Datadog

Fixes a security vulnerability in tracing described in GHSA-3633-r77q-h3v3, and an AI Guard issue where LangChain model responses were never evaluated for unsafe output, leaving them neither reported nor blocked. Also adds tracing stats cardinality limits, Trio trace-context support, and LLM Observability agent manifests and sampling rules.

Fixed a security vulnerability in tracing described in GHSA-3633-r77q-h3v3, and stopped AI Guard credentials embedded in DD_AI_GUARD_ENDPOINT from leaking into debug logs, exception messages, and span error tags. Also adds LLM Observability tag-based head sampling via DD_LLMOBS_SAMPLING_RULES and Azure Durable Functions tracing.

Datadog introduced Scout 1.0, its first AI model specialized for investigating production issues, which powers its AI SRE Bits Investigation. Trained on GLM-5.3 Flash with reinforcement learning over historical incidents and telemetry simulations, Scout 1.0 medium matches GPT-6.1 Sol high and Claude Opus 5.5 high at 3-8x lower estimated inference cost, with the xhigh mode matching Fable xhigh at 4x lower cost.

Operations Monitoring, included with RUM at no additional cost, lets teams define application-controlled steps like "process payment" with their own starts, outcomes, and durations, then track availability and latency independently using out-of-the-box metrics rum.measure.operation and rum.measure.operation.duration. Teams can set separate availability and latency SLOs per operation and use Bits AI to investigate degradations.

Datadog examines how the legacy device plugin model limits GPU utilization through fixed MIG partition profiles, opaque GPU counts that can't express memory or topology requirements, and a lack of scheduler-managed capacity accounting. The post covers the three mechanisms Kubernetes Dynamic Resource Allocation uses to raise utilization and how Datadog GPU Monitoring can track the resulting cost savings.

Private Action Runner Kubernetes custom resource actions can no longer access core and native Kubernetes APIs by default, with a new private_action_runner.kubernetes_allowed_custom_resources setting to restrict access to an exact list of resources. The Agent also now ships Private Action Runner script configuration as a template instead of replacing the live file on upgrade, and the gpu.nvlink.ber.effective and gpu.nvlink.ber.symbol metrics now decode NVML's packed bit error rate encoding instead of reporting 4095 for healthy links.

The Browser SDK now collects WebSocket vitals and starts a point-in-time RUM action on the first hit of each browser probe and EXIT probe. Also exposes expandOrRenew on the session manager, sends the build debug ID on Live Debugger Delivery API polls, and hides server-only flags in the developer extension Flags tab.

Datadog describes building a service criticality system that combines incident postmortem history, APM/RUM error traces, traffic volume, and on-call monitors into high, low, or unknown levels with a confidence score. The postmortem signal used an LLM to extract involved services from several hundred SEV-1 and SEV-2 postmortems, validated against Software Catalog.

Fixes a security vulnerability in tracing, documented in GHSA-3633-r77q-h3v3. The advisory does not state severity or affected versions, so operators should review it directly to judge urgency.

Datadog Incident Response is now covered by Datadog for Government's FedRAMP High certification, bringing paging, incident coordination, automation, and postmortem workflows into the GovCloud US1-FED environment. Datadog says it is the only incident response platform with FedRAMP High certification at publication time.

Datadog Action Management's Visual Labeler lets teams navigate their web app via the test recorder Chrome extension, select an element, and name the interaction without writing code or deploying, including on authenticated and gated pages. Labels apply retroactively to matching interactions already recorded within the 15-month retention window, and labeled actions can be reused across Product Analytics funnel steps, dashboards, and Notebooks.

Patches the embedded MIT krb5 library so NegoEx GSS token parsing rejects truncated headers and missing extension vectors instead of reading past the buffer, and bumps pip to 26.2.1 in the embedded Python distribution. Adds Fleet-managed upgrades and rollback for Windows FIPS Agents, plus fixes for Kueue pod tag loss after restart and Cluster Agent namespace metadata collection when on-demand instrumentation is enabled.

Adds OpenTelemetry consistent probability sampling state to spans exported through OTLP and OTel sampling support in distributed tracing, plus remote evaluators and BaseEvaluator support for LLM Observability Experiments. Dynamic Instrumentation now redacts sensitive identifiers in log templates and capture expressions.