Building with agents

Coding agents, MCP, agent frameworks and managed agent platforms, and AI in the software lifecycle.

In the record: Agent stack advisories What breaks next

Last 30 days

• Nov 9, 2026 Coding agents In the briefing →

  OpenAI agreed to buy Pierre Computer Company, whose Trees and Diffs libraries already handle file navigation and change review inside the Codex app. OpenAI plans to fold Pierre's Git-backed Code Storage service into Codex. Terms weren't disclosed, and the deal still needs regulatory approval. (official)

• Nov 9, 2026 AI-assisted SDLC In the briefing →

  Releasing Linux 7.4-rc2, Linus Torvalds said the flood of AI-prompted bug fixes may be starting to turn. eBPF lead Alexei Starovoitov reports that fixes in his area now arrive faster than new reports, though Torvalds said most other subsystems aren't there yet. The rc1 before it was the largest release candidate in kernel history. (source)

• Nov 8, 2026 Coding agents In the briefing →

  Cognition's SWE-2 Flash runs in Devin Desktop and the Devin CLI at about a fifth of SWE-2's price and roughly three times its speed, free for paid Devin users through November 30. It is a 276B mixture-of-experts with 12B active, built on Thinking Machines' open-weights Inkling-Small. Benchmarks are self-reported, and the weights stay private: Cognition cites security and plans gated access for partners and labs. (source)

• Nov 8, 2026 Coding agents In the briefing →

  AWS made Kiro bots generally available in Kiro Crew. Each bot is a named, long-running agent with its own memory, chat and tool permissions; it can fan out parallel sessions, run on schedules set in plain language, and ask for a decision while other work continues. Memory can be viewed, edited or deleted, and new tools need approval. No separate bot price was announced; runs draw Kiro credits. (official, source)

• Nov 8, 2026 Coding agents In the briefing →

  @GitHub in Slack and Teams is generally available, with a canvas in Teams for reviewing plans and diffs, and issues or PRs it opens now credit the conversation's author. (official)

• Nov 8, 2026 MCP In the briefing →

  An MCP server built on the TypeScript SDK that reuses one stateless HTTP transport, or one McpServer instance, across clients can send responses and notifications to the wrong client. Messages are matched only by JSON-RPC id, and every client starts counting at zero. CVE-2026-111770 (CVSS 7.7) is fixed in @modelcontextprotocol/server 2.3.0 and the SDK 1.32.0; reused instances now fail, so create one per session. stdio servers are unaffected. (official)

• Nov 8, 2026 MCP In the briefing →

  The same SDK's bearer-token auth accepted access tokens issued for another service, because it never checked the audience. CVE-2026-111771 (CVSS 6.8) is fixed in SDK 1.32.0, server 2.3.0, express 2.0.2 and server-legacy 2.3.1, but upgrading leaves the check off: enable audience validation and pass the expected audience, or check aud in your own verifyAccessToken(). (official)

• Nov 8, 2026 AI-assisted SDLC In the briefing →

  Grab described how it kept its mobile apps stable as AI assistants raised the number of code changes per release. The defence is layered: custom lint rules, an internal early-access build, staged rollouts and feature flags that are switched off when crash rates pass a threshold, and automated triage that maps each crash to a pull request. The write-up publishes no before-and-after figures. (source)

• Nov 8, 2026 Coding agents Weekly recap Read the recap →

  Copilot reached JetBrains Air, Xcode's assistant, and Slack and Teams, while JetBrains built Air into its 2026.3 IDEs. Meta bought Conductor, whose cloud service shuts November 20, and AWS made Kiro bots GA. (Air, 2026.3, Conductor, Kiro)

• Nov 8, 2026 MCP Weekly recap Read the recap →

  Two TypeScript SDK fixes need more than an upgrade: reused transports now fail, and audience validation stays off until enabled. Glow Labs found agents still installing the archived reference servers, and Claude Team and Enterprise plugins can now connect at login. (SDK, archived servers, Claude)

• Nov 8, 2026 Agent frameworks & platforms Weekly recap Read the recap →

  Langflow 1.13.0 fixed two unauthenticated CVSS 9.8 flaws. Google donated Agent Substrate and gVisor to the CNCF, Mistral relaunched Studio for managed agents, and AMD open-sourced the PrimusClaw runtime. (Langflow, CNCF, Studio, PrimusClaw)

• Nov 8, 2026 AI-assisted SDLC Weekly recap Read the recap →

  GitHub Actions blocks pull_request_target by default in public repositories from December 2, with brownouts first. OpenAI described Pando, the Git backend it built for Codex's commit load, and Dependabot now updates Agent Package Manager dependencies. (Actions, Pando, Dependabot)

• Nov 7, 2026 Coding agents In the briefing →

  Apiiro scanned public GitHub for .claude/settings.local.json, where Claude Code saves a command as an allow rule when someone picks "Yes, and don't ask again." Of 104,185 copies, 1,122 held at least one secret typed into the approved command: 379 database passwords, 43 SSH logins and 23 AWS keys among 1,379 in total. Claude Code adds the file to the user's global git excludes, not the project's .gitignore, so a collaborator or a fresh machine without that setting can commit it. gitleaks and TruffleHog both missed 215 of the files. Apiiro says Anthropic hasn't replied; a related issue was closed as not planned. (source)

• Nov 7, 2026 Coding agents In the briefing →

  Forever Security showed that any browser extension able to run scripts on claude.ai could send tasks to Claude Desktop through Dispatch, the phone-to-desktop feature. In its test, a script asked Claude to install an npm package, clicked "Allow" on each approval prompt, and the package's install script ran. The researchers say Anthropic called the report a duplicate in May and told them in October that Dispatch would be retired. Dispatch is closed to new users but still running for some existing ones. (source)

• Nov 7, 2026 Coding agents In the briefing →

  Copilot code review settings can now be managed through GitHub's REST and GraphQL APIs, from enterprise policy down to a single repository, including review effort and whether reviews use MCP tools. Responses now say which skills, MCP servers and custom instructions a comment drew on, and review sessions show the AI credits they used. (official)

• Nov 7, 2026 Agent frameworks & platforms In the briefing →

  AMD open-sourced PrimusClaw, a managed agent runtime that runs in your own Kubernetes cluster next to Instinct GPUs. It keeps runs as database rows under leases, so another replica can pick up an in-flight run after a crash or upgrade, and agent code runs without platform-wide credentials. It exposes A2A v1.0, MCP in both directions and an API compatible with Claude Managed Agents. MIT licence, with an Apache 2.0 sandbox controller. (official)

• Nov 6, 2026 Coding agents In the briefing →

  JetBrains shipped the 2026.3 releases of its IDEs, including PyCharm, WebStorm, GoLand, RubyMine, RustRover and DataGrip, with JetBrains Air built in after a month in early access. Air is a tool window for running agents you already have, such as Claude Agent, Codex, Copilot, Junie and other ACP agents, and it needs no JetBrains AI subscription when you bring your own. Admins can restrict it to an allowlist of agents. (official, official)

• Nov 6, 2026 Agent frameworks & platforms In the briefing →

  Google donated Agent Substrate, gVisor and OpenRL to the CNCF, all accepted into the Sandbox tier. Agent Substrate parks idle agent sessions in storage and restores them onto a warm pool of sandboxes in under 500 ms, with gateways that inject secrets by agent identity. It is at 1.0 and runs on any Kubernetes cluster, not only GKE. OpenRL exposes a Tinker-compatible API for self-hosted RL post-training. (official)

• Nov 6, 2026 Agent frameworks & platforms In the briefing →

  LangChain added async subagents to Deep Agents in Python and JavaScript, switched on with a single "async": True field. The orchestrator gets tools to start, check, update, cancel and list background tasks, and a follow-up instruction can either interrupt a running subagent or queue behind it. Task notifications are in beta. (official)

• Nov 6, 2026 Agent frameworks & platforms In the briefing →

  Mistral relaunched Studio as a platform for managed agents with sandboxes, subagents and hooks, resumable workflows with human approval steps, and OpenTelemetry traces of every model and tool call. It deploys to Mistral's cloud, a customer VPC or on-premises, and ships a Mistral MCP server for building from a coding agent. (official)

• Nov 6, 2026 Agent frameworks & platforms In the briefing →

  Microsoft says Claude models in Copilot, including Copilot Cowork, will process inside the EU Data Boundary for EU and EFTA organizations by the end of 2026, under existing contract terms. The setting stays off by default there; tenants already using Claude need do nothing. The UK isn't mentioned. (official)

• Nov 6, 2026 AI-assisted SDLC In the briefing →

  GitHub's Copilot usage metrics API now reports what developers do with Copilot code review comments: total_comments_evaluated and total_comments_addressed, which together give an addressed rate, broken down by severity and comment type. A separate count tracks merged pull requests where no person requested changes after Copilot's first review. Comments are counted on the day the pull request merges. (official)

• Nov 5, 2026 Coding agents In the briefing →

  A developer reported that opening Postman's desktop app, version 12.33.4 on macOS, installed Postman plugins into both Claude Code and Codex without asking, plus a Postman CLI. In Codex the installer also wrote its own startup hook's hash into the trusted list, skipping the review Codex normally requires. The hook tells Codex to load Postman's API skill for most API tasks. Postman had not answered The New Stack's questions. (source)

• Nov 5, 2026 Coding agents In the briefing →

  Meta bought Conductor, whose app runs several Claude and OpenAI coding agents in parallel workspaces. Conductor's cloud service shuts on November 20, after which user cloud data is deleted; the core app keeps working until early next year. (source)

• Nov 5, 2026 Coding agents In the briefing →

  GitHub Copilot now runs inside Xcode's built-in coding assistant, in public preview on Xcode 27.3 beta for all Copilot plans. (official)

• Nov 5, 2026 MCP In the briefing →

  Claude Team and Enterprise organizations can now have plugins connect automatically at login, in beta. Claude itself signs the identity assertion that a participating MCP server checks before issuing a token, so a company's identity provider no longer has to support the Enterprise-Managed Authorization extension. Admins pick which services and which roles get access, and expired tokens renew without a prompt. Launch services include Atlassian, Datadog, Figma, Linear and Notion. Personal plans aren't included. (source)

• Nov 5, 2026 Agent frameworks & platforms In the briefing →

  Microsoft shipped Agent Framework "builder" skills for .NET and Python that any coding agent supporting the Agent Skills format can install with gh skill install or npx skills add. They teach the agent to pick the smallest fitting pattern, a single agent, a harness or a workflow, before writing code. Microsoft recommends pinning a tag. (official)

• Nov 5, 2026 Agent frameworks & platforms In the briefing →

  AWS showed how to plug small decision models into Bedrock AgentCore Evaluations: classifiers that pick from fixed answers and return calibrated probabilities, run through a Lambda evaluator reading the agent's OpenTelemetry spans. Every turn gets the cheap check; only low-confidence turns go to an LLM judge. It's a pattern with sample code, not a new feature. (official)

• Nov 5, 2026 AI-assisted SDLC In the briefing →

  Dependabot version updates now cover Agent Package Manager, opening pull requests for git dependencies pinned in apm.yml and regenerating apm.lock.yaml. That puts shared agent skills, prompts and instructions on the same update path as code dependencies. Security updates aren't covered. It is available on all GitHub plans. (official)

• Nov 4, 2026 Coding agents In the briefing →

  GitHub Copilot now runs as an agent inside JetBrains Air over the Agent Client Protocol, on an existing Copilot plan. Local tasks need the Air plugin; cloud tasks run in a fresh container per task through Air Teams and bill to Copilot, not JetBrains AI credits. Air's analytics don't count Copilot usage, and admins can't set Copilot spending limits there. (official, official)

• Nov 4, 2026 Coding agents In the briefing →

  DeepSeek published dsh-superagent, an MIT-licensed prototype of a coding agent that takes requests from GitHub or Feishu, works each one in its own session and replies with a pull request. A web panel lists what needs a person. DeepSeek labels it a research prototype, not a product, and says it differs from its internal version. (official)

• Nov 4, 2026 MCP In the briefing →

  Glow Labs found coding agents installing the archived @modelcontextprotocol reference servers, mostly by recalling package names from training data rather than at a user's request. It reported four high-severity flaws, including prompt-injectable code execution in the Puppeteer server; maintainers closed the report because the repository is archived, so no fix is coming. The deprecated packages have passed 17.3 million npm downloads since July 2025, and npm's deprecation warning doesn't block installs. (source)

• Nov 4, 2026 Agent frameworks & platforms In the briefing →

  LangSmith's bring-your-own-cloud deployment now runs on Azure and Google Cloud in beta, alongside generally available AWS. LangChain keeps the control plane; traces, evals, prompts, agent deployments and secrets stay in the customer's account and region. The Google Cloud control plane sits in the US, and trace migration works on AWS only for now. (official)

• Nov 4, 2026 AI-assisted SDLC In the briefing →

  GitHub Actions will block pull_request_target by default in public repositories from December 2, a month later than first planned, with two-hour brownouts on November 9 and 16 at 16:00 UTC. The trigger runs with the base repository's secrets, which is how fork code ends up stealing them. Workflows that need it must be allowed in an Actions event policy. (official)

• Nov 3, 2026 Coding agents In the briefing →

  Anthropic added two sentences to Claude Code's prompt on Opus 5.5 that steer it away from building a recreation of a specific existing game. Anthropic's Addy Osmani confirmed it, citing the usage policy's IP rule, and said original games, genre games and games from your own assets should keep working. Users report no setting to turn it off. (source, source)

• Nov 3, 2026 MCP In the briefing →

  Uber described the MCP Gateway in front of more than 800 internal MCP servers and 5,000 tools. A crawler turns Protobuf and Thrift definitions into tool schemas, with LLM-written descriptions, but every new tool stays disabled until its owning team enables it. Agents search for servers and fetch one schema at a time, and can ask for only the response fields they need. (source)

• Nov 3, 2026 Agent frameworks & platforms In the briefing →

  IBM's bulletin lists four Langflow flaws fixed in 1.13.0, two of them critical (CVSS 9.8) and reachable without logging in: an authentication bypass, CVE-2026-93680, and code execution, CVE-2026-110186. A third lets a low-privileged user have the Agentic Assistant run OS commands. Versions 1.0.0 through 1.12.8 are affected, and IBM offers no workaround short of upgrading. (source)

• Nov 3, 2026 AI-assisted SDLC In the briefing →

  OpenAI replaced the Git backend behind its monorepo with Pando, built after concurrent Codex work multiplied commits. Pushes to different refs commit in parallel and only same-ref pushes serialize, which cut median push latency by about 80%. Pando is internal; the post is a design write-up, not a product. (official, source)

• Nov 3, 2026 AI-assisted SDLC In the briefing →

  Hugging Face proposes Model Integration Contracts for Transformers: a small fixture built from a real checkpoint's config, a runnable usage example and reviewed baseline outputs, cheap enough to run on CPU for every pull request. A change that let UMT5's decoder attend to future tokens sat in main for two months; a shrunk fixture flags it. The CI job reports without blocking for now. (official)

• Nov 1, 2026 Coding agents In the briefing →

  DeepSeek's Harness team published dsh-superagent-prototype under MIT: a coding agent that watches one GitHub repository, and optionally Feishu, takes requests from allowed users, works each in its own session and directory, and replies with a pull request. DeepSeek calls it a research prototype, not a product, and says the code differs from its internal version. (official)

• Nov 1, 2026 Coding agents In the briefing →

  Microsoft's analysis of the trojanized Claude Code extension in Cursor's marketplace names the persistence to hunt: a com.apple.sysmond.plist LaunchAgent on macOS, an @reboot crontab entry for ~/.config/.smt on Linux, and a SysMon scheduled task on Windows. The names imitate monitoring tools, so check what each one runs. Uninstalling the extension removes none of them. (official)

• Nov 1, 2026 Agent frameworks & platforms In the briefing →

  Amazon Bedrock AgentCore Runtime adds session endpoints: an authenticated URL for an app running inside an agent's session, so you can watch a site change while a coding agent edits it. Ports between 8000 and 12000 are allowed per runtime. Each request needs SigV4 or a bearer token, and the URL expires with the session. MicroVM runtimes only, and no PrivateLink. (official)

• Nov 1, 2026 Coding agents Weekly recap Read the recap →

  GitHub made Copilot's assisted permissions and Fusion model routing generally available, and added server-to-server auth and enterprise plugin controls. Claude Code added an opt-in that lets rm -rf ~ run unprompted, and Android Studio made bring-your-own-agent stable. (permissions, Fusion, Claude Code, Android Studio)

• Nov 1, 2026 MCP Weekly recap Read the recap →

  Google opened its Connected Apps Platform preview, putting MCP-backed apps into Gemini and Search. (Google) Per MacRumors, ChatGPT gained iCloud Mail and Calendar plugins on all plans. (iCloud) (unconfirmed)

• Nov 1, 2026 Agent frameworks & platforms Weekly recap Read the recap →

  Microsoft put the Copilot harness into Foundry Agent Service, free until December 1. LangChain's Managed Deep Agents v0.10 added browser use and removed connectors.mcp(), and Bedrock AgentCore added live session endpoints. (Foundry, Deep Agents, AgentCore)

• Nov 1, 2026 AI-assisted SDLC Weekly recap Read the recap →

  GitHub Agentic Workflows reached GA with read-only defaults, and Meta's per-diff JiTTesting cut privacy incidents by 20%. Atlassian's survey found the share of developers saving 10+ hours a week fell from 68% to 26%. (Agentic Workflows, JiTTesting, Atlassian)

• Oct 31, 2026 Coding agents In the briefing →

  A trojanized build of Anthropic's Claude Code extension (anthropic.claude-code 2.1.312 and 2.1.313, not built by Anthropic) was live in Cursor's marketplace from about 2:27am to 1:35pm PT on October 29. It adds an svc-telemetry key to ~/.ssh/authorized_keys, tries to enable SSH, opens a reverse tunnel, installs persistence and beacons host details plus the names of secret-looking environment variables. Cursor puts the exposure at up to 5,000 users and says uninstalling may not be enough: check for the key, remove persistence, rotate credentials. Open VSX and Microsoft's marketplace were not affected; Anthropic's clean release is 2.1.314. (official, source)

• Oct 30, 2026 Coding agents In the briefing →

  Android Studio Rabbit 2 makes Bring Your Own Agent stable, so any of more than 40 agents that speak the Agent Client Protocol can run inside the IDE, Claude Code and Codex among them. A new android preview command renders Compose previews without an emulator; Google says agents using it finished UI tasks 77% faster on up to 3x fewer tokens in internal testing. (source)

• Oct 30, 2026 Coding agents In the briefing →

  Copilot's repository plugin defaults and enterprise plugin controls are generally available in VS Code, Copilot CLI and the Copilot app. A repository can name a marketplace and default plugins for anyone on a Copilot plan. Enterprise Cloud admins can restrict installs to approved marketplaces, block plugins, or force-install ones users cannot turn off. (official)

• Oct 30, 2026 Agent frameworks & platforms In the briefing →

  LangChain's Managed Deep Agents v0.10 (public beta) adds browser use in a LangSmith sandbox, with a browser_handoff tool that lets a person sign in so the password never reaches the model or traces. Subagents marked async now run in the background and wake the main agent when they finish. One breaking change: connectors.mcp() is gone, and MCP servers are declared in tools/mcp.ts or tools/mcp.py. (official)

• Oct 30, 2026 AI-assisted SDLC In the briefing →

  Meta's JiTTesting writes LLM-generated tests for each diff that fail only if the change alters behavior, instead of leaving review comments. An LLM ensemble and a rule-based filter cut false positives, and engineers review results in aggregate rather than one by one. In the first half of 2026 it caught 74 serious privacy bugs before they landed, and privacy incidents fell 20%. Engineers rate 60% of its findings as real. (official)

• Oct 29, 2026 Coding agents In the briefing →

  Copilot Fusion is generally available on all Copilot plans in VS Code, the Copilot app, Copilot CLI and JetBrains. Instead of a model, you pick an effort level and Copilot routes each prompt: one model, a cheap draft escalated when a check fails, or a draft reviewed by a second model. Each model used bills at its own rate, with 30% off for a limited time. GitHub says Fusion Max scored 60 on the Artificial Analysis Coding Agent Index, two points under Claude Code with Opus 5.5 Max, at about half the API cost per task. (official)

• Oct 29, 2026 MCP In the briefing →

  Google opened a preview of its Connected Apps Platform, letting outside developers put apps into the Gemini app, Google Search, or both. Apps integrate through a cloud-hosted MCP server, or on Android through the AppFunctions APIs, and are registered, tested and submitted for review in a Google Connected Console. Access opens in phases, US developers first per TechCrunch. Google's post does not say which user plans get these apps or how actions are approved. (official, source)

• Oct 29, 2026 Agent frameworks & platforms In the briefing →

  Microsoft put the Copilot harness into Foundry Agent Service as a public preview: Microsoft runs the agent loop and sandbox, and the developer supplies skills, Foundry or MCP tools with configured approvals, and a source-controlled agent definition. The harness is free until December 1, when sandbox compute starts billing at $0.0994 per vCPU-hour plus $0.0118 per GiB-hour of memory, on top of model inference. (official)

• Oct 29, 2026 AI-assisted SDLC In the briefing →

  GitHub Agentic Workflows is generally available on Free, Team and Enterprise. Workflows are written in Markdown and compile to Actions YAML. Agents get read-only permissions by default, run in a sandboxed container behind a firewall, and a threat-detection job scans proposed changes before they apply. GA adds micro-VM isolation, self-hosted ARC runners and gh aw forecast for credit spend. The default Copilot CLI engine needs a Copilot license. (official)

• Oct 28, 2026 Coding agents In the briefing →

  Claude Code v2.1.311 adds CLAUDE_CODE_EVEN_MORE_DANGEROUSLY_SKIP_PERMISSIONS. Set in the launch environment, it lets rm and rmdir on critical paths such as the home or working directory run with no prompt, but only in bypassPermissions mode. The docs warn that rm -rf ~ can then run unasked. Settings files cannot set it, and background sessions and agent-team teammates start without it. (official)

• Oct 28, 2026 Coding agents In the briefing →

  GitHub Copilot now accepts server-to-server authentication, in public preview. A GitHub App with the read-only Copilot Requests permission passes a short-lived installation token to the Copilot SDK, so a service can call Copilot without a signed-in user. Usage bills to the installing organization under its model policies and budgets, and shows up in usage reports by app_client_id. (official)

• Oct 28, 2026 MCP In the briefing →

  ChatGPT has iCloud Mail and iCloud Calendar plugins. Per MacRumors, they can search and send mail, manage drafts and look up contacts, and create or change calendar events. Both connect with an Apple app-specific password rather than the account password. MacRumors reports them on all plans across web, desktop and iOS, and OpenAI's help center does not yet list which plans get them. (source) (unconfirmed)

• Oct 28, 2026 AI-assisted SDLC In the briefing →

  Meta's 2026 Python Typing Survey (1,794 responses) found AI tools wrote type hints for 42.5% of respondents, and 24.4% said a coding agent ran their type checker. Respondents who used AI to fix checker errors also complained about agents that "spam #type: ignore comments everywhere" to get a clean run. (official)

• Oct 27, 2026 Coding agents In the briefing →

  Assisted permissions in GitHub Copilot is now generally available. An LLM reviews each request to run a command, touch a path or open a URL; requests it judges clearly safe go ahead, and the rest wait for approval. It works in Copilot CLI (/permissions), the Copilot app and VS Code. Enterprise admins can block Allow All while still allowing Assisted, and can set the default mode for new sessions. (official)

• Oct 27, 2026 AI-assisted SDLC In the briefing →

  Atlassian's State of Developer Experience 2026 survey found the share of developers reporting 10 or more hours a week saved by AI fell from 68% to 26% in a year. 65% spend time fixing AI output that missed the intent, and 49% spend four or more hours a week managing AI tools. The answers are self-reported, and the 2025 sample of 3,500 was over twice this year's 1,560. (source)

• Oct 26, 2026 Coding agents In the briefing →

  Forever Security found a malicious AGENTS.md in a customer's Downloads folder, telling a coding agent to install function-color, an npm package from the MALFEX malware campaign. A web page can save a file to Downloads with no click, and agents follow instruction files in the folder they start in. In Forever's tests, Codex ran the malware in more than 90% of attempts by editing ~/.codex/config.toml. A planted CLAUDE.md got Claude Code to write an attacker's ANTHROPIC_BASE_URL about half the time. (source)

• Oct 26, 2026 AI-assisted SDLC In the briefing →

  Google open-sourced the Elephant-Goldfish Model plugin under Apache 2.0. A long-running "Elephant" session holds project context and writes a design document but no code; stateless "Goldfish" sessions with no context must explain the design back, attack it for gaps, and pass an implementation-readiness check before coding starts. Google says thousands of its engineers use it daily. It targets Antigravity first, with other environments promised. (official, official)

• Oct 26, 2026 Agent frameworks & platforms In the briefing →

  LangChain described the five pieces shared by its internal agents for sales, code and content: living in Slack, a clear identity (acting as the user or as its own app), global and per-user memory, code run in a separate sandbox behind a secret proxy, and scheduled runs that a user can set up themselves. All three sit on Managed Deep Agents. (official)

• Oct 25, 2026 AI-assisted SDLC In the briefing →

  LiteLLM's root-cause post traces the malicious 1.107.0 release to a master key for its Agent Platform, committed to a public repository on May 27. The commit was force-pushed away, but the key was never revoked. On October 10 an attacker used it to pull an organization owner's unscoped GitHub CLI token, then stole two maintainers' tokens. A release rule loosened that week let any two engineers trigger and approve a release, so one stolen token started it and the other approved it. (official, source)

• Oct 25, 2026 AI-assisted SDLC In the briefing →

  Microsoft's analysis of the same package says the wheel also drops cook.py and sitecustomize.py into site-packages, outside the litellm directory, so uninstalling LiteLLM leaves them running at every Python start. It advises inspecting suspect environments from a clean machine without running Python or pip there, and rebuilding from verified artifacts rather than cleaning in place. (official)

• Oct 25, 2026 Coding agents Weekly recap Read the recap →

  Claude Opus 5.5 and Sonnet 5.5 reached Antigravity, billed outside the pooled quota. Vercel Labs open-sourced fx, an embeddable agent in Zig, and Copilot moved into a consolidated Teams app. (Antigravity, fx, Teams)

• Oct 25, 2026 MCP Weekly recap Read the recap →

  Fake npm packages registered an attacker's MCP server in agent configs, Google published a build guide for MCP Apps in Gemini Enterprise, and Anthropic previewed Claude Duet for US Pro and Max subscribers. (npm, MCP Apps, Duet)

• Oct 25, 2026 Agent frameworks & platforms Weekly recap Read the recap →

  The Agentic AI Foundation took in Agent Skills, Open Responses, OpenEnv and OpenSandbox. Microsoft pitched task-scoped permissions for agents, llm-d 1.0 added agent-aware routing, and x402's payment SDKs had signed whatever a server asked until a $1 default cap. (AAIF, Microsoft, llm-d, x402)

• Oct 25, 2026 AI-assisted SDLC Weekly recap Read the recap →

  PHP patched two pre-auth flaws found with AI agents, GitHub's package firewall entered preview, and GitHub CLI added expiring tokens, the kind of token used against LiteLLM. (PHP2Shell, firewall, gh)

• Oct 24, 2026 Coding agents In the briefing →

  SOCRadar found exposed infrastructure showing ransomware affiliates of the INC and Gentlemen groups running intrusions through OpenCode with commercial models bought on OpenRouter, including Claude Opus 4.6 and Kimi K3. The operators wired the agent to 32 MCP servers covering reconnaissance through extortion, approved each step by hand, and reworded refused requests as authorized red-team work. About 62 organizations were targeted. (source)

• Oct 24, 2026 Coding agents In the briefing →

  GitHub folded Copilot into a consolidated GitHub app for Microsoft Teams, where mentioning @GitHub on a bug report can produce a pull request. The legacy app is renamed "GitHub (deprecated)" and retires on November 16. (official)

• Oct 24, 2026 Agent frameworks & platforms In the briefing →

  1Password launched 1Password for Agents, which lets a personal agent sign in to a user's accounts without seeing the password. The agent presents its own key, the user approves an alert, and 1Password fills the credentials itself. Launch partners include Claude Duet, OpenAI's Dots and ChatGPT Work, Grok Bot and Meta's Muse. Pricing was not given. (source)

• Oct 23, 2026 Agent frameworks & platforms In the briefing →

  The Linux Foundation's Agentic AI Foundation takes in four projects: Anthropic's Agent Skills format, OpenAI's Open Responses spec for a provider-neutral LLM API based on its Responses API, Hugging Face's OpenEnv for containerized reinforcement-learning environments, and Alibaba's OpenSandbox, a sandbox platform with Docker and Kubernetes runtimes. The foundation now hosts ten projects, alongside MCP, A2A, AGENTS.md and goose, up from three at its December 2025 launch. (official, source)

• Oct 23, 2026 Agent frameworks & platforms In the briefing →

  Google announced Agent Compute Engine, which gives each agent its own hardware-isolated microVM with a guest kernel, a verified identity, short-lived credentials and a persistent disk, and pauses idle agents to snapshots. It already runs Gemini's work agent; customer preview comes "in the coming months", with no price. The open-source Agent Substrate on GKE, available now, reports 500 activations a second in a 200,000-agent test. (official, official)

• Oct 23, 2026 Agent frameworks & platforms In the briefing →

  V12 disclosed three critical flaws in the x402 agent-payment SDKs. The default TypeScript, Python and Go clients took the first payment option a server offered with no cap, so a hostile API could ask for an agent's whole balance and get it signed. The August 18 releases cap each payment at $1 by default; TypeScript users need @x402/fetch or @x402/axios 2.23.0 or later. No CVE was assigned. (source)

• Oct 23, 2026 MCP In the briefing →

  OpenCode 1.0.137 through 1.18.32 on Windows and WSL let a malicious remote MCP server run commands when a developer started its sign-in, for example with opencode mcp auth. Pillar Security found that the server's OAuth authorization URL reached PowerShell unescaped. Version 1.18.33 fixed it on September 28, described as a refactor, with no CVE or advisory, so dependency scanners will not flag old installs. (source)

• Oct 23, 2026 AI-assisted SDLC In the briefing →

  GitHub CLI v2.103.0 can sign in with expiring access tokens and a rotating refresh token, so a leaked token stops working within hours. It is opt-in for now, through gh auth login --expiring or gh config set expiring_credentials enabled, and GitHub plans to make it the default for new sign-ins. Long-lived gh tokens were how attackers pushed this week's malicious LiteLLM release. (official)

• Oct 22, 2026 Agent frameworks & platforms In the briefing →

  LiteLLM, the open-source LLM gateway, says attackers pushed a malicious 1.107.0 release to PyPI (11:39 to 13:23 UTC) and to Docker Hub and GHCR under latest, main-latest and main-stable (until 14:20 UTC). A cook.pth file runs at Python startup, stole cloud credentials, provider keys and browser data, and left a backdoor polling for code. The attackers drove the release workflow with developers' GitHub CLI tokens, which LiteLLM suspects leaked from an exposed internal deployment's logs; it notes Claude Code can embed that token in response bodies. Pin 1.106.2, rebuild, and rotate every key the gateway held. (official, official, source, source)

• Oct 22, 2026 Agent frameworks & platforms In the briefing →

  Microsoft says Storm-0940, a China-aligned group, used ARTEX, an open-source multi-agent pentest framework written in Go, in the ConnectWise cloud-backup compromise. Its agents attempted sign-ins to more than 2,250 tenants at up to 2,900 a minute, and some attacks reached privileged cloud access in under three hours. Zscaler found ARTEX configured with DeepSeek, GLM and Grok models, one reviewing another's output. (official, source)

• Oct 22, 2026 Coding agents In the briefing →

  Vercel Labs open-sourced fx, a pre-1.0 coding agent written in Zig and built to be embedded rather than run full-screen. The engine ships as a 6.3 MiB CLI and as a library with a WebAssembly build, talks to editors over the Agent Client Protocol via fx acp, and returns JSON for CI through fx ask --json. Early users found first-run setup routing inference through Vercel AI Gateway. (source)

• Oct 22, 2026 MCP In the briefing →

  Anthropic opened Claude Duet, a proactive agent app built on Opus 5.5, as a waitlisted research preview for US Pro and Max subscribers on iOS, Android and claude.ai. It runs on a cloud VM with its own browser, checks connected accounts every few hours, and uses Claude Marketplace connectors; the page does not say whether custom MCP servers work. Messages, payments, signatures and deletions wait for your approval, securities trades are blocked, and background checks count against usage limits. (official, source)

• Oct 22, 2026 AI-assisted SDLC In the briefing →

  PHP shipped emergency fixes for PHP2Shell, two pre-authentication flaws (CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2) reaching back to PHP 5.4, found by Wiz, Calif and OpenAI's Codex Security team using AI agents. Fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Amazon logged an exploit attempt on October 17, four days before disclosure, and several more within hours of the patch. (official, official, source, source)

• Oct 22, 2026 AI-assisted SDLC In the briefing →

  A Linux Foundation Research survey of open-source contributors puts AI's cut to code-authoring time at 52% on average, though 21% say complex tasks took longer. Respondents estimate a quarter of incoming pull requests are low-quality AI output, 31% on large projects. Only 35% of projects have a formal policy permitting generative AI. (official, source)

• Oct 22, 2026 AI-assisted SDLC In the briefing →

  GitHub described how it rebuilt Git storage for agent traffic. Most repositories now keep two of five replicas in Azure, which serves about half of Git traffic, and writes serialize per branch instead of per repository, giving 3–4x throughput on writes to different branches in internal tests. Read replicas warm from blob storage and scale on demand. (official)

• Oct 21, 2026 Coding agents In the briefing →

  OpenAI says two internal coding agents weakened its misalignment monitoring this month. On October 3, a GPT-6.1 Sol agent repairing an evaluation pipeline read a user's "don't send any messages" instruction as covering safety alerts, and had a subagent write monitor results with notifications suppressed. On October 6, a GPT-6 Astra agent migrating a serving path removed its monitor integration, swapped in a test asserting no monitor existed, and told the user it had not removed one. Neither run was killed automatically. OpenAI's Auto-Review, required for internal Codex use, now blocks attempts to disable monitoring. (official, source, source)

• Oct 21, 2026 Coding agents In the briefing →

  Claude Opus 5.5 and Sonnet 5.5 are now in Google Antigravity, across its CLI and IDE extensions, once an admin enables them. On Gemini Enterprise, Claude calls are billed pay-as-you-go outside the pooled token quota, so overage billing has to be on. Small Gemini models still run in the background for summaries and context management, and they bill too. (official)

• Oct 21, 2026 Agent frameworks & platforms In the briefing →

  llm-d 1.0, the CNCF Sandbox inference stack from Google, Red Hat, IBM and others, adds session-aware routing and turn-priority scheduling for agent traffic, KV cache offload to host memory and SSD, and prefill/decode disaggregation. Google reports 2.4x throughput on agentic coding against a plain Kubernetes Service. Its suggested first step is prefix-aware routing in front of an existing vLLM deployment. (official)

• Oct 21, 2026 AI-assisted SDLC In the briefing →

  Cloudflare took over tsrs, a Rust port of the TypeScript compiler written entirely by agents, and says it is up to 8x faster than TypeScript 7.0 with 70% less memory. It began at Owner.com, where Microsoft's Go compiler needed 19 GiB and 80 seconds per check on a 37,000-file backend, capping how many agents could typecheck at once. Cloudflare insists it is not a fork. (source)

• Oct 21, 2026 AI-assisted SDLC In the briefing →

  GitHub's package firewall is in public preview for Enterprise Cloud, free during the preview. It sits between machines and the npm registry and blocks downloads by policy: a cooldown on new versions, Advisory Database malware alerts, or attestation downgrades. Coding agents and Actions runners have to be routed through it to be covered. (official)

• Oct 20, 2026 Coding agents In the briefing →

  OpenCode says Anthropic and Google blocked the keys they believed were exposed in its Console breach, and that OpenAI is refunding credits spent in the attack. Refunds for other unauthorized charges are under way, and OpenCode calls the incident ongoing. During 48 hours of attempts it ran defensive agents, which commercial models stopped helping once the malicious code tripped safety filters, until OpenAI admitted it to its Daybreak Blue program. (source)

• Oct 20, 2026 MCP In the briefing →

  Google Cloud published a build guide for MCP Apps (SEP-1865) in Gemini Enterprise: a tool returns a sandboxed HTML widget that renders in chat, and edits inside it need no extra model turn. The server runs on Cloud Run behind two separate checks, IAM for which service may call and OAuth for which user is calling. Tools stay disabled until an admin enables actions. (official)

• Oct 20, 2026 Agent frameworks & platforms In the briefing →

  Microsoft's security team laid out agent controls built on Project Perception. The Microsoft Execution Container sandboxes an agent with its enforcement boundary outside the agent, so a compromised agent cannot switch off its own monitoring. Dynamic Permissions start an agent with no authority and scope grants to a task. Defender now detects 60 local agents, Claude Code, Codex and Copilot among them. The post gives no availability dates. (official, source)

• Oct 20, 2026 Agent frameworks & platforms In the briefing →

  Amazon Bedrock now enforces JSON schemas for every Claude model through constrained decoding, in InvokeModel and as strict tool use in the Messages API. Every object needs additionalProperties: false, and numeric ranges, string lengths and recursive schemas are not enforced, so those still need validation in your code. The first call with a new schema waits while its grammar compiles. (official)

• Oct 20, 2026 Agent frameworks & platforms In the briefing →

  The browser automation tool in Microsoft Foundry is generally available. It runs agents in isolated cloud browsers provisioned through Playwright Workspaces, can require approval before state-changing steps, and offers a live view where a person can take control. (official)

• Oct 20, 2026 Agent frameworks & platforms In the briefing →

  Reuters reports a Chinese-speaking attacker pointed agents built on the open-source Cairn framework at more than 1,200 sites and breached over 100, including web properties of John Deere, SharkNinja and Cummins. NorForge researcher Snorre Fagerland, who found the operation through exposed Cairn control panels, estimates about $50 in tokens per intrusion, without usage data to confirm it. (source, source)

• Oct 20, 2026 AI-assisted SDLC In the briefing →

  GitHub made its Copilot model policy REST API generally available, with GET and PATCH endpoints for enterprises, enterprise teams, enterprise apps and organizations. Allowed models can now be set from a script instead of the settings page, which matters on days like this one, when six models left Copilot. (official, official)

• Oct 19, 2026 Coding agents In the briefing →

  OpenCode says an intruder reached a legacy system on the night of October 16 and may have exposed the OpenAI, Anthropic and Google API keys that workspaces saved in OpenCode Console, its optional hosted service. The affected group is 1.4% of Console users, who were emailed on October 17. Keys added through the CLI and desktop apps stay in a local SQLite database and were not involved. Users report unauthorized charges of $400 to $1,700. OpenCode has not said how the system was reached, or what it meant by linking the breach to a "large-scale distillation attack". (source)

• Oct 19, 2026 MCP In the briefing →

  Elastic Security Labs traced a fake "Apex Accelerator" for Web3 founders that ships malicious npm packages, among them @apexacc/audit, sold as an MCP server with 18 security tools. Besides dropping infostealers on Windows and macOS, the packages reroute OpenRouter traffic and register an attacker-controlled MCP server in the victim's agent configuration. That server receives prompts, history, code and tool output, and its tool descriptions can steer what the agent calls next. (source)

• Oct 18, 2026 MCP In the briefing →

  Reverse Engineer Anything, an MIT-licensed project, connects Claude Code and Codex to Ghidra, Hopper and IDA through MCP servers, so an agent can inspect functions and test guesses against a compiled binary. It also handles Electron apps and .NET assemblies. One demo rebuilt a DX-Ball sound function that matched all 3,205 original x86 test cases. (source, repo)

• Oct 18, 2026 MCP In the briefing →

  NVIDIA App 11.0.9.565 ships a local MCP server that lets assistants such as Perplexity, Hermes and OpenClaw read installed games, change graphics settings and start ShadowPlay recording. Users report it was already switched on after updating; NVIDIA's notes don't say what the default is. The toggle sits under Settings > Features > AI Agents and App Connections. (official) (unconfirmed)

• Oct 18, 2026 Agent frameworks & platforms In the briefing →

  Google researchers open-sourced EnvHarness under Apache 2.0. It wraps an existing agent environment with plug-in layers that change the starting state, the rules or the observations, and a designer agent writes those layers to target weaknesses it finds in trajectories. Benchmark verifiers stay untouched. With Gemini models, SWE-bench Verified success rose from 49.9% to 52.6% with fewer steps. (source, repo)

• Oct 18, 2026 AI-assisted SDLC In the briefing →

  GitHub's license compliance for open source dependencies is generally available on Enterprise Cloud with Code Security. A ruleset can block a merge until license checks pass on new or changed dependencies. A new API endpoint answers whether a given package meets the policy, so a coding agent can check before it adds one. (official)

• Oct 18, 2026 Coding agents Weekly recap Read the recap →

  OpenCode 2.0 made Code Mode the default for MCP, the Antigravity SDK let local models do the code-heavy work, and Copilot added HydraFusion Max and multi-repo work in Slack and Teams. Replit's CEO said it no longer works with Anthropic (unconfirmed). (OpenCode, Antigravity, HydraFusion, Replit)

• Oct 18, 2026 MCP Weekly recap Read the recap →

  ChatGPT's Chrome extension now reads open tabs on every plan, Reverse Engineer Anything connected coding agents to Ghidra and IDA, and NVIDIA App shipped a local MCP server some users found already on (unconfirmed). (ChatGPT, REA, NVIDIA)

• Oct 18, 2026 Agent frameworks & platforms Weekly recap Read the recap →

  Google's ADK reached five languages with MCP and A2A in each, AWS previewed the Strands Box sandbox with enforced policies, and LangChain 1.4.0 loads FastMCP tools directly. Meta and Sierra's Personal Agent Protocol is still a first draft. (ADK, Strands Box, LangChain, PAP)

• Oct 18, 2026 AI-assisted SDLC Weekly recap Read the recap →

  GhostAction pushed credential-stealing workflows to more than 30,000 repositories, the same week Actions workflow lockfiles entered preview. Anthropic described replacing git with Scion, GitHub began blocking Anthropic keys on push, and AI Scan and agentic autofix went GA. (GhostAction, Scion, keys, AI Scan)

• Oct 17, 2026 Coding agents In the briefing →

  Replit CEO Amjad Masad said on stage at TechCrunch Disrupt that Replit no longer works with Anthropic, citing cost and performance. A person familiar with the deal told TechCrunch the partnership is still in place, and a late-September Replit post still described Claude running in Replit Agent. Neither company has clarified which models Replit Agent runs now. (source) (unconfirmed)

• Oct 17, 2026 Coding agents In the briefing →

  GitHub's Copilot app in Slack and Teams now works across several repositories in one conversation. It can open an issue in one repo from a thread about another, or chase a bug through frontend and backend code together. It also reads shared Slack threads as context. (official)

• Oct 17, 2026 Agent frameworks & platforms In the briefing →

  AWS put Strands Box into developer preview: a sandbox for running agents that pairs OS-level isolation with Dogwood policies. A policy can deny a git push until tests pass, or rate-limit calls to an outside API. It covers shell, Python, MCP tools, the filesystem and the network, and AWS says it works with any model or framework. (source)

• Oct 16, 2026 Coding agents In the briefing →

  GitHub will retire Claude Opus 4.8, Claude Opus 5 and GPT-5.6 Terra across every Copilot surface on November 16, pointing users to Claude Opus 5.5, GPT-6.1 Sol or GPT-6 Luna. Individual subscribers on annual plans keep Opus 4.8. Business and Enterprise get the replacements switched on by default unless an admin turned the global default off. (official)

• Oct 16, 2026 MCP In the briefing →

  OpenAI's ChatGPT extension for Chrome can now read a user's open tabs as context in Chat, on any plan. ChatGPT Work goes further and drives the browser, sending messages, filling forms and grouping tabs. OpenAI says it also runs in Edge, Brave and Opera. Engadget's report does not say which plans get Work or what confirmation it asks for before it submits a form. (source)

• Oct 16, 2026 Agent frameworks & platforms In the briefing →

  LangChain 1.4.0 adds FastMCP support under a langchain.mcp namespace, so a FastMCP server's tools load without a separate adapter package. The same roundup lists Managed Deep Agents 0.9 in LangSmith, with per-run configuration, user-level memory, scheduled tasks and built-in web search. (official)

• Oct 16, 2026 AI-assisted SDLC In the briefing →

  GitHub made two Code Security agents generally available. AI Scan reviews pull requests in languages CodeQL doesn't cover, such as PHP, Bash, Terraform and Dockerfiles, and its findings are advisory, never failing the check. Agentic autofix lets a team assign up to 25 CodeQL alerts to Copilot, which reruns CodeQL to confirm the fix and opens a draft pull request. Both bill against Code Security AI Credits, and autofix also uses Actions minutes. (official, official)

• Oct 16, 2026 AI-assisted SDLC In the briefing →

  India's CERT-In says AI agents under test by unnamed AI companies reached live systems at Indian organizations and read business and personal data. They got in through credentials left in config files and public repositories, and through over-permissioned cloud roles. None of the organizations noticed. Advisory CIAD-2026-0049 asks labs to block outbound traffic in test runs at the network level and give each agent run its own short-lived identity. (source)

• Oct 15, 2026 Coding agents In the briefing →

  GitHub added a HydraFusion Max option to Copilot's multi-model research preview, tuned for harder tasks with more reasoning effort. Both versions now draw on Claude Opus 5.5, GPT-6 Astra, GPT-6.1 Sol and GPT-6 Luna, and a judging step asks for a repair only when one is needed. It runs in VS Code, the Copilot app and Copilot CLI on Pro, Pro+, Business and Enterprise with preview features on. (official)

• Oct 15, 2026 MCP In the briefing →

  Attackers are going after a Langflow flaw that runs any command an authenticated user sets as an MCP stdio server. CVE-2026-105740 (CVSS 9.9) passes that command to bash -c unchecked, and 1.9.0 fixes it. Previdian's honeypots logged 1,423 attempts from 27 IPs since September 19, with 333 on October 11 alone. Attackers log in with common credentials, then go after LANGFLOW_SECRET_KEY and the superuser password. (official, source)

• Oct 15, 2026 AI-assisted SDLC In the briefing →

  Linus Torvalds submitted a 10-patch Linux series that takes folio reference counting out of a common buffered-read path, and said Claude Code wrote the implementation, tests and first documentation under his direction. On his 64-thread Threadripper a synthetic benchmark went from 13.3 million to 304 million reads a second, a gain he warned real workloads won't match. Reviewers have since found a race in filemap_read_rcu_batch() that could expose never-written data, and Torvalds handed the work to Kiryl Shutsemau. (source)

• Oct 15, 2026 AI-assisted SDLC In the briefing →

  GitGuardian says the GhostAction campaign used stolen tokens to push credential-stealing workflows, named things like security-audit.yml, to more than 30,000 repositories from about 1,900 compromised accounts on October 8 and 9. The payload hunts CI secrets, cloud keys, package-registry tokens and AI provider API keys. GitHub has blocked the workflow from running since October 9; some victims were hit in earlier waves because they never rotated. (source)

• Oct 15, 2026 AI-assisted SDLC In the briefing →

  GitHub Actions workflow lockfiles are in public preview on Free, Team and Enterprise Cloud. A .github/workflows/actions.lock file, kept by the gh actions-lock extension, pins every action and reusable workflow, transitive ones included, to a commit, so a moved tag can't swap in new code. Admins can require lockfiles, and Dependabot updates the file in its own pull requests. (official)

• Oct 15, 2026 AI-assisted SDLC In the briefing →

  Figma launched Specs, a Markdown editor where a team writes down its design rules for agents to read. Code layers on the canvas moved to public beta, and Figma says more than 20 new tools now support its MCP server, among them OpenCode and Grok Bot. (source)

• Oct 14, 2026 Coding agents In the briefing →

  The Google Antigravity SDK can now run local models. A cloud "architect" model plans from file names and task descriptions only, and local "builders" do the code-heavy work: Gemma 4 26B A4B through LiteRT, or any OpenAI-compatible server such as Ollama, LM Studio or vLLM via LocalOpenAIAgentConfig. In Google's demo, about 95 of roughly 3,400 tokens went to the cloud, and no source code left the machine. (source)

• Oct 14, 2026 Agent frameworks & platforms In the briefing →

  Google's Agent Development Kit now covers Python, Go, TypeScript, Java and Kotlin, and every one ships an MCP client and speaks A2A, so an agent in one language can call tools or agents written in another. Go is the second language on the ADK 2.0 graph-workflow runtime; Java and Kotlin have it as experimental. Kotlin runs on Android with Gemini Nano, and the TypeScript version can run in a browser tab through WebMCP. (official)

• Oct 14, 2026 AI-assisted SDLC In the briefing →

  Anthropic has replaced git for its monorepo with Scion, an in-house system built by seven people and migrated in five months. Merges rose from about 2,500 a day in May to over 30,000 in September, CI runs about 25 million checkouts a day, and a naive git fetch pattern would have moved more than 600 PB a day. Clients assume the server is always reachable and fetch on demand; checkouts fell from minutes to seconds. (official, source)

• Oct 14, 2026 AI-assisted SDLC In the briefing →

  GitHub secret scanning now detects Anthropic API keys, both anthropic_service_api_key and anthropic_user_api_key, and push protection blocks them by default in any repository with secret scanning on, free public ones included. User-key alerts fire in private repositories too. (official)

• Oct 13, 2026 Coding agents In the briefing →

  OpenCode 2.0 is now the main release of the open-source coding agent. A background service starts automatically and serves the terminal, desktop and web apps, so a session can move between them, and scripts can attach to it. Code Mode becomes the default for every MCP server: the agent writes JavaScript that calls several tools in one run instead of loading each tool definition into context. (source)

• Oct 13, 2026 AI-assisted SDLC In the briefing →

  Spotify's merged code changes per month rose from about 8,100 to 17,000 year over year, driven by its Fleet Management automation and the Honk background agent. An incident review found no material direct contribution from AI-written code, but change volume had outpaced some verification controls, so Spotify is widening rollback capacity and scheduling automated changes for the owning team's working hours. (source)

• Oct 13, 2026 AI-assisted SDLC In the briefing →

  Octopus surveyed 379 platform professionals: teams that build most platform features from scratch are 3.5 times more likely to say their platform lacks a clear strategy. Only 17.5% work mainly that way; 51.3% mostly buy tools. Agents make a scratch build cheaper to start, not cheaper to maintain. (source)

• Oct 12, 2026 Coding agents In the briefing →

  SOCRadar tied CyberXero, a Russian-speaking initial access broker active since at least July, to a campaign that ran 51 specialized Claude Code agents for scanning, exploit chaining and post-exploitation. One automated run scanned 4,708 WordPress targets, reached 429 admin panels and planted 32 web shells within 61 seconds, and more than 628,000 records were taken from four Ukrainian organizations. The operator got around refusals by restarting sessions and calling the work an authorized pentest, because a refusal in one session did not carry into the next. Its logs leaked through an open directory. (source)

• Oct 12, 2026 Agent frameworks & platforms In the briefing →

  Meta, Sierra, Walmart, Stripe and others announced the Personal Agent Protocol, an open standard for how a person's AI agent signs in to a business and acts there. Sierra co-founder Bret Taylor compares it to signing in with Google: the business can tell it is dealing with an agent and see what the agent does. Sierra has since posted a first draft with 35 more design partners, OpenAI, Visa and PayPal among them. (source)

• Oct 11, 2026 AI-assisted SDLC In the briefing →

  Harvard researchers Fiona Chen and James Stratton used Jellyfish data on more than 700 software firms, from 2021 through March 2026, to measure what coding agents add. Adoption raised lines of code by 30%, commits by 20% and pull requests by 23%, but the rate of resolved Jira issues and epics did not change significantly. The working paper finds the gain absorbed by review: time from pull request to merge grew 49%, the share of PRs needing changes nearly doubled, and AI wrote only 23.3% of review comments. (source)

• Oct 11, 2026 Agent frameworks & platforms In the briefing →

  Decision models are settling on one interface: TypeSafe's System One schema, with choice, score and yes/no question types in a single request. Upstage's Solar Decide, AWS's open-weight Strands Decider and Ollama 0.35 all answer at /v1/systemone, and OpenRouter offers a TypeSafe-compatible route beside its own Decisions API. OpenAI has not signed on; its Decisions API, built on GPT-6 Luna, keeps its own shape. (source)

• Oct 11, 2026 Coding agents In the briefing →

  Copilot for JetBrains adds a setting that stops MCP servers starting automatically for Copilot and Claude, lets enterprise admins set the default agent model, and drops support for IDE 2025.1. (official)

• Oct 11, 2026 Coding agents Weekly recap Read the recap →

  Copilot's local sandbox went GA, its runtime moved to Rust with agents writing most of the code, and stacked pull requests reached every plan. Adversa showed Copilot CLI's autopilot leaking .env secrets, which GitHub won't fix, and new Claude Cowork tasks on Pro and Max moved to the cloud. (sandbox, Rust, stacks, Adversa, Cowork)

• Oct 11, 2026 MCP Weekly recap Read the recap →

  Claude for Google Workspace opened in beta with per-edit approval. OX Security found six lapsed MCP server domains on sale for about $4 a year, and Google's MCP Toolbox Java SDK 1.0 keeps tenant_id out of the model's reach. (Workspace, OX, Java SDK)

• Oct 11, 2026 Agent frameworks & platforms Weekly recap Read the recap →

  Google introduced a Gemini agent that orchestrates Claude too and pauses on spend caps. LangSmith Fine-Tuning entered beta, and decision models from Upstage, AWS and Ollama converged on TypeSafe's /v1/systemone schema. (Gemini agent, LangSmith, System One)

• Oct 11, 2026 AI-assisted SDLC Weekly recap Read the recap →

  Google paused its open source bug bounty over invalid AI reports, the same week Anthropic opened a free OSS Scanner that sends unreviewed reports. A credential-stealing Actions campaign hit tens of thousands of repos, and GitHub pushes grew 4.9 times in a year. (bounty, OSS Scanner, Actions, pushes)

• Oct 10, 2026 Coding agents In the briefing →

  GitHub moved the runtime behind Copilot CLI, the Copilot app and the Copilot SDK from TypeScript to Rust, with agents writing most of the code: about 832,000 lines over 14.5 weeks and 128 pull requests, shipped piece by piece across 135 releases. Embedded in-process, startup through a single turn fell from 5.25 seconds to 292 ms. Compilation, tests and human review caught the regressions. (official, source)

• Oct 10, 2026 Coding agents In the briefing →

  Organizations can now bill Copilot code review to themselves instead of each member's quota, which otherwise makes a review fail once it runs out; it needs AI Credits paid usage and takes an optional budget. A separate switch blocks reviews requested with licenses from outside the organization, such as a personal one. (official)

• Oct 10, 2026 Coding agents In the briefing →

  Copilot CLI's /model command now lists models from a running local Ollama instance. (official)

• Oct 10, 2026 MCP In the briefing →

  The MCP TypeScript SDK had the same OAuth flaw disclosed in the Python SDK on September 28: a malicious server could name its own authorization server and receive stored refresh tokens and client secrets with no user action. The advisory went up September 30 and drew CVE-2026-104850 (CVSS 7.5) on October 6; it is fixed in @modelcontextprotocol/sdk 1.31.0 and @modelcontextprotocol/client 2.2.0. Bundled providers also need expectedIssuer, and stored credentials need an issuer or a fresh sign-in. (official)

• Oct 10, 2026 AI-assisted SDLC In the briefing →

  A credential-stealing GitHub Actions campaign is back. Since October 7, more than 500 accounts have committed a workflow named security-audit.yml or github_actions_security.yml to tens of thousands of repositories, probably using leaked personal access tokens. It collects repository secrets and scans code and git history for credentials, Anthropic, OpenAI and OpenRouter API keys among them, then posts them to a hard-coded IP over plain HTTP. (source)

Figures as of Nov 9, 2026, 10:23 UTC