AI News Briefing — OpenAI opens the Codex harness to developers

Agent frameworks & interop

• [2026-09-10] OpenAI opened the Agents API in public beta, which is the harness behind Codex and ChatGPT for Work rather than a new wrapper over chat completions. An agent can run for days, compact its own context when it fills, hand parallel work to subagents with separate contexts, and reach tools over MCP. Environments are optional sandboxes, either OpenAI-hosted or on one of nine partners — Cloudflare, DigitalOcean, Modal, Oracle, Vercel and E2B among them. No API fee during the beta; you pay tokens, tools and container time. (official)

  OpenAI is shipping the part teams usually build themselves and get wrong: an agent that runs for days and compacts its own context when it fills. No API fee during the beta is a beta price — size a rollout on tokens and container time, which are what remain afterwards.

  For Solution Architects: Environments are the early decision. OpenAI-hosted or one of the nine partners determines where agent code executes and whose network it sits in, so picking a partner you already hold a contract with turns a new vendor review into an existing one.

• [2026-09-10] AWS open-sourced Pizza Bot, an inbox for agents whose work outlives your attention. Threads, not sessions: finished jobs land unread, anything needing a decision goes to an Action queue, and an Activity panel shows what specialist subagents did. Built on LangGraph and DeepAgents, extended through SKILL.md files or MCP servers, state in SQLite under ~/.pizza-bot-oss. Apache 2.0. (official, source)

  Pizza Bot keeps its state in SQLite under your home directory, which makes it a single-developer inbox rather than a team queue — nobody else sees what the agents did. Skills files and MCP servers are the extension points, so what you wrote for another harness carries over.

• [2026-09-09] ADK for Kotlin 1.0 reaches parity with ADK Core, so hierarchical multi-agent setups, resumable sessions and human-in-the-loop steps are now available to JVM and Android teams without a Python sidecar. Tool schemas are generated at compile time through KSP instead of runtime reflection. On-device inference runs via LiteRT-LM and ML Kit, still beta; Room and AppSearch hold state across restarts. (official)

  KSP moves tool-schema errors to build time: a signature that stops matching its declared parameters fails the compile instead of surfacing as a malformed call in production. On-device inference is still beta, so don’t plan an Android feature on it yet.

Model releases

• [2026-09-10] GPT-Live-1 landed in the API, splitting a voice agent into a fast conversational model in front and whichever reasoning model you choose behind it. Being natively full-duplex, an interruption mid-sentence needs no turn-taking code of your own. $0.05 a minute, billed by the second, with backend model and tool calls charged separately. EliseAI’s CTO put the switch at 23,000 lines deleted. (official, source)

  Two models means two bills. Swapping which reasoning model answers behind the conversational layer no longer means rebuilding the voice plumbing in front of it.

  For Engineering Managers / Tech Leads: Billing by the second prices a pilot directly — average call length times call volume gives the conversational floor at $0.05 a minute, then backend model and tool calls go on top. The 23,000 lines deleted is the maintenance side of the same comparison.

Coding agents

• [2026-09-11] Google published a Google Cloud Developer Plugin that installs into Claude Code, Codex CLI or Antigravity CLI from one marketplace command. It carries skills for auth, project management and guarded gcloud use, plus a Developer Knowledge MCP server that grounds answers in current Google docs rather than whatever the model remembers. It follows the vendor-neutral Agent Plugins spec, so the same bundle installs across three harnesses. (official)

  Google built this to the Agent Plugins spec, so a team can standardise on the tooling without also standardising on one coding agent. The Developer Knowledge MCP server is the half that matters for gcloud flags, where remembered syntax and current syntax drift apart.

MCP

• [2026-09-09] A paper argues you can audit an MCP server you cannot run. MCPSEC hypothesises indirect prompt-injection flaws from registration-time tool descriptions alone — no execution, no source — and across 20 deployed servers and 177 tools it recovered 98.9% of the 95 human-confirmed vulnerable tools, against 84.2% for a plain LLM baseline. The catch is precision: it flagged 143. (paper)

  Registry operators are the obvious user: tool descriptions are what a registry already holds, so this screens a whole catalogue instead of testing one server at a time. At 143 flags for 95 real tools it sorts a review queue; it decides nothing.

AI-assisted SDLC

• [2026-09-10] Specs did not help reviewers find more bugs. In a controlled study behind an InfoQ write-up, five reviewers hit 52.5% recall with specifications and 51.8% without — but 81% of their findings tied back to a named requirement, against zero on the baseline, and reviews took 48 minutes instead of 27. An automated replication across 90 reviews reproduced both halves. (source)

  Reviewers found the same bugs either way and spent 21 minutes longer doing it. What they gained was traceability — 81% of findings tied to a named requirement, against zero — which is worth paying for in audit work and not in a bug hunt.

• [2026-09-10] GitHub put AI Scan for pull requests behind REST endpoints in public preview, at /orgs/{org}/code-scanning/ai-scan and the repository equivalent, so the setting can be rolled across hundreds of repos without clicking through each one. Advanced Security customers only, github.com only, and a repository cannot re-enable what the organisation turned off. (official)

  GitHub made the organisation setting final, which is either the control you wanted or a support queue, depending on how much autonomy your teams expect over their own repositories.

  For Platform / DevOps Engineers: Script the repository endpoint across the fleet and enablement becomes one pass instead of a per-repo click-through. Check the licensing constraints first — anything on GHES or outside Advanced Security is not reachable by these endpoints at all.

AI cost tracking & telemetry

• [2026-09-10] OpenAI stopped selling $200 Pro subscriptions to new customers, a week after Astra shipped, saying that tier strains its systems hardest. Plus, Go and API access continue, and no restart date was given. A capacity signal like this is worth reading before you plan a rollout on the newest model. (source)

  OpenAI gave no restart date, and a tier you cannot buy into is not one you can standardise a team on — whatever it does for the people already holding a seat.

• [2026-09-11] StackGen’s account of running agents in production puts the diagnostic unit at the session, not the request: nested spans for every LLM call, tool execution and subagent handoff, each carrying latency and token cost, exported asynchronously so telemetry trouble never blocks the agent. Cost control is pre-execution — hard iteration caps, per-tool limits, a block on identical consecutive calls. (source)

  StackGen puts the controls before execution rather than in a dashboard: an iteration cap stops a loop at no further cost, while a spend alert fires once the tokens are gone. Blocking identical consecutive calls is the cheapest of the three to add.

Practice & craft

• [2026-09-10] Anthropic’s threat report puts numbers on distillation against a frontier model: nearly 200 million exchanges across five campaigns, 151 million of them traced to Alibaba between May and July and peaking near 3 million a day across 3,500 accounts. Moonshot AI ran roughly 300,000 requests through 5,000 accounts in ten days and relayed its own users’ traffic to Claude. Chain-of-thought traces were the target, extracted by dressing requests as translation tasks. (official, source)

  Each request looked like ordinary translation work, so the volume is the only part that stands out. Anyone running an API product should expect that shape: nothing wrong per call, 3 million a day spread across 3,500 accounts.

Teaching & learning

• [2026-09-10] Twenty-six part-time MSc cybersecurity students fixed vulnerabilities with ChatGPT while researchers coded every interaction. Prior security background did not change how they used it, and individual usage patterns lost significance once corrected for multiple comparisons. What predicted grades was breadth — how many distinct ways a student put the tool to work. (paper)

  Students who used ChatGPT in more distinct ways scored better, and students with a security background were no different from those without. That puts the teachable thing at range of application rather than prompt wording. Twenty-six students is small; the null result is the sturdier half.

Research worth reading

• [2026-09-10] SemVerBench asks models whether a version satisfies a constraint, 240 checkable items across npm, PEP 440 and Cargo, and the failures are not evenly spread. Cargo’s partial-comparator rule dropped every model tested near 60%. On PEP 440 zero-pad and post-release cases Claude scored 97–100% while GPT-5.1 returned 0 of 26. A resolver is deterministic and free; have the agent call one. (paper)

  Claude at 97–100% and GPT-5.1 at 0 of 26 on the same PEP 440 cases is a coin flip on whether a model happened to absorb one spec’s edge rule. Read the per-ecosystem scores rather than an average across the three.

• [2026-09-09] Passing static analysis is not the same as being safe. A pipeline that scanned with Bandit and Semgrep, then built and ran exploits in containers, took 654 statically clean Python samples and confirmed 14.5% exploitable — 33.7% on RedCode, 5.4% on SecurityEval. Two of the most common confirmed classes, CWE-338 and CWE-916, were flagged by neither scanner. (paper)

  Bandit and Semgrep both missed two of the most common confirmed classes, so adding a third scanner is not the fix. Building and running the exploit in a container is what separated 14.5% from statically clean.

Watch list

• DeepSeek’s V4-Pro cutover. Sunday: deepseek-v4-pro calls start landing on V4.1-Flash, at Flash billing.

  Sunday resolves this, and the failure mode is silent: calls keep succeeding under a different model at a different price, with nothing in the response to say so.

• AWS’s bedrock-agentcore namespace. Old namespace off September 17; nothing left to wait for but the grep.

  Six days out, this only becomes news if somebody’s infrastructure code still names the old namespace on the 17th.

• OpenAI’s misalignment disclosure framework. Promised within weeks on September 5, and now overtaken by events: Senator Josh Hawley opened a subcommittee investigation on September 9 into the Hugging Face breach, with 16 questions and a document demand due October 1. A deadline set by someone else is the first hard date this item has had. (source)

  October 1 is a date somebody else enforces, so the open question has moved from whether OpenAI publishes a framework to what a subcommittee’s sixteen questions extract first.

• GitSpawn’s two laggards. Retired unresolved: Qwen Code 0.22.3 and Grok Build 1.0.13 went ten days without a fix while four peers shipped, and no version number appeared. Anyone still on either one is running the exposure, not waiting out a patch.

  Closing this without a fix is the accurate ending. What stays true after the line goes is that nobody on those two versions has a patch to wait for.