Independent AI intelligence Two editions daily · ET
Fervor AI
Menu

AI Trending Briefing · September 25, 2026 · afternoon edition

Three vendors and one federal appeals court each moved a piece of the agent control plane out of the agent process and into whoever hosts it.

AnthropicMicrosoft Foundry Agent ServiceTurnstile SpinLangSmith Custom AppsMicrosoft Agent FrameworkHindsightagent-infrastructureagent-identityagent-memoryregulationagent-securitymulti-agent

Trending AI Briefing: Friday, September 25, 2026 (afternoon ET)

An agent's schedule, its memory, its review interface, and the security controls on the site it touches all used to live inside the agent's own process, or at least inside code its builder wrote. Three vendors shipped in the last 48 hours, and each one pulled a piece of that out and handed it to a platform that runs it on the builder's behalf, usually holding an identity of its own while doing so. Microsoft turned scheduling into a managed resource and memory into a Foundry-managed service. LangChain turned the review interface into a hosted app inside its own auth boundary. Cloudflare had a coding agent install a security control that the agent, and Cloudflare, then cannot inspect. Then the D.C. Circuit ruled on the outermost layer of that same stack and said the government decides which model vendor a defense contractor is allowed to have in it at all.

What's hottest in AI news right now

The D.C. Circuit upheld the Pentagon's designation of Anthropic as a supply chain risk on September 25, two to one, and the scope is the part builders should read. Judges Gregory Katsas and Neomi Rao formed the majority and Judge Karen LeCraft Henderson dissented. The majority held the Pentagon had "ample support" for the designation and framed its reasoning around "what Anthropic does, not why Anthropic does it," which matters because a separate federal judge in California had earlier found the Pentagon acted illegally by punishing the company for its criticism of the department's views on AI use. The Defense Department began removing Claude from its workflows earlier this year, and the ruling upholds its ability to continue, including prohibiting contractors from using Anthropic products. Under this ruling the products are not barred from the federal government as a whole. Pentagon spokesman Sean Parnell said the decision "completely validates the Department's position," and Anthropic said it respectfully disagrees and pointed to the parallel designation another federal court has already held unlawful. The uncomfortable lesson for anyone with Claude in a defense-adjacent stack: this vendor risk is not technical, and the vendor cannot patch it. (CNBC, wire copy via CP24)

Microsoft made Routines generally available in Foundry Agent Service on September 24, which converts agent scheduling into a managed resource that can hold an identity of its own. A routine binds a trigger to an agent and its instructions, and Foundry then queues the invocation, runs the agent, and records the result. Three trigger types ship: a timer for one future run, a recurring cron schedule (Microsoft's own sample uses 0 7 * * 1-5), and event-based firing from a connected system such as a GitHub issue or a Teams message. The identity field is where this gets consequential. A routine either acts with the creator's delegated access or runs as an independent agent under its own configured permissions, and that second option creates a scheduled actor whose authority keeps working after the person who created it stops. A reminder tool, still in preview, goes one step further by letting an agent schedule its own re-invocation on the same conversation with context preserved. The catch is small and telling: the Python surface is AIProjectClient.beta.routines.create_or_update(), still carrying beta on a feature announced as generally available, and the post states no pricing, quota, or concurrency limit anywhere. (Microsoft Foundry devblog)

Cloudflare shipped Turnstile Spin on September 25, handing an AI coding agent the job of wiring bot protection into a codebase Cloudflare deliberately never sees. Spin runs in three modes: a fresh install that embeds the widget on the frontend and wires Siteverify into the backend, a widget recovery that adds the missing server-side check to a widget already running without one, and a CAPTCHA migration that detects an existing provider and proposes a substitution plan. You start it from the dashboard, from Wrangler, or by pointing any agent at a public skill, which Cloudflare's blog describes as a skill URL on GitHub and its own docs serve at https://developers.cloudflare.com/turnstile/spin/prompt.md with the source in the cloudflare/skills repo. Cloudflare says Turnstile now processes about three billion verifications on a typical weekday, and that the dashboard has recorded more than 65,000 successful Spin widget creations since the July 2026 release. Here is the tension worth sitting with. Widget recovery exists because real deployments shipped a Turnstile widget with no server-side validation behind it, which is a decorative control. An agent can reintroduce that exact mistake, and because Cloudflare states plainly that it does not "send your application code to Cloudflare or ask Cloudflare to change it remotely," nothing on Cloudflare's side can confirm the backend half actually landed. (Cloudflare blog)

LangChain shipped LangSmith Custom Apps on September 24, letting a team build a review interface and run it inside LangSmith rather than hosting it themselves. Apps sit on top of LangSmith data, reach it through the LangSmith API, and inherit the workspace's existing permission and authentication systems, so the pitch is that teams skip hosting, auth, and permissions work entirely. You build one by chat prompt on Plus and Enterprise plans, or from code templates with a coding agent doing the typing. The plan gate is the detail: Plus organizations get one Custom App plus the chat experience, Enterprise gets unlimited. That is a per-seat-tier cap on how many views you are allowed to put over trace data you are already paying to store, and the post names no limits at all on app complexity, data volume, concurrency, or API rate. (LangChain blog)

Microsoft Agent Framework added AG-UI, a Foundry memory provider, workflow checkpointing, and CodeAct on September 24, and the writeup is unusually frank about what each one does not promise. AG-UI is an open event-based protocol for agent-to-interface communication covering streaming responses, tool activity visibility, and user approval, stable in Python and in public preview for .NET. FoundryMemoryProvider pulls relevant memories before execution and extracts new ones after, and Microsoft says outright that the extraction is asynchronous and does not guarantee immediate recall, which is exactly the property that makes memory bugs hard to reproduce. Checkpointing persists workflow state through Foundry Agent Service, paired with the sentence "Recovery does not imply exactly-once execution of external effects," so idempotency stays your problem after a resume. CodeAct, Python only and built on Hyperlight, gets credited with roughly 50% latency reduction and better than 60% token savings in evaluated workloads, a number Microsoft reports from its own evaluation with no third party named. (Microsoft Agent Framework devblog)

New tools and features worth actually trying

Foundry Routines with agent identity, in a project you can throw away. Create one recurring routine under the creator-delegated identity and one under an independent agent identity, then revoke the creator's access and watch which one keeps firing. That is the whole lesson in ten minutes. Honest tradeoff: this is Azure-shaped all the way down, the Python entry point is still under beta, and the announcement gives you no pricing or quota to plan against.

Turnstile Spin in widget-recovery mode on a form you already ship. If you have a Turnstile widget anywhere without a Siteverify call behind it, this is the cheapest possible fix, and Turnstile itself remains free. Honest tradeoff: an agent is editing your auth path, Cloudflare cannot see the result, and you still have to read the diff yourself and prove the server-side check rejects a forged token.

Hindsight as a standalone memory server. The Docker image starts with one command and gives you retain, recall, and reflect over Postgres with pgvector, which is a real alternative to bolting vector search onto your agent loop. Honest tradeoff: it is a separate service with a real database to operate, the README's own framing says it is overkill for simple automation, and its state-of-the-art LongMemEval claim is dated January 2026 with reproduction credited to research collaborators rather than an independent benchmark authority.

Agent Framework checkpointing against a workflow that sends an email. Kill the process mid-run, resume it, and count the emails. Honest tradeoff: Microsoft already told you the answer might be two, so what you are really testing is whether your own side effects are idempotent, and fixing that is days of work rather than a config flag.

Trending AI repos on GitHub today

Trendshift daily board re-read at 3:21pm ET after an earlier read went stale mid-run; the ranks below are that 3:21pm read. The board reshuffled twice more during this run (hindsight read #1 at 3:21pm and #6 about an hour later), so treat every rank here as a snapshot. Rankings there are momentum scores, not star deltas. Star counts come from cache-busted shields badges and licenses from the LICENSE file text.

  • vectorize-io/hindsight (#1): agent memory built around retain, recall, and reflect over Postgres with pgvector, rather than plain document retrieval. Why now: the paperclip and obsidian integrations both cut releases this morning at 11:45 UTC, which is what put it at the top of the board beside paperclip itself. MIT, "Copyright (c) 2025 Vectorize AI, Inc.", ~30k stars, latest release integrations/paperclip/v0.4.0 on 2026-09-25, and the README's state-of-the-art LongMemEval claim is dated January 2026 with reproduction credited to research collaborators rather than an independent benchmark authority.
  • rocketride-org/rocketride-server (#4): a visual pipeline builder and C++ runtime for AI apps, usable inside VS Code or from the CLI, claiming 100+ nodes across 15+ LLM providers. Why now: today's VS Code extension prerelease. MIT, ~12k stars, extension v1.4.0 prerelease on 2026-09-25 at 01:17 UTC built automatically from develop, and the LICENSE copyright line reads "Copyright (c) 2026 Aparavi Software AG," which does not match the org name.
  • rohitg00/ai-engineering-from-scratch (#5): a free AI-engineering curriculum, 523 lessons across 20 phases from math to production systems, in Python, TypeScript, Rust, and Julia. Why now: the Edition 2026.09 release on 2026-09-07 has kept it climbing all month. MIT, "Copyright (c) 2026 Rohit Ghumare", ~57k stars, and the README's traffic figures (114,584 readers, 181,995 page views in 30 days as of August 2026) are self-reported with no source given.
  • dream-num/univer (#10): an SDK for embedding spreadsheet, document, and presentation editing into your own product, now pitched as the office harness for AI agents. Why now: the agent-facing framing is new and it lands the same week several vendors started shipping document surfaces for agents. Apache-2.0, ~18k stars, v1.0.2 on 2026-09-24, and the LICENSE file is the bare Apache text with no copyright line filled in.
  • Contrastive-LM/CLM (#13): CLM-8B, a contrastive-learning "System One" model positioned as a fast verifier and policy model for agentic decisions. Why now: it is the third low-latency decision model to trend this month. Apache-2.0, ~1.2k stars, no releases at all, and the LICENSE file still reads "Copyright [yyyy] [name of copyright owner]" with the template never filled in.
  • NVIDIA/Model-Optimizer (#18): quantization, pruning, NAS, distillation, speculative decoding, and sparsity for models headed to TensorRT-LLM, vLLM, or SGLang. Why now: ModelOpt 0.47.0 landed 2026-09-23 and the local-inference crowd is reading it. Apache-2.0 with bundled third-party Apache, MIT, and BSD-3-Clause code, ~4.2k stars, and the LICENSE file carries no filled copyright line either.
  • asokurasu/text-humanizer (#19): a multilingual rewrite pipeline that reworks AI-generated text to read naturally and, in its own words, bypass most AI detectors. Why now: it is the detector-evasion counterpart to every writing agent shipping this month. MIT, "Copyright (c) 2026 asokurasu", ~480 stars, no releases, and the "completely free" billing sits on a four-stage pipeline calling DeepSeek, Google Translate, and DeepL, which generally want paid API keys.

What actually matters from today's signal

Track where the identity lives. Every launch above is a story about an agent's surrounding machinery gaining an owner who is not the builder, and identity is the field that tells you which owner. A Foundry routine running under its own configured permissions is a scheduled principal with authority that survives its creator. A Custom App inheriting a LangSmith workspace's auth is a UI whose access boundary is set by a vendor's plan tier. An agent running the Turnstile skill is writing into your authentication path under whatever credential you handed the agent. The four highest-signal places for builders right now are scheduled agent identity, memory as an external service with its own store, vendor-hosted interfaces over your own trace data, and agents that write security-relevant code the security vendor cannot see.

The counter-signal is that almost nobody is shipping the audit half. Microsoft at least says what recovery does not guarantee and what memory extraction does not promise, and that honesty is the exception rather than the standard. Cloudflare cannot verify the control its own agent installed. LangChain does not say what a Custom App can read beyond "LangSmith data." Nothing in today's set gives you a single place to ask what your agents are scheduled to do next week, under whose authority, against which stores. The board itself is the same gap in miniature. The repo trending at number one is a memory server whose headline benchmark claim is dated January 2026 and reproduced by its own research collaborators, and three of the seven repos below it ship Apache license files with no copyright holder named at all, one still carrying the literal [yyyy] [name of copyright owner] template. The tooling around the agent is arriving faster than the discipline for trusting it.

And the ruling reframes all of it. A designation upheld on Friday morning can pull a model vendor out of an entire class of stacks on Monday, and no amount of architecture on your side prevents it. If your agent design treats one lab's model as load-bearing infrastructure, today was the day that assumption acquired a legal failure mode. Write the abstraction layer now, while it is still a refactor rather than a fire drill.

Source access notes: The CNBC story on the D.C. Circuit ruling returned a 403 from this workspace; the ruling details above came from the syndicated wire copy at CP24, and the CNBC link is included as the primary reference. Google's AI blog index returned no dated September 24-25 entries and was treated as no-signal rather than fetched further. Mistral's newsroom's most recent post is dated September 16 and xAI's is September 22, so neither shipped in window. developers.openai.com/codex/changelog now redirects to learn.chatgpt.com/docs/changelog, which resolved and confirmed Codex CLI 0.157.0 dated September 25; that release was already covered in this morning's briefing and is not repeated here. Claude Code remains at 2.1.282 per the npm packument (publish timestamp 1790265382622, 2026-09-24 15:56 UTC), also already covered this morning. Product Hunt returned no dated launches via site-scoped search and was skipped. api.github.com is proxy-blocked as usual; all repo figures came from cache-busted shields badges, raw LICENSE files, and releases.atom.

Article-research correction fed back: Article research on the Turnstile skill found that the blog's phrase "a public skill URL on GitHub" is one of two live locations; Cloudflare's docs point agents at https://developers.cloudflare.com/turnstile/spin/prompt.md and keep the source in cloudflare/skills. Both are named in the Turnstile paragraph now. No other briefing claim changed.

Adversarial pass: Ran against this draft and caught two real errors. Every Trendshift rank in the first draft was wrong and three featured repos (tigerless-labs/autoharness, tigerless-labs/cost-xray, dataelement/dsh-desktop) had dropped off the board between reads, so the section was rebuilt from a re-read at 3:21pm ET and those three were removed along with a downstream claim about three Tigerless Labs repos trending at once. The thesis also overcounted vendors at four by treating two Hindsight sub-integration point releases as a launch alongside Microsoft, Cloudflare, and LangChain; corrected to three vendors, with Hindsight moved to the repo and tools sections where its dated releases support it. The court ruling, all five launch paragraphs, every license, release tag, and star count verified clean.