PyCon AU 2026 held in Brisbane this week was a five day event for the Python community. With specialized tracks and dedicated tutorial and engineering days there was a wide variety of content available. Before I get into the conference content I wanted to offer a shoutout to the amazing school student presentations on Friday afternoon.
Here is a quick summary of some of the great presentations I attended.
Keynotes and Bookends
The Thursday keynote by Liz Fong-Jones on “30 to 70 PRs a day: How we managed to not wreck our systems ” was a lesson in how one organization has successfully navigated crossing the chasm as we have seen with the huge acceleration in AI code contributions just in the past year. We have witnessed the massive acceleration of GitHub contributions in that time, and all the outages in infrastructure demand this has caused. It was good to see how Honeycomb has progressed when leadership enables a broad AI policy in a well-performing organization. The inverse is, the introduction of AI into a dysfunctional team will only enhance the underlying problems. Using the Tuckman analogy, if you’re in the norming to performing stages, you will only accelerate the team performance, if you’re still suck in storming and have not reached the accelerated upward curve of team effectiveness, AI will not help you.
To provide one example detailed, the move to leveraging AI including humans for contribution reviews showed up in the correct outcome of performing code reviews. That is, the right design questions were being asked and discussed rather than reviewing syntax. This led to improvements in the systems design, and where the total impact for the whole system over time has a far greater benefit.
To leave with some key points mentioned, as I’d like to cover this presentation in a dedicated separate post.
- The measure of engineering work is not a PR.
- Shipping twice as much code, aided by AI, still resulted in 50% more issues.
- There is no excuse for not adding feature flags.
- “We didn’t obviously break anything” is not success on its own.
- Your CI needs to be deterministic, not an AI or MCP.
- By default AI will write statistical average code across the whole industry, not your organisation. You need to codify organisational standards.
Liz is also the co-author of Observability Engineering by O’Reilly. I look forward to reading!
Thursday ended with lightning talks. Anybody gets 5 minutes to talk on any topic, and the topics presented were wide and varied. Talks ranged from world cup 2026 sticker statistics, dust clouds in astronomy, knowing the importantance of fire safety in your home, to admitting not understanding Python lists quirky operations to a Python heavy audience. It was very good to see attendees getting the opportunity to speak in front of a crowd. Saturday also had lightning talks but I was unable to attend.
The Friday keynote by journalist Cam Wilson “Why Australians don’t trust AI and what that means for all of us ” was a great way for a non-technologist to share their view of the technology sphere in a technology-focussed event. A great example also for the Culture and Community of the PyCon community where we don’t assume anyone is non-technical. Yes, there is a serious musk problem and a centralization of AI power to a named few that can have an affect on entire countries. Just look at one incident with Ukraine. This monopoly over AI and related infrastructure could easily impact others nations on a whim. Having just returned to Australia I see lots of differences around AI including the transparency on Australian government websites and in slide deck acknowledgements by presenters. It was interesting to hear from Cam that Australian is one of the highest per capita AI consumers, but ranks equal lowest on global AI sentiment. I want to know with what other country?
Friday concluded in the first ballroom with a student showcase and some wonderful presentations on Python projects and a sharing of quite experienced advice from non-professionals. The memorable and wise comments from just one presenter I wrote down included “Security should come first”, “Plan your data”, and “Listen to your teacher” (aka mentor).
A Security Urgency
While I did not signup for a security conference, I did get a lot from the dedicated cybersecurity track and if this did not scare developers into action with bringing this to the attention of your employers executives, well it should.
“Your Python container is 90% stuff you didn’t ask for” showed the critical importance to know and understand the stack you are using. Avoid all the paperwork with ISM , PSPF and IRAP , by, for lack of a better analogy, K-I-S-S. Just use the “Minimal image by construction” strategy. This probably needs to be on a tee-shirt. However I will say the best slogan I snagged a picture of on a tee-shirt was “I’m the Human-in-the-Loop”. I need one of these.
Scott Norris talked about the increase in a malicious actor’s attacker vectors with every extra binary being a gift, and by offering an ability to gain remote control, or escalated privileges you are giving unnecessary free range. The most recent OWASP LLM Top 10 listed supply chain vulnerabilities as number 3, however it is one the easier and most visible attack vectors that AI has exposed consistently.
My take away quote was “Deleting beats patching, and beats explaining”. For some more info not, checkout the ChainGuard Demo with Python Container .
In Vibe-Check Your Vibe Code: Surviving the Era of Agentic Open Source Dependencies I was introduced to deps.dev and to GOSSIP , highlighting the importance of patching critical vulnerabilities responsibly using different signals. I learned the term “slop-squatting” and that in 2026, the industry is averaging 233 CVE publications per day, and that is just what is announced, an entire shadow CVE ecosystem exists.
Other Presentations
Other talks I attended included:
- Filling in data gaps using Chronos in AI-assisted coding, Python and dbt: taking Chronos live in two days
- The importance of a layered RAG strategy in Ship Reliable RAG: Evals That Grow with Your Retrieval Complexity
- Using Coco in Snowflake to maximize productivity over data wrangling and plumbing in Why Your ML Pipeline Needs an Agent (and How to Build One)
- Observability in the Python age What Happened in Production?! Instrumenting with OpenTelemetry
- How to base your presentation solely on an online demo, and how to recover when it doesn’t work with Adventures in FastAPI: A Choose-Your-Own PyCon AU Talk . A live PR review would have made it! (you had to be there)
- Sensitive data with Privacy data encryption & deletion while preserving analytical integrity
- Security by Obscurity is not a strategy from Can I Trust You? Service-to-Service Identity with SPIFFE
- Encryption was possible in the 13th century with the Persian Seljuk Box 40,000 CVEs and Counting: What 60 Years of AppSec Tells Us About 2026
Conclusion
I could not solve the conference puzzle, but I did get all the codes from the exhibitors and it was obvious after the first 2 or 3 numbers what they were about. It was nice to hear “You are the first person to ask?” No dancing was required.
Why I have never attended a PyCon before I simply cannot justify. I had a great time in this community and it reminded me of those great times in various open-source communities such as MySQL and FOSDEM. I have been involved with Python for over a decade, including for a time a core contributor at OpenStack , which at the time was the largest public Python project. I even have records of a talk proposal from PyCon 2016 (that’s 10 years ago), and a discussion with a colleague of attending in 2021. My loss.
The “relieved of binary gender bathrooms”, “wear it purple day”, and the “Kiwi Python Conference West Island” references cannot be appreciated in a message, you needed to be there. But isn’t New Zealand the 9th Australian territory.
This blog post was written by a human and not produced by Gen AI.
