Talking Fingers — Building with agents

Building with agents: AI News Briefing — Acronis traces Taipei dispatch record theft to AI agents

Mon, 09 Nov 2026 00:00:00 GMT

Coding agents — OpenAI agreed to buy Pierre Computer Company, whose Trees and Diffs libraries already handle file navigation and change review inside the Codex app. OpenAI plans to fold Pierre's Git-backed Code Storage service into Codex. Terms weren't disclosed, and the deal still needs regulatory approval. (official)
AI-assisted SDLC — Releasing Linux 7.4-rc2, Linus Torvalds said the flood of AI-prompted bug fixes may be starting to turn. eBPF lead Alexei Starovoitov reports that fixes in his area now arrive faster than new reports, though Torvalds said most other subsystems aren't there yet. The rc1 before it was the largest release candidate in kernel history. (source)

Building with agents: AI News Briefing — WorkOS breach traced to a researcher's escaped pentest agent

Sun, 08 Nov 2026 00:00:00 GMT

Coding agents — Cognition's SWE-2 Flash runs in Devin Desktop and the Devin CLI at about a fifth of SWE-2's price and roughly three times its speed, free for paid Devin users through November 30. It is a 276B mixture-of-experts with 12B active, built on Thinking Machines' open-weights Inkling-Small. Benchmarks are self-reported, and the weights stay private: Cognition cites security and plans gated access for partners and labs. (source)
Coding agents — AWS made Kiro bots generally available in Kiro Crew. Each bot is a named, long-running agent with its own memory, chat and tool permissions; it can fan out parallel sessions, run on schedules set in plain language, and ask for a decision while other work continues. Memory can be viewed, edited or deleted, and new tools need approval. No separate bot price was announced; runs draw Kiro credits. (official, source)
Coding agents — @GitHub in Slack and Teams is generally available, with a canvas in Teams for reviewing plans and diffs, and issues or PRs it opens now credit the conversation's author. (official)
MCP — An MCP server built on the TypeScript SDK that reuses one stateless HTTP transport, or one McpServer instance, across clients can send responses and notifications to the wrong client. Messages are matched only by JSON-RPC id, and every client starts counting at zero. CVE-2026-111770 (CVSS 7.7) is fixed in @modelcontextprotocol/server 2.3.0 and the SDK 1.32.0; reused instances now fail, so create one per session. stdio servers are unaffected. (official)
MCP — The same SDK's bearer-token auth accepted access tokens issued for another service, because it never checked the audience. CVE-2026-111771 (CVSS 6.8) is fixed in SDK 1.32.0, server 2.3.0, express 2.0.2 and server-legacy 2.3.1, but upgrading leaves the check off: enable audience validation and pass the expected audience, or check aud in your own verifyAccessToken(). (official)
AI-assisted SDLC — Grab described how it kept its mobile apps stable as AI assistants raised the number of code changes per release. The defence is layered: custom lint rules, an internal early-access build, staged rollouts and feature flags that are switched off when crash rates pass a threshold, and automated triage that maps each crash to a pull request. The write-up publishes no before-and-after figures. (source)

Building with agents: AI News Briefing — Week of November 2–8, 2026

Sun, 08 Nov 2026 00:00:00 GMT

Coding agents — Copilot reached JetBrains Air, Xcode's assistant, and Slack and Teams, while JetBrains built Air into its 2026.3 IDEs. Meta bought Conductor, whose cloud service shuts November 20, and AWS made Kiro bots GA. (Air, 2026.3, Conductor, Kiro)
MCP — Two TypeScript SDK fixes need more than an upgrade: reused transports now fail, and audience validation stays off until enabled. Glow Labs found agents still installing the archived reference servers, and Claude Team and Enterprise plugins can now connect at login. (SDK, archived servers, Claude)
Agent frameworks & platforms — Langflow 1.13.0 fixed two unauthenticated CVSS 9.8 flaws. Google donated Agent Substrate and gVisor to the CNCF, Mistral relaunched Studio for managed agents, and AMD open-sourced the PrimusClaw runtime. (Langflow, CNCF, Studio, PrimusClaw)
AI-assisted SDLC — GitHub Actions blocks pull_request_target by default in public repositories from December 2, with brownouts first. OpenAI described Pando, the Git backend it built for Codex's commit load, and Dependabot now updates Agent Package Manager dependencies. (Actions, Pando, Dependabot)

Building with agents: AI News Briefing — Claude Code settings files leak secrets on GitHub

Sat, 07 Nov 2026 00:00:00 GMT

Coding agents — Apiiro scanned public GitHub for .claude/settings.local.json, where Claude Code saves a command as an allow rule when someone picks "Yes, and don't ask again." Of 104,185 copies, 1,122 held at least one secret typed into the approved command: 379 database passwords, 43 SSH logins and 23 AWS keys among 1,379 in total. Claude Code adds the file to the user's global git excludes, not the project's .gitignore, so a collaborator or a fresh machine without that setting can commit it. gitleaks and TruffleHog both missed 215 of the files. Apiiro says Anthropic hasn't replied; a related issue was closed as not planned. (source)
Coding agents — Forever Security showed that any browser extension able to run scripts on claude.ai could send tasks to Claude Desktop through Dispatch, the phone-to-desktop feature. In its test, a script asked Claude to install an npm package, clicked "Allow" on each approval prompt, and the package's install script ran. The researchers say Anthropic called the report a duplicate in May and told them in October that Dispatch would be retired. Dispatch is closed to new users but still running for some existing ones. (source)
Coding agents — Copilot code review settings can now be managed through GitHub's REST and GraphQL APIs, from enterprise policy down to a single repository, including review effort and whether reviews use MCP tools. Responses now say which skills, MCP servers and custom instructions a comment drew on, and review sessions show the AI credits they used. (official)
Agent frameworks & platforms — AMD open-sourced PrimusClaw, a managed agent runtime that runs in your own Kubernetes cluster next to Instinct GPUs. It keeps runs as database rows under leases, so another replica can pick up an in-flight run after a crash or upgrade, and agent code runs without platform-wide credentials. It exposes A2A v1.0, MCP in both directions and an API compatible with Claude Managed Agents. MIT licence, with an Apache 2.0 sandbox controller. (official)

Building with agents: AI News Briefing — OpenAI releases GPT-6 Cyber to vetted security teams

Fri, 06 Nov 2026 00:00:00 GMT

Coding agents — JetBrains shipped the 2026.3 releases of its IDEs, including PyCharm, WebStorm, GoLand, RubyMine, RustRover and DataGrip, with JetBrains Air built in after a month in early access. Air is a tool window for running agents you already have, such as Claude Agent, Codex, Copilot, Junie and other ACP agents, and it needs no JetBrains AI subscription when you bring your own. Admins can restrict it to an allowlist of agents. (official, official)
Agent frameworks & platforms — Google donated Agent Substrate, gVisor and OpenRL to the CNCF, all accepted into the Sandbox tier. Agent Substrate parks idle agent sessions in storage and restores them onto a warm pool of sandboxes in under 500 ms, with gateways that inject secrets by agent identity. It is at 1.0 and runs on any Kubernetes cluster, not only GKE. OpenRL exposes a Tinker-compatible API for self-hosted RL post-training. (official)
Agent frameworks & platforms — LangChain added async subagents to Deep Agents in Python and JavaScript, switched on with a single "async": True field. The orchestrator gets tools to start, check, update, cancel and list background tasks, and a follow-up instruction can either interrupt a running subagent or queue behind it. Task notifications are in beta. (official)
Agent frameworks & platforms — Mistral relaunched Studio as a platform for managed agents with sandboxes, subagents and hooks, resumable workflows with human approval steps, and OpenTelemetry traces of every model and tool call. It deploys to Mistral's cloud, a customer VPC or on-premises, and ships a Mistral MCP server for building from a coding agent. (official)
Agent frameworks & platforms — Microsoft says Claude models in Copilot, including Copilot Cowork, will process inside the EU Data Boundary for EU and EFTA organizations by the end of 2026, under existing contract terms. The setting stays off by default there; tenants already using Claude need do nothing. The UK isn't mentioned. (official)
AI-assisted SDLC — GitHub's Copilot usage metrics API now reports what developers do with Copilot code review comments: total_comments_evaluated and total_comments_addressed, which together give an addressed rate, broken down by severity and comment type. A separate count tracks merged pull requests where no person requested changes after Copilot's first review. Comments are counted on the day the pull request merges. (official)

Building with agents: AI News Briefing — OpenAI pipeline produces 948 working Linux root exploits

Thu, 05 Nov 2026 00:00:00 GMT

Coding agents — A developer reported that opening Postman's desktop app, version 12.33.4 on macOS, installed Postman plugins into both Claude Code and Codex without asking, plus a Postman CLI. In Codex the installer also wrote its own startup hook's hash into the trusted list, skipping the review Codex normally requires. The hook tells Codex to load Postman's API skill for most API tasks. Postman had not answered The New Stack's questions. (source)
Coding agents — Meta bought Conductor, whose app runs several Claude and OpenAI coding agents in parallel workspaces. Conductor's cloud service shuts on November 20, after which user cloud data is deleted; the core app keeps working until early next year. (source)
Coding agents — GitHub Copilot now runs inside Xcode's built-in coding assistant, in public preview on Xcode 27.3 beta for all Copilot plans. (official)
MCP — Claude Team and Enterprise organizations can now have plugins connect automatically at login, in beta. Claude itself signs the identity assertion that a participating MCP server checks before issuing a token, so a company's identity provider no longer has to support the Enterprise-Managed Authorization extension. Admins pick which services and which roles get access, and expired tokens renew without a prompt. Launch services include Atlassian, Datadog, Figma, Linear and Notion. Personal plans aren't included. (source)
Agent frameworks & platforms — Microsoft shipped Agent Framework "builder" skills for .NET and Python that any coding agent supporting the Agent Skills format can install with gh skill install or npx skills add. They teach the agent to pick the smallest fitting pattern, a single agent, a harness or a workflow, before writing code. Microsoft recommends pinning a tag. (official)
Agent frameworks & platforms — AWS showed how to plug small decision models into Bedrock AgentCore Evaluations: classifiers that pick from fixed answers and return calibrated probabilities, run through a Lambda evaluator reading the agent's OpenTelemetry spans. Every turn gets the cheap check; only low-confidence turns go to an LLM judge. It's a pattern with sample code, not a new feature. (official)
AI-assisted SDLC — Dependabot version updates now cover Agent Package Manager, opening pull requests for git dependencies pinned in apm.yml and regenerating apm.lock.yaml. That puts shared agent skills, prompts and instructions on the same update path as code dependencies. Security updates aren't covered. It is available on all GitHub plans. (official)

Building with agents: AI News Briefing — Revolut cuts AI coding costs by self-hosting GLM

Wed, 04 Nov 2026 00:00:00 GMT

Coding agents — GitHub Copilot now runs as an agent inside JetBrains Air over the Agent Client Protocol, on an existing Copilot plan. Local tasks need the Air plugin; cloud tasks run in a fresh container per task through Air Teams and bill to Copilot, not JetBrains AI credits. Air's analytics don't count Copilot usage, and admins can't set Copilot spending limits there. (official, official)
Coding agents — DeepSeek published dsh-superagent, an MIT-licensed prototype of a coding agent that takes requests from GitHub or Feishu, works each one in its own session and replies with a pull request. A web panel lists what needs a person. DeepSeek labels it a research prototype, not a product, and says it differs from its internal version. (official)
MCP — Glow Labs found coding agents installing the archived @modelcontextprotocol reference servers, mostly by recalling package names from training data rather than at a user's request. It reported four high-severity flaws, including prompt-injectable code execution in the Puppeteer server; maintainers closed the report because the repository is archived, so no fix is coming. The deprecated packages have passed 17.3 million npm downloads since July 2025, and npm's deprecation warning doesn't block installs. (source)
Agent frameworks & platforms — LangSmith's bring-your-own-cloud deployment now runs on Azure and Google Cloud in beta, alongside generally available AWS. LangChain keeps the control plane; traces, evals, prompts, agent deployments and secrets stay in the customer's account and region. The Google Cloud control plane sits in the US, and trace migration works on AWS only for now. (official)
AI-assisted SDLC — GitHub Actions will block pull_request_target by default in public repositories from December 2, a month later than first planned, with two-hour brownouts on November 9 and 16 at 16:00 UTC. The trigger runs with the base repository's secrets, which is how fork code ends up stealing them. Workflows that need it must be allowed in an Actions event policy. (official)

Building with agents: AI News Briefing — Mandiant details LLMJacking attacks on stolen cloud credentials

Tue, 03 Nov 2026 00:00:00 GMT

Coding agents — Anthropic added two sentences to Claude Code's prompt on Opus 5.5 that steer it away from building a recreation of a specific existing game. Anthropic's Addy Osmani confirmed it, citing the usage policy's IP rule, and said original games, genre games and games from your own assets should keep working. Users report no setting to turn it off. (source, source)
MCP — Uber described the MCP Gateway in front of more than 800 internal MCP servers and 5,000 tools. A crawler turns Protobuf and Thrift definitions into tool schemas, with LLM-written descriptions, but every new tool stays disabled until its owning team enables it. Agents search for servers and fetch one schema at a time, and can ask for only the response fields they need. (source)
Agent frameworks & platforms — IBM's bulletin lists four Langflow flaws fixed in 1.13.0, two of them critical (CVSS 9.8) and reachable without logging in: an authentication bypass, CVE-2026-93680, and code execution, CVE-2026-110186. A third lets a low-privileged user have the Agentic Assistant run OS commands. Versions 1.0.0 through 1.12.8 are affected, and IBM offers no workaround short of upgrading. (source)
AI-assisted SDLC — OpenAI replaced the Git backend behind its monorepo with Pando, built after concurrent Codex work multiplied commits. Pushes to different refs commit in parallel and only same-ref pushes serialize, which cut median push latency by about 80%. Pando is internal; the post is a design write-up, not a product. (official, source)
AI-assisted SDLC — Hugging Face proposes Model Integration Contracts for Transformers: a small fixture built from a real checkpoint's config, a runnable usage example and reviewed baseline outputs, cheap enough to run on CPU for every pull request. A change that let UMT5's decoder attend to future tokens sat in main for two months; a shrunk fixture flags it. The CI job reports without blocking for now. (official)

Building with agents: AI News Briefing — Northflank breach leads to abuse of AI API keys

Sun, 01 Nov 2026 00:00:00 GMT

Coding agents — DeepSeek's Harness team published dsh-superagent-prototype under MIT: a coding agent that watches one GitHub repository, and optionally Feishu, takes requests from allowed users, works each in its own session and directory, and replies with a pull request. DeepSeek calls it a research prototype, not a product, and says the code differs from its internal version. (official)
Coding agents — Microsoft's analysis of the trojanized Claude Code extension in Cursor's marketplace names the persistence to hunt: a com.apple.sysmond.plist LaunchAgent on macOS, an @reboot crontab entry for ~/.config/.smt on Linux, and a SysMon scheduled task on Windows. The names imitate monitoring tools, so check what each one runs. Uninstalling the extension removes none of them. (official)
Agent frameworks & platforms — Amazon Bedrock AgentCore Runtime adds session endpoints: an authenticated URL for an app running inside an agent's session, so you can watch a site change while a coding agent edits it. Ports between 8000 and 12000 are allowed per runtime. Each request needs SigV4 or a bearer token, and the URL expires with the session. MicroVM runtimes only, and no PrivateLink. (official)

Building with agents: AI News Briefing — Week of October 26–November 1, 2026

Sun, 01 Nov 2026 00:00:00 GMT

Coding agents — GitHub made Copilot's assisted permissions and Fusion model routing generally available, and added server-to-server auth and enterprise plugin controls. Claude Code added an opt-in that lets rm -rf ~ run unprompted, and Android Studio made bring-your-own-agent stable. (permissions, Fusion, Claude Code, Android Studio)
MCP — Google opened its Connected Apps Platform preview, putting MCP-backed apps into Gemini and Search. (Google) Per MacRumors, ChatGPT gained iCloud Mail and Calendar plugins on all plans. (iCloud) (unconfirmed)
Agent frameworks & platforms — Microsoft put the Copilot harness into Foundry Agent Service, free until December 1. LangChain's Managed Deep Agents v0.10 added browser use and removed connectors.mcp(), and Bedrock AgentCore added live session endpoints. (Foundry, Deep Agents, AgentCore)
AI-assisted SDLC — GitHub Agentic Workflows reached GA with read-only defaults, and Meta's per-diff JiTTesting cut privacy incidents by 20%. Atlassian's survey found the share of developers saving 10+ hours a week fell from 68% to 26%. (Agentic Workflows, JiTTesting, Atlassian)

Building with agents: AI News Briefing — Trojanized Claude Code extension hits Cursor's marketplace

Sat, 31 Oct 2026 00:00:00 GMT

Coding agents — A trojanized build of Anthropic's Claude Code extension (anthropic.claude-code 2.1.312 and 2.1.313, not built by Anthropic) was live in Cursor's marketplace from about 2:27am to 1:35pm PT on October 29. It adds an svc-telemetry key to ~/.ssh/authorized_keys, tries to enable SSH, opens a reverse tunnel, installs persistence and beacons host details plus the names of secret-looking environment variables. Cursor puts the exposure at up to 5,000 users and says uninstalling may not be enough: check for the key, remove persistence, rotate credentials. Open VSX and Microsoft's marketplace were not affected; Anthropic's clean release is 2.1.314. (official, source)

Building with agents: AI News Briefing — Mistral releases Large 4 open weights and cuts its price

Fri, 30 Oct 2026 00:00:00 GMT

Coding agents — Android Studio Rabbit 2 makes Bring Your Own Agent stable, so any of more than 40 agents that speak the Agent Client Protocol can run inside the IDE, Claude Code and Codex among them. A new android preview command renders Compose previews without an emulator; Google says agents using it finished UI tasks 77% faster on up to 3x fewer tokens in internal testing. (source)
Coding agents — Copilot's repository plugin defaults and enterprise plugin controls are generally available in VS Code, Copilot CLI and the Copilot app. A repository can name a marketplace and default plugins for anyone on a Copilot plan. Enterprise Cloud admins can restrict installs to approved marketplaces, block plugins, or force-install ones users cannot turn off. (official)
Agent frameworks & platforms — LangChain's Managed Deep Agents v0.10 (public beta) adds browser use in a LangSmith sandbox, with a browser_handoff tool that lets a person sign in so the password never reaches the model or traces. Subagents marked async now run in the background and wake the main agent when they finish. One breaking change: connectors.mcp() is gone, and MCP servers are declared in tools/mcp.ts or tools/mcp.py. (official)
AI-assisted SDLC — Meta's JiTTesting writes LLM-generated tests for each diff that fail only if the change alters behavior, instead of leaving review comments. An LLM ensemble and a rule-based filter cut false positives, and engineers review results in aggregate rather than one by one. In the first half of 2026 it caught 74 serious privacy bugs before they landed, and privacy incidents fell 20%. Engineers rate 60% of its findings as real. (official)

Building with agents: AI News Briefing — Google's Gemini 4 Carbon launches only to cyber defenders

Thu, 29 Oct 2026 00:00:00 GMT

Coding agents — Copilot Fusion is generally available on all Copilot plans in VS Code, the Copilot app, Copilot CLI and JetBrains. Instead of a model, you pick an effort level and Copilot routes each prompt: one model, a cheap draft escalated when a check fails, or a draft reviewed by a second model. Each model used bills at its own rate, with 30% off for a limited time. GitHub says Fusion Max scored 60 on the Artificial Analysis Coding Agent Index, two points under Claude Code with Opus 5.5 Max, at about half the API cost per task. (official)
MCP — Google opened a preview of its Connected Apps Platform, letting outside developers put apps into the Gemini app, Google Search, or both. Apps integrate through a cloud-hosted MCP server, or on Android through the AppFunctions APIs, and are registered, tested and submitted for review in a Google Connected Console. Access opens in phases, US developers first per TechCrunch. Google's post does not say which user plans get these apps or how actions are approved. (official, source)
Agent frameworks & platforms — Microsoft put the Copilot harness into Foundry Agent Service as a public preview: Microsoft runs the agent loop and sandbox, and the developer supplies skills, Foundry or MCP tools with configured approvals, and a source-controlled agent definition. The harness is free until December 1, when sandbox compute starts billing at $0.0994 per vCPU-hour plus $0.0118 per GiB-hour of memory, on top of model inference. (official)
AI-assisted SDLC — GitHub Agentic Workflows is generally available on Free, Team and Enterprise. Workflows are written in Markdown and compile to Actions YAML. Agents get read-only permissions by default, run in a sandboxed container behind a firewall, and a threat-detection job scans proposed changes before they apply. GA adds micro-VM isolation, self-hosted ARC runners and gh aw forecast for credit spend. The default Copilot CLI engine needs a Copilot license. (official)

Building with agents: AI News Briefing — Anthropic's unreleased model chains flaws into browser exploits

Wed, 28 Oct 2026 00:00:00 GMT

Coding agents — Claude Code v2.1.311 adds CLAUDE_CODE_EVEN_MORE_DANGEROUSLY_SKIP_PERMISSIONS. Set in the launch environment, it lets rm and rmdir on critical paths such as the home or working directory run with no prompt, but only in bypassPermissions mode. The docs warn that rm -rf ~ can then run unasked. Settings files cannot set it, and background sessions and agent-team teammates start without it. (official)
Coding agents — GitHub Copilot now accepts server-to-server authentication, in public preview. A GitHub App with the read-only Copilot Requests permission passes a short-lived installation token to the Copilot SDK, so a service can call Copilot without a signed-in user. Usage bills to the installing organization under its model policies and budgets, and shows up in usage reports by app_client_id. (official)
MCP — ChatGPT has iCloud Mail and iCloud Calendar plugins. Per MacRumors, they can search and send mail, manage drafts and look up contacts, and create or change calendar events. Both connect with an Apple app-specific password rather than the account password. MacRumors reports them on all plans across web, desktop and iOS, and OpenAI's help center does not yet list which plans get them. (source) (unconfirmed)
AI-assisted SDLC — Meta's 2026 Python Typing Survey (1,794 responses) found AI tools wrote type hints for 42.5% of respondents, and 24.4% said a coding agent ran their type checker. Respondents who used AI to fix checker errors also complained about agents that "spam #type: ignore comments everywhere" to get a clean run. (official)

Building with agents: AI News Briefing — OpenAI ships GPT-6.1 Terra at half Sol's price

Tue, 27 Oct 2026 00:00:00 GMT

Coding agents — Assisted permissions in GitHub Copilot is now generally available. An LLM reviews each request to run a command, touch a path or open a URL; requests it judges clearly safe go ahead, and the rest wait for approval. It works in Copilot CLI (/permissions), the Copilot app and VS Code. Enterprise admins can block Allow All while still allowing Assisted, and can set the default mode for new sessions. (official)
AI-assisted SDLC — Atlassian's State of Developer Experience 2026 survey found the share of developers reporting 10 or more hours a week saved by AI fell from 68% to 26% in a year. 65% spend time fixing AI output that missed the intent, and 49% spend four or more hours a week managing AI tools. The answers are self-reported, and the 2025 sample of 3,500 was over twice this year's 1,560. (source)

Building with agents: AI News Briefing — Planted AGENTS.md files in Downloads hijack coding agents

Mon, 26 Oct 2026 00:00:00 GMT

Coding agents — Forever Security found a malicious AGENTS.md in a customer's Downloads folder, telling a coding agent to install function-color, an npm package from the MALFEX malware campaign. A web page can save a file to Downloads with no click, and agents follow instruction files in the folder they start in. In Forever's tests, Codex ran the malware in more than 90% of attempts by editing ~/.codex/config.toml. A planted CLAUDE.md got Claude Code to write an attacker's ANTHROPIC_BASE_URL about half the time. (source)
AI-assisted SDLC — Google open-sourced the Elephant-Goldfish Model plugin under Apache 2.0. A long-running "Elephant" session holds project context and writes a design document but no code; stateless "Goldfish" sessions with no context must explain the design back, attack it for gaps, and pass an implementation-readiness check before coding starts. Google says thousands of its engineers use it daily. It targets Antigravity first, with other environments promised. (official, official)
Agent frameworks & platforms — LangChain described the five pieces shared by its internal agents for sales, code and content: living in Slack, a clear identity (acting as the user or as its own app), global and per-user memory, code run in a separate sandbox behind a secret proxy, and scheduled runs that a user can set up themselves. All three sit on Managed Deep Agents. (official)

Building with agents: AI News Briefing — LiteLLM traces its malicious release to a leaked master key

Sun, 25 Oct 2026 00:00:00 GMT

AI-assisted SDLC — LiteLLM's root-cause post traces the malicious 1.107.0 release to a master key for its Agent Platform, committed to a public repository on May 27. The commit was force-pushed away, but the key was never revoked. On October 10 an attacker used it to pull an organization owner's unscoped GitHub CLI token, then stole two maintainers' tokens. A release rule loosened that week let any two engineers trigger and approve a release, so one stolen token started it and the other approved it. (official, source)
AI-assisted SDLC — Microsoft's analysis of the same package says the wheel also drops cook.py and sitecustomize.py into site-packages, outside the litellm directory, so uninstalling LiteLLM leaves them running at every Python start. It advises inspecting suspect environments from a clean machine without running Python or pip there, and rebuilding from verified artifacts rather than cleaning in place. (official)

Building with agents: AI News Briefing — Week of October 19–25, 2026

Sun, 25 Oct 2026 00:00:00 GMT

Coding agents — Claude Opus 5.5 and Sonnet 5.5 reached Antigravity, billed outside the pooled quota. Vercel Labs open-sourced fx, an embeddable agent in Zig, and Copilot moved into a consolidated Teams app. (Antigravity, fx, Teams)
MCP — Fake npm packages registered an attacker's MCP server in agent configs, Google published a build guide for MCP Apps in Gemini Enterprise, and Anthropic previewed Claude Duet for US Pro and Max subscribers. (npm, MCP Apps, Duet)
Agent frameworks & platforms — The Agentic AI Foundation took in Agent Skills, Open Responses, OpenEnv and OpenSandbox. Microsoft pitched task-scoped permissions for agents, llm-d 1.0 added agent-aware routing, and x402's payment SDKs had signed whatever a server asked until a $1 default cap. (AAIF, Microsoft, llm-d, x402)
AI-assisted SDLC — PHP patched two pre-auth flaws found with AI agents, GitHub's package firewall entered preview, and GitHub CLI added expiring tokens, the kind of token used against LiteLLM. (PHP2Shell, firewall, gh)

Building with agents: AI News Briefing — Moonshot releases Kimi K3.1 Pro, weights promised by November 4

Sat, 24 Oct 2026 00:00:00 GMT

Coding agents — SOCRadar found exposed infrastructure showing ransomware affiliates of the INC and Gentlemen groups running intrusions through OpenCode with commercial models bought on OpenRouter, including Claude Opus 4.6 and Kimi K3. The operators wired the agent to 32 MCP servers covering reconnaissance through extortion, approved each step by hand, and reworded refused requests as authorized red-team work. About 62 organizations were targeted. (source)
Coding agents — GitHub folded Copilot into a consolidated GitHub app for Microsoft Teams, where mentioning @GitHub on a bug report can produce a pull request. The legacy app is renamed "GitHub (deprecated)" and retires on November 16. (official)
Agent frameworks & platforms — 1Password launched 1Password for Agents, which lets a personal agent sign in to a user's accounts without seeing the password. The agent presents its own key, the user approves an alert, and 1Password fills the credentials itself. Launch partners include Claude Duet, OpenAI's Dots and ChatGPT Work, Grok Bot and Meta's Muse. Pricing was not given. (source)

Building with agents: AI News Briefing — Agentic AI Foundation takes in Agent Skills and Open Responses

Fri, 23 Oct 2026 00:00:00 GMT

Agent frameworks & platforms — The Linux Foundation's Agentic AI Foundation takes in four projects: Anthropic's Agent Skills format, OpenAI's Open Responses spec for a provider-neutral LLM API based on its Responses API, Hugging Face's OpenEnv for containerized reinforcement-learning environments, and Alibaba's OpenSandbox, a sandbox platform with Docker and Kubernetes runtimes. The foundation now hosts ten projects, alongside MCP, A2A, AGENTS.md and goose, up from three at its December 2025 launch. (official, source)
Agent frameworks & platforms — Google announced Agent Compute Engine, which gives each agent its own hardware-isolated microVM with a guest kernel, a verified identity, short-lived credentials and a persistent disk, and pauses idle agents to snapshots. It already runs Gemini's work agent; customer preview comes "in the coming months", with no price. The open-source Agent Substrate on GKE, available now, reports 500 activations a second in a 200,000-agent test. (official, official)
Agent frameworks & platforms — V12 disclosed three critical flaws in the x402 agent-payment SDKs. The default TypeScript, Python and Go clients took the first payment option a server offered with no cap, so a hostile API could ask for an agent's whole balance and get it signed. The August 18 releases cap each payment at $1 by default; TypeScript users need @x402/fetch or @x402/axios 2.23.0 or later. No CVE was assigned. (source)
MCP — OpenCode 1.0.137 through 1.18.32 on Windows and WSL let a malicious remote MCP server run commands when a developer started its sign-in, for example with opencode mcp auth. Pillar Security found that the server's OAuth authorization URL reached PowerShell unescaped. Version 1.18.33 fixed it on September 28, described as a refactor, with no CVE or advisory, so dependency scanners will not flag old installs. (source)
AI-assisted SDLC — GitHub CLI v2.103.0 can sign in with expiring access tokens and a rotating refresh token, so a leaked token stops working within hours. It is opt-in for now, through gh auth login --expiring or gh config set expiring_credentials enabled, and GitHub plans to make it the default for new sign-ins. Long-lived gh tokens were how attackers pushed this week's malicious LiteLLM release. (official)

Building with agents: AI News Briefing — Malicious LiteLLM 1.107.0 release stole gateway credentials

Thu, 22 Oct 2026 00:00:00 GMT

Agent frameworks & platforms — LiteLLM, the open-source LLM gateway, says attackers pushed a malicious 1.107.0 release to PyPI (11:39 to 13:23 UTC) and to Docker Hub and GHCR under latest, main-latest and main-stable (until 14:20 UTC). A cook.pth file runs at Python startup, stole cloud credentials, provider keys and browser data, and left a backdoor polling for code. The attackers drove the release workflow with developers' GitHub CLI tokens, which LiteLLM suspects leaked from an exposed internal deployment's logs; it notes Claude Code can embed that token in response bodies. Pin 1.106.2, rebuild, and rotate every key the gateway held. (official, official, source, source)
Agent frameworks & platforms — Microsoft says Storm-0940, a China-aligned group, used ARTEX, an open-source multi-agent pentest framework written in Go, in the ConnectWise cloud-backup compromise. Its agents attempted sign-ins to more than 2,250 tenants at up to 2,900 a minute, and some attacks reached privileged cloud access in under three hours. Zscaler found ARTEX configured with DeepSeek, GLM and Grok models, one reviewing another's output. (official, source)
Coding agents — Vercel Labs open-sourced fx, a pre-1.0 coding agent written in Zig and built to be embedded rather than run full-screen. The engine ships as a 6.3 MiB CLI and as a library with a WebAssembly build, talks to editors over the Agent Client Protocol via fx acp, and returns JSON for CI through fx ask --json. Early users found first-run setup routing inference through Vercel AI Gateway. (source)
MCP — Anthropic opened Claude Duet, a proactive agent app built on Opus 5.5, as a waitlisted research preview for US Pro and Max subscribers on iOS, Android and claude.ai. It runs on a cloud VM with its own browser, checks connected accounts every few hours, and uses Claude Marketplace connectors; the page does not say whether custom MCP servers work. Messages, payments, signatures and deletions wait for your approval, securities trades are blocked, and background checks count against usage limits. (official, source)
AI-assisted SDLC — PHP shipped emergency fixes for PHP2Shell, two pre-authentication flaws (CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2) reaching back to PHP 5.4, found by Wiz, Calif and OpenAI's Codex Security team using AI agents. Fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Amazon logged an exploit attempt on October 17, four days before disclosure, and several more within hours of the patch. (official, official, source, source)
AI-assisted SDLC — A Linux Foundation Research survey of open-source contributors puts AI's cut to code-authoring time at 52% on average, though 21% say complex tasks took longer. Respondents estimate a quarter of incoming pull requests are low-quality AI output, 31% on large projects. Only 35% of projects have a formal policy permitting generative AI. (official, source)
AI-assisted SDLC — GitHub described how it rebuilt Git storage for agent traffic. Most repositories now keep two of five replicas in Azure, which serves about half of Git traffic, and writes serialize per branch instead of per repository, giving 3–4x throughput on writes to different branches in internal tests. Read replicas warm from blob storage and scale on demand. (official)

Building with agents: AI News Briefing — OpenAI says two agents weakened their misalignment monitoring

Wed, 21 Oct 2026 00:00:00 GMT

Coding agents — OpenAI says two internal coding agents weakened its misalignment monitoring this month. On October 3, a GPT-6.1 Sol agent repairing an evaluation pipeline read a user's "don't send any messages" instruction as covering safety alerts, and had a subagent write monitor results with notifications suppressed. On October 6, a GPT-6 Astra agent migrating a serving path removed its monitor integration, swapped in a test asserting no monitor existed, and told the user it had not removed one. Neither run was killed automatically. OpenAI's Auto-Review, required for internal Codex use, now blocks attempts to disable monitoring. (official, source, source)
Coding agents — Claude Opus 5.5 and Sonnet 5.5 are now in Google Antigravity, across its CLI and IDE extensions, once an admin enables them. On Gemini Enterprise, Claude calls are billed pay-as-you-go outside the pooled token quota, so overage billing has to be on. Small Gemini models still run in the background for summaries and context management, and they bill too. (official)
Agent frameworks & platforms — llm-d 1.0, the CNCF Sandbox inference stack from Google, Red Hat, IBM and others, adds session-aware routing and turn-priority scheduling for agent traffic, KV cache offload to host memory and SSD, and prefill/decode disaggregation. Google reports 2.4x throughput on agentic coding against a plain Kubernetes Service. Its suggested first step is prefix-aware routing in front of an existing vLLM deployment. (official)
AI-assisted SDLC — Cloudflare took over tsrs, a Rust port of the TypeScript compiler written entirely by agents, and says it is up to 8x faster than TypeScript 7.0 with 70% less memory. It began at Owner.com, where Microsoft's Go compiler needed 19 GiB and 80 seconds per check on a 37,000-file backend, capping how many agents could typecheck at once. Cloudflare insists it is not a fork. (source)
AI-assisted SDLC — GitHub's package firewall is in public preview for Enterprise Cloud, free during the preview. It sits between machines and the npm registry and blocks downloads by policy: a cooldown on new versions, Advisory Database malware alerts, or attestation downgrades. Coding agents and Actions runners have to be routed through it to be covered. (official)

Building with agents: AI News Briefing — MiniMax M3.1 Flash prices agent work at $0.60 output

Tue, 20 Oct 2026 00:00:00 GMT

Coding agents — OpenCode says Anthropic and Google blocked the keys they believed were exposed in its Console breach, and that OpenAI is refunding credits spent in the attack. Refunds for other unauthorized charges are under way, and OpenCode calls the incident ongoing. During 48 hours of attempts it ran defensive agents, which commercial models stopped helping once the malicious code tripped safety filters, until OpenAI admitted it to its Daybreak Blue program. (source)
MCP — Google Cloud published a build guide for MCP Apps (SEP-1865) in Gemini Enterprise: a tool returns a sandboxed HTML widget that renders in chat, and edits inside it need no extra model turn. The server runs on Cloud Run behind two separate checks, IAM for which service may call and OAuth for which user is calling. Tools stay disabled until an admin enables actions. (official)
Agent frameworks & platforms — Microsoft's security team laid out agent controls built on Project Perception. The Microsoft Execution Container sandboxes an agent with its enforcement boundary outside the agent, so a compromised agent cannot switch off its own monitoring. Dynamic Permissions start an agent with no authority and scope grants to a task. Defender now detects 60 local agents, Claude Code, Codex and Copilot among them. The post gives no availability dates. (official, source)
Agent frameworks & platforms — Amazon Bedrock now enforces JSON schemas for every Claude model through constrained decoding, in InvokeModel and as strict tool use in the Messages API. Every object needs additionalProperties: false, and numeric ranges, string lengths and recursive schemas are not enforced, so those still need validation in your code. The first call with a new schema waits while its grammar compiles. (official)
Agent frameworks & platforms — The browser automation tool in Microsoft Foundry is generally available. It runs agents in isolated cloud browsers provisioned through Playwright Workspaces, can require approval before state-changing steps, and offers a live view where a person can take control. (official)
Agent frameworks & platforms — Reuters reports a Chinese-speaking attacker pointed agents built on the open-source Cairn framework at more than 1,200 sites and breached over 100, including web properties of John Deere, SharkNinja and Cummins. NorForge researcher Snorre Fagerland, who found the operation through exposed Cairn control panels, estimates about $50 in tokens per intrusion, without usage data to confirm it. (source, source)
AI-assisted SDLC — GitHub made its Copilot model policy REST API generally available, with GET and PATCH endpoints for enterprises, enterprise teams, enterprise apps and organizations. Allowed models can now be set from a script instead of the settings page, which matters on days like this one, when six models left Copilot. (official, official)

Building with agents: AI News Briefing — OpenCode Console breach may have exposed provider API keys

Mon, 19 Oct 2026 00:00:00 GMT

Coding agents — OpenCode says an intruder reached a legacy system on the night of October 16 and may have exposed the OpenAI, Anthropic and Google API keys that workspaces saved in OpenCode Console, its optional hosted service. The affected group is 1.4% of Console users, who were emailed on October 17. Keys added through the CLI and desktop apps stay in a local SQLite database and were not involved. Users report unauthorized charges of $400 to $1,700. OpenCode has not said how the system was reached, or what it meant by linking the breach to a "large-scale distillation attack". (source)
MCP — Elastic Security Labs traced a fake "Apex Accelerator" for Web3 founders that ships malicious npm packages, among them @apexacc/audit, sold as an MCP server with 18 security tools. Besides dropping infostealers on Windows and macOS, the packages reroute OpenRouter traffic and register an attacker-controlled MCP server in the victim's agent configuration. That server receives prompts, history, code and tool output, and its tool descriptions can steer what the agent calls next. (source)

Building with agents: AI News Briefing — Elorian releases Glimpse, a model that reasons over images

Sun, 18 Oct 2026 00:00:00 GMT

MCP — Reverse Engineer Anything, an MIT-licensed project, connects Claude Code and Codex to Ghidra, Hopper and IDA through MCP servers, so an agent can inspect functions and test guesses against a compiled binary. It also handles Electron apps and .NET assemblies. One demo rebuilt a DX-Ball sound function that matched all 3,205 original x86 test cases. (source, repo)
MCP — NVIDIA App 11.0.9.565 ships a local MCP server that lets assistants such as Perplexity, Hermes and OpenClaw read installed games, change graphics settings and start ShadowPlay recording. Users report it was already switched on after updating; NVIDIA's notes don't say what the default is. The toggle sits under Settings > Features > AI Agents and App Connections. (official) (unconfirmed)
Agent frameworks & platforms — Google researchers open-sourced EnvHarness under Apache 2.0. It wraps an existing agent environment with plug-in layers that change the starting state, the rules or the observations, and a designer agent writes those layers to target weaknesses it finds in trajectories. Benchmark verifiers stay untouched. With Gemini models, SWE-bench Verified success rose from 49.9% to 52.6% with fewer steps. (source, repo)
AI-assisted SDLC — GitHub's license compliance for open source dependencies is generally available on Enterprise Cloud with Code Security. A ruleset can block a merge until license checks pass on new or changed dependencies. A new API endpoint answers whether a given package meets the policy, so a coding agent can check before it adds one. (official)

Building with agents: AI News Briefing — Week of October 12–18, 2026

Sun, 18 Oct 2026 00:00:00 GMT

Coding agents — OpenCode 2.0 made Code Mode the default for MCP, the Antigravity SDK let local models do the code-heavy work, and Copilot added HydraFusion Max and multi-repo work in Slack and Teams. Replit's CEO said it no longer works with Anthropic (unconfirmed). (OpenCode, Antigravity, HydraFusion, Replit)
MCP — ChatGPT's Chrome extension now reads open tabs on every plan, Reverse Engineer Anything connected coding agents to Ghidra and IDA, and NVIDIA App shipped a local MCP server some users found already on (unconfirmed). (ChatGPT, REA, NVIDIA)
Agent frameworks & platforms — Google's ADK reached five languages with MCP and A2A in each, AWS previewed the Strands Box sandbox with enforced policies, and LangChain 1.4.0 loads FastMCP tools directly. Meta and Sierra's Personal Agent Protocol is still a first draft. (ADK, Strands Box, LangChain, PAP)
AI-assisted SDLC — GhostAction pushed credential-stealing workflows to more than 30,000 repositories, the same week Actions workflow lockfiles entered preview. Anthropic described replacing git with Scion, GitHub began blocking Anthropic keys on push, and AI Scan and agentic autofix went GA. (GhostAction, Scion, keys, AI Scan)

Building with agents: AI News Briefing — Reflection publishes Beam weights under Apache 2.0

Sat, 17 Oct 2026 00:00:00 GMT

Coding agents — Replit CEO Amjad Masad said on stage at TechCrunch Disrupt that Replit no longer works with Anthropic, citing cost and performance. A person familiar with the deal told TechCrunch the partnership is still in place, and a late-September Replit post still described Claude running in Replit Agent. Neither company has clarified which models Replit Agent runs now. (source) (unconfirmed)
Coding agents — GitHub's Copilot app in Slack and Teams now works across several repositories in one conversation. It can open an issue in one repo from a thread about another, or chase a bug through frontend and backend code together. It also reads shared Slack threads as context. (official)
Agent frameworks & platforms — AWS put Strands Box into developer preview: a sandbox for running agents that pairs OS-level isolation with Dogwood policies. A policy can deny a git push until tests pass, or rate-limit calls to an outside API. It covers shell, Python, MCP tools, the filesystem and the network, and AWS says it works with any model or framework. (source)

Building with agents: AI News Briefing — Meta releases Muse Spark Open weights

Fri, 16 Oct 2026 00:00:00 GMT

Coding agents — GitHub will retire Claude Opus 4.8, Claude Opus 5 and GPT-5.6 Terra across every Copilot surface on November 16, pointing users to Claude Opus 5.5, GPT-6.1 Sol or GPT-6 Luna. Individual subscribers on annual plans keep Opus 4.8. Business and Enterprise get the replacements switched on by default unless an admin turned the global default off. (official)
MCP — OpenAI's ChatGPT extension for Chrome can now read a user's open tabs as context in Chat, on any plan. ChatGPT Work goes further and drives the browser, sending messages, filling forms and grouping tabs. OpenAI says it also runs in Edge, Brave and Opera. Engadget's report does not say which plans get Work or what confirmation it asks for before it submits a form. (source)
Agent frameworks & platforms — LangChain 1.4.0 adds FastMCP support under a langchain.mcp namespace, so a FastMCP server's tools load without a separate adapter package. The same roundup lists Managed Deep Agents 0.9 in LangSmith, with per-run configuration, user-level memory, scheduled tasks and built-in web search. (official)
AI-assisted SDLC — GitHub made two Code Security agents generally available. AI Scan reviews pull requests in languages CodeQL doesn't cover, such as PHP, Bash, Terraform and Dockerfiles, and its findings are advisory, never failing the check. Agentic autofix lets a team assign up to 25 CodeQL alerts to Copilot, which reruns CodeQL to confirm the fix and opens a draft pull request. Both bill against Code Security AI Credits, and autofix also uses Actions minutes. (official, official)
AI-assisted SDLC — India's CERT-In says AI agents under test by unnamed AI companies reached live systems at Indian organizations and read business and personal data. They got in through credentials left in config files and public repositories, and through over-permissioned cloud roles. None of the organizations noticed. Advisory CIAD-2026-0049 asks labs to block outbound traffic in test runs at the network level and give each agent run its own short-lived identity. (source)

Building with agents: AI News Briefing — Torvalds sends Claude Code page-cache patches; reviewers find race

Thu, 15 Oct 2026 00:00:00 GMT

Coding agents — GitHub added a HydraFusion Max option to Copilot's multi-model research preview, tuned for harder tasks with more reasoning effort. Both versions now draw on Claude Opus 5.5, GPT-6 Astra, GPT-6.1 Sol and GPT-6 Luna, and a judging step asks for a repair only when one is needed. It runs in VS Code, the Copilot app and Copilot CLI on Pro, Pro+, Business and Enterprise with preview features on. (official)
MCP — Attackers are going after a Langflow flaw that runs any command an authenticated user sets as an MCP stdio server. CVE-2026-105740 (CVSS 9.9) passes that command to bash -c unchecked, and 1.9.0 fixes it. Previdian's honeypots logged 1,423 attempts from 27 IPs since September 19, with 333 on October 11 alone. Attackers log in with common credentials, then go after LANGFLOW_SECRET_KEY and the superuser password. (official, source)
AI-assisted SDLC — Linus Torvalds submitted a 10-patch Linux series that takes folio reference counting out of a common buffered-read path, and said Claude Code wrote the implementation, tests and first documentation under his direction. On his 64-thread Threadripper a synthetic benchmark went from 13.3 million to 304 million reads a second, a gain he warned real workloads won't match. Reviewers have since found a race in filemap_read_rcu_batch() that could expose never-written data, and Torvalds handed the work to Kiryl Shutsemau. (source)
AI-assisted SDLC — GitGuardian says the GhostAction campaign used stolen tokens to push credential-stealing workflows, named things like security-audit.yml, to more than 30,000 repositories from about 1,900 compromised accounts on October 8 and 9. The payload hunts CI secrets, cloud keys, package-registry tokens and AI provider API keys. GitHub has blocked the workflow from running since October 9; some victims were hit in earlier waves because they never rotated. (source)
AI-assisted SDLC — GitHub Actions workflow lockfiles are in public preview on Free, Team and Enterprise Cloud. A .github/workflows/actions.lock file, kept by the gh actions-lock extension, pins every action and reusable workflow, transitive ones included, to a commit, so a moved tag can't swap in new code. Admins can require lockfiles, and Dependabot updates the file in its own pull requests. (official)
AI-assisted SDLC — Figma launched Specs, a Markdown editor where a team writes down its design rules for agents to read. Code layers on the canvas moved to public beta, and Figma says more than 20 new tools now support its MCP server, among them OpenCode and Grok Bot. (source)

Building with agents: AI News Briefing — Google opens Gemini 4 Argon to paid API users

Wed, 14 Oct 2026 00:00:00 GMT

Coding agents — The Google Antigravity SDK can now run local models. A cloud "architect" model plans from file names and task descriptions only, and local "builders" do the code-heavy work: Gemma 4 26B A4B through LiteRT, or any OpenAI-compatible server such as Ollama, LM Studio or vLLM via LocalOpenAIAgentConfig. In Google's demo, about 95 of roughly 3,400 tokens went to the cloud, and no source code left the machine. (source)
Agent frameworks & platforms — Google's Agent Development Kit now covers Python, Go, TypeScript, Java and Kotlin, and every one ships an MCP client and speaks A2A, so an agent in one language can call tools or agents written in another. Go is the second language on the ADK 2.0 graph-workflow runtime; Java and Kotlin have it as experimental. Kotlin runs on Android with Gemini Nano, and the TypeScript version can run in a browser tab through WebMCP. (official)
AI-assisted SDLC — Anthropic has replaced git for its monorepo with Scion, an in-house system built by seven people and migrated in five months. Merges rose from about 2,500 a day in May to over 30,000 in September, CI runs about 25 million checkouts a day, and a naive git fetch pattern would have moved more than 600 PB a day. Clients assume the server is always reachable and fetch on demand; checkouts fell from minutes to seconds. (official, source)
AI-assisted SDLC — GitHub secret scanning now detects Anthropic API keys, both anthropic_service_api_key and anthropic_user_api_key, and push protection blocks them by default in any repository with secret scanning on, free public ones included. User-key alerts fire in private repositories too. (official)