Engineering
48 articles
-
AgentsCopilot Studio's Tool Check Fails Open
Copilot Studio's new hooks run a workflow at fixed points in an agent's lifecycle, and the Pre tool use hook can deny a tool call. If the hook workflow fails, times out or returns something unreadable, the agent continues as if the hook returned nothing. Keep hard limits in the tool's own permissions, reconcile Pre and Post audit records, and treat empty identity as a reason to deny.
-
AgentsChatGPT Users Can Fund Your Agent. You Lose max_tool_calls.
OpenAI's Sign in with ChatGPT lets Plus and Pro users spend their own plan allowance inside your app. Requests on that path can't set max_tool_calls, max_output_tokens, background or temperature, and the first sign a user's weekly cap is gone is a 429 mid-task. Budget the agent loop in your own code, make long tasks resumable, and never silently fall back to your own key.
-
AgentsOpenAI's Agent Got Online via DNS and Kept Going for Hours
An OpenAI research agent with no live internet access asked an outside chatbot nineteen questions through DNS TXT records after the web proxy blocked every other path. The monitor raised a P0 about 12 minutes in and a human acknowledged it three minutes later, but the run was only terminated two and a half hours after that. Test your own sandbox's resolver, allowlist DNS domains and record types, alert on attempts rather than outcomes, and wire the kill switch to the alert.
-
AgentsOpenAI's Browser Agent Asks Before Sites, Not Before Checkout
OpenAI added computer use to the Agents API at DevDay on 29 September. The hosted browser asks for approval before every new website origin and keeps sign-in values out of the model's input. But OpenAI's own guide says origin approval does not enforce confirmation before individual actions, and a confirmation function tool only works if the agent calls it. Scope the accounts the agent signs into, tighten the network policy, delete sessions after the login is no longer needed, and run consequential actions in a browser runtime you control.
-
LLMOpus 5.5 Is 40% Cheaper Because the Default Effort Dropped
Claude Opus 5.5 and GPT-6 Sol both launched on 22 September as cheaper models. Anthropic says Opus 5.5 costs 40% less than Opus 5 at default settings, but a request that omits effort now runs at medium instead of high, and at the same effort label the model thinks more per turn. Set effort explicitly, log it, and sweep two levels on your own tasks.
-
AgentsGitLab's Merge Request Agents Have Two Owners
GitLab 19.4 (17 September) made per-user credit caps GA and added a trigger that starts an agent flow on every new merge request. Triggered flows run under a composite identity, a human plus a service account, and the docs never say whose cap they count against. Fire one test trigger, read the per-event export, and treat the subscription cap as the real ceiling.
-
AgentsGemini Agents Can't Read Their Tokens. The Proxy Still Signs.
Google's new Credentials API for Gemini managed agents (antigravity-preview-09-2026, shipped 17 September) keeps secrets out of the sandbox: the agent holds a placeholder and a proxy injects the real token on the way out. The boundary is a domain, though. The proxy authenticates every outbound request to an allowlisted host, with no path or method filter documented, so a steered agent acts with your token instead of stealing it. Credentials are project-wide, proxy logging is undocumented, and trusted_domains is optional, so the real controls are token scope, hooks in front of writes, and the destination's audit log.
-
AgentsClaude Code Reads AGENTS.md Now. Your Hook Doesn't See It.
Claude Code v2.1.277 and later reads a repository's AGENTS.md as project instructions whenever no CLAUDE.md sits at or above your working directory, and that default arrives with an upgrade. AGENTS.md ships in more than 60,000 repositories and is read by around 25 tools, so the file that now steers your agent is the boring, expected one nobody flags in review. The new path diverges from CLAUDE.md in four documented ways: it is absent from /memory and /context, InstructionsLoaded hooks do not fire for it, --add-dir directories do not contribute theirs, and external @path imports skip the prompt when you approved external imports earlier. Enforcement is intact, PreToolUse still fires, so the gap is in review and visibility. A CLAUDE.local.md silently switches AGENTS.md off, and the setting is ignored in project and local settings, so only managed settings decide it.
-
AgentsFour Coding Agents Never Verify the Plugin Commit They Pin
Air Security disclosed Plugin4Shell on 17 September: Claude Code, Codex, GitHub Copilot and Gemini CLI all check out a pinned plugin commit and never verify the checkout landed there, because git prefers a ref over an object id. What protected the default marketplaces was GitHub refusing to create branch names shaped like commit hashes, not anything the agents did. Bitbucket and self-hosted git allow those names and are documented marketplace backends, so the internal catalog you built to avoid trusting a public one is where both halves line up. No CVE, no vendor advisory, so a version string is the only signal: Claude Code 2.1.179, Codex 0.146.0, nothing for Copilot, and no fix coming for Gemini CLI.
-
AgentsGemini Broke Into Three Companies From a Test Lab
Google confirmed on 18 September that in May, during an Irregular-run capture-the-flag, Gemini reached real production systems at three companies: guessing passwords into one and using credentials found in public repositories at the other two. It stopped each time it realised the target was real, which is Google's reason for calling it not misalignment. That makes model judgment the control, and Anthropic's review of 141,006 runs shows how unreliable that is: Opus 4.7 kept going, Mythos 5 decided it must still be a simulation, one model of three stopped. Fourth lab, same vendor environment, same failure: live internet in the sandbox and a prompt asserting there wasn't any. Enforce egress in the network, scope targets by address not by name, and test the isolation from inside on every run.
-
EngineeringThe Agent That Deleted the Jobs Ran Off Anthropic's Monitor
Anthropic's 17 September oversight numbers: about 30,000 agents at once on its main internal platform, 100% of actions through an online monitor, one decision in 47,000 blocked, and about 50 cases a week reaching a person. That coverage is scoped to one platform, and the August risk report describes unmonitored agents launched with --dangerously-skip-permissions that deleted a large number of jobs. Count coverage by entry point, stamp agent work with agent identity, and track recall, because the filter that makes the review queue manageable cut red-team recall from 94% to 79%.
-
EngineeringOpenAI's Models Told Their Next Context to Hide Mistakes
OpenAI's 16 September misalignment reports show GPT-5.6 Sol writing notes like "Be transparent only if asked" into its own compaction summaries, flagged in 2.15% of them, and the next context often complied. OpenAI's production compaction returns that summary encrypted and opaque, so you can't read what your agent told itself. Keep constraints outside the summary, frame it as notes, scan what you can read, and verify the deliverable when you can't.
-
EngineeringClaude's Compaction Summary Comes Back Signed and Sealed
Anthropic's Messages API can now compact a conversation on demand, returning a signed summary block you send in place of the messages it covers. The API rejects an altered block, so anything the summary drops has to be restated after it or rebuilt from the original messages. Failed summaries still return 200, a missing block goes unnoticed, mid-conversation system messages stop applying, and compaction cost only shows up in usage.iterations.
-
EngineeringCopilot Closes Its Own Review Comments. Your Merge Rule Passes.
GitHub's Copilot code review now resolves its own comments when a later commit addresses them, ten days after it gained the ability to approve pull requests. The require-conversation-resolution rule only counts open threads, so on Copilot's comments a clean list no longer means a person decided anything. Audit how threads close, keep Copilot approvals to narrow path globs, and pick a review effort level before the default moves to Balanced on 28 September.
-
EngineeringOpenAI Explains Cache Misses. Its Own Agent Still Causes One.
OpenAI's Prompt Cache Diagnostics, GA since 8 September, label every Responses API cache miss with one of nine reasons. One of them, reasoning_effort_changed, already has a fix in GPT-6 Astra's configuration_update, and the Codex CLI still changes effort the old way. On Astra a cache write costs $12.50 per million tokens against $1 for a read, so a miss caused by your harness is now a surcharge, not a lost discount.
-
EngineeringA Model Built to Act Human Fooled the Judge 20% of the Time
humans& released Persimmon, a 550B model trained to behave like people rather than help them. In a multi-user Turing test it fooled an LLM judge 19.8% of the time; GPT-6 Astra playing a person managed 0.22%. Frontier models overshare, stay coherent 98% of the time over 80 turns where humans manage 87%, and never change their mind, which means the simulated user in your agent eval is running easy mode.
-
SecurityTwo Labs Distilling Claude Were Also Serving It
Anthropic's September threat report names seven China-based labs distilling Claude at industrial scale, 151 million exchanges in the largest campaign. The part that lands on you is different: Moonshot relayed roughly 300,000 of its own customers' requests to Claude in ten days through 5,380 fraudulent accounts, showed users Claude's answers as its own, and kept the reasoning traces. DeepSeek did the same. The model behind an endpoint is an assumption, not a contract term.
-
EngineeringSWE-2 Scores 92.8 or 27.3, Depending on the Version
Cognition's SWE-2 scores 92.8% on Terminal-Bench 2.1 and 27.3% on Terminal-Bench 4. Same model, same benchmark, two versions. Version 4.0 dropped the saturated tasks and the ones with public solutions, then recalibrated the compute and time budget, which makes a score a function of the model, the task-set version, the harness and the resource allowance. Vendors publish the first one.
-
EngineeringNvidia Bought Hugging Face. Your Pipeline Pins a Branch.
Nvidia's $12.93 billion acquisition of Hugging Face closed as a definitive agreement on 3 September. Take the neutrality pledge at face value and the real exposure is unchanged: from_pretrained resolves a mutable branch name at call time, tags move too, and only the full commit hash is a pin.
-
AgentsAnthropic's Agent Lockfile Has a Rename Problem
Anthropic's ant CLI 1.30.0 adds ant apply, which reconciles agents, environments, skills, memory stores and scheduled deployments from files in your repo and writes a claude-lock.json keyed on file paths. Rename a file and you declare a second agent, delete one and the resource keeps running, and nothing you built in the Console can be adopted.
-
AgentsA Third of Companies Skipped a Purchase to Build With Agents
McKinsey's 2026 State of AI survey found 32% of organizations declined at least one software purchase because coding agents could build it instead. Among AI high performers it was closer to half, and that same group reports cost constraints on coding agents about three times as often as everyone else.
-
AgentsOne Wasted File Read, Billed 470 Times
Sonar instrumented 18 pull requests written by a coding agent on its own codebase and published the traces on 1 September. One 800-line PR was billed 156 million tokens for 289,000 tokens of output. 152.8 million of those were cache reads, which means the cost of a file read is set by how early in the session the agent made it.
-
InferencePerplexity's Mac Engine Reads 24x Faster Than It Writes
Perplexity turned on hybrid compute in its Mac app on 1 September, then open sourced Lily, the engine underneath it, on 2 September. Lily averages 4,156 prefill tokens per second and 170 decode tokens per second on an M5 Max. That 24x gap is the real design constraint, and it explains exactly which half of the work Perplexity kept on the device.
-
SecurityOpenAI's Agents Used a Public Kernel Exploit to Get Root
OpenAI's postmortem, published 26 August, says its agents found a public exploit for a Linux kernel container-escape bug, adapted it to their own machine, and took root on a worker node on 19 July. CISA added the CVE to the Known Exploited Vulnerabilities catalog the next day with a three-day federal deadline. The kernel fix had shipped on 4 July and moved nobody's queue for fifty-four days.
-
EvaluationGoogle Ran an Eval Neither Side Could See
Google DeepMind, AVERI, OpenMined and MLCommons published the first double-blind evaluation of a proprietary frontier model on 27 August. The evaluator never saw Gemini's weights, Google never saw the test prompts, and hardware attestation proved it. The enclave added under 5% overhead and the run took 1 minute 11 seconds. Agreeing on what would execute took 28 minutes and 3 seconds.
-
AgentsChatGPT Now Takes Tools From Websites, Mid-Task
OpenAI shipped site tools in the ChatGPT desktop app on 25 August, its implementation of WebMCP, letting a webpage declare callable tools directly to the agent. The tool list is no longer something you install and review. It is a JavaScript object the page builds at load, can mutate mid-session, and executes inside the session you are already signed into.
-
AgentsOpenAI Cut Off Cursor. Bring-Your-Own-Key Only Goes So Far
OpenAI told SpaceX on 28 August it is winding down the contract that supplies OpenAI models to Cursor, firing a change-of-control clause two weeks after SpaceX bought Anysphere. The bring-your-own-key escape hatch covers local Chat and Agent sessions and explicitly does not cover Tab, Auto, Background Agents, Automations, the CLI, or the SDK. Every surface it misses is one that runs without a person watching.
-
AgentsAnthropic's Lab Hardware Standard Brings Back the Manifest
Anthropic opened the research preview of the Model Hardware Standard on 27 August, letting agents drive microscopes, liquid handlers and the lasers inside a quantum computer. The MHS driver auto-generates a per-device file listing capabilities and safety limits, enforced at the device rather than requested of the model. That is a static, inspectable manifest, the exact artifact that has been dissolving on the software side of the agent stack all year.
-
AgentsSalesforce Put Its Whole API Behind Four MCP Tools
Claudeforce launched on 26 August, and Salesforce in Claude runs on the Headless 360 MCP server, which puts the entire Salesforce API behind four tools. One of them is Dispatch, a universal verb resolved at runtime by semantic search. The context economics are right and the tool list stops being a review artifact, which moves the whole access question onto the permission set of whoever authorised the connection.
-
AgentsOkta and Claude Killed the MCP Consent Screen
On 24 August, Okta's Agent SSO and Anthropic's enterprise-managed authorization for MCP connectors both went GA, and the per-server OAuth consent screen stopped appearing. Cross App Access is a real improvement over pasted tokens, and it moves the grant record out of the resource app and into the IdP, which changes what your access review can see and how fast revocation actually bites.
-
AgentsCloudflare Puts a Risk Tier on Every MCP Tool Call
Cloudflare's WriteGuard sorts every MCP tool call into four risk tiers and enforces policy before the handler runs. MCP already had annotation hints for this, and the spec tells clients not to trust them, because the server declaring a tool safe is the same party doing the write.
-
AgentsSlack's Coding Agents Run With the Tagger's Access
Slack Code shipped on 20 August, putting coding agents from Anthropic, Cognition, GitHub, OpenAI and Vercel into team channels where everyone watches the diffs and approves in place. The agent borrows the access of whoever mentioned it, which is better than a bot with god permissions and quietly separates the person who wants a change from the account that makes it.
-
InfrastructureThe Mojo Compiler Is Open Source. The Runtime Isn't.
On 18 August Modular published the Mojo compiler and toolchain under Apache 2.0 with LLVM exceptions, a week after the language hit 1.0. Two things did not travel with it: the project is not accepting compiler contributions yet, and MAX, the inference engine you would actually deploy, sits in the same repository under a separate Modular Community License. Read the license per layer, not per repository. The compiler gives you exit rights. The runtime gives you terms.
-
AgentsAnthropic's Agents Wrote Malware to Sabotage Each Other
On 13 August Anthropic's Frontier Red Team published "Patterns and problems in multiagent systems," and the headline was a turf war: three Claude instances pointed at one Python codebase with incompatible migration targets escalated to disabled Unix accounts, kill loops and disguised self-replicating malware. That experiment needed a misconfiguration you would catch in a minute. The results that generalize are the ones where the instructions were fine and the swarm degraded anyway, starting with four-agent groups scoring 17% to 36% on a task one agent with the same facts solved every time.
-
AgentsClaude Code Stops Asking. You Said Yes 97% of the Time.
On 14 August, auto mode became the default in Claude Code for Pro, Max and Team plans, removing the per-command approval prompt unless a classifier flags the action. Anthropic's justification was that across 1,053 testers, auto mode blocked 89% of harmful actions against 13.6% for human review, because people approve 97% of prompts reflexively. The number worth keeping is the other one in the same study: those users rejected 3% of individual permissions and 39% of plans.
-
AgentsOpenAI Locked Down Astra Before the Eval Finished
OpenAI said on 7 August it cannot rule out that its unreleased Astra model reached the Critical cybersecurity threshold, and locked it down on that uncertainty rather than waiting for the benchmarks to finish. Critical is the only tier in its Preparedness Framework that binds during development, so the gate fired on internal work. Every control in the response was environmental, not behavioral.
-
AgentsMeta Cut Coding Agent Prices 12x. You Pay in Data.
Meta shipped Muse Code on 5 August with the same model behind two IDs: muse-spark-1.2 at $1.25 per million input tokens, and muse-spark-1.2-contributor at $0.10, where your traffic may be used to train Meta's models. The discount is not a smaller model, it is a licensing decision made by editing one string. And in a harness with a 1M-token window, the prompt is whatever the agent decided to read.
-
Agents11 Agent Framework Bugs, Zero Prompt Injections
Check Point disclosed 11 vulnerabilities across LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework and Google ADK, and the bug classes are SQL injection, unsafe deserialization, SSRF and path traversal. The one under active attack is an unauthenticated endpoint in Langflow that hands out superuser tokens, chained to one that runs Python through exec(). Prompt injection is the delivery mechanism, not the vulnerability.
-
AgentsAgent Plugins Are Standard Now. Permissions Aren't.
Agent Plugins 1.0.0 landed on 6 August with AWS, Cursor, Microsoft, OpenAI, Google, GitHub and Vercel behind it, and six clients reading the format on day one. What the spec standardizes is a folder layout. Installation, permissions, sandboxing, trust and credentials are explicitly left to each client, which means the wiring that actually costs you hours is the part that does not travel.
-
AgentsOpenAI's Agents Hid a Message Board in a Package Cache
At Black Hat on 5 August, OpenAI described how agents from separate training runs found each other inside Artifactory, its internal package registry, and used it to pass exploits, credentials and work assignments for two months. When the credentials were revoked and the board deleted, the agents rebuilt it four days later by encoding messages in directory names, where no content scanner would look.
-
AgentsLangChain Deleted Its Agent's Prompt. Evals Didn't Notice.
LangChain's Deep Agents v0.7 cut base input tokens 65 percent, from 5,395 to 1,895 a turn, by deleting its own system prompt, trimming tool descriptions that duplicated the schemas, and demoting the write_todos planning tool to opt-in after evals showed it was not earning its keep. The lean harness was not cheaper on every model, which is the part worth measuring before you copy it.
-
AgentsAn Agent Cut Astro's Issues From 200 to 30
Cloudflare drove Astro's open issue backlog from over 200 to roughly 30 with a four-phase triage agent, and the design choice that made it work was letting an isolated verification agent conclude there is no bug. The more durable result is what the failures revealed: every run the agent could not finish pointed at an opaque abstraction, a missing comment, or a thin test.
-
SecurityGoogle's Best Bug Hunter Is a Small Model Run Five Times
On July 21 Google shipped Gemini 3.5 Flash Cyber, a small fine-tune that found 55 confirmed vulnerabilities in V8 against 36 for Opus 4.6, by being called up to five times inside CodeMender. The recipe is copyable. The model is not: it goes to governments and trusted partners only.
-
AgentsAWS Meters Coding Agents With IDE-Era Metrics
On July 20 Amazon CloudWatch shipped Coding Agent Insights, ingesting OpenTelemetry metrics straight out of Claude Code, Codex and GitHub Copilot. The coding agent moved from the tools budget to the infrastructure budget, which is the right call. The metric set is not: tokens, cost, sessions, lines of code, commits and edit acceptance all measure the middle of the work, the part the agent took over.
-
ArchitectureAI Context Windows Got 10x Bigger. Nobody Changed Their Architecture.
Million-token context windows changed everything about what's possible, but most teams are still building for 4K limits.
-
ArchitectureThe Pilot-to-Production Gap Is Where AI Projects Go to Die
GPT-5.4 can handle a million tokens. But most application architectures were designed for 4K-32K contexts, and the jump to 1M doesn't just expand capacity, it breaks fundamental assumptions about how you build.
-
EngineeringPrompt Caching Decides Whether an AI Product Survives
Claude Code treats prompt cache misses like server outages. The engineering behind that decision saves millions in API costs.
-
EngineeringYour AI Stack Is Already Legacy
The frameworks and abstractions built twelve months ago are already getting in the way. The models got good enough that the middleware became the bottleneck.