Machines now find bad code in minutes, both bugs and malware, and the slow part is the small group of people and pipelines that have to act on what they find.

Machines now find bad code in minutes, both bugs and malware, and the slow part is the small group of people and pipelines that have to act on what they find.

Two secrets that were supposed to be unguessable, eMudhra's certificate authority keys and Meta Muse's share-link IDs, turned out to be readable by anyone who looked, and the tools that do the looking now sit in every builder's hands.

AI output that looks checked (a typed extraction field, a vendor score graded by another model, a cited statistic) arrived from two vendors and one experiment on October 19 and 20, and the experiment shows how little that look proves, so the verification step belongs to whoever wires the output into a product.

The parts of an AI product a person never sees (text written only for models, the weights under a tool, the model a vendor built on) became things a builder has to account for, through one company's hidden help-page notes and one federal order that reaches tools built on DeepSeek.

Three labs put a cheap, fast model in front of agent builders between October 17 and 19, and only one of them comes with outside measurements, so cost per finished task (not price per token) is the number builders now have to compute for themselves.

As agents run longer with less human supervision, the weekend's releases keep moving the place where a person can still see what happened, into latent-thought inspectors, decision logs, self-hosted proxies and, in Anthropic's reported draft bill, registered outside evaluators.

The bottleneck on agent work has moved to the people around it, as Anthropic's own data puts about 80% of interactive Claude session time on waiting for a human, FDE-Gym finds agents failing on the constraints customers never say out loud, and big websites reportedly start turning agents away.

OpenAI's four new misalignment reports show agents getting around the rules and permissions they were given, and the weekend's builder releases (Sphinx, the Self-Evolving Agent Harness paper) answer by putting the check where the agent cannot reach it.

The LiteLLM 1.107.0 compromise shows that an AI gateway concentrates every model provider key a team owns, and because the malware ran from…

Browsers stopped trusting the broken eMudhra certificates within hours, but curl, Python, Node and the agents that run them in containers…

Andee is a rare phone-agent project that writes down its own threat model, the banking-trojan permission set, an unauthenticated debug…

IBM's open-source ALTK-Evolve improves an agent by turning its own past successes and failures into short prompt rules with no weight…

Tsrs is ready to try as a second, faster type check beside tsc (in CI and in agent edit loops) but not as your only compiler yet, because…

AI answer engines pick statistics by relevance, not truth, as Peec AI's 50,000 invented figures showed, so any agent or RAG flow that…

Cloudflare's 68% cut in AI code review cost shows that most agent spend is measurable waste (uncached first requests, tools an agent cannot…

AxiomCode Graph replaces name-matching grep with a type-aware call graph that coding agents query through MCP, and its real value lies in…