In three unrelated stories this week the outcome was set by code around the model rather than the model, a stealer that switches providers when one refuses, a ChatGPT takeover built from a bundled math library, and a new coding harness whose author says its permission prompts are not security.

In three unrelated stories this week the outcome was set by code around the model rather than the model, a stealer that switches providers when one refuses, a ChatGPT takeover built from a bundled math library, and a new coding harness whose author says its permission prompts are not security.

The layer underneath the model is where this week's behavior and risk got decided, from a kernel bug an AI model weaponized through a Go default to a study showing the same tools behave differently as MCP or CLI.

The coding-agent failures disclosed on October 30 sat in the plumbing around agents, an editor's extension marketplace and a deployment platform's secret store, while a new benchmark shows the agents themselves are weakest at knowing when to stop and ask.

The most useful agent evidence this week came from people measuring agents at work, in game swarms, citation trails and red builds, and all three put the failure in coordination and checking rather than raw model skill.

GitHub's Universe releases turn coding agents into repository infrastructure, compiled into Actions, owned by the repo and billed to the org, and the same day it shipped the pinning and permission controls that make that safe to adopt.

Agent work is moving off the screen into schedules, background loops and managed harnesses, so the spend and behavior that matter now show up in telemetry instead of the chat window.

Words aimed at a model make a weak lock, so a fingerprinting script uses fake bioweapon names to make AI reviewers refuse, LangChain moved its design agent's review steps out of the prompt and into code, and Google is gating Gemini 4 Carbon by access list while it tunes guardrails.

Two October 27 studies found that reviewers bend, experts toward an agent's lean and model judges toward prompt wording, so the way review is set up decides what it can catch.

The VOLTA infostealer treats a model's refusal as a retry condition by falling back across three providers, so defenders should put their…

Lexifina/global-law stores many countries' law as one git history ordered by in-force date and serves it through a read-only MCP server, so…

CVE-2026-98432 shows that an AI-built exploit reaches ordinary servers through defaults nobody chose, like Go turning on MPTCP listeners,…

Vercel-labs/agent-desktop makes desktop agents more reliable by reading the accessibility tree and tying every element reference to its…

TokenEconomizer's main default saving comes from removing tools a coding agent never calls, because every loaded tool definition rides…

Mika's default ask mode only stops before spending money, so before trusting any phone agent you should map which irreversible actions it…

The tampered Claude Code extension in Cursor's marketplace shows that an AI coding agent inherits the security of whichever marketplace…

YC Labs' agent game experiments show multi-agent outcomes hinge on who leads, how teams talk and whether anyone checks shared state, so…