A year ago, the notion of "agentic AI" and "infrastructure" residing in the same conversation was met with skepticism by many VPs of infrastructure. Today, that perception has dramatically shifted. Joe Duffy, CEO of Pulumi, reports that AI agents are now responsible for an impressive 20 percent of all operations on the Pulumi platform, a stark contrast to virtually zero just twelve months prior. Duffy anticipates this figure could eventually reach 100 percent as AI’s role in infrastructure management continues to expand. In response to this burgeoning trend, Pulumi has officially launched a suite of capabilities specifically engineered for what the company terms the "agentic infrastructure era."
This significant rollout, announced on a Tuesday, signifies a strategic pivot by Pulumi to fully embrace and facilitate the integration of AI agents into the core of infrastructure management. The company’s proactive approach aims to streamline the entire lifecycle of infrastructure operations, from provisioning to ongoing maintenance, by providing agents with the seamless access and intuitive tools they require to function effectively.
A Product Ecosystem Designed for Agentic Workflows
The cornerstone of Pulumi’s new offering is a comprehensive set of features designed to empower AI agents to operate autonomously and efficiently within the Pulumi ecosystem. A key enabler for this is the introduction of free, ephemeral Pulumi Cloud accounts. These accounts can be provisioned by an agent on-demand, bypassing the traditional human-centric sign-up procedures. Each agent-registered account is designed to expire after 72 hours, providing a secure and temporary environment for testing and operations. However, the system allows for human intervention to claim and convert these ephemeral accounts into permanent ones, ensuring continuity and control.
Further enhancing agent accessibility, Pulumi has released an npm package that transforms the Pulumi Command Line Interface (CLI) into a single-invocation tool. With the command npx pulumi <anything>, agents can execute Pulumi operations without the need for prior installation, significantly reducing friction and setup time.
A novel imperative verb, pulumi do, has been integrated into the CLI. This command enables agents to provision single cloud resources with unprecedented ease, eliminating the need for extensive scaffolding. For instance, an agent can execute pulumi do create eks:Cluster to provision an Amazon Elastic Kubernetes Service (EKS) cluster. These operations maintain statefulness and adhere to Pulumi’s robust policy framework, mirroring the security and compliance standards of regular Pulumi deployments, but crucially, they bypass the project structure that would otherwise necessitate the agent inferring file structures, directory layouts, and tooling versions.
Pulumi is also bringing over 30 features previously exclusive to its Pulumi Cloud web console directly into the CLI. This expansion encompasses critical capabilities such as change history tracking, drift detection, comprehensive audit logs, secure secrets management, and robust policy enforcement – features that Pulumi has been developing and refining over the past three years.
Duffy draws a parallel between Pulumi’s enhanced CLI and GitHub’s gh CLI, noting that agents naturally gravitate towards such user-friendly interfaces. The CLI’s new capability to emit JSON output and structured errors further facilitates agent parsing and programmatic interaction with the platform’s responses. The overarching objective is to equip agents with a complete toolkit, enabling them to navigate their operational workflows without requiring continuous human oversight.
The Linguistic Advantage: General-Purpose Languages for Infrastructure as Code
In a candid interview with The New Stack, Duffy elaborated on the strategic advantage of Pulumi’s foundational choice to utilize general-purpose programming languages. He highlighted that Large Language Models (LLMs) exhibit a high degree of fluency in languages like Python, TypeScript, and Go, primarily due to their extensive training on vast datasets of production code in these languages. Conversely, LLMs demonstrate less proficiency with HashiCorp Configuration Language (HCL), the domain-specific language commonly used by Terraform. This disparity arises because publicly available HCL examples predominantly originate from tutorials rather than real-world production systems, as organizations often have little incentive to share their proprietary infrastructure as code (IaC) configurations.
Duffy argues that Pulumi’s early bet on leveraging widely adopted programming languages has proven prescient. What was initially conceived as a user-centric approach, focusing on developer preferences, has inadvertently positioned Pulumi as an ideal platform for AI agents. This alignment, nearly a decade after Pulumi’s inception, underscores the foresight in building an infrastructure tool that speaks the language of both humans and increasingly sophisticated AI systems.
A HITRUST Audit Milestone and Remediation at Scale
The transformative impact of Pulumi’s agentic capabilities was vividly demonstrated following a significant event involving a large healthcare customer. Approximately one month after Pulumi introduced its in-house infrastructure agent, Neo, in September 2025, this customer initiated an audit of Pulumi’s policy framework as part of their preparation for HITRUST compliance certification. The audit uncovered an astonishing 400,000 violations within the customer’s infrastructure. With a board-imposed deadline of less than a year to rectify these issues, the customer faced a daunting challenge.
"They were, in essence, saying they had no hope," Duffy recounted. "And then we introduced Neo. Without the AI’s capabilities, they likely would have been unable to meet their compliance obligations." This scenario underscores the critical role of advanced automation in addressing complex compliance and security requirements at scale.
In another notable case, Pulumi highlighted a customer who successfully migrated 500 Terraform workspaces to Pulumi within a single hour, leveraging the power of Neo. This migration occurred amidst a period of reevaluation for many HashiCorp customers, particularly following the company’s acquisition by IBM, prompting a broader assessment of their existing IaC stacks.
Expanding Horizons: Beyond Provisioning to Day-2 Operations
Pulumi’s latest initiative aims to extend Neo’s capabilities beyond initial provisioning into the realm of ongoing, Day-2 operations. The introduction of the Neo Integration Catalog facilitates seamless integration with a host of leading platforms, including Atlassian, Datadog, Honeycomb, Linear, PagerDuty, and Supabase, through remote MCP servers. The catalog is continuously expanding, with more partner integrations anticipated.
Furthermore, the catalog incorporates a new integration for the kubectl CLI, empowering Neo to interact directly with live Kubernetes clusters. Scheduled Neo tasks can now be configured to execute drift detection, manage dependency updates, and conduct compliance audits on a predefined cadence. The results of these automated operations can then be automatically packaged and submitted as pull requests, streamlining the remediation and update process.
Duffy points to the often-overlooked "boring" tasks as the most impactful area for agentic infrastructure. "Aside from dependency management, it’s rarely the case that I go and say: across all my applications, I want to make some giant refactoring," he explained. "But it happens all the time for infrastructure. You think of upgrading versions or changing IAM policies, or some compliance fix that I need to make globally."
He cited ongoing discussions with a major financial institution grappling with the monumental task of revising identity and access management (IAM) policies across its extensive AWS accounts. "Hundreds of thousands, if not millions, of IAM policies that need to be changed," Duffy stated. This type of long-horizon, high-blast-radius work, he believes, represents the next significant frontier for agentic infrastructure.
Ubiquitous Access and Enhanced Collaboration
Pulumi is further democratizing access to Neo by extending its availability beyond the Pulumi Cloud console and into the familiar environments where developers already work. A new pulumi neo command allows the agent to run directly from the local terminal, sharing the same agentic loop as its cloud counterpart but with direct access to the developer’s source tree and local tooling.
To foster collaborative workflows, a Neo GitHub App has been introduced. This app enables teams to interact with @neo on pull requests, facilitating the investigation of failed deployments, the proposal of automated fixes, and the review of changes alongside human reviewers. Complementing this, a Neo Slack App brings the @neo invocation directly into Slack channels, integrating the agent’s capabilities into ongoing incident threads and infrastructure-related conversations.
To address varying security and operational needs, Pulumi has also introduced read-only Neo sessions. This feature allows teams to confine the agent’s operations to inspection-only tasks, which is particularly valuable for lower-stakes reporting and compliance checks where write access is not required or desired.
In a separate but related development, Pulumi is releasing its first infrastructure-as-code providers specifically designed for NVIDIA’s AI Cluster Runtime and CoreWeave’s GPU platform. These providers are tailored to meet the demanding requirements of AI labs and other organizations engaged in large-scale training and inference workloads, further solidifying Pulumi’s commitment to supporting cutting-edge technological advancements.
