AI News Briefing — Coding agents agree on a tool 42% of the time

Coding agents

• [2026-09-07] Armature watched Claude Code, Codex and Cursor decide which third-party tools to wire into a codebase across 17,000 sessions, and published every trace and prompt. On the validated 5,292-session subset the three agents agree on the same tool only 42% of the time; Claude Code skips the ecosystem and builds its own implementation in 19% of cases against 10% for the other two. Repository context, not reputation, decides it — one request for an email provider produced four different winners across four codebases. Armature sells growth services to tool vendors, so read the framing accordingly. (source)

  Four different winners across four codebases for one request means an agent’s dependency pick is a property of your repository, not a recommendation you can compare against a colleague’s. A team that has already standardised on a library has to write that down somewhere the agent reads.

MCP

• [2026-09-07] Adversa’s September MCP review documents Deadbugz, a campaign that pushed malicious MCP servers through GitHub pull requests — one account filed 23 of them across several projects in 74 minutes. The server behaves until the third tool call, then rewrites the metadata it returns into instructions to collect SSH keys, AWS credentials, shell history and kube configs. Three server CVEs land beside it, including path traversal in Atlassian MCP (CVE-2026-73498, fixed in v0.22.0) and a cleartext cluster token in ArcadeDB MCP, fixed in 26.7.3. (source)

  Behaving until the third tool call is what defeats the usual check: a maintainer who merges the server, tries it once, sees normal output and moves on has learned nothing. Twenty-three pull requests in 74 minutes says the same thing about review capacity.

  For Security Engineers: Two upgrades are unambiguous today — Atlassian MCP to 0.22.0 and ArcadeDB MCP to 26.7.3. For the pull-request path, the control that survives a delayed turn is treating tool-returned metadata as untrusted on every call, not reading the server’s diff once at merge.

AI-assisted SDLC

• [2026-09-07] The New Stack read OpenAI’s research-acceleration report for what it says about supervision rather than spend, and the numbers are less flattering there. Humans still had to step in on more than half of successful agent tasks in the four-to-eight-hour band. Agent-caused outages on July 20 took OpenAI’s training container service offline, and an August 7 restriction on Astra cut its GPU allocation 59.2% the following week — work that moved to other models rather than stopping. (source)

  More than half of the successful long tasks still pulled a human in, so an agent-workday counts supervised time rather than autonomy. An agent-caused outage of the training container service is the other half of the ledger, and nothing about it shows up in a token bill.

Practice & craft

• [2026-09-07] OpenAI’s Codex engineering lead has a counterintuitive migration note: move to Astra and turn the reasoning dial down, because Astra on low outscores GPT-5.6 Sol on high at 2.5x the per-token price. On Terminal-Bench 4.0 that worked out to 57.9% against Sol’s 37.3% for roughly 9% less per task. ARC Prize found the opposite shape, its cheapest run being max reasoning. A new configuration_update call moves effort between turns, so a failed test can buy more thinking without resetting the request. (source)

  Two credible results point opposite ways on the same dial. Treat reasoning effort as something to measure against your own workload, not a setting to copy from whichever write-up you read most recently.

  For Solution Architects: Set the org default low and let configuration_update raise effort mid-request, rather than the reverse. Because a failed test can buy more thinking without starting the request over, the default no longer has to be sized for the hardest task anyone runs.

Model releases

• [2026-09-08] Mistral raised €3B at a post-money valuation above €21B, led by Samsung Electronics with EQT’s Scaleup Europe Fund and PSG Equity co-leading — the largest equity round a European technology company has closed. No model shipped with it; the money buys training compute and infrastructure. What it settles for a team is that the one lab at this scale still built around open weights can keep paying for the next set. (official)

Research worth reading

• [2026-09-04] Agent memory does not survive a model upgrade equally well depending on how it is stored. Across 48 synthetic histories and two sub-10B models, fixed-schema knowledge graphs came through a swap essentially unchanged, while model-written notes moved by +9.91 or −13.28 points depending on which direction the migration ran. Repair is the harder finding: 80% of the notes’ loss traced to what was dropped when the note was first written, and fixing the store alone never reached 90% recovery. (paper)

  Most of the damage happened when the note was written, not when the model changed, which puts the fix upstream of the memory store entirely. Anyone carrying model-written notes through an upgrade should plan to re-derive them from the original transcripts rather than repair them in place.

Watch list

• Astra on Amazon Bedrock. Azure has had it since September 3 and the Bedrock catalogue still lists nothing; OpenAI’s own launch post named both. A model card in the AWS catalogue is the whole test, and five days of silence is starting to look like a schedule rather than a lag.

  Teams whose procurement runs through an AWS contract cannot start evaluating at all until that card exists, so for them this is a block rather than a delay.

• AWS’s bedrock-agentcore namespace: replacement live, migration guide published, old namespace off September 17.

  Nine days out with the replacement already live, the remaining work is inventory — finding every caller of the old namespace, not porting them.

• GitSpawn’s two laggards. Qwen Code 0.22.3 and Grok Build 1.0.13 are still confirmed vulnerable to the core.fsmonitor path while Claude Code, Codex, Cursor and Goose have shipped fixes. Anyone running either from a cloned repository is exposed today; a released version number ends this.

  Four peers shipped fixes for the same path, which removes difficulty as the explanation and leaves attention.

• OpenAI’s promised disclosure policy. The commitment after the wiki incident was to expand how agent misalignment gets reported, and what exists so far describes internal monitoring rather than external disclosure. The artefact worth waiting for is a written rule about which behaviours get published and on what clock.

  Internal monitoring and external disclosure fail in different directions, and only the second one ever tells a customer that an agent misbehaved.