-android-sdk) via `SentryNavEffect`. On the server side, [Sentry Python deprecated send_default_pii and transaction profiling](https://github.com/getsentry/sentry-python/releases/tag/2.72.0) and added localhost and user-agent attributes for inbound filters. In the product itself, [Explore > Agents can now sort and filter conversations](https://sentry.io/changelog/agent-conversation-sorting-and-filters-by-cost-tokens-and-tool-calls) by whole-conversation cost, tokens, tool calls, and errors.

### Labels and a quieter Axiom release

Axiom shipped [labels for organizing resources](https://axiom.co/changelog/labels): assign colored tags like `env=production` or `team=platform` to datasets, dashboards, monitors, and notifiers, filter lists by ANY or ALL matches, and let the MCP server surface that context to agents so they know which service, environment, and owner a resource belongs to.

## Releases covered

### Axiom

- [Axiom adds labels to organize datasets, dashboards, monitors, and notifiers](https://axiom.co/changelog/labels)

### Datadog

- [Datadog APM 4.16.0 patches tracing security vulnerability and fixes AI Guard evaluation gap](https://github.com/DataDog/dd-trace-py/releases/tag/v4.16.0)
- [Datadog dd-trace-py 4.16.0rc2 patches tracing security vulnerability](https://github.com/DataDog/dd-trace-py/releases/tag/v4.16.0rc2)
- [Datadog dd-trace-js 6.21.0 adds WebdriverIO failure video uploads](https://github.com/DataDog/dd-trace-js/releases/tag/v6.21.0)
- [Datadog dd-trace-js v5.132.0 adds WebdriverIO failure videos and Cypress TIA skip counts](https://github.com/DataDog/dd-trace-js/releases/tag/v5.132.0)
- [Datadog Agent 7.84.3 restricts Private Action Runner Kubernetes API access by default](https://github.com/DataDog/datadog-agent/releases/tag/7.84.3)
- [RUM Browser SDK v7.16.0 collects WebSocket vitals and adds probe RUM actions](https://github.com/DataDog/browser-sdk/releases/tag/v7.16.0)
- [Datadog launches Scout 1.0, an SRE-specialized model powering Bits Investigation](https://www.datadoghq.com/blog/ai/introducing-scout-sre-specialized-model-bits-ai/)
- [Datadog launches RUM Operations Monitoring for critical user journey steps](https://www.datadoghq.com/blog/rum-operations-monitoring/)
- [Datadog shares how it classifies internal service criticality at 6,000-service scale](https://www.datadoghq.com/blog/how-datadog-defines-service-criticality-at-scale/)
- [Datadog explains how Kubernetes DRA improves GPU utilization and cuts costs](https://www.datadoghq.com/blog/how-kubernetes-dra-can-improve-gpu-utilization-and-cut-costs/)

### Sentry

- [Sentry JavaScript 11.8.0 ships bundler plugins from SDK repo, requires Node 20.19](https://github.com/getsentry/sentry-javascript/releases/tag/11.8.0)
- [Sentry JavaScript 11.7.0 adds Cloudflare cron monitoring and Neon DB spans](https://github.com/getsentry/sentry-javascript/releases/tag/11.7.0)
- [Sentry React Native SDK 8.30.0 adds Turbo Module insights](https://sentry.io/changelog/react-native-sdk-turbo-module-insights)
- [Sentry Android SDK 8.60.0 adds experimental Jetpack Navigation 3 support](https://sentry.io/changelog/nav3-support-on-the-android-sdk)
- [Sentry Python 2.72.0 deprecates send_default_pii and transaction profiling](https://github.com/getsentry/sentry-python/releases/tag/2.72.0)
- [Sentry agents now sort and filter conversations by cost, tokens, and tool calls](https://sentry.io/changelog/agent-conversation-sorting-and-filters-by-cost-tokens-and-tool-calls)