← Building with agents

Building with agents

September 2026

• Sep 30, 2026 Coding agents In the briefing →

  Sign in with ChatGPT now lets Plus and Pro subscribers spend their plan allowance inside third-party tools instead of paying for tokens there. The 16 launch partners include Amp, Devin, Warp, Kilo Code, OpenCode, Notion and Vercel, with per-partner caps on how much each can consume. (official, source)

• Sep 30, 2026 Coding agents In the briefing →

  JetBrains launched Air Teams for business customers: shared cloud environments with credentials and dependencies set up once, parallel cloud tasks, and Automations that run code review, issue fixes or dependency updates on a schedule or event rather than a person's prompt. Individual plans come later. (official)

• Sep 30, 2026 MCP In the briefing →

  OpenAI said it backs the proposed MCP Events specification, so ChatGPT automations can fire on events from connected apps rather than only on a schedule. Plugins also get a sidebar home, interactive panels and a Plugin Creator, and users now approve each plugin's access needs individually. OpenAI did not say which plans get the automations. (official, source)

• Sep 30, 2026 Agent frameworks & platforms In the briefing →

  Google published a working guide to graph workflows in ADK, rebuilding a single refund agent as nodes: three lookups fanned out in parallel, a join, a policy router, and a human-review pause. It also covers when a static graph fits and when to let Python schedule work as results arrive. (official)

• Sep 30, 2026 AI-assisted SDLC In the briefing →

  CodeScene had coding agents refactor a 300,000-line decompiled C game over three weeks for about $4,000 in tokens: 2,903 commits, merged to a fork's main through 54 pull requests. Two things carried it — a deterministic code-health score over MCP, and a replay harness comparing game state frame by frame after every change. The team found Claude Code with Opus better than Codex with Sol at recording reusable refactoring recipes. (source)

• Sep 29, 2026 Coding agents In the briefing →

  GitHub added Claude Sonnet 5.5 to Copilot on Pro, Pro+, Max, Business and Enterprise, including the coding agent and CLI. It rolls out gradually, and it is on by default unless an admin's model policy says otherwise. (official)

• Sep 29, 2026 MCP In the briefing →

  Shopify is rolling out three WebMCP tools to eligible merchant storefronts — get_checkout, update_checkout and complete_checkout — so a browser-based agent can read the checkout page, change the address or delivery option, and submit the order with the buyer's authorization. It sits on the Universal Commerce Protocol. Shopify hasn't yet said how agents identify themselves or how merchants opt out. (source)

• Sep 28, 2026 MCP In the briefing →

  Cycode disclosed an account takeover in the official MCP Python SDK: a malicious MCP server can force the client's OAuth flow onto a fallback path with no audience binding, then collect the client secret, authorization code and PKCE verifier and log in as you. It affects mcp 1.9.1–1.29.1 and 2.0.0–2.1.1 across all three OAuth providers, rated CVSS 7.5. Upgrade to 2.2.0 or 1.30.0, pass issuer= to the client-credentials and JWT providers, clear stored registrations, and rotate secrets for any client that may have reached an untrusted server. (official)

• Sep 28, 2026 Agent frameworks & platforms In the briefing →

  NVIDIA open-sources OpenShell (Apache 2.0), a runtime that sandboxes an agent with kernel-level isolation, traces every action and can enforce policy over the files, network, tools, processes and credentials it reaches — outside the model and the harness. The paired Sentry design runs an out-of-band watchdog on BlueField-4 DPUs that can quarantine an agent in milliseconds. OpenShell is tuned for Vera CPUs but also runs on other hardware; more than 100 organisations back it, including Anthropic, SAP and Salesforce. (official, official, source)

• Sep 27, 2026 Coding agents In the briefing →

  Docker's Cloud Sandboxes run coding agents in microVMs on Docker's own infrastructure, and sbx move my-project --to cloud carries a local sandbox's filesystem across so a long task can keep going after the laptop closes. Docker frames it around agent sessions now lasting 5 to 21 hours. Kits v3 turns preconfigured sandboxes into ordinary OCI images you can build and pull. Commenters on the launch raised the open question: isolation does nothing for the external services a useful agent still has to reach. (source)

• Sep 27, 2026 Coding agents In the briefing →

  GitHub's agentic autofix now writes each successful security fix into Copilot Memory, where code review and the cloud agent can reuse it as a repository convention. Both features are in public preview and apply only where Memory is enabled. (official)

• Sep 27, 2026 MCP In the briefing →

  Anthropic opened a submission portal for the Claude directory, open to developers on any paid Claude plan. Submit a remote MCP server as a single connector, or a plugin bundle of MCP servers and skills from a GitHub repo; each entry is auto-validated, safety-scanned and reviewed, and the publisher picks when it goes live. Listings get analytics on views, search terms and installs by product surface and version. Free-plan accounts cannot publish, and the post says nothing about install eligibility. (official)

• Sep 27, 2026 MCP In the briefing →

  Gemini added 14 connected apps, among them Airtable, Linear, monday.com, Adobe, Webflow and Peloton. Google named no plan or account-type limits. (official)

• Sep 27, 2026 Coding agents Weekly recap Read the recap →

  Researchers disclosed two since-patched Codex sandbox escapes that turned opening someone else's repository into code execution on your machine. Gemini CLI 0.61.0 now asks before touching any build file, Copilot's app got local sandboxing off by default, and from 22 October Copilot code review and MCP servers switch on by default for Business and Enterprise. (Codex, Gemini CLI, sandboxing, defaults)

• Sep 27, 2026 MCP Weekly recap Read the recap →

  The Bifrost gateway shipped with management auth off, and one request registering a stdio MCP client ran commands on the host (CVE-2026-90898, 9.8). OX Security found expired domains behind public MCP registry entries for sale at $4–12, AWS wrote up what the stateless spec lets you delete, and Anthropic opened Claude directory submissions to paid-plan developers. (Bifrost, OX, stateless, directory)

• Sep 27, 2026 Agent frameworks & platforms Weekly recap Read the recap →

  Microsoft split Foundry hosted-agent isolation into separate user and session controls, and shipped CodeAct and GA Routines that run as their creator's identity or their own. AWS added skill-selection and step-following checks to Strands Evals, and LangSmith Engine v2 replays a flagged input before trusting it. (isolation, CodeAct, Routines, Strands Evals, Engine)

• Sep 27, 2026 AI-assisted SDLC Weekly recap Read the recap →

  Alibaba's Open Code Review claims better precision than Claude Code at a ninth of the tokens, though an independent run landed near 12%. A study of 1,248 agentic workflow files found only 9.4% mention prompt-injection defence, and roughly 16,000 Supabase databases are exposing personal data from apps whose builders never set access control. (Open Code Review, workflow files, Supabase)

• Sep 26, 2026 Coding agents In the briefing →

  Microsoft rebuilt the Copilot app around three surfaces. Home folds Chat, Cowork and Office editing into one starting point. Code builds apps and workflows from a description, on the same technology as GitHub Copilot and sandboxed inside the tenant. Autopilot is a named agent with its own identity that watches channels and picks work back up days later. Anything built in Code, Cowork or Copilot Studio runs on a new Copilot Managed Runtime inside Microsoft 365. Home and Code reach the Frontier programme first; Autopilot enters private preview this month. (official, source)

• Sep 26, 2026 Coding agents In the briefing →

  Codex was down for 56 minutes from 22:58 UTC — web, API, CLI and the VS Code extension together. OpenAI's status note offered one workaround while it lasted: sign in with an API key instead of an account. (official)

• Sep 26, 2026 MCP In the briefing →

  The July spec removed protocol-level sessions, and AWS has now written down what that means for anyone running a server on it: retire sticky routing for plain round-robin, delete the DynamoDB or ElastiCache store that existed only to hold MCP state, and treat Lambda as an ordinary target rather than a workaround. Caching moves into the protocol through ttlMs and cacheScope. Legacy clients are the catch — session infrastructure has to stay until traffic on the 2025-11-25 revision reaches zero, so pick a sunset date now. (official, source)

• Sep 26, 2026 AI-assisted SDLC In the briefing →

  Roughly 16,000 Supabase databases are handing names, addresses, phone numbers and passwords to anyone who asks. TechCrunch ties the pattern to vibe-coded apps whose builders never configured access control; Supabase's CISO says projects are secure by default and configuration is a shared responsibility. Both statements can hold at once, which is the uncomfortable part — an app that works is not an app that is closed, and nothing in a green build says otherwise. (source)

• Sep 25, 2026 Coding agents In the briefing →

  Gambit Security traced a five-day crime spree run almost entirely by open source agents. Hermes orchestrated the campaign, Strix scanned 146 times in deep mode, and Cairn opened 105 exploitation projects against the results. At least 27 companies were breached between 10 and 15 September — a Fortune 500 hospitality chain, a major US airline, an industrial distributor — and two of them lost over 600,000 card records. Model access through OpenRouter came to $12,000–18,000, a mean of $25.46 a scan, with exploitation usually landing within hours. (source)

• Sep 25, 2026 Coding agents In the briefing →

  Gemini CLI 0.61.0 stops to ask before it touches a build file. Edits to package.json, Makefile, pyproject.toml or BUILD files, the build and test commands that follow them, and any shell argument drawn from a web fetch, an MCP response or a Google Doc all need a fresh confirmation, and none can be waved through with a standing "always allow". The sandbox also stops exposing host credentials and OAuth tokens to sandboxed processes. (source, official)

• Sep 25, 2026 Coding agents In the briefing →

  Cursor shipped Rollouts, an agent that follows a change from pull request into production. It posts a monitoring plan as a PR comment, checks post-deploy logs, metrics and traces against that plan, and returns one of three verdicts — verified healthy, regression detected, inconclusive — optionally opening a revert PR or handing the fix to a cloud agent. Teams and Enterprise plans only, alongside a per-repo security reviewer. (official, source)

• Sep 25, 2026 Coding agents In the briefing →

  From 22 October, generally available Copilot features — Copilot code review and MCP servers among them — switch on by default for Copilot Business and Enterprise. Explicit admin choices survive and previews stay opt-in, so the change lands on organisations that never set the new AI Controls policy either way. (official)

• Sep 25, 2026 MCP In the briefing →

  OX Security resolved the hostnames behind 15,465 MCP servers across three public registries. Of 5,095 unique hosts, 15.6% sit outside the US, 19 of them in China and 18 in Russia; 0.45% are proxied through home networks and consumer tunnels; 2.3% no longer resolve at all, and six of those domains can be bought for $4–12 a year by anyone willing to answer as the server that used to be there. (source)

• Sep 25, 2026 Agent frameworks & platforms In the briefing →

  LangSmith's Engine v2 replays an offending input through your agent to confirm a flagged issue is real, then tests the proposed fix against your eval set before you ship it. Detection widens past correctness into error rate, latency, cost and repetitive tool calls, and a red-teaming pass now runs ahead of deployment rather than after the first incident. (official)

• Sep 25, 2026 Agent frameworks & platforms In the briefing →

  Microsoft Agent Framework added CodeAct, which lets a model emit a short program instead of picking tools one call at a time — early measurements put it at roughly half the latency and 60% fewer tokens. The same release brings AG-UI event streaming for agent progress, a FoundryMemoryProvider that carries memory across conversations, and workflow checkpointing so an interrupted run can reconnect. (official)

• Sep 25, 2026 Agent frameworks & platforms In the briefing →

  Routines in Microsoft Foundry reached general availability — agents that fire on a timer, on a recurrence, or on a GitHub issue or Teams message, with a preview reminder tool an agent can use to schedule its own next run. Each routine runs as either the creator's identity or its own. (official)

• Sep 25, 2026 AI-assisted SDLC In the briefing →

  InfoQ names the thing teams keep rebuilding from scratch: the agent harness, everything wrapped around the model — memory, tools, retrieval and orchestration on the build side, observability, guardrails and scaling on the run side. The choice splits two ways, a managed runtime such as AgentCore or Foundry against a stack you assemble on your own cluster, and the article is plain that you are trading speed to market for portability. (source)

• Sep 24, 2026 Coding agents In the briefing →

  The GitHub Copilot app picked up local sandboxing in public preview — per-project denied and read-only folder lists, outbound network controls, and a setting that keeps Git and GitHub CLI credentials out of the agent's reach. It covers local repository and working-tree sessions only, not cloud sandboxes or remote hosts, and ships off by default; /sandbox on enables it mid-session. (official)

• Sep 24, 2026 MCP In the briefing →

  Graphify compiles a repository and its docs into a queryable knowledge graph — tree-sitter ASTs, semantic doc cues, community detection — and hands it to coding agents over an MCP server, so the agent queries structure instead of reading files until the context window fills. First-party numbers: 76% on the LongMemEval-S subset, ERPNext key-fact coverage from 70.8% to 82.0%. Dual MIT and Apache-2.0. (source)

• Sep 24, 2026 Agent frameworks & platforms In the briefing →

  AWS added skill-level checks to Strands Evals and Bedrock AgentCore Evaluations. Two questions, scored separately: did the agent load the right skill, and did it follow that skill's steps — the latter on a five-level scale from fully followed down to not followed. Both read recorded trajectories rather than the final answer, which is what tells a routing miss apart from an instruction-following one. (official)

• Sep 24, 2026 AI-assisted SDLC In the briefing →

  Someone finally read the agentic workflow files: 1,248 of them across 276 repositories, to see what teams actually put in the Markdown that drives their agents. Median length 556.5 words, code blocks in 62.1%, and tasks, outputs, constraints and process instructions each present in over 93%. Only 9.4% mention prompt-injection defence at all. These files are maintained, too — 78.2% still receive edits in month four. (paper)

• Sep 23, 2026 Coding agents In the briefing →

  JetBrains pulled its agent work under one name, Air. Air in the IDEs directs and verifies agents, Air Teams coordinates humans and agents through a delivery workflow, and Air Governance — formerly JetBrains Central — holds policy, audit and cost control. Junie runs across all three. The connective piece is the Agent Client Protocol, which admits non-JetBrains agents to the same surfaces. No pricing or dates. (official, source)

• Sep 23, 2026 MCP In the briefing →

  Bifrost, an open-source gateway fronting more than twenty LLM providers, ships with management auth off by default. One HTTP request registering a stdio-type MCP client through that management API runs arbitrary commands on the gateway host, no credentials involved. JFrog's Yuval Moravchick reported it; CVE-2026-90898 carries a 9.8. Fixed in transports/v2.1.0. (source)

• Sep 23, 2026 MCP In the briefing →

  Databricks made the Genie One MCP server generally available, so a natural-language question over governed enterprise data becomes a tool any MCP client can call — Claude, ChatGPT, Copilot, Cursor. It runs as a managed service inside Unity Gateway, which puts Unity Catalog permissions and audit logging on every invocation rather than on each connector. (official)

• Sep 23, 2026 Agent frameworks & platforms In the briefing →

  Prismor sits between an agent and its tool calls and rules on each one — allow, warn, or block — against a self-hosted policy, with a local dashboard for what it stopped and why. It is agent-agnostic across Claude Code, Codex and LangChain. Its authors measure 0.8 ms of added latency per call over 10,000 simulated sessions. (official)

• Sep 23, 2026 AI-assisted SDLC In the briefing →

  Compile rate is the metric most LLM patch benchmarks lead with, and a new empirical study says it mostly measures the harness. Across 203 vulnerable C/C++ functions and three code models, roughly 64% of compilation failures trace to the evaluation harness and dataset rather than the model, and compiler flags alone move identical patches by 1.8–2.7x. Optimizing for it produced deletion-based non-repairs. (paper)

• Sep 22, 2026 Coding agents In the briefing →

  AWS open-sourced Strands harness, an Apache-2.0 agent you add with one import in Python or TypeScript and point at Bedrock, Anthropic, OpenAI, Google, Ollama or LiteLLM. AWS measures 28% lower token cost at comparable accuracy, and 77% against Claude Code on Fable 5 while scoring higher on Terminal-Bench 2.1. The savings are mechanical rather than clever: tool results truncated past ~1,500 tokens, compaction at 85% of the window, prompt caching on by default. (official, source)

• Sep 22, 2026 Agent frameworks & platforms In the briefing →

  Microsoft split isolation for Foundry hosted agents into two independent controls. User isolation decides whose data an agent may touch, through an Entra or delegated identity; session isolation decides where its sandbox and files live, keyed by agent_session_id. A Foundry session is not a conversation — it holds compute and files, not message history — so a middle tier can pool sessions across users without pooling their data. Hosted agents are GA; the AgentServer SDKs are pre-release. (official)

• Sep 21, 2026 Coding agents In the briefing →

  Two sandbox escapes in OpenAI Codex, both patched in August and disclosed now. Heapjack shares a memory heap between trusted and untrusted JavaScript in Codex Desktop's node_repl: open someone else's repository, ask a question about the code, and the repository's author gets unsandboxed execution on your machine. Overpatch walks the CLI's apply_patch tool out of workspace-write through a symlink and rewrites your .zshrc. Fixed in Desktop 26.818.21641 and CLI 0.149.0. (source)

• Sep 21, 2026 AI-assisted SDLC In the briefing →

  Alibaba's Open Code Review splits the job in two — deterministic pipelines pick files, bundle diffs and match rules, and an LLM agent only does the reading. Alibaba's own benchmark over 200 pull requests in ten languages reports better precision than Claude Code at roughly a ninth of the tokens. An independent run on ten PRs landed near 12% precision, so treat the internal figure as a ceiling. Apache-2.0, Go, OpenAI- and Anthropic-compatible. (source, official)

• Sep 21, 2026 AI-assisted SDLC In the briefing →

  Lauren Tan's pstack workflow reportedly ships 2,000 pull requests a month to production, and the argument built around it is that generation stopped being the bottleneck — verification is. For distributed systems that means a runtime problem: one shared stable stack running continuously, with each agent spinning up only the service it changed and joining it as an isolated environment. (source) (unconfirmed)

• Sep 20, 2026 Coding agents In the briefing →

  Claude Code now reads AGENTS.md when a repo has no CLAUDE.md in or above the working directory, retiring the symlinks and one-line imports teams used to keep a single instruction file across agents. Precedence is blunt rather than merged: any CLAUDE.md in scope wins outright and the AGENTS.md is skipped, unless a CLAUDE.md imports it or you switch the project-instructions setting to load both. (official, source)

• Sep 20, 2026 Coding agents In the briefing →

  Hacktron chained a Discourse image-upload path into a heap overflow in libheif, then used Claude Opus 5 to write the exploit. First look to an OpenAI employee's account took under 72 hours. Proof of impact was that employee's connected Codex opening a pull request in OpenAI's internal monorepo. OpenAI patched in roughly 14 hours and paid $6,500. An agent wired into your source control inherits every account that can reach it. (source, source)

• Sep 20, 2026 Coding agents In the briefing →

  GitHub retires six Copilot models on October 19 — Gemini 3.7 Flash, GPT-5.5, GPT-5.4, GPT-5.4 mini, GPT-5 mini and Grok 4.5 — with replacements on by default unless you disabled the global default setting. (official)

• Sep 20, 2026 MCP In the briefing →

  LinkedIn's fix for agents that don't know the company is a local MCP server, pre-installed on laptops and refreshed hourly, serving 600-plus playbooks — written procedures for migrations, environment setup, debugging — behind a tool-search layer rather than thousands of exposed tools. Ajay Prakash reports 8,000 daily users and a 20% productivity gain with no reliability loss. The search layer is the part worth copying: dumping every tool into context is what degrades the agent. (source)

• Sep 20, 2026 Agent frameworks & platforms In the briefing →

  Bedrock AgentCore's new runtime pages memory in on demand and reclaims it when freed, rather than holding your whole container image for the length of a session. P75 cold start now sits near 2 seconds across images from 200MB to 2GB, where the old runtime climbed from 5.4 seconds to nearly 30. Billing follows: a higher per-unit rate over far fewer GB-hours. Opting in is platformVersion: V2. (official)

• Sep 20, 2026 AI-assisted SDLC In the briefing →

  DoorDash turned agents loose on 60,000 feature flags across 623 repositories. Claude Sonnet pulls stale-flag tickets from Jira and queries metadata over MCP; up to four Opus agents then work concurrently in isolated git worktrees, run tests, and open PRs. Of 50 evaluated flags, 45 produced usable pull requests and 31 merged first pass, averaging 13.8 minutes and $4.79 against an estimated one to two hours by hand. No regressions across the 50. (source)

• Sep 20, 2026 Coding agents Weekly recap Read the recap →

  Beyond Plugin4Shell: Real-SWE dropped eight frontier setups into private enterprise codebases and graded them against the merged PRs, with Claude Code on Fable 5.1 highest at 38.8%. Claude Code rebuilt Projects around parallel cloud sessions and began reading AGENTS.md where no CLAUDE.md is in scope, and Zed turned pull requests off on its own repository for the Delta beta. (Real-SWE, Projects, AGENTS.md, Delta)

• Sep 20, 2026 MCP Weekly recap Read the recap →

  LinkedIn serves 600-plus written playbooks from a local MCP server behind a tool-search layer, reporting 8,000 daily users; the search layer is the point, since dumping every tool into context is what degrades the agent. Bedrock AgentCore Identity shipped a managed consent portal for three-legged OAuth, AWS published a per-role tool allowlist pattern, Meta opened a WhatsApp Business setup server, and the Linux Foundation launched an MCP Associate exam. (LinkedIn, Identity, authorization, WhatsApp, exam)

• Sep 20, 2026 Agent frameworks & platforms Weekly recap Read the recap →

  Google open-sourced Agent Substrate, a GKE runtime giving each agent kernel isolation and snapshot-resume under 500ms, with production use still allowlisted. AgentCore's V2 runtime pulled P75 cold start near 2 seconds across 200MB–2GB images, Grab's internal LLM-Kit carries 500-plus agent services, Included Health composed team-owned agents into one LangGraph supergraph, and Microsoft argued skills over MCP beat standing up A2A specialists. (Substrate, runtime, Grab, supergraph, skills)

• Sep 20, 2026 AI-assisted SDLC Weekly recap Read the recap →

  DoorDash pointed agents at 60,000 stale feature flags across 623 repositories; of 50 evaluated, 31 merged first pass at 13.8 minutes and $4.79 apiece. Ericsson's multi-agent reviewer was 96% correct across 200-plus hand-checked findings and only 69% worth acting on, and a self-selected survey of 305 developers found 43% still coding after hours when they meant to stop. (DoorDash, Ericsson, survey)

• Sep 18, 2026 Coding agents In the briefing →

  Plugin4Shell breaks the SHA pinning that is supposed to lock a plugin to a reviewed commit, across four major coding agents. The agent checks out the pinned commit but never verifies what landed there, so whoever controls the plugin repo can make the checkout resolve to malicious code while the pin still reads as honored. Claude Code and Codex update installed plugins by default, which removes the click. Anthropic fixed it in 2.1.179 and OpenAI in 0.146.0 back in June; Microsoft has not responded, and Google deprecated Gemini CLI rather than patch it. (source)

• Sep 18, 2026 Coding agents In the briefing →

  Anthropic rebuilt Claude Code Projects around a coordinator that splits a goal into parallel cloud sessions, each on its own branch and repository copy, then reviews and assembles what comes back. Threads share memory and a file library, and keep running after you close the laptop. Beta reaches some Pro and Max subscribers first. Each thread bills as a full session, so a project burns a plan several times faster than one. (official, source)

• Sep 18, 2026 MCP In the briefing →

  AWS published a worked pattern for authorizing MCP tool calls rather than merely authenticating them: a Lambda interceptor in front of a Bedrock AgentCore Gateway that walks OIDC claims through four independent gates — MFA, country, group-to-role mapping, then whether the requested tool is in that role's allowlist — returning 403 before any business logic runs. Audit records capture who called what. (official)

• Sep 18, 2026 Agent frameworks & platforms In the briefing →

  Included Health wired separate product teams' agents into one LangGraph supergraph, so scheduling, urgent-care intake and behavioral health stay independently owned but compose at runtime. Deep Agents supplies a shared filesystem and one platform prompt; capabilities like coverage questions are inherited rather than threaded through each workflow. Reported: 75% more chat engagement, 95%+ routing accuracy, 99%+ detection of high-risk situations. (official)

• Sep 18, 2026 AI-assisted SDLC In the briefing →

  A survey of 305 developers who use AI weekly found 43% still coding with it after hours when they meant to stop and 32% putting off sleep to keep going, with Claude Code named hardest to put down by 35%. The uncomfortable half is managerial: heaviest users get rewarded, including for shipping code they do not understand. Self-selected sample, so read the direction rather than the decimals. (source)

• Sep 17, 2026 AI-assisted SDLC In the briefing →

  GitHub rewrote the Copilot agent runtime in Rust and published the working numbers. One developer supervised while agents did most of the writing: 430,000 lines of TypeScript became 832,000 lines of Rust plus 469,000 of tests, merged as 128 pull requests between May 12 and August 21. The port went component by component, each PR swapping one piece behind a thin TypeScript shim so main stayed shippable. Borrow-checker errors were 1.7% of compiler failures; 87.1% of cargo check runs passed first time. (official)

• Sep 17, 2026 Coding agents In the briefing →

  Zed turned pull requests off on its own repository and opened Delta to public beta. Teammates join a conversation with an agent rather than review a pushed branch, and each review gets a subthread holding an isolated copy of the worktree. Underneath is DeltaDB, a Git extension that records the edits between commits next to the human and agent messages that produced them. Thirty-three people, 570 changes landed since PRs went away. (official, source)

• Sep 17, 2026 Coding agents In the briefing →

  Mandiant traced a Shai-Hulud outbreak to a hijacked coding-assistant session at a SaaS vendor. The attacker rode the live session to plant an infostealer, took GitHub OAuth tokens and repository secrets, poisoned a PyPI package and then one in the company's own namespace, and reached roughly 100 internal repositories; a second employee was infected by pulling the bad package. Recent variants sweep 469 locations for credentials. (source)

• Sep 17, 2026 MCP In the briefing →

  Google opened early access to a Google Home MCP server. Claude, ChatGPT, Hermes, OpenClaw and Antigravity can now drive Nest doorbells and thermostats, read camera summaries and assemble dashboards from a prompt. Setup is a Google Cloud project configured for Home MCP, then a sign-in and a scope grant. It sits behind Google Home Premium Advanced at $20 a month, US only, rolling out over the coming weeks. (source)

• Sep 17, 2026 Agent frameworks & platforms In the briefing →

  Microsoft's Agent Framework team argues for moving a specialist's instructions into the orchestrator rather than standing up a second agent to hold them. Skills travel over MCP: skill://index.json for discovery, a SKILL.md per skill, and add_tools() registering the matching MCP tools once a skill loads. Against A2A specialists on three prompts, the skills path made 3 model calls instead of 6–7 and took 6.3 seconds instead of 15.5, at a few thousand more tokens. (official)

• Sep 16, 2026 MCP In the briefing →

  Standing up a WhatsApp Business account has meant clicking through several dashboards. Meta now ships a WhatsApp Business Tools MCP server that lets an agent create the account, add and verify phone numbers, register for Cloud API access, edit message templates, and check terms-of-service and verification status. Claude, Cursor, Codex and ChatGPT are the named clients. The agents get no identity of their own, so every action lands under the human's credentials. (source, source)

• Sep 16, 2026 Agent frameworks & platforms In the briefing →

  Google Cloud open-sourced Agent Substrate, a GKE runtime for the case where your agent runs code nobody wrote on purpose. Each sandbox gets kernel isolation — Cloud Hypervisor microVMs or gVisor — behind an egress proxy, with credentials injected outside the agent's reach. The interesting claim is idle economics: snapshot dormant agents to disk, 1,000-plus per host, resume under 500ms at 500 activations a second. Production use is allowlisted. (official)

• Sep 16, 2026 Agent frameworks & platforms In the briefing →

  Microsoft's Foundry Dev Pack collapses the Azure CLI, the Azure Developer CLI, the Foundry VS Code toolkit and a Foundry skill for coding agents into one installer — winget, brew, or a curl script. It installs conditionally, so the VS Code pieces appear only if VS Code does. This earns its place as a line in a CI image or an onboarding script, not as something you run twice. (official)

• Sep 16, 2026 AI-assisted SDLC In the briefing →

  Ericsson pointed a multi-agent reviewer at its own commits, scoring changes on readability, maintainability, reliability and performance with project-specific context attached per agent. Developers hand-checked 200-plus findings: 96% were correct, and roughly 69% of those were judged worth acting on — about a third severe, a third important. The remaining third were accurate and still not worth a reviewer's morning, which is the number most teams never collect. (paper)

• Sep 15, 2026 Coding agents In the briefing →

  Public benchmarks have agents looking competent; Real-SWE puts them in code they have never seen. Specific Labs took 10 tickets real engineers had worked, some for weeks, out of private enterprise codebases, gave eight frontier setups eight attempts each, and graded against the merged PRs. Claude Code with Fable 5.1 scores highest at 38.8%, then GPT-6 Astra on Codex CLI at 33.8% and Gemini 3.8 Flash on Gemini CLI at 31.2%. Failures clustered on missed requirements, integration errors, and assumptions nobody checked. (source)

• Sep 15, 2026 MCP In the briefing →

  Agents calling third-party APIs on a user's behalf need three-legged OAuth, and until now every team built the session-binding plumbing itself. Bedrock AgentCore Identity now ships a managed Consent Portal: the user authenticates against your own identity provider, approves providers one at a time, and tokens land in AgentCore's vault for refresh and reuse. AWS aims it at agents reached from MCP clients — Kiro, Claude Code, Cursor, VS Code. (official)

• Sep 15, 2026 Agent frameworks & platforms In the briefing →

  Wiring a new agent service into production at Grab takes about an hour, down from two weeks, since the company standardised on LLM-Kit — FastAPI and LangGraph with OpenTelemetry tracing, Vault secrets and service discovery already attached. Agents discover tools at runtime from 50-plus MCP servers, and model calls go through an OpenAI-compatible gateway fronting five providers. It carries 500-plus internal agent services. Not open source. (source)

• Sep 14, 2026 MCP In the briefing →

  MCP has an exam now. The Agentic AI Foundation and Linux Foundation Education opened enrollment for the Model Context Protocol Associate, 120 minutes, online and proctored, pinned to the 2026-07-28 spec. The domain weights say where the protocol's hard parts sit: interactions and execution 26%, security and governance 24%, fundamentals 16%. (official, details)

• Sep 13, 2026 Coding agents In the briefing →

  GitHub's HydraFusion has been sitting in the Copilot CLI since September 1 and only got written up this week. It plans each task across models from several providers instead of the one you picked: a single model, a cascade that escalates when a quality gate rejects the draft, or a drafter checked by an independent critic. GitHub reports 4.9 points more verified quality on TerminalBench 2.1 at 67% lower estimated cost than Claude Opus 5. Turn it on with /experimental on, then /model; you pay for every model it calls. (official, source)

• Sep 13, 2026 MCP In the briefing →

  Most MCP servers were installed on their defaults, and the numbers show it: 88% of servers need credentials, 8.5% use OAuth. The common failure is not a missing permission model but an ignored one — a server wanting read-only calendar access asks for read, write and admin because the tutorial did. July's spec update was almost entirely authorization work, and the Enterprise-Managed Authorization extension that routes MCP access through a company's identity provider is now stable. (source)

• Sep 13, 2026 AI-assisted SDLC In the briefing →

  Spec-driven toolkits each prescribe one pipeline — Anthropic's AI-Native SDLC Playbook, Amazon's Kiro, GitHub's Spec Kit — and no real organization runs one. The alternative on offer: model the pipeline as facts a change accumulates (reviewed, validated, approved), with rules naming which facts it needs and whether a human or a check supplies each. A docs fix merges on a green build; a payments migration waits for the payments owner. (source)

• Sep 13, 2026 AI-assisted SDLC In the briefing →

  OpenAI hired Git AI's founders, Aidan Cunniffe and Sasha Varlamov, onto the Codex team. Their open-source Git extension traces how much of a diff an agent wrote, how much of it survives to production, and where tokens went — across Codex, Claude Code, Cursor and Gemini CLI, plus background agents including Devin. The stated job now is ROI data for Codex buyers. (source)

• Sep 13, 2026 Coding agents Weekly recap Read the recap →

  GitHub spent the week on controls: enterprise-managed permissions for agent operations went generally available across the app, CLI and VS Code, sandbox policies for JetBrains entered preview, and Copilot code review now closes threads a later commit has addressed. Google open-sourced Mantis for agent-run security review, a DeepSeek Harness flaw let a sandboxed agent switch its own sandbox off at CVSS 9.4, and three agents picked the same third-party tool only 42% of the time. (permissions, JetBrains, review, Mantis, Harness, tools)

• Sep 13, 2026 MCP Weekly recap Read the recap →

  Authorization was the whole story. The Python SDK's 2.2.0 added token-resource and issuer validation, Enterprise-Managed Authorization reached stable against 8.5% OAuth adoption across servers, and Wiz found 294 of 3,074 exposed LiteLLM gateways still accepting the sk-1234 key printed in the setup docs. Adversa documented Deadbugz pushing malicious servers through 23 pull requests in 74 minutes, and AWS documented hosting MCP Apps on AgentCore. (SDK, OAuth, LiteLLM, Deadbugz, Apps)

• Sep 13, 2026 Agent frameworks & platforms Weekly recap Read the recap →

  Beyond the Agents API: Meta's Muse gates a personal agent's egress through a second agent isolated on the same machine, LangChain shipped per-caller credentials as Connections and argued subagents should fork or isolate context deliberately rather than all starting blank, AWS open-sourced Pizza Bot as an inbox for background agents, and ADK for Kotlin 1.0 reached parity with ADK Core. (Muse, Connections, context, Pizza Bot, Kotlin)

• Sep 13, 2026 AI-assisted SDLC Weekly recap Read the recap →

  Every pull request at OpenAI now passes an automated security review that can block the merge with no human enforcing it. Figma put an agent on security alert triage for 70% faster resolution on complex alerts, Shopify rewrote its Shop app to native Swift and Kotlin in 12 weeks with six engineers, and a controlled study found specifications bought traceability rather than bugs — 52.5% recall against 51.8%, at 48 minutes instead of 27. (OpenAI, Figma, Shopify, specs)

• Sep 12, 2026 Coding agents In the briefing →

  Fusion reached Devin Desktop and the CLI, splitting a coding run between a frontier model that plans and reviews and a cheaper one that executes. The two hold separate persistent contexts and their own prompt caches, trading briefs rather than swapping mid-task. Cognition puts Fable 5.1 with SWE-2 at $7.90 against $12.36 for Claude Code alone, and Astra with SWE-2 at $4.54 against $7.47 for Codex; savings ran 11–46% across five benchmarks. (official)

• Sep 12, 2026 Coding agents In the briefing →

  GitHub's Copilot code review now closes its own threads once a later commit addresses the feedback, and the Lite effort level runs several agents whose findings merge into one review. GitHub measured 47% more high-severity findings actually addressed, 31% more medium, and review costs down about 8%. Validation can now run builds and tests through the Copilot SDK's shell tools. (official)

• Sep 12, 2026 MCP In the briefing →

  AWS documented hosting MCP Apps servers on Bedrock AgentCore — the spec extension that lets a tool return an interactive widget instead of text. Servers register ui:// resources through @modelcontextprotocol/ext-apps; the host renders the markup in a sandboxed frame and injects the tool result. AgentCore Runtime holds the server, Gateway exposes it to ChatGPT and Claude.ai. (official)

• Sep 12, 2026 AI-assisted SDLC In the briefing →

  Shopify rebuilt its Shop app from React Native to native Swift and Kotlin in 12 weeks with six engineers, years after betting on one shared codebase. Writing each feature twice stopped being the expensive option once agents did the typing. The gate is a system called Helix: checkpoints, tests, visual review and an adversarial code review before a human signs off. Next is the merchant app, 300-plus screens. (source)

• Sep 11, 2026 Agent frameworks & platforms In the briefing →

  OpenAI opened the Agents API in public beta, which is the harness behind Codex and ChatGPT for Work rather than a new wrapper over chat completions. An agent can run for days, compact its own context when it fills, hand parallel work to subagents with separate contexts, and reach tools over MCP. Environments are optional sandboxes, either OpenAI-hosted or on one of nine partners — Cloudflare, DigitalOcean, Modal, Oracle, Vercel and E2B among them. No API fee during the beta; you pay tokens, tools and container time. (official)

• Sep 11, 2026 Agent frameworks & platforms In the briefing →

  AWS open-sourced Pizza Bot, an inbox for agents whose work outlives your attention. Threads, not sessions: finished jobs land unread, anything needing a decision goes to an Action queue, and an Activity panel shows what specialist subagents did. Built on LangGraph and DeepAgents, extended through SKILL.md files or MCP servers, state in SQLite under ~/.pizza-bot-oss. Apache 2.0. (official, source)

• Sep 11, 2026 Agent frameworks & platforms In the briefing →

  ADK for Kotlin 1.0 reaches parity with ADK Core, so hierarchical multi-agent setups, resumable sessions and human-in-the-loop steps are now available to JVM and Android teams without a Python sidecar. Tool schemas are generated at compile time through KSP instead of runtime reflection. On-device inference runs via LiteRT-LM and ML Kit, still beta; Room and AppSearch hold state across restarts. (official)

• Sep 11, 2026 Coding agents In the briefing →

  Google published a Google Cloud Developer Plugin that installs into Claude Code, Codex CLI or Antigravity CLI from one marketplace command. It carries skills for auth, project management and guarded gcloud use, plus a Developer Knowledge MCP server that grounds answers in current Google docs rather than whatever the model remembers. It follows the vendor-neutral Agent Plugins spec, so the same bundle installs across three harnesses. (official)

• Sep 11, 2026 MCP In the briefing →

  A paper argues you can audit an MCP server you cannot run. MCPSEC hypothesises indirect prompt-injection flaws from registration-time tool descriptions alone — no execution, no source — and across 20 deployed servers and 177 tools it recovered 98.9% of the 95 human-confirmed vulnerable tools, against 84.2% for a plain LLM baseline. The catch is precision: it flagged 143. (paper)

• Sep 11, 2026 AI-assisted SDLC In the briefing →

  Specs did not help reviewers find more bugs. In a controlled study behind an InfoQ write-up, five reviewers hit 52.5% recall with specifications and 51.8% without — but 81% of their findings tied back to a named requirement, against zero on the baseline, and reviews took 48 minutes instead of 27. An automated replication across 90 reviews reproduced both halves. (source)

• Sep 11, 2026 AI-assisted SDLC In the briefing →

  GitHub put AI Scan for pull requests behind REST endpoints in public preview, at /orgs/{org}/code-scanning/ai-scan and the repository equivalent, so the setting can be rolled across hundreds of repos without clicking through each one. Advanced Security customers only, github.com only, and a repository cannot re-enable what the organisation turned off. (official)

• Sep 10, 2026 Coding agents In the briefing →

  Google open-sourced Mantis, a stack-agnostic set of security-review skills for coding agents. Fifteen-plus tools chain into one pass: find a suspected flaw, strip the false positives, reproduce it in a sandbox, write a minimal patch, then re-attack that patch and score the residual risk. Google's own framing is that conventional AI code scanning lands true positives under 7%. Apache 2.0, and it runs under Gemini CLI, Antigravity CLI, the ADK or any comparable harness. (official, source)

• Sep 10, 2026 Coding agents In the briefing →

  A sandboxed DeepSeek Harness agent could switch its own file sandbox off. The tool's local web interface authenticated on the Host header alone, so an agent that read attacker-supplied text could flip itself to danger-full-access and write anywhere on disk. OX Research reported it on August 24 and DeepSeek patched three days later with one-time token auth. Everything through 0.1.1-rc.2 is affected; 0.1.2-rc.1 is current. CVE-2026-82533, CVSS 9.4. (advisory, source)

• Sep 10, 2026 Coding agents In the briefing →

  GitHub's enterprise-managed permissions for Copilot agent operations went generally available. Administrators set which shell commands, file reads and edits, and network domains are blocked, need human approval, or run unprompted, and no local setting — user preferences, workspace config, a previously saved approval — can override them. Covers the Copilot app, the CLI, and VS Code Agent Host sessions. (official)

• Sep 10, 2026 MCP In the briefing →

  Wiz scanned internet-facing LiteLLM gateways and found 294 of 3,074 — nearly one in ten — still accepting sk-1234, the master key printed in the setup docs. Alongside it, CVE-2026-59822, an MCP authentication bypass at CVSS 8.8 that CISA added to its Known Exploited Vulnerabilities catalogue on September 2, plus authenticated command execution through MCP test endpoints and a guardrail sandbox escape. Upgrade to 1.84.0; rotating the master key needs no upgrade at all. (source, advisory)

• Sep 10, 2026 Agent frameworks & platforms In the briefing →

  LangChain's Connections retires the one-hardcoded-key pattern in Managed Deep Agents. A connection is defined on two axes — owned by the agent or resolved per person at runtime, backed by a static secret or an OAuth grant — and tool code fetches it with connections.get(). A missing user authorization pauses the run once for consent rather than failing it. Needs v0.7.0 or later; 23 OAuth providers ship in the catalogue. (official)

• Sep 10, 2026 AI-assisted SDLC In the briefing →

  Every pull request at OpenAI now passes through an automated security review, and the model can block the merge on its own — no human reviewer is needed to enforce it. Codex engineering lead Thibault Sottiaux says the same reviewers catch regressions and carry dependency upgrades, and that many engineers run /review in the Codex CLI before they push at all. (source)

• Sep 9, 2026 Coding agents In the briefing →

  GitHub put enterprise-managed sandbox policies for Copilot in JetBrains IDEs into public preview. Administrators now set sandbox enablement, filesystem and network access, proxy settings, developer-tool access and macOS Keychain access centrally, and the IDE marks the controls the organisation owns and locks them. The settings appear only with the Editor Preview flag on or a managed setting already configured. (official)

• Sep 9, 2026 MCP In the briefing →

  The MCP Python SDK's 2.2.0 release is mostly authorization work: validate_token_resource checks a token was actually issued for this server, a new issuer= parameter validates the authorization server across every discovery path, and session_idle_timeout= and max_sessions= bound Streamable HTTP servers. One breaking change to plan around — HTTP client redirects are followed only within the endpoint's own origin, so a cross-origin hop now fails. Tasks, DPoP and JWT-bearer remain unimplemented. (release)

• Sep 9, 2026 Agent frameworks & platforms In the briefing →

  Meta's Muse puts a personal agent on a dedicated cloud VM and gates its egress with a second agent. A Sentinel process runs on the same machine, isolated from Muse at the system level, and nothing Muse does reaches the internet unless Sentinel approves it. Purchases route through Link by Stripe one-time cards and Meta says Muse never sees passwords. US rollout on iOS, Android and the web; no developer API, and the isolation claims have had no outside review. (official, source)

• Sep 9, 2026 Agent frameworks & platforms In the briefing →

  LangChain's argument on multi-agent context is that subagents should not all start blank. Workers and memory agents take mode: fork and inherit the supervisor's history; verifiers and researchers take mode: isolated, so a reviewer is not anchored by the reasoning it was asked to check. Forking is also claimed cheaper through prompt caching, though the post publishes no numbers. (official)

• Sep 9, 2026 AI-assisted SDLC In the briefing →

  OpenAI's 1Password case study reports a 20.9% engineering productivity gain and a 10.9% cut in median pull-request cycle time. The $783,750 annual capacity figure printed beside them is modelled rather than measured: 50 consistently active Codex developers, $250,000 loaded cost each, 40% attribution to Codex, 75% realisation. The two percentages are the part worth borrowing. (official)

• Sep 9, 2026 AI-assisted SDLC In the briefing →

  Microsoft's Edge team says extension submissions have outrun its review pipeline and turnaround times have stretched, crediting AI-assisted coding for the volume. Its answer was automating the repeatable validation checks rather than adding reviewers, alongside a Featured badge that now refreshes every 15 days. Anyone shipping a browser extension this quarter should plan for a slower queue. (source)

• Sep 8, 2026 Coding agents In the briefing →

  Armature watched Claude Code, Codex and Cursor decide which third-party tools to wire into a codebase across 17,000 sessions, and published every trace and prompt. On the validated 5,292-session subset the three agents agree on the same tool only 42% of the time; Claude Code skips the ecosystem and builds its own implementation in 19% of cases against 10% for the other two. Repository context, not reputation, decides it — one request for an email provider produced four different winners across four codebases. Armature sells growth services to tool vendors, so read the framing accordingly. (source)

• Sep 8, 2026 MCP In the briefing →

  Adversa's September MCP review documents Deadbugz, a campaign that pushed malicious MCP servers through GitHub pull requests — one account filed 23 of them across several projects in 74 minutes. The server behaves until the third tool call, then rewrites the metadata it returns into instructions to collect SSH keys, AWS credentials, shell history and kube configs. Three server CVEs land beside it, including path traversal in Atlassian MCP (CVE-2026-73498, fixed in v0.22.0) and a cleartext cluster token in ArcadeDB MCP, fixed in 26.7.3. (source)

• Sep 8, 2026 AI-assisted SDLC In the briefing →

  The New Stack read OpenAI's research-acceleration report for what it says about supervision rather than spend, and the numbers are less flattering there. Humans still had to step in on more than half of *successful* agent tasks in the four-to-eight-hour band. Agent-caused outages on July 20 took OpenAI's training container service offline, and an August 7 restriction on Astra cut its GPU allocation 59.2% the following week — work that moved to other models rather than stopping. (source)

• Sep 7, 2026 MCP In the briefing →

  Sessions left the MCP spec on 2026-07-28, and what replaced them is a portable handle the model carries in its context window. The Mcp-Session-Id header and the initialize handshake used to bind a client to a server instance; now each endpoint has to do that alone. Anything that can plant text an agent trusts can read or forge the handle. Validate each one against the identity it was issued to, and bind tokens to an audience. (source)

• Sep 7, 2026 AI-assisted SDLC In the briefing →

  Figma put an agent on security alert triage, hung off Panther as the SIEM with tool access to audit logs in AWS, Okta, GitHub and GCP. Past investigations, behavioural steering and learned table schemas feed back in as memory. InfoQ reports 70% faster resolution on complex alerts, 20% fewer on-call pages, and a separate code reviewer reaching 80% precision within a month. Agent-opened pull requests default to draft. (source)

• Sep 6, 2026 Coding agents In the briefing →

  GitHub's weekly Copilot roll-up carries three things past changelog noise: Agent Merge entered public preview in VS Code 1.136, taking a pull request from agent output to merge-ready; the Copilot harness for JetBrains IDEs reached general availability; and Claude Fable 5.1 plus Gemini 3.8 Flash joined the model picker on paid tiers. (official)

• Sep 6, 2026 MCP In the briefing →

  CVE-2026-85620 reduces Postgres MCP Pro's restricted mode to decoration. Function-name validation never runs on RangeFunction nodes, so a blocked SELECT pg_read_file(...) succeeds when rewritten as SELECT * FROM pg_read_file(...), returning any file the database process can read. Everything through 0.3.0 is affected at CVSS 9.2, with the fix still an open pull request. Run the server under a role without pg_read_server_files in the meantime. (advisory, issue)

• Sep 6, 2026 Agent frameworks & platforms In the briefing →

  AWS published a memory-lifecycle design for AgentCore: TTL expiry at 90 days, a relevance score weighting creation recency, access recency and access frequency, and Bedrock-driven consolidation that merges low-scoring memories into compact entries. Suggested prune windows range from 7 days for support bots to 90 for IT operations. The failure it describes is an agent citing a billing dispute closed four months ago as live. (official)

• Sep 6, 2026 Coding agents Weekly recap Read the recap →

  GitSpawn aside, GitHub's week was administrative: Copilot code review can now approve pull requests where an admin turns it on, six models were retired and four more leave on October 2, and Agent Merge entered preview in VS Code 1.136. CloudSEK traced the Aurora ransomware crew running Cursor Agent as an intrusion console against ten victims. (approvals, Aurora, Agent Merge)

• Sep 6, 2026 MCP Weekly recap Read the recap →

  Three critical advisories in six days: UFO's Mobile MCP servers accepting requests with no authentication at CVSS 9.4, a Grafana SSRF steered by a request header, and a Postgres MCP Pro bypass that reads arbitrary files straight through restricted mode, with the fix still an open pull request. LangChain folded MCP into its main package and dropped sessions. (UFO, Grafana, Postgres)

• Sep 6, 2026 Agent frameworks & platforms Weekly recap Read the recap →

  Attackers spent the week harvesting OpenAI and AWS keys from internet-facing Langflow servers, detections climbing from 50 to 360 inside a day. AWS Agent Registry reached general availability as one catalogue holding MCP servers, A2A cards and skills, and both Microsoft and AWS published durable-memory designs for their agent stacks. (Langflow, Registry, memory)

• Sep 6, 2026 AI-assisted SDLC Weekly recap Read the recap →

  Debian settled its ballot by declining to write an AI policy: the review and licensing bar it already had covers model-written patches either way. DoorDash's Flux platform is running 130,000 agent tasks a month, Google open-sourced its Mantis vulnerability harness, and its finance team refactored 30-plus data access objects by queueing Antigravity CLI overnight against bazel test. (Debian, Flux, Mantis, Antigravity)

• Sep 5, 2026 Coding agents In the briefing →

  GitHub's Project HydraFusion picks a workflow rather than a model: solve directly, cascade to something stronger, or run independent critique and revision. On TerminalBench 2.1 it reports 67% lower cost and 4.9 points better quality; on DeepSWE, 36% lower cost for 1.5 points worse. It is a research preview behind /experimental in Copilot CLI, billed at each model's own rate. (official)

• Sep 5, 2026 Coding agents In the briefing →

  Coder Agent Relay splits a cloud coding agent in half. Cursor keeps running the agent loop in its own cloud; tool calls execute in Coder workspaces on the customer's network, so source, secrets and internal services never leave. Egress policy, approved-model lists, per-task permissions, audit records and spend caps are enforced at the infrastructure layer. Private preview with design partners. (source, detail)

• Sep 5, 2026 Agent frameworks & platforms In the briefing →

  Microsoft Agent Framework got durable memory that survives sessions. CosmosMemoryContextProvider hooks the framework's context-provider lifecycle: before a run it searches Cosmos DB for memories relevant to the incoming message and adds them to context, after a run it stores the new turns and extracts facts and profiles in the background. Hybrid vector and full-text retrieval. Preview, Python only, with APIs that may still move. (official)

• Sep 5, 2026 AI-assisted SDLC In the briefing →

  Google's finance engineering team refactored 30-plus data access objects for a Spanner dual-write migration by running Antigravity CLI in headless mode from an orchestration script. Version-controlled prompt templates encoded the schema translation, timestamp and nullability rules; bazel test output fed failures back for self-correction; a human saw only the finished changelist. Ten DAOs queued overnight came back with tests by morning. (official)

• Sep 4, 2026 Coding agents In the briefing →

  GitHub Copilot code review reached Azure Repos for every Azure DevOps customer, billed per review in AI credits at a credit per cent, with charges landing in Cost Management about 48 hours later. Limits are tight: five concurrent reviews per org, two per user, repos under 10 GB, 100 changed files. Budgets notify, they do not stop reviews. (source)

• Sep 4, 2026 Coding agents In the briefing →

  Four models leave Copilot on October 2: Gemini 3.5 and 3.6 Flash, Kimi K2.7 Code and Claude Opus 4.7. Business and Enterprise admins have to enable the replacements in org model policy first, or their developers lose the option rather than getting it swapped. (official)

• Sep 4, 2026 MCP In the briefing →

  Grafana patched CVE-2026-19516, a CVSS 9.1 SSRF in its MCP server: a caller could set an X-Grafana-URL header on the grafana_api_request tool and steer the server's outbound request — method, path and body — at loopback, link-local and cloud metadata endpoints. Fixed in 1.1.0, which also adds optional bearer-token protection. An earlier fix stopped credential leakage but never enforced the destination. (official)

• Sep 4, 2026 MCP In the briefing →

  LangChain folded MCP into the main package as langchain.mcp, rebuilt on FastMCP, and dropped MultiServerMCPClient for a single MCPAdapter. The interesting part is the July spec revision it tracks: sessions are gone, so a redeploy no longer kills live connections and remote servers stop needing sticky routing. Elicitation arrives as LangGraph interrupts; tool catalogues are cached client-side. Python now, TypeScript later. (official)

• Sep 4, 2026 AI-assisted SDLC In the briefing →

  Google open-sourced Mantis, the harness behind its own vulnerability work: critic and review agents, sandboxed reproduction to ground each finding, commit-history analysis, and a hierarchical summary tree that cuts token overhead more than 85% on large repositories. Aimed at beating the sub-7% true-positive rate typical of AI scanning. A companion mantis-advise skill feeds the same knowledge to coding agents. (official, repo)

• Sep 3, 2026 Coding agents In the briefing →

  Manifold Security disclosed GitSpawn: eight flaws across seven CLI coding agents where a repository's own .git/config runs attacker code before the agent contacts a model. Nearly every agent runs git status or git diff at startup to gather context, and git executes core.fsmonitor from the repo it just entered. GitHub's advisory for Copilot CLI (CVE-2026-45033, CVSS 8.5) names fifteen-plus further keys — core.hookspath, diff.external, merge.tool — and fixes it in 1.0.43 by setting safe.bareRepository=explicit. goose patched in 1.44.0; four issues were still open at publication. (advisory, source)

• Sep 3, 2026 Coding agents In the briefing →

  GitHub made content exclusions generally available in the Copilot app and CLI, so enterprise, org and repo admins can keep named files out of an agent's context. Business and Enterprise only. The same day, enterprise-managed settings gained the ability to pin any model as the default rather than a short approved list. (official)

• Sep 3, 2026 Agent frameworks & platforms In the briefing →

  LangChain published what Schneider Electric, Vodafone and monday.com learned running agents at scale. Schneider has 350 people supporting 60-plus agents behind an assistant serving 160,000 employees in 107 countries. The finding worth stealing is monday.com's: adding tools made their Sidekick agent less capable, and the fix was splitting one reasoning loop into subagents with bounded responsibilities. (source)

• Sep 2, 2026 Coding agents In the briefing →

  Copilot code review can now approve pull requests, in public preview across Pro, Pro+, Max, Business and Enterprise. It is off by default and an admin has to turn it on per enterprise, org or repo; until then the approval is an assessment in the review's overview comment and counts for nothing. Enable it and the approval satisfies the required-approvals rule, though admins can restrict which paths Copilot may sign off. A push after approval dismisses it, same as for a human. (official)

• Sep 2, 2026 Coding agents In the briefing →

  GitHub retired six Copilot models the same week: Gemini 3.1 Pro, Claude Opus 4.5 and 4.6, Claude Sonnet 4.5 and 4.6, and Raptor Mini, across chat, inline edits, ask and agent modes, and completions. Sonnet 4.6 survives for individual subscribers on annual plans. If your agent config pins a version rather than a family, that pin is now dead. (official)

• Sep 2, 2026 Agent frameworks & platforms In the briefing →

  OpenClaw 2.0 landed after a seven-week cycle — 16,000-plus pull requests from 933 contributors — and the headline change is setup: the installer now detects existing subscriptions, API keys and local models, and pushes the rest of configuration into conversation with the agent. Shared cloud sessions let several people work one agent session with context intact. Upgrades have been rough for some: broken gateways, lost automations, failed auth. (source, critique)

• Sep 1, 2026 Coding agents In the briefing →

  CloudSEK and Gambit Security traced the Aurora ransomware crew running Claude Sonnet through Cursor Agent for hands-on intrusion against ten victims between April and May — environment recon, VPN client installs, certificate attacks. An exposed open directory leaked months of chat history, showing the operator planning phases in Russian and excluding CIS ranges without exception. (source)

• Sep 1, 2026 Coding agents In the briefing →

  GitHub's August drop for Copilot in VS Code is chat plumbing that adds up: chats arranged side by side in persistent groups, a /btw side conversation that shares context and cache with the main thread, and sessions that carry across windows and in from other tools. A token readout now splits input, cached and output. (official)

• Sep 1, 2026 MCP In the briefing →

  Microsoft patched CVE-2026-73296 (CVSS 9.4) in UFO, whose Mobile MCP servers accepted requests with no authentication at all. Bound to 0.0.0.0 as the project's own remote deployment model suggests, ports 8020 and 8021 let any reachable client screenshot, tap, swipe, type and launch apps on an ADB-connected Android device. Version 3.0.8 makes a bearer token mandatory. (official)

• Sep 1, 2026 Agent frameworks & platforms In the briefing →

  Attackers are harvesting API keys from Langflow servers exposed to the internet. CVE-2026-0768 (CVSS 9.8) executes attacker-supplied Python as root through the validate endpoint; VulnCheck logged over 50 hits within hours on August 30 and 360 by Monday. The requests read cached secret-key files and query environment variables holding OpenAI and AWS credentials, with traffic mostly from Russia. Network isolation and authentication in front of the endpoint are the mitigations on offer. (source)

• Sep 1, 2026 Agent frameworks & platforms In the briefing →

  AWS Agent Registry is generally available — the discovery layer the ARD spec described last week, shipped as a product. One searchable catalogue holds MCP servers, A2A agent cards, skills written as markdown plus code, and custom JSON descriptors, with a publish-then-curate approval step in front. Semantic and lexical search, CI/CD publishing, Kiro and Claude Code as clients, consumption pricing, five regions. (official)

• Sep 1, 2026 AI-assisted SDLC In the briefing →

  Debian settled its eight-way ballot on LLM-assisted contributions. Responsible Use of Generative AI won: the project neither endorses nor prohibits the tools, contributors must understand, review, test and where needed modify what a model produces, and the same quality and licensing bar applies however the patch was written. Disclosure is encouraged, not required. Both restrictive options lost to None of the Above. (source)

• Sep 1, 2026 AI-assisted SDLC In the briefing →

  DoorDash moved its engineering agents off laptops into Flux, a cloud platform now running 130,000 tasks a month — 25,000 automated code reviews a week, and 10,000 weekly invocations of some 300 YAML playbooks. Firecracker microVMs hand back a sandbox in under five seconds at p95, and an in-house MCP gateway scopes permissions and logs what the agents touched. (source)