VulnCheck says Archon 0.2.13 through 0.11.1 (including the current release) binds its /api/* control API to 0.0.0.0 with no auth by default, so anyone on the network can message the coding agent, which runs with bypassPermissions, and run commands as the Archon user. No fix is listed yet; set HOST=127.0.0.1, or set both DATABASE_URL and BETTER_AUTH_SECRET to turn on the auth gate.
As of Oct 16, adding https://mcp.teable.ai/mcp to an MCP client (for example claude mcp add transport http teable https://mcp.teable.ai/mcp ) lets agents list projects, inspect tables and fields, query and edit records, and discover APIs within your existing permissions, approved once in the browser instead of with a personal access token. Self hosted instances expose it at /mcp , and Settings → MCP lists connected clients so you can revoke them…
As of Oct 16, GitHub Enterprise Cloud repos with Code Security can enforce an enterprise wide dependency license policy through a ruleset condition, Require license compliance results before merging , which annotates and blocks PRs that add noncompliant dependencies. A new API endpoint checks whether packages comply, so coding agents can avoid suggesting dependencies that break the org's license rules…
As of Oct 15, SPACE ( perplexityai/SPACE , written in Rust) runs agent or user code in isolated Firecracker microVMs behind an HTTP API for creating sandboxes, running commands, streaming output, and pausing, resuming, or branching sessions, with credentials and network access kept outside the VM. It deploys locally on a Kind cluster, and CoreWeave, Akamai, and Crusoe have signed on to offer it to customers…
As of Oct 15, FLUX 3 Image Klein ships as open weights (base for LoRA fine tuning plus a step distilled model) with native 4K output, bounding box edits, and up to 10 reference images; the INT8 build runs on 8GB RTX GPUs via ComfyUI or Diffusers. It's under the FLUX Kommunity License (free commercial use under $5M revenue) and on the BFL API as flux 3 image klein from $0.009 per image…
Claude Code v2.1.302 (Oct 16) enables fork subagents everywhere the terminal already had them (set CLAUDE CODE FORK SUBAGENT=0 to opt out) and adds CLAUDE CODE AUTO MODE MODEL to pick the model behind the client side auto mode classifier. The release also notes that standalone Claude Design at claude.ai/design closes on December 14, 2026…
Spotted something we missed? Start a thread.