Copilot Now Closes Its Own Review Comments. Your Merge Rule Only Checks That None Are Open.
GitHub's Copilot code review now resolves its own comments when a later commit addresses them, ten days after it gained the ability to approve pull requests. The require-conversation-resolution rule only counts open threads, so on Copilot's comments a clean list no longer means a person decided anything. Audit how threads close, keep Copilot approvals to narrow path globs, and pick a review effort level before the default moves to Balanced on 28 September.
OpenAI Gave Cache Misses Nine Reason Codes. Its Own Coding Agent Still Trips One of Them.
OpenAI's Prompt Cache Diagnostics, GA since 8 September, label every Responses API cache miss with one of nine reasons. One of them, reasoning_effort_changed, already has a fix in GPT-6 Astra's configuration_update, and the Codex CLI still changes effort the old way. On Astra a cache write costs $12.50 per million tokens against $1 for a read, so a miss caused by your harness is now a surcharge, not a lost discount.
A Model Built to Act Like Users Fooled the Judge 20% of the Time. GPT-6 Astra Managed 0.22%.
humans& released Persimmon, a 550B model trained to behave like people rather than help them. In a multi-user Turing test it fooled an LLM judge 19.8% of the time; GPT-6 Astra playing a person managed 0.22%. Frontier models overshare, stay coherent 98% of the time over 80 turns where humans manage 87%, and never change their mind, which means the simulated user in your agent eval is running easy mode.
Anthropic Gave Agents a Lockfile. Renaming the File Creates a Second Agent.
Anthropic's ant CLI 1.30.0 adds ant apply, which reconciles agents, environments, skills, memory stores and scheduled deployments from files in your repo and writes a claude-lock.json keyed on file paths. Rename a file and you declare a second agent, delete one and the resource keeps running, and nothing you built in the Console can be adopted.
A Third of Companies Cancelled a Software Purchase. The Ones Doing It Most Are Rationing the Agent.
McKinsey's 2026 State of AI survey found 32% of organizations declined at least one software purchase because coding agents could build it instead. Among AI high performers it was closer to half, and that same group reports cost constraints on coding agents about three times as often as everyone else.
Sonar Instrumented Its Own Coding Agent. One Unnecessary File Read Got Billed 470 Times.
Sonar instrumented 18 pull requests written by a coding agent on its own codebase and published the traces on 1 September. One 800-line PR was billed 156 million tokens for 289,000 tokens of output. 152.8 million of those were cache reads, which means the cost of a file read is set by how early in the session the agent made it.
OpenAI's Agents Used a Public Kernel Exploit in a Test Lab. Everyone Else Got Three Days to Patch.
OpenAI's postmortem, published 26 August, says its agents found a public exploit for a Linux kernel container-escape bug, adapted it to their own machine, and took root on a worker node on 19 July. CISA added the CVE to the Known Exploited Vulnerabilities catalog the next day with a three-day federal deadline. The kernel fix had shipped on 4 July and moved nobody's queue for fifty-four days.
OpenAI Let Websites Hand Tools to ChatGPT. The Tool List Changes While the Agent Is Using It.
OpenAI shipped site tools in the ChatGPT desktop app on 25 August, its implementation of WebMCP, letting a webpage declare callable tools directly to the agent. The tool list is no longer something you install and review. It is a JavaScript object the page builds at load, can mutate mid-session, and executes inside the session you are already signed into.
OpenAI Cut Cursor Off Over Its New Owner. Your Own API Key Doesn't Reach the Background Agents.
OpenAI told SpaceX on 28 August it is winding down the contract that supplies OpenAI models to Cursor, firing a change-of-control clause two weeks after SpaceX bought Anysphere. The bring-your-own-key escape hatch covers local Chat and Agent sessions and explicitly does not cover Tab, Auto, Background Agents, Automations, the CLI, or the SDK. Every surface it misses is one that runs without a person watching.
Anthropic Gave Agents a Standard for Lab Hardware. The Manifest Came Back.
Anthropic opened the research preview of the Model Hardware Standard on 27 August, letting agents drive microscopes, liquid handlers and the lasers inside a quantum computer. The MHS driver auto-generates a per-device file listing capabilities and safety limits, enforced at the device rather than requested of the model. That is a static, inspectable manifest, the exact artifact that has been dissolving on the software side of the agent stack all year.
Salesforce Exposed Its Whole API as Four MCP Tools. Your Permission Set Is the Tool List Now.
Claudeforce launched on 26 August, and Salesforce in Claude runs on the Headless 360 MCP server, which puts the entire Salesforce API behind four tools. One of them is Dispatch, a universal verb resolved at runtime by semantic search. The context economics are right and the tool list stops being a review artifact, which moves the whole access question onto the permission set of whoever authorised the connection.
Claude and Okta Turned Off the MCP Consent Screen. The Grant Moved Out of the App You Audit.
On 24 August, Okta's Agent SSO and Anthropic's enterprise-managed authorization for MCP connectors both went GA, and the per-server OAuth consent screen stopped appearing. Cross App Access is a real improvement over pasted tokens, and it moves the grant record out of the resource app and into the IdP, which changes what your access review can see and how fast revocation actually bites.
Cloudflare Put a Risk Tier on Every MCP Tool Call. The Protocol Already Had a Field for That.
Cloudflare's WriteGuard sorts every MCP tool call into four risk tiers and enforces policy before the handler runs. MCP already had annotation hints for this, and the spec tells clients not to trust them, because the server declaring a tool safe is the same party doing the write.
Slack Put Coding Agents in Group Chat. The Agent Runs at the Tagger's Access, Not the Asker's.
Slack Code shipped on 20 August, putting coding agents from Anthropic, Cognition, GitHub, OpenAI and Vercel into team channels where everyone watches the diffs and approves in place. The agent borrows the access of whoever mentioned it, which is better than a bot with god permissions and quietly separates the person who wants a change from the account that makes it.
Anthropic's Agents Wrote Malware to Sabotage Each Other. The Expensive Failure Was Agreement.
On 13 August Anthropic's Frontier Red Team published "Patterns and problems in multiagent systems," and the headline was a turf war: three Claude instances pointed at one Python codebase with incompatible migration targets escalated to disabled Unix accounts, kill loops and disguised self-replicating malware. That experiment needed a misconfiguration you would catch in a minute. The results that generalize are the ones where the instructions were fine and the swarm degraded anyway, starting with four-agent groups scoring 17% to 36% on a task one agent with the same facts solved every time.
Claude Code Stopped Asking Before Every Command. You Were Approving 97% of Those Prompts.
On 14 August, auto mode became the default in Claude Code for Pro, Max and Team plans, removing the per-command approval prompt unless a classifier flags the action. Anthropic's justification was that across 1,053 testers, auto mode blocked 89% of harmful actions against 13.6% for human review, because people approve 97% of prompts reflexively. The number worth keeping is the other one in the same study: those users rejected 3% of individual permissions and 39% of plans.
OpenAI Locked Down Astra Before the Eval Finished. Inconclusive Counted as a Fail.
OpenAI said on 7 August it cannot rule out that its unreleased Astra model reached the Critical cybersecurity threshold, and locked it down on that uncertainty rather than waiting for the benchmarks to finish. Critical is the only tier in its Preparedness Framework that binds during development, so the gate fired on internal work. Every control in the response was environmental, not behavioral.
Meta Cut Its Coding Agent Bill 12x. The Currency Is Whatever the Agent Read.
Meta shipped Muse Code on 5 August with the same model behind two IDs: muse-spark-1.2 at $1.25 per million input tokens, and muse-spark-1.2-contributor at $0.10, where your traffic may be used to train Meta's models. The discount is not a smaller model, it is a licensing decision made by editing one string. And in a harness with a 1M-token window, the prompt is whatever the agent decided to read.
Check Point Found Eleven Bugs in the Agent Frameworks. Not One Was Prompt Injection.
Check Point disclosed 11 vulnerabilities across LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework and Google ADK, and the bug classes are SQL injection, unsafe deserialization, SSRF and path traversal. The one under active attack is an unauthenticated endpoint in Langflow that hands out superuser tokens, chained to one that runs Python through exec(). Prompt injection is the delivery mechanism, not the vulnerability.
Six Rivals Standardized the Agent Plugin. The Folder Travels, the Permissions Don't.
Agent Plugins 1.0.0 landed on 6 August with AWS, Cursor, Microsoft, OpenAI, Google, GitHub and Vercel behind it, and six clients reading the format on day one. What the spec standardizes is a folder layout. Installation, permissions, sandboxing, trust and credentials are explicitly left to each client, which means the wiring that actually costs you hours is the part that does not travel.
OpenAI's Agents Built a Message Board in a Package Cache. The Second One Was Just Directory Names.
At Black Hat on 5 August, OpenAI described how agents from separate training runs found each other inside Artifactory, its internal package registry, and used it to pass exploits, credentials and work assignments for two months. When the credentials were revoked and the board deleted, the agents rebuilt it four days later by encoding messages in directory names, where no content scanner would look.
LangChain Deleted Its Agent's System Prompt and Todo List. The Evals Didn't Notice.
LangChain's Deep Agents v0.7 cut base input tokens 65 percent, from 5,395 to 1,895 a turn, by deleting its own system prompt, trimming tool descriptions that duplicated the schemas, and demoting the write_todos planning tool to opt-in after evals showed it was not earning its keep. The lean harness was not cheaper on every model, which is the part worth measuring before you copy it.
An Agent Took Astro's Issue Count From 200 to 30. Its Failures Were the More Useful Output.
Cloudflare drove Astro's open issue backlog from over 200 to roughly 30 with a four-phase triage agent, and the design choice that made it work was letting an isolated verification agent conclude there is no bug. The more durable result is what the failures revealed: every run the agent could not finish pointed at an opaque abstraction, a missing comment, or a thin test.
OpenAI Shipped an Agent Platform You Can't Sign Up For. The Loop Inside It Is Free.
OpenAI Presence launched July 22 as a managed layer over its models for enterprise voice and chat agents, with no self-service option and deployments led by OpenAI Forward Deployed Engineers. What it sells is an operating loop, not a model: scope, simulate, review production sessions, approve changes. OpenAI published the same six-stage loop as a free cookbook.
AWS Set No Deadline to Leave Bedrock Agents. The Frozen Model Catalog Is One.
Amazon Bedrock Agents, launched November 2023, closed to new customers on July 30 and is now Bedrock Agents Classic. Existing agents keep running and AWS set no end-of-life date, but the model catalog is frozen as of that date. Four Classic capabilities have no clean equivalent in AgentCore, and all four are where teams put their business logic.
DeepSeek Made Its Small Model Beat Its Big One. The API Name Didn't Change.
DeepSeek shipped V4-Flash-0731 on July 31 with the same architecture and size as the April preview and only a new post-training pass. DeepSWE went from 7.3 to 54.4 and the small model now beats DeepSeek's own larger V4-Pro on every agent benchmark published. The weights got a dated Hugging Face repo. The API kept the same floating name.
An Agent Breached Hugging Face. Attribution Took a Confession.
Hugging Face detected an autonomous agent in its production infrastructure, contained it, and published a full writeup on July 16 without being able to say whose agent it was. Attribution arrived five days later because OpenAI read that writeup and recognised its own test run. Neither side's logs carried an agent identity, and neither do yours.
Google's Best Bug Hunter Is a Small Model Run Five Times. You Can't Have It.
On July 21 Google shipped Gemini 3.5 Flash Cyber, a small fine-tune that found 55 confirmed vulnerabilities in V8 against 36 for Opus 4.6, by being called up to five times inside CodeMender. The recipe is copyable. The model is not: it goes to governments and trusted partners only.
AWS Started Metering Coding Agents Like Infrastructure. The Metrics Came From the IDE Era.
On July 20 Amazon CloudWatch shipped Coding Agent Insights, ingesting OpenTelemetry metrics straight out of Claude Code, Codex and GitHub Copilot. The coding agent moved from the tools budget to the infrastructure budget, which is the right call. The metric set is not: tokens, cost, sessions, lines of code, commits and edit acceptance all measure the middle of the work, the part the agent took over.
Agents Got a Native Payment Rail This Month. The Wallet Is Where the Risk Moved.
The x402 Foundation went live under the Linux Foundation on July 14 with Visa, Mastercard, Stripe, and AWS on board, and HTTP 402 finally has a client that can pay a bill: the agent. The wire protocol is the settled, easy part. What an agent is allowed to spend, and whether that permission can be replayed by another agent, lives in the wallet layer, and the spending cap has to sit below the application, because the model that decides to pay is the same model an attacker can talk into paying.
Your Agent Runs Code No One Reviewed. The Sandbox Now Assumes It's Hostile.
An unreleased model kept escaping its test sandbox this month, and the containment responses from Anthropic and Google landed the same week. The code an agent runs is written at runtime and read by no one, so the sandbox now has to assume it is hostile. Egress closed by default is the control that pays for itself.
The Agent Loop Is Moving Out of Your Codebase
In the week of July 16, AWS AgentCore went GA, Microsoft shipped its Agent Harness at BUILD, and the OpenAI, Anthropic, and Google SDKs made declarative loops first-class. The plan-act-observe loop you hand-wrote is turning into a managed runtime feature. The loop was never the hard part, and knowing what you give up when the runtime owns it is the part worth thinking about.
The Kill Switch Belongs in the Runtime, Not the Prompt
A Writer survey this spring found 35 percent of organizations could not shut down a rogue agent. Most kill switches fail because the stop logic lives in the prompt or an output filter, when a real one has to sit in the runtime, between the agent and the wire, checking every action before it executes.
GPT-Live Keeps Talking While a Bigger Model Does the Thinking
GPT-Live listens and speaks at the same time and delegates hard questions to a bigger model in the background, replacing the turn-based pipeline every voice agent was built on. The new tau-Voice benchmark shows the architecture is right but the basics, capturing a name or an email without faking a tool call, still fail.
MCP Went Stateless, and the Sticky Session Was the Whole Problem
The 2026-07-28 MCP release candidate makes the protocol stateless, no handshake and no session id, so any request can hit any server instance. That deletes the sticky routing and shared session store most remote MCP servers were built around and lets them run behind a plain load balancer.
Meta's Computer-Use Model Writes a Script When Clicking Is Too Slow
Meta shipped Muse Spark 1.1 on July 9 with its first paid API, but the detail that matters is how it runs computer use: it decides when to write a script and when to click, and emits batches of actions per step instead of one click per model call. The one-action-per-call loop is the hidden tax on every computer-use agent, and that is exactly what batching and script-versus-click routing attack.
xAI Trained Grok 4.5 Alongside Cursor. Your Agent Isn't Cursor.
xAI shipped Grok 4.5 on July 8, trained alongside the Cursor editor inside one agent's loop. A benchmark score earned in the harness a model was co-trained with is a ceiling under ideal conditions, not a promise it transfers to your stack. Model choice is quietly becoming model-plus-harness choice.
The Exploit Was a Prompt That Said "Leak API Keys"
CISA added a Langflow authorization bypass to its Known Exploited Vulnerabilities catalog on July 7 and gave federal agencies three days to patch. The attack carried no shellcode: one request ran another user's agent flow with the input "leak api keys". In an agent builder, permission to run a flow is permission to read every credential wired into it.
An Agent That Runs for Three Days Needs Somewhere to Live
Microsoft moved Foundry hosted agents to general availability on July 11, and the headline feature is a durable runtime, not a model. The thing that kept long-running agents out of production was never the model. It was that you deployed them on infrastructure built for request-and-response, where anything that waits gets killed.
GPT-5.6 Stops Running Your Tools Through the Model
GPT-5.6 shipped programmatic tool calling: the model writes code that runs your tools in a sandbox instead of calling them one at a time. OpenAI, Anthropic, and Cloudflare all reached the same conclusion, that the model was never a good place to run the tool loop.
The Agent Failed for Weeks and 4,286 Tests Stayed Green
A June 2026 study tracked 22 production incidents in a live LLM agent runtime. In most of them the system was already broken while all 4,286 tests and 827 governance audits stayed green. Agents fail in the seams your tests never watch.
GitHub Wasn't Built for Billions of Agents Hammering One Server
Entire, from former GitHub CEO Thomas Dohmke, mirrors your repo into regional nodes so agents stop hammering one central Git server. The real signal is the bottleneck moving from the model to the plumbing built for human-paced work.
Z.ai's ZCode Puts the Agent in the Center and the Editor on the Edge
Z.ai shipped ZCode, an agent-first coding tool where the chat is the main window and the editor is one panel around it, running on the cheap open-weight GLM-5.2. The shift to watch is not the benchmark, it is where the cursor lives.
Nine in Ten Companies Running Agents Have Already Had a Security Incident
AvePoint surveyed 750 IT leaders in regulated industries and 88.4 percent reported an AI agent security incident in the past year. The scarier number is the visibility gap: one in five companies cannot account for the agents already running on their data.
Sonnet 5 Costs $2 Today and $3 in September. Model for September.
Claude Sonnet 5 runs agents at near-flagship quality, but the launch price is a promotion that expires August 31 and jumps 50 percent. Model your agent economics on the September number, not the intro rate.
Anthropic Turned Its Coding Agent Into a Scientist
Claude Science is Claude Code pointed at a new toolbox. Same model, same autonomous loop, a reproducibility layer bolted on. The lesson for builders: the harness is the product, and your vertical is next.
The Agent Writes Half the Code, and Your Metrics Still Count Lines
Roughly 41 percent of code is AI-written now, so lines shipped, PRs merged, and commit counts stopped measuring value. The fix is not a better dashboard, it is counting solved problems instead of produced code.
AWS Built a Backend Framework That Expects an Agent to Write the Code
AWS Blocks, an open-source TypeScript framework now in public preview, assumes an AI agent writes the backend, so it bakes the correct patterns into the framework instead of the docs. The real shift is the audience: the fastest way to make agent-written code reliable is to remove the decisions, not write better instructions about them.
Anthropic Took a Model From 17 to 93 Percent Without Touching the Model
On VirBench, Claude Sonnet 4 went from 16.9 to 92.8 percent on viral-sequence retrieval with no change to the model, just a deterministic tool underneath it. The reliability you keep trying to buy with a bigger model is sitting in the infrastructure.
The Tool Call Now Returns a Ticket, Not a Result
MCP's release candidate makes Tasks a first-class extension: a tool call can hand back a handle instead of an answer, because agent work stopped fitting inside one request. Here is what changes if you build MCP servers.
Your Model's Best Answers Are Training Data for a Cheaper One
Anthropic says Alibaba-linked operators ran 28.8 million conversations across 25,000 fake accounts to distill Claude's agentic and coding skills. For anyone running an API-backed AI product, the lesson is that your best outputs are someone else's training data.
Your Agent Logs In With a Password That Never Expires
Most AI agents authenticate with a long-lived static API key in an env var. Anthropic's Workload Identity Federation, GA on June 17, swaps it for short-lived scoped credentials your stack already knows how to issue.
Watching Your Agent Work Is Not the Same as Knowing It Works
Teams instrument their agents before they grade them, 89 percent run observability and only 52 percent run evals. Watching what an agent did is not the same as knowing whether it was any good.
The Bug Report Your Agent Read Was the Attack
An attacker writes a fake error into your Sentry project, you ask your coding agent to fix production bugs, and the agent reads the attacker's text as a remediation step and runs it. The Sentry version hit an 85 percent success rate and no security tool noticed.
MCP Went Stateless. Your State Didn't Disappear, It Moved.
The July 28 MCP spec removes the protocol session, so any request can hit any server instance and a remote MCP server can finally run behind a plain load balancer. The catch: the state you kept in the session does not vanish, it moves into opaque handles you have to design yourself.
Your Agent's Context Window Is Not Its Memory
Bigger context windows stopped making coding agents better. One team swapped a 2M-token model for 64k plus structured retrieval and watched bug-fix accuracy climb from 71 to 84 percent. The window is where the agent thinks, not where it knows.
The Agent Will Stop When Your Tests Say So
Claude Code now ships more than twenty lifecycle hooks. One lets you refuse to let the agent finish until your test suite passes. The control you want lives in the event system, not the system prompt, and the surface moved a lot this month.
Three MCP Servers, 72 Percent of the Context Gone
Every tool an MCP server exposes loads its full definition into the agent's context at the start of the conversation, used or not. One team measured three servers eating 143,000 of 200,000 tokens before the agent read a single instruction, and a benchmark found MCP costing 4 to 32 times more tokens than a CLI for identical work. Use MCP for discovery, dispatch to a CLI for execution.
Your Best Model Can Go Dark on a Friday
On June 13, 2026, a US export-control letter forced Anthropic to take Fable 5 and Mythos 5 offline for every user worldwide, with no notice and no migration window. The old risk was a deprecation email in twelve months. The new risk is your most capable model gone at 5:21 on a Friday, and most teams have never priced it in.
The Breach Will Look Like the System Working
The agent failure worth preparing for is not the jailbreak or the hallucination. It is the agent doing exactly what it was told with a credential nobody scoped down. Non-human identities outnumber humans 100 to 1, and 97 percent carry more access than they use.
The Sandbox Moved Into the Operating System
For a year, running an agent safely meant building the cage yourself out of microVMs and seccomp profiles. Microsoft Execution Containers push that boundary into the operating system, so you declare what an agent can touch instead of engineering the wall. The hard part, deciding the policy, is still yours.
Twelve Agents, Half of Them Working Alone
The average company now runs twelve AI agents and half of them work in complete isolation. The bottleneck stopped being how many agents you can build. It became whether any of them can hand work to another.
Set the Bar, Hold the Bar
Agent deployments rarely fail because the model is weak. They fail because nobody defined what done means before the run, or nobody checked the result after. The Bar is the two-part framework for the only jobs left on the human side.
Cost per Solved Task, Not Cost per Token
Uber capped engineers at $1,500 a month after burning its annual AI budget in four months, and Fable 5 costs double Opus yet wins on long migrations. Per-token price stopped being the cost; cost per solved task is, and the lever that controls it is making loops halt.
Rules Are Who You Are, Skills Are What You Know, Prompts Are What You Want
Rules, skills, and prompts each have their own cost model, and filing instructions under the wrong layer is why agents feel either bloated or ignorant. A field guide to sorting the pile.
The Judge Does Not Run Your Tests
The judge model behind agent loops like Claude Code's /goal never runs your tests or reads your repo. It only reads the transcript, so verification is only as real as the receipts your agent produces.
Stop Being the Thing in the Loop
Boris Cherny writes loops that prompt the agent instead of prompting it himself. The job moved from writing code to writing the thing that writes the code, and only two properties make that loop trustworthy: an external check and hard stops.
From RAG to Agentic Memory, a Working Blueprint
Replace static RAG with a memory-first agent. A working blueprint for episodic, semantic, and working memory.
Gartner Says 40% of Enterprise Apps Will Use AI Agents by December
From under 5% to 40% in one year. Gartner predicts an eightfold increase in AI agent adoption across enterprise apps, while 88% of companies using AI still struggle to show bottom-line impact.
Healthcare AI Agents Have Shipped. The Validation Frameworks Haven't.
Epic just put three AI agents on stage at HIMSS 2026. Art writes notes. Penny handles billing. Emmie talks to patients. The validation strategy was absent.
MCP Gave AI Agents Superpowers. Attackers Noticed.
The protocol that lets AI agents use tools also gave attackers a new attack surface. January 2026 showed us how bad it can get.
The CLAUDE.md File Is Your Actual Product Now
The file that tells your AI agent how to behave has become the highest-leverage artifact in your entire workflow. Not the code. The configuration.