# pulumi-neo Pulumi Neo is an AI infrastructure agent that automates, governs, and optimizes cloud infrastructure tasks. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Neo Security: Securing Infrastructure in the Agentic Era DevFeed: [Neo Security: Securing Infrastructure in the Agentic Era]() Original publisher: [Read original article]() Author: Joe Duffy Published: 2026-08-28T00:00:00Z Content type: release Language: en Sources: [Pulumi]() Topics: [pulumi-neo](), [Security](), [cloud-infrastructure](), [Artificial Intelligence](), [Infrastructure as code](), [Static code analysis]() Tags: [agent](), [agentic](), [ai](), [aws](), [azure](), [cloud-infrastructure](), [infrastructure-as-code](), [kubernetes](), [product](), [pulumi](), [pulumi-neo](), [security]() ### AI overview Pulumi is opening a research preview of Neo Security, an agent that analyzes cloud infrastructure for exploitable flaws. It builds a threat model, maps attack paths, and produces an actionable security posture report, including for infrastructure provisioned across AWS, Azure, Google Cloud, and Kubernetes. ### Source excerpt Recently, AI systems have started turning up exploitable flaws in code that survived decades of human review. The frontier labs have released useful tools to help uncover many of these flaws through agent-led static code analysis. This is a huge leap ahead, but cloud infrastructure has many exploitable flaws that code analysis alone cannot find. These flaws are often as severe as the ones in code, or worse, and they await discovery by malicious agents on offense. We realized recently we can uniquely help here. At Pulumi, we have complete visibility into your entire cloud estate: infrastructure resources, their semantics, connections and dependencies between them, runtime logs and information, and more -- and have built an entire context graph out of them that is accessible to agents. Thanks to large language models, the cost of analyzing that full context graph is no longer prohibitive. As a result, today we're opening a research preview of Pulumi Neo Security. Neo Security is an agent that can find exploitable flaws in your cloud infrastructure. It starts with a threat model of your cloud estate, and then works systematically through every potential point of attack. The result is a security posture report that is immediately actionable thanks to Pulumi's infrastructure as code technology. Neo Security works on your existing infrastructure regardless of how it was provisioned, across any of our thousands of cloud providers including AWS, Azure, Google Cloud, and Kubernetes. We're releasing it in research preview to begin, so we can work closely with customers to run and address any findings. If you'd like to give it a try, contact us. How it finds attack paths Neo Security's aim is to provide a high-confidence, actionable security posture report. It gets there in three passes. The first builds a threat model, before it looks for anything. It works out what your crown jewels are, which resources are accessible to outside actors, which accounts hold production data, wh ## Pulumi Context API: query your infrastructure as a graph DevFeed: [Pulumi Context API: query your infrastructure as a graph]() Original publisher: [Read original article]() Author: Levi Blackstone Published: 2026-08-26T00:00:00Z Content type: release Language: en Sources: [Pulumi]() Topics: [API](), [Graphs](), [Cloud APIs](), [infrastructure as code (IAC)](), [Command-line interface](), [JSON](), [pulumi-neo]() Tags: [agent](), [ai-agents](), [api](), [cli](), [features](), [graph](), [iac](), [infrastructure-as-code-iac](), [json](), [product](), [pulumi](), [pulumi-cloud](), [pulumi-neo](), [rest-api]() ### AI overview Pulumi is launching the Context API, a read-only API that connects Pulumi-managed and discovered resources, stacks, and their relationships into a graph. Available in public preview for Enterprise and Business Critical organizations, it supports infrastructure-impact, coverage, and cleanup queries through the Pulumi CLI or REST API. Pulumi Neo uses it out of the box, and other authenticated agents can access its schema and query guidance. ### Source excerpt Every platform team fields the same questions: What is running? What breaks if we change this? What can we safely delete? The answers exist, but they're scattered across state files, cloud consoles, and the memories of whoever set things up. Today we're launching the Pulumi Context API, a read-only API that connects Pulumi-managed and discovered resources, stacks, and their relationships into a graph. It's designed agent-first: Pulumi Neo, our infrastructure agent, uses it out of the box, and other agents can fetch the current graph vocabulary and query guidance on demand. It's available in public preview for organizations on the Enterprise and Business Critical editions. Answers that follow infrastructure relationships Pulumi already records the resources your programs manage, their dependencies, how stacks consume each other's outputs, and the resources Pulumi Discovery finds outside infrastructure as code (IaC). The Context API connects this data so you can ask questions that depend on the relationships: Impact: Which stacks are affected if we upgrade this provider? If this stack changes, what consumes its outputs? Coverage: How much of our infrastructure lives outside IaC, and in which accounts? Cleanup: Which stacks have no dependents and are candidates for retirement? A query is a JSON document with a handful of clauses. anchor names the starting nodes, traverse follows relationships from there, and return chooses what comes back. You can run a query through the Pulumi CLI or REST API. Here's a selector that starts from AWS provider instances older than version 7.0.0 and follows incoming provided_by relationships back to the visible resources they manage: { "anchor": { "nodeType": "resource", "match": { "type": "pulumi:providers:aws", "fields": { "provider_version": { "op": "lt", "value": "7.0.0" } } } }, "traverse": [ { "edgeTypes": ["provided_by"], "direction": "in", "alias": "managed" } ], "return": { "select": ["anchor", "managed"] } } A response for one m ## Introducing Usage Limits for Pulumi Neo DevFeed: [Introducing Usage Limits for Pulumi Neo]() Original publisher: [Read original article]() Author: John Keiser Published: 2026-07-14T15:00:00Z Content type: release Language: en Sources: [Pulumi]() Topics: [pulumi-neo](), [AI Agent](), [Artificial Intelligence](), [Cloud]() Tags: [agent](), [ai](), [ai-agent](), [ai-agents](), [billing](), [cloud](), [features](), [notifications](), [organization](), [product](), [pulumi](), [pulumi-cloud](), [pulumi-neo](), [token]() ### AI overview Pulumi introduces usage limits for Pulumi Neo, allowing paid-plan organizations to set monthly organization and per-member dollar limits. Neo pauses when a limit is reached, resumes in the next billing period, and supports email alerts at specified thresholds. ### Source excerpt Pulumi Neo is an AI agent that takes on real infrastructure work, and it's natural to want to hand it more and more. Usage limits give you control so you can do exactly that: set a monthly dollar limit, and Neo pauses when your organization reaches it. How usage limits work Your organization limit is a single monthly dollar amount covering all Neo usage across the org. To set one: In the Pulumi Cloud console, navigate to Settings -> Billing & usage -> Neo token usage. In the Manage token usage panel, enter an organization limit. Save your changes. When usage reaches the limit, Neo pauses for the rest of the billing period and resumes automatically at the start of the next one. An Admin or Billing Manager can raise the limit to resume before then. Enforcement happens at a natural boundary in Neo's work, so a task already in progress finishes its current step before pausing. As a result, usage can go a few dollars over the set limit. Per-member limits and alerts You can also set a separate limit for each member. A member is paused at whichever limit is smaller: their own or the organization's. For example, a member with a $200 limit under a $150 organization limit pauses at $150, because the organization limit is smaller. Turn on Enable email notifications to get a heads-up before you reach the limit. Billing admins are alerted at 50%, 80%, and 95% of the organization limit, with a final notice at 100% when Neo pauses. Get started Set your usage limits and stay in control as your organization hands Neo more and more work. Usage limits are available today for organizations on a paid plan, and an Admin or Billing Manager can set them. Sign in to Pulumi Cloud and set your first organization limit Read the Neo usage limits documentation for per-member limits, alerts, and enforcement details Join the Community Slack to share your feedback ## Neo code reviews: AI code review built for infrastructure DevFeed: [Neo code reviews: AI code review built for infrastructure]() Original publisher: [Read original article]() Author: Pulumi Neo Team Published: 2026-06-22T15:00:00Z Content type: release Language: en Sources: [Pulumi]() Topics: [pulumi-neo](), [ai code review](), [Infrastructure as code](), [pull-requests](), [GitHub]() Tags: [ai](), [ai-agents](), [ai-code-review](), [features](), [github](), [governance](), [infrastructure-as-code](), [logging](), [preview](), [product](), [pull-requests](), [pulumi-neo]() ### AI overview Pulumi introduces Neo code reviews in public preview. The feature analyzes GitHub pull requests alongside Pulumi Cloud infrastructure state, preview output, stack relationships, and dependencies to provide high-level and code-level feedback. It supports automatic or mention-triggered reviews, with governance controls including RBAC, guardrails, and audit logging. ### Source excerpt Today we're introducing Pulumi Neo code reviews, now in public preview. Neo code reviews analyze pull request changes in conjunction with what Pulumi Cloud knows about your running infrastructure, providing both high-level and code-level feedback. Normal code review agents can't reliably anticipate the impact an infrastructure-as-code change will have. This is because they don't have access to critical aspects of the IaC workflow: the potential impact the update will have, in this case the pulumi preview output; and the current state of the cloud infrastructure. Neo not only has access to both of those, but also to the entirety of your other cloud context, such as stack relationships and dependencies. Running reviews Neo can review every pull request automatically, or only when someone mentions @pulumi-neo. Either way, it skips draft pull requests and those opened by bots by default. A review is a comment, so it informs the person approving the merge and sits alongside the required checks and branch protection you already enforce. Neo code reviews run inside the same governance as every other Neo task, with the RBAC, guardrails, and audit logging your organization has set. Enable code reviews Neo code reviews are available on GitHub during public preview. They require Pulumi Neo to be enabled for your organization, the Pulumi GitHub App installed on the repositories you want reviewed, and a one-time grant from each organization user to access their GitHub account under Management > Version control. If Neo currently posts preview summaries on your pull requests, code reviews are already enabled, and they take the place of those summaries. Neo code reviews are free while in public preview. On July 1, 2026, they'll be generally available, and reviews will begin counting toward your organization's Neo token usage, at the same per-token rate as any other Neo task. The pricing page shows that rate and the monthly token allotment included with each plan. Give it a try Open ## Bringing Neo to GitHub and Slack DevFeed: [Bringing Neo to GitHub and Slack]() Original publisher: [Read original article]() Author: Pulumi Neo Team Published: 2026-05-21T15:00:00Z Content type: release Language: en Sources: [Pulumi]() Topics: [pulumi-neo](), [GitHub](), [Slack](), [Pull Request](), [configuration](), [Cloud]() Tags: [agent](), [ai](), [ai-agents](), [configuration](), [features](), [github](), [product](), [pull-request](), [pulumi-cloud](), [pulumi-neo](), [slack]() ### AI overview Pulumi Neo is now available in GitHub and Slack, extending its existing Pulumi Cloud console and terminal capabilities into team discussion threads. Users can ask Neo to inspect stack state, explain changes, investigate failures, and perform approved actions, with responses and follow-up work recorded in the relevant thread. ### Source excerpt This week, Pulumi Neo started working in two more places: GitHub and Slack. The agent that already runs Pulumi tasks from the Cloud console and the terminal now participates in the threads where your team discusses changes. Mention @pulumi-neo in a pull request or issue and Neo replies in the thread. Mention @Neo in a Slack channel and Neo starts a task, continuing the conversation as you reply. Neo in GitHub Mention @pulumi-neo in a pull request description, a top-level or inline review comment, or an issue. Neo sees the diff, the stacks linked to the repository, and their current state. Reviewers can ask Neo to walk through what a proposed change does, including resources that change in stacks the PR doesn't touch directly. Responses land in the same thread, so the analysis becomes part of the review record and any follow-up stays with it. Neo in Slack Mention @Neo in any channel where Neo has been added, and Neo starts a task in the thread. The reply lands in the same thread, and follow-up messages continue the conversation there. The rest of the channel can see what was asked and what Neo found. Neo has the same capabilities here as in the Pulumi Cloud console or the terminal: check stack state, investigate failures, walk through what a change will do, or carry out actions the team has approved. Integrations in action A teammate posts in #platform-engineering: "API latency p95 has been climbing for two days, nobody can figure out why." You reply: You: @Neo check the production API stack. Anything change in the last 72 hours? Neo starts a task in the thread, walks the stack history, and finds a configuration change to the load balancer's idle-timeout setting that landed Friday afternoon. It posts the change, who deployed it, and when. The rest of the channel sees the finding without you having to retell it. You: @Neo open a PR to revert idle-timeout to the previous value. Neo edits the stack's Pulumi program, runs pulumi preview to confirm the change touches only ## Neo Automations: Scheduled Tasks Shipped as Pull Requests DevFeed: [Neo Automations: Scheduled Tasks Shipped as Pull Requests]() Original publisher: [Read original article]() Author: Pulumi Neo Team Published: 2026-05-21T14:00:00Z Content type: release Language: en Sources: [Pulumi]() Topics: [pulumi-neo](), [Automation](), [pull-requests](), [pulumi](), [Amazon Web Services](), [Kubernetes]() Tags: [ai](), [ai-agents](), [automation](), [aws](), [features](), [kubernetes](), [product](), [pull-requests](), [pulumi](), [pulumi-neo]() ### AI overview Pulumi Neo now supports scheduled automations that run tasks on hourly, daily, weekday, or weekly cadences and open pull requests for proposed changes. The launch includes templates for provider freshness, encryption, backup, and activity audits, along with configurable prompts, permissions, and integrations. ### Source excerpt Recurring platform work slips: provider versions fall behind, drift accumulates between checks, and the quarterly audit keeps getting pushed back another month. Pulumi Neo can now run any task on a cadence you set, opening a pull request for each run. Automations in action Your platform team runs stacks across staging and production, and the AWS, GCP, and Kubernetes providers keep shipping new versions. Nobody has time to bump them stack by stack. You write one automation: Every Monday at 8 AM, check the infra/ project for stacks where the AWS, GCP, or Kubernetes provider is more than two minor versions behind. For each one, bump the out-of-date provider, run pulumi preview, and open a PR if the preview is clean. Monday morning, Neo runs the prompt. It finds three stacks behind on the AWS provider, edits each program, runs preview, and opens a PR for each clean run. You review the PRs like you would any other dependency bump, merge them, and Neo runs again next Monday. What automations are for The launch includes four built-in templates: a provider freshness check, an encryption audit, a backup audit, and an activity digest. You can also skip the templates and write your own prompt. Pick from hourly, daily, weekdays, or weekly cadences. Each automation gets its own page in the Automations tab, where you can edit the prompt, change the schedule, run it once on demand, or pause it. Safe by default Automations default to two settings that fit recurring work. Approval mode is auto, so a run doesn't wait for human confirmation between steps. Permission mode is read-only, so a run can read state and propose changes through pull requests but can't apply changes directly. You can override either default per automation. How automations fit with the rest of Neo A scheduled task uses the same context as an interactive Neo task. Custom Instructions at the organization and project level apply, so a scheduled run respects the same naming conventions, tagging policies, and archite