AI News Briefing — Agentic AI Foundation takes in Agent Skills and Open Responses

Agent frameworks & interop

[2026-10-22] The Linux Foundation’s Agentic AI Foundation takes in four projects: Anthropic’s Agent Skills format, OpenAI’s Open Responses spec for a provider-neutral LLM API based on its Responses API, Hugging Face’s OpenEnv for containerized reinforcement-learning environments, and Alibaba’s OpenSandbox, a sandbox platform with Docker and Kubernetes runtimes. The foundation now hosts ten projects, alongside MCP, A2A, AGENTS.md and goose, up from three at its December 2025 launch. (official, source)

Teams writing Agent Skills or adapting to Open Responses now depend on a shared governance process for changes to those formats, not on one vendor’s roadmap.
[2026-10-22] Google announced Agent Compute Engine, which gives each agent its own hardware-isolated microVM with a guest kernel, a verified identity, short-lived credentials and a persistent disk, and pauses idle agents to snapshots. It already runs Gemini’s work agent; customer preview comes “in the coming months”, with no price. The open-source Agent Substrate on GKE, available now, reports 500 activations a second in a 200,000-agent test. (official, official)

Two things arrived at once. The microVM service is not yet open to customers; the GKE project can be installed today.
[2026-10-22] V12 disclosed three critical flaws in the x402 agent-payment SDKs. The default TypeScript, Python and Go clients took the first payment option a server offered with no cap, so a hostile API could ask for an agent’s whole balance and get it signed. The August 18 releases cap each payment at $1 by default; TypeScript users need @x402/fetch or @x402/axios 2.23.0 or later. No CVE was assigned. (source)

A $1 default only protects deployments that never raised it, so any configured cap is worth rereading.

For Security Engineers: An agent holding a funded wallet behind @x402/fetch or @x402/axios older than 2.23.0 signs whatever a server asks for, so the lockfiles of every agent that can pay deserve a search before the next run.

MCP

[2026-10-22] OpenCode 1.0.137 through 1.18.32 on Windows and WSL let a malicious remote MCP server run commands when a developer started its sign-in, for example with opencode mcp auth. Pillar Security found that the server’s OAuth authorization URL reached PowerShell unescaped. Version 1.18.33 fixed it on September 28, described as a refactor, with no CVE or advisory, so dependency scanners will not flag old installs. (source)

Nothing in the release notes says security, so only the version number tells a patched install from an exposed one.

For Software Developers: On Windows or WSL, an opencode --version below 1.18.33 means upgrading before the next opencode mcp auth against a server you do not control.

Model releases

[2026-10-23] Claude on Google Cloud now has a generally available Anthropic-managed option alongside the Google-managed one. Anthropic is the data processor, features such as Claude Managed Agents, skills and code execution arrive on day zero, and authentication and billing stay in Google Cloud IAM and commitments. The Google-managed option keeps VPC Service Controls, customer-managed keys and data residency, but gets new features later. (official)

Billing through existing Google Cloud commitments means switching options needs no new purchasing route.

For Solution Architects: Workloads that rely on VPC Service Controls, customer-managed keys or data residency stay on the Google-managed option and wait for features; those that want Managed Agents or code execution on day zero go Anthropic-managed, with Anthropic as data processor.
[2026-10-22] OpenAI opened its Decisions API to all customers. It runs on Luna and picks among developer-supplied options with a confidence score instead of writing text, and Speak says time between actions fell from 1.4 seconds to 0.13. Voice and image inputs were added; TechCrunch’s report gives no price. (official, source)

Without a price, it cannot yet be weighed against a structured-output call to an ordinary model.

AI-assisted SDLC

[2026-10-21] GitHub CLI v2.103.0 can sign in with expiring access tokens and a rotating refresh token, so a leaked token stops working within hours. It is opt-in for now, through gh auth login --expiring or gh config set expiring_credentials enabled, and GitHub plans to make it the default for new sign-ins. Long-lived gh tokens were how attackers pushed this week’s malicious LiteLLM release. (official)

Machines where gh stays signed in for months, such as shared build boxes, are where the opt-in pays off first.

AI cost tracking & telemetry

[2026-10-22] GitHub’s Copilot usage metrics API now reports custom skills, custom agents, MCP servers, slash commands and plugins by name instead of lumping them under “other”, with up to 25 entries per record, up from five. Names come from Copilot CLI 1.0.97 or later, the Copilot app, ACP integrations and SDK 1.0.21, not from IDE chat, and only for days processed after the change. (official)

Names appear only from the change onward, so a before-and-after view of MCP server use has no history to compare with.

Research worth reading

[2026-10-22] AfterDeleteBench asks whether an agent with persistent memory really forgets a deleted secret. One query recovered it from a Qwen2.5-7B agent about two-thirds of the time, and when only its stored components remained, Qwen, Mistral and Phi-3 agents rebuilt it in 62% to 99% of cases. Tracking what was derived from the deleted entry and removing that too closed the leak in the tested settings. (paper)

Deleting a memory entry does not delete what was built from it. Tracking derived data is the fix the authors actually tested.
[2026-10-22] Prompt Sensitivity in Tool-Augmented Model Comparisons tested six open models across five domains and five prompt wordings. Tools raised accuracy where a program could answer, but made model-versus-model rankings less stable, tracking how often each model chose to call a tool. The authors ask evaluations to report call frequency and stability across several wordings, not one accuracy number. (paper)

A tool-enabled leaderboard scored on one prompt wording may be measuring how often each model reaches for tools as much as how good it is.

Watch list

MiniMax M3.1 Flash weights and Nemotron 3.5 Bolt E4B: both due October 23; neither posted as of this morning.
Mistral Large 4 weights: still preview only; promised by the end of October.
DeepSeek Search & Fetch billing: free harness calls end October 31.
Google Agent Compute Engine: preview promised “in the coming months”; a price and a region list would make it plannable.