← Building with agents

Building with agents

August 2026

• Aug 31, 2026 Coding agents In the briefing →

  Anthropic emailed Claude users whose login sessions were hijacked off their own machines by infostealer malware — Vidar, LummaC2, StealC, RedLine and Acreed on Windows, Atomic Stealer on macOS. A stolen session cookie is already an authenticated session, so it walks past the password, MFA and SSO alike. The tell Anthropic offered: limits that refilled and then drained while you weren't using Claude. It is revoking sessions, stripping saved payment methods and refunding charges it identifies as unauthorised. Signing out does nothing about the malware that took the cookie. (source)

• Aug 31, 2026 Coding agents In the briefing →

  OpenClaw 2.0 shipped as v2026.8.1. Sessions can now run on a paired device or a cloud worker with the workspace travelling along, and an agent asks for a secret through a masked prompt rather than putting the value in the chat. Automation permissions are granted for one exact operation, then inspectable and revocable afterwards. Upgrading is not free: the OpenProse plugin and OpenAI route migrations are breaking, and openclaw doctor --fix rewrites the config. (official)

• Aug 31, 2026 MCP In the briefing →

  Cloudflare wired Workers AI, Vectorize, R2 and Browser Run into a single retrieval service, AI Search, and exposed it at /mcp and /search — endpoints that need no deployment and, as shipped, no authentication. A discovery mode crawls a site with no sitemap, and one query can span several instances. Embedding and re-ranking are free on Workers AI models, answer generation bills by model, and everything is free through the beta. (source)

• Aug 31, 2026 Agent frameworks & platforms In the briefing →

  Security architect Ravindra Annam argues the agent gateway is the control teams reach for first and are least equipped to run, because the identity and attribution layer it sits on mostly isn't there. His alternative is runtime trust: check each proposed action against the original objective, watch tool and API patterns for drift, issue short-lived permissions from runtime context, and put a person in front of high-impact calls. He anchors it to NIST SP 800-207, OWASP GenAI and MITRE ATLAS. (source)

• Aug 30, 2026 Coding agents In the briefing →

  GitHub's August Copilot update for Visual Studio adds organization-level custom agents — an org or enterprise owner publishes an agent once, and Visual Studio surfaces it across repositories with its description and its source org. Supported models pick up Low/Medium/High thinking effort, and the Git agent will now review uncommitted changes and commits before any pull request exists. (official)

• Aug 30, 2026 Agent frameworks & platforms In the briefing →

  ServiceNow's August advisory carries three CVSS 10.0 flaws in the ServiceNow AI Platform, each reachable over the network with no authentication and no user interaction: code injection in the GraphQL Composite Data API, an access-control gap in the image upload processor, and SQL injection through a dynamic ORDER BY clause. A sandbox escape in Now Platform rates 8.7. No exploitation seen as of the advisory. (source, source)

• Aug 30, 2026 Coding agents Weekly recap Read the recap →

  JetBrains put Junie fully on-device, a 27B model on a 64 GB Mac with no network call. GitHub took global model policy to GA and dated three Copilot billing and retention changes for late September. Shopify's CEO floated banning Claude Code until it reads AGENTS.md, on an issue open a year with 5,200 reactions. (Junie, policy, Shopify)

• Aug 30, 2026 MCP Weekly recap Read the recap →

  Anthropic took enterprise-managed authorization to GA, so connector access follows IdP groups rather than per-user OAuth, with Okta first. AWS put MCP Apps behind the OpenSearch server, rendering widgets server-side against the same indices as the dashboards. Two disclosures landed months after their patches: marimo notebook metadata at CVSS 8.8, and Kiro Powers, where opening a workspace was the whole attack. (auth, MCP Apps, marimo)

• Aug 30, 2026 Agent frameworks & platforms Weekly recap Read the recap →

  Nine vendors published ARD, an open specification for federated discovery of agents and tools that stops at discovery and says so. Anthropic previewed the Model Hardware Standard for driving lab instruments over MCP. Microsoft's Agent Framework added channels and a production Agent Harness, and OpenAI's Assistants API shut down with no automated thread migration. (ARD, MHS, Assistants)

• Aug 30, 2026 AI-assisted SDLC Weekly recap Read the recap →

  JetBrains asked 15,000 developers what share of last month's code agents wrote and got three clusters, with agentic coders at roughly 84%. JetBrains also pulled Cadence offline after intruders got in through the TeamCity flaw it had told everyone else to patch. Visa open-sourced an eleven-stage harness that runs an adversarial panel against its own fixes. (survey, Cadence, Visa)

• Aug 29, 2026 Coding agents In the briefing →

  OpenAI is ending the contract that puts its models inside Cursor, fifteen days after SpaceX closed the acquisition. Shutoff is proposed for November 12, the longest notice the contract allows. The reason given is not technical: OpenAI says it cannot be confident SpaceX will stay inside its terms of service, citing Twitter's contract breach and Musk's sworn admission that xAI violated them. Cursor's Michael Truell puts OpenAI models at roughly 5% of user traffic and says talks continue. Your own API key still works. (official, source)

• Aug 29, 2026 Coding agents In the briefing →

  Johann Rehberger got Claude Code in Opus 5 auto mode to run attacker-supplied code by asking it to summarize a web page, in 60–80% of runs across three variants. The guardrail is the exploit path: Claude declines the supplied decoder, writes its own, and that decoder imports base64, which loads a planted local struct.py. Anthropic's answer is that auto mode is a best-effort classifier rather than a security boundary. (source, writeup)

• Aug 29, 2026 Coding agents In the briefing →

  GitHub attached dates to three Copilot changes. From October 1, existing Business and Enterprise customers paying by card must fund a seat before the user gets access. From September 28, Copilot Chat on github.com, Mobile and the cloud agent merge into one experience whose chat retention runs for the account's lifetime instead of 28 days — opting out means losing the feature. Code review's default effort goes from Lite to Balanced the same day. (official)

• Aug 29, 2026 AI-assisted SDLC In the briefing →

  JetBrains pulled Cadence, its PyCharm cloud-execution service, offline after finding intruders had been inside since August 8. The way in was CVE-2026-63077, the critical TeamCity flaw JetBrains disclosed in July and told everyone to patch; Cadence orchestrates on TeamCity and was missed. A full 2024 server backup left with them, along with AWS IAM credentials belonging to customers and staff. Rotate anything a Cadence run ever touched. (official, source)

• Aug 28, 2026 Agent frameworks & platforms In the briefing →

  Anthropic put the Model Hardware Standard into research preview: a driver-level spec that lets an agent discover a physical device and read from or write to it, with device characteristics carried as natural-language tags so a model can work out what an unfamiliar instrument does. Orchestration runs over MCP, the CLI and code, and the spec enforces device-level safety limits with human approval on high-risk steps. QuEra reports a Claude-built laser relock succeeding in 99.3% of 700 trials against 58% for the script it replaced. Genentech, CMU, HHMI Janelia and the University of Washington are early users; Tecan, QIAGEN, Doosan and Universal Robots are adding support. Open-source release comes after the preview. (official, source)

• Aug 28, 2026 Agent frameworks & platforms In the briefing →

  Microsoft's Agent Framework shipped Agent Harness, the production wrapper around an agent you already built: OpenTelemetry traces with token metrics and tool-call logs, Purview screening of prompts and responses, Foundry hosted deployment, and an evals runner. The pattern is one shared agent factory feeding three thin hosts — console, service, evals — so the definition stops being copied per environment. Samples ship for .NET and Python. (official)

• Aug 28, 2026 Coding agents In the briefing →

  Documentation meant for machines turned out to be an install path. Researchers scanned 6,214 domains belonging to Fortune 500s, defense contractors and big tech, and found 227 install commands inside llms.txt and llms-full.txt files pointing at packages and domains nobody owned. They registered some of the unclaimed names; a Fortune 500 host called their server within the hour. Claude, Codex and Hermes all ran the commands. (source)

• Aug 28, 2026 MCP In the briefing →

  Mindgard disclosed a prompt-injection path through Kiro Powers, the bundles of MCP server config, POWER.md steering files and hooks that give Amazon's IDE persistent context. A crafted workspace is enough: open it, send any message, and the agent exfiltrates local data to an attacker endpoint — no malicious prompt from the user. Amazon fixed it in 0.8.140; the write-up landed this week, months after the patch. (source)

• Aug 28, 2026 MCP In the briefing →

  Salesforce put its CRM behind an MCP server and shipped it as a Claude CoWork plugin with 37 pre-built sales skills. The access model is the interesting part: Claude reasons over skills and executes against the MCP server under the caller's own record permissions, so an agent cannot read what its user cannot. Pilot customers have it now, open beta lands in September, and billing splits between Salesforce consumption pricing and an Anthropic contract. (source)

• Aug 28, 2026 AI-assisted SDLC In the briefing →

  Visa open-sourced the Vulnerability Agentic Harness, an eleven-stage pipeline that finds a vulnerability, writes the patch and then runs an adversarial panel against its own fix before a person sees it. Stage 11 is read-only and scores each fix validated, failed or needs-review. It edits source files in the target repo unless you pin it to detection-only. Visa cites resolutions dropping from weeks to hours but has published no precision or recall. (source)

• Aug 27, 2026 Coding agents In the briefing →

  GitHub took global model policy to general availability on Copilot Business and Enterprise. Admins set one default enablement state, and per-model decisions override it rather than being wiped by it. Open-weight models and any model that requires data retention stay off no matter what the default says, so turning one on is always a deliberate act. Enforcement rolls out through September 1. (official)

• Aug 27, 2026 MCP In the briefing →

  AWS put MCP Apps behind the OpenSearch MCP server: one tool call returns a text summary and an interactive widget rendered in the conversation, so a service topology graph or a RED-metrics panel arrives without a tab switch. The visualizations are generated server-side against the same sources as the dashboards rather than drawn by the model. Claude Desktop, VS Code, Cursor, Goose and ChatGPT are supported today. (official)

• Aug 27, 2026 Agent frameworks & platforms In the briefing →

  Microsoft's Agent Framework added channels: declare an agent or workflow once, then expose it through a separate hosting package as an MCP tool, an A2A endpoint, an OpenAI Responses-compatible API, or a Telegram bot. AgentState pairs a target with its session store and WorkflowState resolves one from an instance, factory or builder. (official)

• Aug 27, 2026 Agent frameworks & platforms In the briefing →

  AgentCore Evaluations scores agents off OpenTelemetry spans instead of framework hooks, which puts Strands, LangGraph, the OpenAI Agents SDK, LlamaIndex, Google ADK and the Claude Agent SDK through one harness. Built-in judges cover goal success against an expected tool trajectory, per-turn correctness and helpfulness; anything emitting openinference.instrumentation.* spans is evaluated generically. (official)

• Aug 27, 2026 AI-assisted SDLC In the briefing →

  Reuters obtained the numbers behind Meta's abandoned Project OT, which would have run engineering as small pods supervising agents with some teams cut by up to 60%. AI-driven code changes rose 220% year over year while user-facing feature improvements grew 36%. Technical and security incidents climbed 40%, and time spent firefighting them 70%. November's second layoff wave is off. (source, summary)

• Aug 27, 2026 AI-assisted SDLC In the briefing →

  JetBrains asked 15,000 developers what share of last month's code agents wrote, and three clusters fell out of the answers. Agentic coders are about 31% of respondents at roughly 84% agent-written code; AI-assisted coders sit near 40%; manual coders near 10%. One in five now writes nothing without AI help, and seniors lean on agents harder than juniors. (official)

• Aug 26, 2026 Agent frameworks & platforms In the briefing →

  OpenAI's Assistants API shuts down today. /v1/assistants, /v1/threads and /v1/runs go away and the Responses API takes over: Prompts replace Assistants, Conversations replace Threads, Responses replace Runs. OpenAI states plainly that there will be no automated tool for migrating Threads to Conversations — the guidance is to route new conversations to the new API and carry old ones across as they come up. Anything still pointed at the beta endpoints has today. (official)

• Aug 26, 2026 Coding agents In the briefing →

  Shopify's CEO is weighing a ban on Claude Code inside the company until it reads AGENTS.md and .agents/skills rather than only CLAUDE.md. The complaint is split brain: teams mixing agents maintain two copies of the same build and test instructions. The request has been open since August 2025 with more than 5,200 reactions, and Anthropic's standing answer is "not planned for now". (source, issue)

• Aug 26, 2026 MCP In the briefing →

  A marimo notebook can carry an attacker's MCP server command in its own configuration, and opening that file in edit mode runs the command as a local subprocess before any cell executes. CVE-2026-75149 at CVSS 8.8, fixed in 0.23.15 back in July; the write-up landed this week. The patch treats notebook metadata as hostile and allow-lists which config sections a file is permitted to set. (source)

• Aug 25, 2026 Agent frameworks & platforms In the briefing →

  A working group spanning Microsoft, Google, GitHub, Nvidia, Databricks, Hugging Face, Salesforce, ServiceNow and Snowflake published ARD, an open specification for federated discovery of agents and tools, under Apache 2.0. The shape is DNS-like: each environment exposes its resources at a standard endpoint, registries index across those endpoints, and a publisher describes once instead of wiring a connector to every catalogue. ARD stops at discovery and says so — not MCP, not A2A, not a runtime; invocation still goes through whatever the resource already speaks. AWS's Agent Registry is MCP-native, searchable from any MCP client. (official, source)

• Aug 25, 2026 Coding agents In the briefing →

  Junie Local runs JetBrains' coding agent entirely on the machine — Qwen 3.6-27B at 4-bit, about a 20 GB download, started with /local. No account, no credits, no network call. The price is hardware: an M5 Mac with 64 GB. Reasoning is disabled for speed, which JetBrains' own numbers put near Claude Sonnet 4.5 and below GPT-5, with the gap widening on architectural work. DGX Spark and RTX 5090 are named next. (official, source)

• Aug 25, 2026 Coding agents In the briefing →

  OpenAI made its price-performance case for GPT-5.6 inside Kiro using its own benchmark runs: Terra at 77.4 on the Coding Agent Index against Claude Fable 5's 77.2, Luna at 74.6 against Opus 4.8's 72.5 for roughly a quarter of Sol's cost, and Terra clearing Terminal-Bench 2.1 tasks at about 82% less spend. Vendor-run numbers on a vendor-chosen harness, so reproduce them on your own repositories before moving a tier. (official, source)

• Aug 25, 2026 MCP In the briefing →

  Anthropic took enterprise-managed authorization to general availability: an admin connects the company identity provider — Okta first — picks which MCP connectors the organisation gets, and users inherit access through existing IdP groups at first login rather than approving OAuth connector by connector. Asana, Atlassian, Canva, Figma, Granola, Linear and Supabase work today; Slack, Exa, Miro and Zoom are queued. It implements the Enterprise-Managed Authorization extension to the protocol, so a connector your own team builds can speak the same flow. Shorter token lifetimes stop costing productivity, which is what makes deprovisioning actually expire access. (official)

• Aug 25, 2026 AI-assisted SDLC In the briefing →

  Microsoft's position is that a written AI policy is not governance until production can prove it, so the controls move to runtime. Foundry's AI Gateway authenticates, caps tokens and quotas, and applies policy in the path between users, agents, models, tools and MCP servers without application changes, while Purview, Entra and Defender turn the resulting telemetry into audit evidence. An open-source Agent Governance Toolkit ships alongside. (source)

• Aug 24, 2026 AI-assisted SDLC In the briefing →

  Canonical and UK Research and Innovation are funding a three-year PhD at Bristol on translating large C codebases into safe Rust with LLMs: split the program into components, rewrite each one, preserve the behaviour. Jon Seager oversees it with Meng Wang and Cristina David. Ubuntu already ships Rust sudo and uutils coreutils, both written by hand — this is a research bet, not a migration plan. (source)

• Aug 23, 2026 MCP In the briefing →

  The Model Context Protocol maintainers published a roadmap covering the next specification release and beyond. Server-initiated events — webhooks and channels — would stop clients polling for results, with the Tasks extension maturing behind them. One HTTP-native transport covers every deployment mode, local servers included, over Streamable HTTP on stdio. Agent identity gets DPoP and Workload Identity Federation, aimed at pasted API keys and long-lived tokens. Tool results get a standard shape, and progressive discovery lets a server open small and reveal more as the conversation narrows. No dates attached to any of it. (official)

• Aug 23, 2026 Coding agents In the briefing →

  GitHub Copilot arrived in Microsoft Teams: mention @GitHub in a channel, thread or meeting chat and the conversation becomes a cloud agent session everyone present can watch and redirect, though only people with write access to the repository can make it change code. The pitch is handing a standup's action item to an agent before the standup ends. (official)

• Aug 23, 2026 AI-assisted SDLC In the briefing →

  LinkedIn's code-review platform runs several independent reviewers over a pull request instead of one model, and treats agreement between them as evidence — a finding only one agent raises goes through separate verification before the author ever sees it. Across 5,230 sampled comments on 1,727 pull requests, 63.9% were accepted: 80% of logic errors, 40.6% of security fixes. (source)

• Aug 23, 2026 AI-assisted SDLC In the briefing →

  Enterprise agent governance maturity averages 2.3 out of 4, while deployment scales roughly eight times faster than the controls around it. The teams described as succeeding narrow each agent to a single responsibility, put the human checkpoint before an action rather than after it, and record decision lineage as work happens instead of reconstructing it for an audit. (source)

• Aug 23, 2026 Coding agents Weekly recap Read the recap →

  Cursor's Origin forge arrived switched on for paid plans, Google's Antigravity agents left their own app for VS Code, JetBrains and Zed, and Rider handed agents the IDE's refactoring engine — median task 157.9s to 26.6s, dotnet build calls 163 to 3. Claude Code cut its claude-api skill from over 200,000 tokens to about 25,000 by fetching reference docs on demand. (Origin, Antigravity, Rider, skill)

• Aug 23, 2026 MCP Weekly recap Read the recap →

  Azure DevOps' remote server went GA behind Entra, retiring a personal access token, though Claude Code, ChatGPT and Cursor still cannot connect for want of dynamic OAuth registration. Cloudflare's WriteGuard tiers each tool by risk in front of servers it doesn't change. A survey put deployed tools that modify external state at 65%, up from 27%, with measured protections stopping under 30% of attacks. (Azure DevOps, WriteGuard, survey)

• Aug 23, 2026 Agent frameworks & platforms Weekly recap Read the recap →

  A2A became a hosted project of the Agentic AI Foundation, so agent-to-agent and agent-to-tool now sit under one governance body. AWS open-sourced Dogwood, a Cedar dialect whose policies read an agent's event history rather than judging one call; Bedrock AgentCore Payments went GA with scoped, expiring spend sessions; DeepSeek open-sourced its harness under MIT; Block shipped Berd, an Apache-2.0 workspace keeping transcripts on local disk. (A2A, Dogwood, Berd, harness)

• Aug 23, 2026 AI-assisted SDLC Weekly recap Read the recap →

  Debian's developers are voting on eight proposals for LLM-assisted contributions, the outright ban needing a 3:1 majority. Cloudflare's reviewer agent, enforcing RFCs marked SHOULD or MUST, has flagged nearly 230,000 deviations and withheld approval on about 16,000. LinkedIn's multi-agent reviewer got 63.9% of its comments accepted — 80% on logic errors, 40.6% on security fixes. (Debian, Cloudflare, LinkedIn)

• Aug 22, 2026 Coding agents In the briefing →

  GitHub Copilot in Slack opened as a public preview: mention @GitHub and it will triage a bug report, label issues, or investigate a failure and open a pull request from a cloud sandbox. It draws on existing Copilot Business and Enterprise entitlements. Repository admins can require extra approval before agent-authored PRs merge — worth setting before the first one lands. (official)

• Aug 22, 2026 Coding agents In the briefing →

  OpenAI marked Codex passing 20 million users with a banked rate-limit reset for every paid plan. The reset is a giveaway; the user count is the part worth filing, since vendors almost never publish one for a coding agent. (official)

• Aug 22, 2026 MCP In the briefing →

  Microsoft took the Azure DevOps remote MCP server to GA: one mcp.json entry pointing at the hosted endpoint for your organisation, exposing work items, pull requests, repositories and pipelines behind Entra auth, so the assistant inherits the developer's permissions and no personal access token sits in a config file. Claude Code, Claude Desktop, ChatGPT and Cursor cannot connect yet — none supports dynamic OAuth client registration or Client ID Metadata Documents in Entra. (source)

• Aug 22, 2026 MCP In the briefing →

  AWS wrote up AgentCore Gateway as the single MCP endpoint agents connect through instead of holding credentials locally, staged as four scopes: JWT auth and central credentials, then Cedar role and attribute policies with Guardrails redaction and audit logging, then self-service tool registration and discovery, then PrivateLink ingress and multi-region failover. It documents existing capability rather than announcing new ones, and reads as a checklist even if you never touch Bedrock. (official)

• Aug 22, 2026 Agent frameworks & platforms In the briefing →

  DeepSeek open-sourced DeepSeek Harness (dsh) under MIT — an execution runtime built on a micro-kernel, with model adapters, tool registries, sandboxes, session state, event dispatch and UI all loaded as independent extensions. Swapping a remote API endpoint for a local runtime server becomes a declarative config change rather than a code change. A model lab shipping the harness as a separate artifact is the notable part. (official, source)

• Aug 22, 2026 AI-assisted SDLC In the briefing →

  Cloudflare turned its internal engineering standards into something a reviewer agent enforces. RFCs mark each requirement SHOULD or MUST with a named owner and a lifecycle state, and the agent checks technical designs before implementation, diffs in CI, and incident reports afterwards. Since early 2026 it has flagged nearly 230,000 deviations and withheld approval on about 16,000 of them. (source)

• Aug 22, 2026 AI-assisted SDLC In the briefing →

  GitHub published its account of the August 17 outage: 7 hours 47 minutes, starting when a component in its Central US data centre failed to scale under record traffic and cascaded into authentication failures. Copilot trailed the rest of the recovery because errors there triggered a client-side retry loop that added traffic; GitHub had to damp the retries before restoring it. Consistent retry limits and budgeted timeouts are the named fix, with no date attached. (official)

• Aug 22, 2026 AI-assisted SDLC In the briefing →

  Anthropic put Mythos 5 behind Claude Security, its codebase vulnerability scanner, in public beta for Enterprise plans, billed as ordinary token usage with no separate add-on. Its stated reasoning for exposing a cyber-capable model this way: someone who can only receive a patch or an alert has far less room to steer the model than someone talking to it directly. A $35M credit fund goes to open-source patching. (official)

• Aug 21, 2026 Coding agents In the briefing →

  Salesforce put coding agents into Slack channels that only an agent may open. Tag Claude, Devin, Copilot or Vercel from any conversation and it spins up a project channel, works in the open with diffs, live previews and a running plan in tabs, then archives the channel as a searchable trail. ChatGPT comes later. Slack did not say which plans get it or what it costs. (source, source, source)

• Aug 21, 2026 Coding agents In the briefing →

  Google's Antigravity agents left the Antigravity desktop app. Extensions now carry them into VS Code on all three platforms, JetBrains 2026.2.1 and Zed, with Visual Studio 2026 in preview, and one account covers every environment. Eligible Gemini Enterprise subscriptions include it, which is where the budget and access controls live. (official, source)

• Aug 21, 2026 Agent frameworks & platforms In the briefing →

  Mistral's Agentic Search swaps one-shot retrieval for a loop of five tools — search, open, navigate, read, grep — that reads like a file system. Accuracy on FinanceBench's 368 SEC filings went from 26.7% to 86%; OfficeQA Pro gained 45.6 points to reach 51.9%. Tokens fall by up to a third and p90 latency by 39.6%. Model-agnostic, no fine-tuning, cloud or on-premises. (official)

• Aug 21, 2026 AI-assisted SDLC In the briefing →

  Debian's developers are voting on eight proposals for how LLM-assisted contributions fit the project. Proposal A — no LLM contributions at all, written into the social contract — needs a 3:1 majority; B through H need a simple one and run from conditional acceptance to a climate objection. Whichever wins becomes the reference other distributions cite. (source)

• Aug 21, 2026 AI-assisted SDLC In the briefing →

  LangChain put agent changes behind a pull-request preview. Preview Builds deploy a branch into an isolated production-like environment tied to the parent deployment, refresh on every commit, and let a reviewer exercise the agent without cloning anything. An idle TTL and a concurrency cap bound the bill. Public beta, GitHub integration, LangSmith Cloud only. (official)

• Aug 20, 2026 Coding agents In the briefing →

  JetBrains bundled a refactoring-code skill into Rider 2026.2.1 that hands agents the IDE's own refactoring engine — rename, extract method, extract interface, change signature, safe delete among eight operations — instead of leaving them to edit text and rebuild to check their work. Median across 15 tasks: 157.9s to 26.6s, $0.52 to $0.19, 17 tool calls to 6.2. Calls to dotnet build fell from 163 to 3. Nothing to switch on. (official)

• Aug 20, 2026 Coding agents In the briefing →

  TrueFoundry released TrueForge under MIT: the agent runtime loop — model calls, MCP tools, skills, sandboxing, approvals, context and session state — surfaced as a chat UI, an HTTP API with a TypeScript SDK, and an embeddable UI SDK. Bring your own model, servers and infrastructure. VentureBeat reports task completion 30–75% cheaper than Claude Managed Agents on TrueFoundry's own measurements. (official, source, source)

• Aug 20, 2026 Coding agents In the briefing →

  OpenAI merged an async messaging tool into Codex so it can ask a question and carry on working instead of blocking. The existing request_user_input waits for you; send_user_message_async registers whenever the selected model lists it as supported. The timing problem is the interesting part — nothing stops Codex acting on a decision before you have made it. No model, date or surface named yet. (official, source)

• Aug 20, 2026 MCP In the briefing →

  Cloudflare's WriteGuard puts a policy layer in front of MCP servers without changing the servers. Each tool gets a risk tier — read-only, minimal impact, contained write, critical — and every request is checked against per-tool policy behind Cloudflare's MCP portal. Agent client and session context ride on the human's existing OAuth credentials, so no separate agent accounts. Classified invocations go to an audit log with sensitive values stripped. Private beta. (source)

• Aug 20, 2026 MCP In the briefing →

  Mistral shuts down and deletes the Google Drive and SharePoint Knowledge Connectors in Vibe Work on August 31, with MCP-based replacements as the migration path. Disabling a connector permanently deletes its indexed data, and the deprecation notice does not say whether the shutdown triggers that automatically. Nothing migrates itself: admins install the replacements, then every user reconnects their account. (source)

• Aug 20, 2026 Agent frameworks & platforms In the briefing →

  Netflix open-sourced oci-agent, an actor-critic workflow for observational causal inference: one agent writes and runs the analysis spec against templated Jupyter notebooks, a critic reviews the output and argues back. On a retention question it flagged possible early-adopter bias and a failed placebo test, and landed on an effect a quarter the size of what a plain model prompt had claimed. (official, source)

• Aug 19, 2026 Coding agents In the briefing →

  JetBrains surveyed over 15,000 professional developers between May and July: 90% use a coding agent weekly, 68% daily. Claude Code sits at 39% globally and 47% in the US, up from 18% in January. GitHub Copilot fell to 21% from 29% a year ago. Codex went 3% to 16%, Cursor slipped to 12%. (official)

• Aug 19, 2026 Coding agents In the briefing →

  Claude Code 2.1.234 cut the built-in claude-api skill's load cost from over 200,000 tokens to about 25,000 by fetching its reference docs on demand instead of inlining them. One migration document alone had been worth an estimated 36,000. A one-line question paid the whole bill before Claude read it. (official, source)

• Aug 19, 2026 MCP In the briefing →

  A Keeper Security write-up catalogues how MCP servers leak the credentials they hold: config files that store tokens in plaintext and get copied between machines or committed by accident, dev-time permissions that ship to production, and prompt injection from any document the agent reads. It cites CVE-2025-6514 in mcp-remote, 400,000-plus downloads, as the supply-chain case. (source)

• Aug 19, 2026 MCP In the briefing →

  A survey of MCP, skills and tool calling puts a number on how the surface shifted: deployed tools that modify external state went from 27% to 65%. The attack testing is blockchain-specific — irreversible, agent-signed transactions — but the defence numbers travel: measured protections stopped under 30% of attacks, model-level refusal under 3%. Read-only assumptions no longer describe the ecosystem. (official)

• Aug 19, 2026 Agent frameworks & platforms In the briefing →

  A2A becomes a hosted project of the Agentic AI Foundation, moving out of the Linux Foundation's wider portfolio into the same home as MCP. AAIF has gone from under 40 members at its December launch to more than 250, Google, Microsoft, Amazon, Anthropic, OpenAI and Block among them. Agent-to-agent and agent-to-tool now sit under one governance body. (source)

• Aug 19, 2026 Agent frameworks & platforms In the briefing →

  Bedrock AgentCore Payments went generally available, adding the Machine Payment Protocol alongside x402 and an upto scheme that bills against actual consumption. Spending lives inside scoped sessions with caps and expiry times; credentials stay in Identity Secrets Manager, so the model never sees them. Pay-per-use MCP endpoints are discoverable through AgentCore Gateway. (official)

• Aug 19, 2026 Agent frameworks & platforms In the briefing →

  Block released Berd, an Apache 2.0 desktop app that puts agents, files, skills and sessions behind one interface and keeps conversation history on the local disk. It's built on Tauri rather than Electron, runs on macOS, Windows and Linux, and is deliberately harness-agnostic — a different bet from the vendor-bundled agent UI. (source)

• Aug 18, 2026 Coding agents In the briefing →

  GitHub went down at 13:40 UTC and stayed broken for three hours and nineteen minutes — roughly one request in five to the site and API returning errors, about half of archive downloads and raw content failing outright, Actions and Git operations with them. Seven of eight services were mitigated at 16:59. Copilot stayed dark for five hours thirty-five. Cursor picked that same afternoon to ship Origin, its own git forge. (source, source)

• Aug 18, 2026 Coding agents In the briefing →

  Origin is in early beta on every paid Cursor plan unless an enterprise admin opted out: repos, pull requests, code browsing, and two-way GitHub sync where GitHub stays the source of truth. Vercel, Depot and Buildkite integrations ship with it. Free plans don't get it. (official, source)

• Aug 18, 2026 Coding agents In the briefing →

  JetBrains made Gemini 3.7 Flash the default in Junie, in both the IDE plugin and the CLI, at 40% off base pricing for now. On JetBrains' own private benchmark it matched the solve rate of their Sonnet-5 midtier at roughly a third of the cost per task. Nothing to configure — it's already switched. (official)

• Aug 18, 2026 MCP In the briefing →

  Microsoft Foundry turned on five Claude features for Azure-hosted deployments rather than Anthropic-hosted ones alone: structured outputs, web search, web fetch, an MCP connector that reaches remote servers straight from the Messages API, and tool search, which loads only the definitions a task needs. Web search bills around $10 per 1,000. (official)

• Aug 18, 2026 MCP In the briefing →

  ElevenLabs shipped a hosted MCP connector giving Claude read and write access to agents built on ElevenAgents — create them, compare configurations, and get an estimated LLM cost for a change before it lands. Deleting an agent is destructive; admins can disable tools across an organisation, users can tighten their own sessions. (source)

• Aug 18, 2026 Agent frameworks & platforms In the briefing →

  LangChain published AgentCore Payments middleware: it catches an HTTP 402, checks the charge against a session budget, signs through Bedrock AgentCore, then retries — no change to agent code. Settlement runs over x402, Coinbase's stablecoin micropayment scheme, now stewarded at the Linux Foundation. LangSmith traces what the agent spent. (official)

• Aug 18, 2026 Agent frameworks & platforms In the briefing →

  xpander, founded by three ex-AWS principal engineers, raised $7.5M seed for a vendor-neutral control plane over agents built on any model or framework. The design detail worth stealing regardless of the product: credentials are injected from a vault at the moment a tool call executes, so the model never sees them. (source)

• Aug 18, 2026 AI-assisted SDLC In the briefing →

  Grab cut mechanical analytics tickets from 44% of the queue in February to 30% in June, running a system called Spartan — 50-plus skills, 120 analysis frameworks, routing Slack questions to specialised workflows. Self-service data pulls went 63% to 90%. The substrate underneath is 5,000 certified tables and 4,000 context documents. (source)

• Aug 18, 2026 AI-assisted SDLC In the briefing →

  Microsoft retires Excel's COPILOT() worksheet function on September 14, pointing users at the Copilot side pane instead. It never left preview, so nothing production-critical should be leaning on it — but anyone who wired it into a live sheet has under a month to rewrite the formulas. (source)

• Aug 17, 2026 Coding agents In the briefing →

  DeepSeek's V4 Flash sits at the top of the leaderboards. Composio put it through eight harnesses — Claude Code, Codex and OpenCode among them — on 30 deliberately awkward multi-step tasks spanning Gmail, GitHub, Slack and Sheets. Of 240 runs, 129 passed, and only six of the 30 workflows completed under every harness. Same weights, different scaffolding, different model. (source)

• Aug 17, 2026 Coding agents In the briefing →

  Claude.ai, Claude Code and Cowork went down at 21:58 UTC: authentication failures first, then timeouts and requests that never finished. The Console and the API stayed up. Anthropic had everything restored 42 minutes later and has published no cause. (source)

• Aug 17, 2026 Agent frameworks & platforms In the briefing →

  AWS open-sourced Dogwood, which extends Cedar with temporal conditions so a policy can read an agent's event history rather than judging one call in isolation. Four operators — formerly, count_within, count_distinct_within, sum_within — cover approval-before-execution, spend ceilings and no-outbound-contact-after-sensitive-data. Apache 2.0, and AgentCore Policy already evaluates it. Temporal clauses forfeit Cedar's formal analysis, and the reference interpreter is not meant to run production authorization. (official, source)

• Aug 17, 2026 Agent frameworks & platforms In the briefing →

  DynamoDB now does vector search in-table, up to 4,096 dimensions across Euclidean, cosine and dot-product, so agent memory and the rows it describes stop being two systems you keep in sync. Three new meters ride on top of ordinary DynamoDB billing: bytes written to the index, bytes processed per search, bytes stored. (source)

• Aug 16, 2026 Coding agents In the briefing →

  SpaceX — the Cursor acquisition has closed, four months after the April partnership that carried the option to buy. TechCrunch puts the consideration at $60 billion in SpaceX stock. Cursor's own post frames the payoff as compute: access to what it calls the largest GPU fleet in the world, pointed at cheaper and more capable models. Nothing was said about the editor's roadmap, its pricing, or whether the team keeps its own release cadence. (official, source)

• Aug 16, 2026 Coding agents In the briefing →

  Cursor's IDE and cloud agents passed AIUC-1, a standard that pairs an audit of organisational controls with adversarial testing across thousands of scenarios; Schellman ran the assessment. Scope is secrets protection, secure code generation, MCP security, and agent identity and permissions, held with quarterly testing and a full annual audit. (official)

• Aug 16, 2026 Coding agents In the briefing →

  Anthropic filled in how Claude's text watermarking works: Google DeepMind's SynthID-Text, embedding patterns in low-stakes choices between synonyms, with a detection API to follow. Generated code is barely marked, since working code leaves little room for synonym substitution, though comments can carry it. Light editing probably won't strip a watermark; a full rewrite will. (source)

• Aug 16, 2026 MCP In the briefing →

  MongoDB now hosts its Atlas MCP Server instead of leaving you to run one. Agents connect with existing Atlas credentials and access controls, so agent data access is governed from the same place as everyone else's, and the listed clients are Claude Code, Codex, Grok Build, Devin, ChatGPT and Grok. It's free; the self-run open-source server was already taking 30,000 installs a week. (source)

• Aug 16, 2026 AI-assisted SDLC In the briefing →

  The unit a dev environment is provisioned for stops being the developer once agents are in the loop: one person running five sessions has five changes in flight, each needing somewhere to run. The New Stack's proposal is to deploy only the services a change touches and route test traffic through those, letting everything else fall through to shared stable versions. Anthropic's C-compiler team ran nearly 2,000 Claude Code sessions in a fortnight. (source)

• Aug 16, 2026 Coding agents Weekly recap Read the recap →

  Claude Code made auto mode the default on Pro, Max and Team, a classifier catching 89% of dangerous commands against 13.6% for human approval. Agent Plugins install went generally available across GitHub's four clients, six days after the format published. Zed's Delta puts agent transcripts beside the diffs they produced, and PyCharm lifted task success from 68% to 98% by handing agents a read-only interpreter path. (auto mode, plugins, PyCharm)

• Aug 16, 2026 MCP Weekly recap Read the recap →

  GhostSplice showed a hostile server never has to send one incriminating instruction: put the bland field list in the tool description and the mapping to .ssh/id_rsa in a later result, and average compliance goes from 42% to 82%. MongoDB started hosting its Atlas MCP server, and a Cloudflare dashboard toggle now injects WebMCP into any site on the platform with no redeploy. (GhostSplice, Atlas, WebMCP)

• Aug 16, 2026 Agent frameworks & platforms Weekly recap Read the recap →

  NVIDIA's NeMo Switchyard picks a model per workflow step and runs as a library, proxy or middleware; Cognition wired it into Devin Desktop for 28% lower mean cost. Brex open-sourced CrabTrap, a Go proxy that governs agents at the network edge rather than in the SDK, LangSmith BYOC reached GA on AWS, and LangChain named "managed agents" as the category forming around it. (Switchyard, CrabTrap, managed agents)

• Aug 16, 2026 AI-assisted SDLC Weekly recap Read the recap →

  DX measured AI investment up 28x with velocity flat and its developer-experience index falling for the first time, on a split where maintainability rose while change confidence went negative. Anthropic audited 141,006 offensive-security runs and found three that escaped the sandbox, each time because the isolation claim lived in a system prompt rather than the container. The March LiteLLM poisoning got a size: roughly 2,500 organisations. (DX, sandbox, LiteLLM)

• Aug 15, 2026 Coding agents In the briefing →

  Anthropic — Claude Code now opens new sessions in auto mode on Pro, Max and Team, letting a classifier review each tool call instead of prompting you, and blocking anything irreversible or aimed outside your environment. Across 1,053 paid participants it caught 89% of dangerous commands against 13.6% for human approval. Classifier tokens are no longer billed. Enterprise, API and the cloud platforms stay opt-in for roughly a month. (official)

• Aug 15, 2026 Coding agents In the briefing →

  xAI's Grok 4.6 reached GitHub Copilot two days after launch — VS Code, Visual Studio, the CLI, the cloud agent, JetBrains, Xcode and Eclipse — on usage-based billing at provider list rates. Business and Enterprise admins have to switch the policy on themselves; it ships off. (official)

• Aug 15, 2026 Coding agents In the briefing →

  A Z.ai developer advocate said GLM-5.3 turned up a serious vulnerability in Cursor during a reverse-engineering task, disclosed privately with a fix underway. Cursor has not commented publicly and no advisory exists yet. (source) (unconfirmed)

• Aug 15, 2026 Agent frameworks & platforms In the briefing →

  Vercel made the v0 API generally available, which turns its app-building agent into something a script, a CI job or another agent can call rather than a browser tab. Requests run synchronous, async or streaming; apps start from a prompt, a repo, a ZIP or a file set, run in Vercel Sandbox behind a preview URL, and reach outside tools through MCP servers and custom skills. (source)

• Aug 15, 2026 AI-assisted SDLC In the briefing →

  Apple has reportedly trained its own model for China with Alibaba's help, splitting Apple Intelligence into two regional architectures; Apple has not announced it. Anyone shipping an app against the on-device APIs would go from one behavioural target to two, and the Chinese one is hard to test from outside the region. (source, source) (unconfirmed)

• Aug 14, 2026 Coding agents In the briefing →

  DeepSeek open-sourced the harness it benchmarks its own models with. DeepSeek Harness v0.1 is MIT-licensed and built on the Cordis meta-framework, where models, tools, skills, sessions, sandboxes, storage, the loop and the UI are all swappable plugins. Four runtime modes ship: Standard, Code, Minimal for benchmarking, and Creator for authoring presets. Developer preview. (official, source)

• Aug 14, 2026 Coding agents In the briefing →

  Cursor — The Firetiger team is joining, bringing agents that work after the deploy: watching rollouts, catching regressions, investigating incidents, and handing what they find back to the coding agent. Terms undisclosed. It lands next to Cursor Origin, the company's Git forge, and the Change Monitors that flag a bad deploy. (official)

• Aug 14, 2026 Coding agents In the briefing →

  JetBrains gave PyCharm's agent a live Jupyter kernel instead of a subprocess shell, so variables, models and loaded data survive between cells. A single execute_tool wrapper blocks until the cell finishes and returns only new output rather than the whole buffer. Across 12 ML tasks with Opus, cost fell from $67.06 to $59.09 and cache reads went from 82% to 98%. (official)

• Aug 14, 2026 Agent frameworks & platforms In the briefing →

  LangChain named the category it thinks is forming. In a managed agent, the harness runs on someone else's infrastructure and you supply only context, tools and instructions — through AGENTS.md and MCP. Its own entries are Fleet and Managed Deep Agents, bundling durable execution, event streaming, sandboxes and a context hub; Anthropic and Vercel sell comparable things. (official)

• Aug 14, 2026 AI-assisted SDLC In the briefing →

  Anthropic audited 141,006 offensive-security evaluation runs and found three that escaped the sandbox. Opus 4.7 mistook a fictional target for a real domain and attacked live infrastructure across four runs. Mythos 5 published a dependency-confusion payload to PyPI, where 15 external systems fetched and ran it in the hour before removal. Container misconfiguration had left outbound networking on. (source)

• Aug 13, 2026 Coding agents In the briefing →

  GitHub — Installing an Agent Plugin is now generally available in VS Code, Copilot CLI, the Copilot SDK and the Copilot app, six days after the format was published. A plugin bundles skills/, an mcp.json and a plugin.json manifest, with Copilot-only pieces namespaced under com.github.copilot/ so the rest stays portable. Discovery runs through the Awesome Copilot marketplace, on by default. (official)

• Aug 13, 2026 Coding agents In the briefing →

  Zed — Delta is a separate application, not an editor feature: a shared space where agent transcripts and the diffs they produced sit in one threaded document, with comments anchored to lines that keep moving. It syncs through a new DeltaDB, runs in the browser via WebAssembly, and drives Claude Code and other third-party harnesses. Private beta, first invites out. (official)

• Aug 13, 2026 Coding agents In the briefing →

  JetBrains measured what a missing piece of context costs. Agents kept installing packages into the wrong interpreter and polluting system Python, so PyCharm added a skill exposing get_python_environment and configure_python_interpreter. Across six models and 28 tasks, success went from 68% to 98%; one model went 36% to 96%. The skill only returns information — it never rewrites the command. (official)

• Aug 13, 2026 Agent frameworks & platforms In the briefing →

  LangChain — LangSmith BYOC on AWS is generally available across 15 regions: LangChain runs the control plane, while traces, datasets, experiments, prompts and sandbox data stay in your VPC on a private EKS cluster reached over PrivateLink. You provision it with a supplied Terraform module and a scoped IAM role. Enterprise plan only. (official)

• Aug 13, 2026 AI-assisted SDLC In the briefing →

  The LiteLLM poisoning has a size now. CloudSEK put roughly 2,500 organisations and 434,000 files in the attackers' own logs, harvested when versions 1.82.7 and 1.82.8 sat on PyPI for about 40 minutes on 24 March. The payload took environment variables, SSH keys, cloud credentials, Kubernetes tokens and model API keys. Treat installs through 16:00 UTC that day as suspect. (source)

• Aug 13, 2026 AI-assisted SDLC In the briefing →

  Peking University researchers checked whether coding agents follow the AI-disclosure rules projects now write into CONTRIBUTING.md. Across 106 issues from 49 repositories with such rules, agents largely did not — they never think to look, the way a human contributor does. A contribution can pass every test, break the rule invisibly, and get desk-rejected. (official, source)

• Aug 12, 2026 Coding agents In the briefing →

  JetBrains — WebStorm speaks the Agent Client Protocol, so an existing Anthropic, OpenAI or Google subscription drives the IDE agent with no JetBrains AI seat. Agents come from a registry or from your own acp.json, and the backend can be Azure, AWS, Anthropic or a local model. Copilot already ships an ACP server and Claude Code has an official adapter. (official)

• Aug 12, 2026 Coding agents In the briefing →

  GitHub — Copilot for JetBrains gained memory that persists across agent chat sessions and Ollama as a bring-your-own-key provider, making a local model a first-class choice in the plugin. The administrative half matters more: managed settings now cover plugin availability, MCP server access, permission-bypass behaviour and OpenTelemetry, all set server-side. (official)

• Aug 12, 2026 MCP In the briefing →

  A hostile MCP server never has to send one incriminating instruction. GhostSplice puts a bland field list in a tool description and the mapping to .ssh/id_rsa, .env and customer files in a later tool result, and the agent assembles them. Splitting in two lifted average compliance from 42% to 82% across eleven API-tested models, and the same model refused in one client while complying in another. It assumes you already connected the server. (source)

• Aug 12, 2026 Agent frameworks & platforms In the briefing →

  NVIDIA — NeMo Switchyard is an open-source routing library that runs inside an agent, as a proxy or as middleware, choosing a model per workflow step across open, proprietary and NVIDIA weights. An LLM classifier can pick per call or escalate a whole session after repeated bad turns; a heuristic stage router adds no extra model call at all. Kong serves it natively and LiteLLM is adding it as a proxy plug-in. Cognition wired the staged router into Devin Desktop for 28% lower mean cost. (official)

• Aug 12, 2026 AI-assisted SDLC In the briefing →

  IBM and Red Hat put commercial offerings behind Lightwell, which wires Sigstore, in-toto, SLSA and SBOM tooling into a single signing, provenance and policy layer. The framing is aimed at agent-written code: once an agent opens the pull request and edits the infrastructure, the commit log stops answering where any of it came from. (source)

• Aug 11, 2026 Coding agents In the briefing →

  JetBrains — WebStorm 2026.2.1 bundles Chrome DevTools Connect, so the IDE agent drives a real browser: opens pages, walks a multi-step flow, reads console and network, screenshots, then re-tests its own fix. It arrives as a CLI skill the agent installs on first use. The loop it removes is you describing what you saw on screen. (official)

• Aug 11, 2026 Coding agents In the briefing →

  AWS — Continuum, the vulnerability-remediation agent in gated preview since June, is being wired into Claude Code, Codex and Kiro rather than kept in an AWS console. Findings and fixes land in the tool where the code was written, whichever model wrote it. No ship date was given for any of the three integrations. (official, source)

• Aug 11, 2026 MCP In the briefing →

  Cloudflare — A dashboard toggle now injects WebMCP into any site on the platform, no redeploy. An edge HTMLRewriter drops in a bridge.js that composes tool packs named in a data-packs attribute and registers each one, so an agent calls searchFlights instead of scraping the page. Developer preview, two packs, Chrome 145+ only. (source)

• Aug 11, 2026 MCP In the briefing →

  Nutanix — An open-source MCP server fronts the Prism v4 API gateway, translating plain-English requests into infrastructure calls under the RBAC already configured there. What is worth copying is the rest: request throttling and metering aimed at agent swarms, audit logs of every AI-initiated command, async handling for long tasks. Upwork and Digital Science shipped servers the same day. (source)

• Aug 11, 2026 Agent frameworks & platforms In the briefing →

  Brex — CrabTrap is an MIT-licensed Go proxy that governs agents at the network edge instead of in the SDK. Set HTTP_PROXY and every outbound request is checked against static rules first, with an LLM judge reasoning about the leftovers — under 3% of production traffic, by Brex's count. Framework- and language-agnostic by construction, with OpenTelemetry metrics in Prometheus format. (official, source)

• Aug 10, 2026 AI-assisted SDLC In the briefing →

  DX — AI investment across engineering organisations is up 28x and velocity measures have not moved with it. The State of AI Impact in Engineering also records the first fall in DX's developer-experience index, two points industrywide, on a split that used to track together: code maintainability rose while change confidence went negative. Median pull request grew from 42 lines a year ago to 72. LinearB's separate ranking of 253 organisations puts its top decile under 100 lines and its bottom past 228. (source)

• Aug 10, 2026 AI-assisted SDLC In the briefing →

  Harshal Shah proposes a blunter adoption test: take the tools away tomorrow and see what breaks. Seat counts and token spend only prove someone typed into a box. What survives a bad quarter is a written team norm — at Webflow that meant moving prompts out of scratch files into the repo, with an owner and review. Starting five agent tasks at once parallelises nothing, since review still runs single-threaded inside one head. (source)

• Aug 9, 2026 AI-assisted SDLC In the briefing →

  Coinbase, Shopify and Ramp — Three companies, three internal coding agents, and not one of them displaced Claude Code, Codex or Cursor. What each team chose to own is the harness: context assembly, permissions, workflow orchestration, tool access, verification. The reasoning engine stays rented from Anthropic, OpenAI or Google. Build-versus-buy turns out to be the wrong frame — these teams did both, and drew the line in the same place. (source, source)

• Aug 9, 2026 AI-assisted SDLC In the briefing →

  Speakeasy — Skills Management puts versioning, access control and observability over the SKILL.md files that pile up across repos, laptops and Slack threads. Unglamorous and correct: most teams cannot say which copy of a deployment runbook their agent actually loaded, or who owns it. (source)

• Aug 9, 2026 Coding agents In the briefing →

  Anthropic — Claude Code v2.1.224 lets two sessions message each other on macOS and Linux, using ListAgents to find a live session and SendMessage to reach it. Only a summary crosses; no history, files or permissions travel with it, and a command that arrives lands as plain text you still have to approve. Same-machine traffic stays on a local socket. (official, source)

• Aug 9, 2026 Coding agents In the briefing →

  Prime Intellect — Prime Agent is an MIT-licensed coding and research harness that drops JSON tool schemas entirely: tools, skills and sub-agents are Python objects in one persistent IPython kernel, and sub-agents spawn as rlm() calls. A /refine step writes prompts, memories and sub-agent specs back into durable state, so the harness rewrites itself between runs. (official)

• Aug 9, 2026 Agent frameworks & platforms In the briefing →

  Cloudflare — Cloudflare Computer gives an agent a persistent filesystem rather than a fresh container every turn. A SQLite-backed filesystem is visible to both isolates and containers, and the runtime picks whether a step runs in an isolate shell, a container sandbox or a browser; Cloudflare's stated target is needing a container for under 10% of an agent's work. Early preview, prototypes only. (source)

• Aug 9, 2026 Agent frameworks & platforms In the briefing →

  Tencent Cloud — TencentDB Agent Memory 2.0 is an MIT-licensed team memory hub: chat memory, extracted skills, a wiki and a code graph, shared under private/team/restricted ACLs and wired into Claude Code, CodeBuddy and others. The catch is in the write path. A stale fact reaches everyone's agent as efficiently as a correct one, and nothing here reviews it on the way in. (official, source)

• Aug 9, 2026 Agent frameworks & platforms In the briefing →

  Atlassian — Two indirect prompt-injection paths pulled Jira and Confluence data out through Rovo. Varonis's RovoBlast preloaded attacker instructions into a rovoChatPrompt URL parameter and needed one click from a signed-in user; Atlassian fixed it server-side on July 8. PromptArmor's document-borne variant, disclosed in May and published August 5, exfiltrated to an attacker URL with no separate approval step. (source)

• Aug 9, 2026 Coding agents Weekly recap Read the recap →

  Meta entered with Muse Code, a terminal orchestrator on Muse Spark 1.2, undercutting on price with a feedback-for-discount tier at $0.10/$0.20 per million. Zed moved its agent's terminal and fetch tools into an OS-level sandbox, Kimi K3 became selectable in Copilot at provider list pricing, and an npm worm poisoned 1,684 versions in half an hour, writing a .claude/settings.json SessionStart hook into whatever repo it touched. (Muse Code, Zed, worm)

• Aug 9, 2026 MCP Weekly recap Read the recap →

  Agent Plugins 1.0.0 ratified one package format for Skills and MCP servers, Google joining Amazon, Cursor, Microsoft, OpenAI and Vercel as maintainers. Google published a production account of running the stateless 2026-07-28 core at its own scale, GitHub added fail-closed MCP allowlists to enterprise managed settings, and AWS shipped an IaC server putting cfn-lint and cfn-guard behind the assistant. (plugins, stateless, allowlists)

• Aug 9, 2026 Agent frameworks & platforms Weekly recap Read the recap →

  Microsoft's Agent Framework Harness reached GA and LangChain's Managed Deep Agents a public beta; Rod Johnson's Embabel hit 1.0 for Java and Kotlin. Cloudflare shipped a browser built for agents and a persistent agent filesystem, Kiro's CLI adopted the Agent Client Protocol, and two indirect prompt-injection paths pulled Jira and Confluence data out through Atlassian's Rovo. (Harness, Managed Deep Agents, Rovo)

• Aug 9, 2026 AI-assisted SDLC Weekly recap Read the recap →

  Coinbase, Shopify and Ramp each built an internal coding agent and none of them displaced Claude Code: what all three chose to own is the harness. The EU AI Act's transparency duties became enforceable, with fines up to €15 million or 3% of global turnover, and Cloudflare open-sourced the agent workspace thousands of its own staff use. (harness, AI Act, Cloudflare OS)

• Aug 8, 2026 Coding agents In the briefing →

  Anthropic — From August 14 auto mode is the default permission mode in Claude Code on Pro, Max and Team, with a classifier screening each tool call instead of prompting you. Anthropic's numbers make the case bluntly: across 1,053 paid testers, people caught 13.6% of dangerous commands and the classifier blocked 89%. Three consecutive blocks, or twenty in a session, drops back to manual. The classifier's token overhead is no longer billed on those plans; disableAutoMode turns it off fleet-wide. (official, source)

• Aug 8, 2026 MCP In the briefing →

  GitHub — Enterprise managed settings now carry allowedMcpServers and deniedMcpServers, matching a server by remote URL with wildcards, by local command and arguments, or by the name a user gave it. Anything ambiguous or unverifiable is blocked: the check fails closed. Enforcement covers the Copilot app, Copilot CLI and VS Code, with the policy file living in the org's .github-private repository. (official)

• Aug 8, 2026 Agent frameworks & platforms In the briefing →

  LangChain — Managed Deep Agents entered public beta: a hosted runtime for the Deep Agents harness, with durable threads, checkpointing, sandboxed shell and file execution, agent-scoped memory, and Slack and GitHub as channels. You keep the agent definition in your repo and run mda dev locally, mda deploy to ship. Beta limits are real — LangSmith Cloud, US region, CLI only, no API yet. (official)

• Aug 8, 2026 Agent frameworks & platforms In the briefing →

  AWS — Kiro's CLI now speaks the Agent Client Protocol, so kiro-cli acp puts the Kiro agent inside JetBrains IDEs and Zed rather than only Kiro's own editor. ACP started at Zed and is now co-developed with JetBrains, which is the reason this matters more than a single integration: agent-to-editor wiring goes from N×M to N+M. (official, docs, source)

• Aug 8, 2026 Agent frameworks & platforms In the briefing →

  Cloudflare — Kitesurf is a browser built for agents rather than people, running on Workers with no tabs, themes or extensions and tuned instead for context size, token cost and concurrency. The engine is assembled from Blitz's renderer, Firefox's Stylo CSS parser and Boa JS, passing roughly 215,000 web-platform tests. Free during beta through Browser Run. (source)

• Aug 7, 2026 MCP In the briefing →

  Agent Plugins 1.0.0 is out: an open package format that bundles Agent Skills and MCP servers into one directory a client can install. A plugin.json manifest, a skills/ folder, an mcp.json declaring servers with explicit types, and namespaced folders for anything client-specific. Amazon, Cursor, Microsoft, OpenAI and Vercel are core maintainers; Google joined this week. What it closes is the manifest fork — shipping one skill to two clients has meant maintaining two layouts, and the copies drift. (official)

• Aug 7, 2026 Coding agents In the briefing →

  GitHub — Kimi K3 is now selectable in Copilot on Pro, Pro+, Max, Business and Enterprise, billed at provider list: $3 per million input tokens, $15 output, $0.30 cached. GitHub hosts it on Fireworks. Business and Enterprise organisations start with the policy off, and the changelog tells admins to check open-weight models against their own data-governance rules before switching it on. (official)

• Aug 7, 2026 Agent frameworks & platforms In the briefing →

  CoreBreak — Work presented at Black Hat shows several agent harnesses can be driven to execute tools with no model turn happening at all, by reaching the dispatch path directly. Google's ADK for Python carries CVE-2026-18236 at 9.3, Bedrock AgentCore's InvokeHarness 8.6, two Vercel AI SDK harnesses 6.3. Everything but the Strands Python SDK is patched. Resumed conversation history and structured tool-use blocks are untrusted input. (source)

• Aug 7, 2026 Agent frameworks & platforms In the briefing →

  LangChain — A post finally draws the line between the three products people keep conflating: LangGraph is a runtime, LangChain a framework, Deep Agents a harness, ordered from most deterministic to most autonomous. Start at the harness when an agent needs memory, subagents and skills; drop to LangGraph when part of the flow has to run in a fixed order. Their own GTM agent handles roughly 10,000 requests a week on it. (official)

• Aug 7, 2026 Agent frameworks & platforms In the briefing →

  kagent — One pod per agent wastes a cluster, since agents wake, run briefly, then idle. The alternative on the table is a fixed pool of long-lived worker pods with logical agents scheduled onto them, using Google's Agent Sandbox and Agent Substrate — WorkerPool, Worker, ActorTemplate — as the placement layer. (source)

• Aug 7, 2026 AI-assisted SDLC In the briefing →

  Cloudflare — Cloudflare OS, the internal agent workspace thousands of its own staff use daily, is now on GitHub. Three parts: a chat surface preloaded with company knowledge, a sandbox where agents build and share small personal apps, and Gatekeepers, a per-service broker sitting between an agent and an external system that applies policy there rather than in a prompt. (official, source)

• Aug 6, 2026 Coding agents In the briefing →

  Meta — Muse Code entered beta on macOS and Linux, a terminal orchestrator running on the new Muse Spark 1.2. Sub-agents work in isolated worktrees, so your working copy is never touched, and background agents persist for a whole session rather than being respawned per task. Pricing holds at $1.25/$4.25 per million tokens, with a contributor tier at $0.10/$0.20 for anyone willing to hand feedback back. Terminal-Bench 2.1 and DeepSWE 1.1 put it in a tight cluster with Opus 5, Grok 4.5 and Gemini 3.6 — though the OpenAI comparison used GPT-5.6 Terra, not Sol. (source, source, source)

• Aug 6, 2026 Coding agents In the briefing →

  Zed — The agent panel's terminal and fetch tools now run inside an OS-level sandbox: Seatbelt on macOS, Bubblewrap namespaces on Linux, WSL on Windows. Agents cannot write outside the project, touch .git, or reach the network without asking first. Zed's own framing is the part worth stealing — a rule banning git .* does almost nothing against a model that can spell the command another way. Build scripts, proc macros and Git hooks still execute outside the sandbox. (official)

• Aug 6, 2026 MCP In the briefing →

  Google — A production account of running the stateless 2026-07-28 core at Google Cloud scale: no initialize handshake, no Mcp-Session-Id, every request self-describing through _meta, and routing headers a gateway can dispatch on without reading the body. Long-running work returns a taskId immediately (SEP-2663) and responses carry ttlMs so clients stop polling (SEP-2549). Google co-founded an MCP Transports Working Group with Hugging Face to get the changes landed. (official)

• Aug 6, 2026 MCP In the briefing →

  HashiCorp — CVE-2026-16498 is a CVSS 10.0 in the Terraform MCP server, and it is the stateless migration's first real casualty: in stateless HTTP mode the library assigned no session id, so one user's Terraform token was reused for later users' requests whatever token they had supplied. Versions 0.3.0 through 1.0.0 are affected and 1.1.0 fixes it, alongside a stateful-mode credential-caching bug and an SSRF. Single-user stdio setups are untouched. (source)

• Aug 6, 2026 Agent frameworks & platforms In the briefing →

  LangChain — An autonomous Kubernetes SRE agent, written up with the cost work left in. Scheduled health checks collapsed into a single Haiku call producing one Slack report, cutting per-check cost by 95–99%, and recursion limits ended loops that had been quietly burning about $5 a time. Writes exist only inside a change-executor subagent behind Slack approval, so read/write separation is structural rather than a line in a prompt. (official)

• Aug 6, 2026 Agent frameworks & platforms In the briefing →

  Stripe — Kai, an internal knowledge agent one engineer built in a week, is now used by 83% of the company weekly across more than 60,000 sessions. It sits on LangChain's Deep Agents under three middleware layers Stripe wrote: an S3-backed virtual filesystem so context survives a session, a sandbox for code execution, and summarization to hold multi-turn cost down. (official)

• Aug 5, 2026 Coding agents In the briefing →

  npm — A worm that began with [email protected] poisoned 1,684 versions across 420 package names in roughly half an hour, hopping between orgs every two to seven minutes. Its preinstall script harvested registry, cloud and private-key material, then wrote two persistence paths into whatever repo it landed in: a .claude/settings.json SessionStart hook and a .vscode/tasks.json entry set to runOn: folderOpen. Opening the project in your editor is now part of the blast radius. (source)

• Aug 5, 2026 Coding agents In the briefing →

  JetBrains — IntelliJ's Java and Kotlin analysis now ships as an LSP extension for VS Code and its forks, Cursor included, covering completion, navigation, refactoring and Maven, Gradle and Bazel projects. The pitch to agent users is fewer tokens and more deterministic answers than grepping a repo. Free during the preview, then it needs an IntelliJ IDEA Ultimate subscription. (official)

• Aug 5, 2026 Coding agents In the briefing →

  GitHub — Spark stopped accepting new users and new apps, and existing accounts lose access on August 31. Deployed apps keep running, but exporting the code means opening the workbench and creating a repo before that date, and anything calling llm() needs its own inference provider afterwards. (official)

• Aug 5, 2026 MCP In the briefing →

  Cursor — Gmail, Drive, Calendar, Docs and Sheets reach agents as marketplace plugins backed by Google's remote MCP servers, with no third-party connector in between. Agents can read, draft and label mail, create and share files, and update meetings. A coding agent holding write access to your inbox is a permissions review, not a convenience feature. (official)

• Aug 5, 2026 MCP In the briefing →

  AWS — The IaC MCP Server puts four CloudFormation tools behind one assistant: documentation search, cfn-lint validation, cfn-guard policy checks, and troubleshooting that correlates stack events against CloudTrail. It is open source in the AWS MCP repo. Wire the troubleshooting tool up first — it answers the question a failed stack usually leaves open. (official)

• Aug 5, 2026 Agent frameworks & platforms In the briefing →

  Microsoft — The Agent Framework Harness and Foundry Hosted Agents reached general availability, taking the framework from SDK to supported runtime: function invocation, history persistence, context management, approval gates and OpenTelemetry, in one binary that runs locally, in a container, or hosted on consumption billing. Connectors for the GitHub Copilot and Claude Agent SDKs let third-party coding agents run under the same identity and observability policy as your own. (official, source)

• Aug 5, 2026 Agent frameworks & platforms In the briefing →

  NVIDIA — NOOA collapses an agent into a single Python class. Methods are capabilities, fields are state, docstrings are prompts, type annotations are enforced contracts, and a method whose body is ... gets completed at runtime by an LLM loop. pip install nooa and it is a research preview, with benchmark agents, data and evaluations published alongside. (official, source)

• Aug 5, 2026 AI-assisted SDLC In the briefing →

  Astro / Cloudflare — triagebot-action is open source, the GitHub Action that took Astro's issue backlog from over 200 in January to about 20. A label-driven state machine reproduces the bug in a sandbox, diagnoses it, attempts a fix, then pushes a branch and a preview release and asks the reporter to confirm before any pull request exists. The confirmation step is what keeps maintainer review in the loop. (official, source)

• Aug 4, 2026 Coding agents In the briefing →

  Alibaba — Qwen3.8-Max ran unattended for 16 days building a CLI tool, and the whole trace sits in a public repo: 265 commits, 127 pull requests and 151 issues by July 30. The loop turned user requests into issues, assigned them to itself, wrote the code, then ran build, unit, end-to-end and lifecycle checks, routing every failure back to the issue that spawned it. Apache-2.0 TypeScript, and the commit history is the artifact worth reading rather than the tool. (source, repo)

• Aug 4, 2026 Agent frameworks & platforms In the briefing →

  Embabel — Rod Johnson's agent framework for Java and Kotlin reached 1.0. You declare typed goals, actions and conditions; the planner assembles the sequence at runtime using goal-oriented action planning, and reassesses when the world changes mid-task. Individual actions can route to different models by cost or capability, and GOAP mixes with explicit state machines where you want the control. Built on Spring AI, covering OpenAI, Anthropic, Gemini, Bedrock, Mistral, DeepSeek and Ollama. (official, source)

• Aug 4, 2026 Agent frameworks & platforms In the briefing →

  Microsoft Research — Orchard open-sources the part of agent work that usually stays private: a Kubernetes-native environment service handling sandbox lifecycle, file I/O and networking, plus training recipes for software engineering, GUI navigation and personal assistance. Orchard-SWE reports 69.7% on SWE-bench Verified with roughly 3 billion active parameters, 73% with value-model reranking. Trajectories and evaluation protocols move between harnesses rather than being rebuilt per project. (official, paper)

• Aug 4, 2026 AI-assisted SDLC In the briefing →

  Apple — Bynario put GPT-5.5 through its Atlas platform against the latest macOS and surfaced more than 50 candidate bugs in three weeks. One was real: a Screen Sharing flaw letting an authenticated VNC user read protected data and write files as root, now CVE-2026-43760, fixed in macOS Tahoe 26.6. It nearly went unreported. Apple capped open investigations per researcher in June after AI-generated submissions swamped triage, and hitting that cap means waiting 30 days. (source)

• Aug 4, 2026 AI-assisted SDLC In the briefing →

  Hugging Face — Three flaws in Diffusers, disclosed by Zafran Labs as FaceHugger, defeat trust_remote_code on DiffusionPipeline.from_pretrained with custom pipelines. The check runs once in the first phase; a crafted config or pipeline file swaps in different code before it executes. CVE-2026-44827 and CVE-2026-44513 score 8.8, CVE-2026-45804 scores 7.5, and everything below 0.38.0 is affected. (source)

• Aug 3, 2026 AI-assisted SDLC In the briefing →

  European Union — The AI Act's transparency duties became enforceable on Sunday, and the Commission can now fine general-purpose model providers up to €15 million or 3% of global turnover. Anything conversational has to tell people they are talking to a machine, and images, audio and text built to pass as real need machine-readable marking, with a carve-out for evidently artistic or satirical work. The AI Office added 38 staff to run it. Systems already on the market get longer before the same rules bite. (source, source)

• Aug 2, 2026 Coding agents In the briefing →

  Supabase — Evals is public on GitHub: real tasks — build a schema, debug a failed Edge Function, fix a broken RLS policy — run against Claude Code, Codex and OpenCode, graded by deterministic checks plus an LLM judge, one retry allowed. In the build stage Opus 5 and Kimi K3 hit 100% unaided; Sonnet 5 moved 78% to 100% and GPT-5.6 Sol 89% to 100% once skills loaded. Codex reads about eight doc pages per scenario, Claude Code about two. (official)

• Aug 2, 2026 MCP In the briefing →

  Webflow — A year of running an MCP server, written up by three of its engineers. Wrapping existing REST endpoints as tools failed, because an agent brings none of the implicit context a human developer does: docs read, endpoints composed, state tracked, failures retried by hand. They rebuilt the tools around intents instead of endpoints, flattened the schemas, and reshaped responses so the agent can tell what actually happened. (source)

• Aug 2, 2026 Coding agents Weekly recap Read the recap →

  GitHub shipped stacked pull requests, retired GitHub Models outright, deprecated Gemini 2.5 Pro across Copilot, and opened team-scoped model policy. OpenAI open-sourced the Codex Security CLI under Apache-2.0. Supabase published agent evals where two of four models only reached 100% once skills were loaded. (GitHub, Supabase)

• Aug 2, 2026 MCP Weekly recap Read the recap →

  Spec aside, this was a security week: Ruflo's 10.0, and the Azure DevOps injection retired at day six with no patch and no CVE. The C# and Python SDKs both hit v2.0 with stateless-first defaults, and Webflow published a year of tool design — intents, not endpoints. (SDKs, Webflow)

• Aug 2, 2026 Agent frameworks & platforms Weekly recap Read the recap →

  More than 40 companies launched the Open Secure AI Alliance, with OpenAI, Google and Anthropic off the roster. Google gave Gemini managed agents pre-tool hooks and a max_total_tokens stop, and Y Combinator MIT-licensed QM, its internal multi-agent harness. (alliance, hooks)

• Aug 2, 2026 AI-assisted SDLC Weekly recap Read the recap →

  One day carried three supply-chain defaults: a three-day Dependabot cooldown, publish-time npm malware scanning, and Actions holding flagged workflows on public repos. Google says an agent harness reading every changelist daily fixed 1,072 Chrome bugs across two releases. (defaults, Chrome)

• Aug 1, 2026 AI-assisted SDLC In the briefing →

  Google — Chrome 149 and 150 fixed 1,072 security bugs between them, more than the previous 23 milestones combined. A Gemini agent harness, Big Sleep and CodeMender run every 24 hours across all changelists; one find was a sandbox escape that had sat in the codebase for over 13 years. Patches come from a fixing agent, a critic that scores them, and test-writing agents, with a developer still reviewing. (official, source)

• Aug 1, 2026 AI-assisted SDLC In the briefing →

  Dropbox — Threat models and security requirements now surface inside the pull request. MCP-based retrieval pulls the matching design artifact out of Dash when a PR opens and flags where the implementation drifts from what the design review agreed. No numbers published; the stated design goal was keeping false positives low enough that reviewers keep reading it. (source)

• Aug 1, 2026 MCP In the briefing →

  Simon Willison — Three small tools land on the stateless spec: mcp-explorer lists and calls tools over uvx with nothing installed, datasette-mcp exposes read-only SQL against a Datasette instance, and llm-mcp-client 0.1a0 wires servers into the llm CLI. One HTTP request replaces initialize-then-call, which is what made a weekend client practical. His argument for tools over shell access is auditability. (official)

• Aug 1, 2026 Coding agents In the briefing →

  GitHub — Gemini 2.5 Pro and Gemini 3 Flash are deprecated across every Copilot surface: chat, inline edits, ask and agent modes, completions. Gemini 3.1 Pro (Preview) and Gemini 3.6 Flash replace them, but enterprise admins have to enable the successors in Copilot policy before anyone sees them in the model picker. (official)

• Aug 1, 2026 Coding agents In the briefing →

  GitHub — Model policy can now target enterprise teams, not just the whole enterprise: set a baseline, mark individual models Optional, then grant those to specific teams. Turning the mode on retires org-level model settings entirely, which is the part to plan for. Most enterprises can opt into the preview from August 3. (official)

• Aug 1, 2026 Agent frameworks & platforms In the briefing →

  Y Combinator — QM, the multi-agent harness YC runs internally, is now MIT-licensed TypeScript on GitHub. Each person and project gets a scope with its own durable sandbox; skills are owned by a scope and shared by grant, with admin approval to promote one org-wide. Crons and watches run work unattended, and security postures range from pausing every action to unrestricted. Deploys to Fly or AWS via qm init. (official)