Agent oversight keeps breaking at the moments nobody watches, as an OpenAI monitor that fired only when agents handed control back, attackers whose agents rode already-consented OAuth apps past user sign-in, and Copilot metrics that only now name the skills and MCP servers agents call all showed this week.

Agent oversight keeps breaking at the moments nobody watches, as an OpenAI monitor that fired only when agents handed control back, attackers whose agents rode already-consented OAuth apps past user sign-in, and Copilot metrics that only now name the skills and MCP servers agents call all showed this week.

Checking agent work is getting cheaper by shrinking what has to be checked, from a proof about compiled library code to an answer picked from a fixed menu to a single screen transition, while a steganography test showed how much a free-form output can still carry past a human reader.

The parts agents share are turning into public infrastructure, with Agent Skills handed to a neutral foundation on October 22, while the private window for fixing shared code keeps leaking, as PHP2Shell drew an exploit attempt four days before its embargo and kernel bug reports landed on a public list.

Four vendors spent October 20 and 21 shrinking what an attacker can reach (code before login, a token's lifetime, who resells model access, whether an exploit landed) while Railway's breach showed the stored keys attackers want.

Machines now find bad code in minutes, both bugs and malware, and the slow part is the small group of people and pipelines that have to act on what they find.

Two secrets that were supposed to be unguessable, eMudhra's certificate authority keys and Meta Muse's share-link IDs, turned out to be readable by anyone who looked, and the tools that do the looking now sit in every builder's hands.

AI output that looks checked (a typed extraction field, a vendor score graded by another model, a cited statistic) arrived from two vendors and one experiment on October 19 and 20, and the experiment shows how little that look proves, so the verification step belongs to whoever wires the output into a product.

The parts of an AI product a person never sees (text written only for models, the weights under a tool, the model a vendor built on) became things a builder has to account for, through one company's hidden help-page notes and one federal order that reaches tools built on DeepSeek.

TanStack AI 1.0 sells one typed tool contract across provider adapters, but the release builders will feel is the cleanup, a required…

Thu-nics/AKV lets a long-running agent drop stale tool responses straight from the model's KV cache instead of summarizing its history,…

AI-written formal proofs now cover real open-source libraries, but a proof only holds for the build it describes, so builders should read…

The Storm-0940 campaign shows that once an AI agent holds an app's consented identity it works where sign-in defenses never look, so…

Openai/php2shell-checker can flag a PHP server as vulnerable but can never confirm it is safe, and its honest UNKNOWN answer is the design…

The OpenAI CLI's @path file input is a convenience for humans and a local file read for anything that pipes data into it, so before a…

Anthropic's attack-surface study shows AI is cheap enough to find code that strangers can reach but should not, and cutting that reach…

Now that Agent Skills belongs to a neutral foundation with 70-plus host platforms and no version field in its spec, a skill only travels…