The layer between an agent and the outside world now decides the damage, as OpenCode says a distillation attack reached users who linked provider keys to its hosted Console, a 21k-star plugin routes agents through public gateways and account pools, and GitHub and Cloudflare moved policy checks into calls an agent or gateway makes first.

The layer between an agent and the outside world now decides the damage, as OpenCode says a distillation attack reached users who linked provider keys to its hosted Console, a 21k-star plugin routes agents through public gateways and account pools, and GitHub and Cloudflare moved policy checks into calls an agent or gateway makes first.

Three Anthropic posts in two days tie an AI result to a check (rerunnable code for the NIST curve seeds, an automated evaluator for quantum circuits, revert rates for Claude Code review), while the week's open releases still ask readers to trust vendor numbers.

Passing a check once is losing its meaning, as Postgres reverts committed features partly because LLM-assisted review now finds defects faster, Cloudflare scores verified bots on ongoing behavior, and HTTP headers from ordinary sites turn out to carry instructions for agents.

The week's AI checks ship as advisors bolted to a deterministic gate, with GitHub's AI Scan unable to block a merge, agentic autofix required to pass a CodeQL rerun, and Cloudflare letting your own code confirm a DLP hit, while a trolley-problem test shows a decision model changing its answer when only the word order changes.

Thursday's agent news is about who gets to check the work, with Anthropic giving a METR team employee-like access and no publication veto, Meta releasing Muse Spark Open's weights for anyone to test, and a benchmark showing the best model still fails nearly half of a harness-building job.

Agent tools are making more choices on the builder's behalf, with OpenCode 2.0 routing every MCP server through Code Mode by default and Copilot's HydraFusion picking models and effort per stage, while GitHub's new workflow lockfiles push the other way by pinning the exact commit that runs.

The afternoon's agent news is about the controls around the model rather than the model, with GitHub making Copilot refuse to start on stale policy, LangChain moving agent memory into files the builder owns, security experts calling the labs' agent incidents basic containment failures, and a new benchmark finding coding agents claim work they did not deliver.

The last two days of agent news are about what is allowed to leave the box, with GitHub stopping Anthropic keys at push time, Anthropic fencing Sonnet 5.5 reasoning transcripts off from other organizations, Claude Code closing a sandbox path into plugin code, and Liquid AI pitching agents that never leave the laptop.

Xerj's own study shows a local index saves a coding agent tokens only on code the model has not memorized, so point it at private repos and…

Google Research's Harness² improves an agent by rewriting the prompts, tools, skills and memory around a fixed model, and its own docs show…

When a coding agent picks your dependencies, a license rule that only fires at the pull request arrives too late, so GitHub's new…

The Claude Code team shows that teams whose code is mostly agent-written should stop asking whether a human read every line and let each…

A scan of 217 million web responses shows sites already write instructions for AI agents into HTTP headers, and whether an agent ever sees…

Perplexity's SPACE makes the agent sandbox something you can host yourself, an Apache-2.0 Firecracker microVM platform with an…

GitHub's October 15 launches show where AI belongs in a review pipeline, with AI Scan kept advisory beside the diff and agentic autofix…

Concat turns a free video editor into something an AI agent can drive through a token-gated local JSON-RPC API, but its MCP server is…