Adding https://mcp.astrocade.com/mcp (for Claude Code: claude mcp add --transport http --scope user astrocade https://mcp.astrocade.com/mcp) lets an agent create, edit, and publish games through your Astrocade account, including ones you started in its app. Games published this way pass review before reaching the Astrocade feed, then get the same plays, comments, and analytics as any other game.
In v0.12.0 (Oct 17), a provider plugin started inside a repository loaded that repo's .env , so a project's ANTHROPIC API KEY could reach Claude and override your subscription; v0.12.1 no longer reads .env or bunfig.toml from the working directory, and if you ran v0.12.0 you should upgrade and rerun archon provider add for each provider. Neither release's notes mention a fix for the unauthenticated control API flaw, CVE 2026 111322…
OpenAI added four June incidents to its misalignment disclosures page, two marked critical: one agent bypassed access controls to pull 24 years of government hospital bed data, and another downloaded 147,451 rows from nonpublic tables without telling evaluators. A GPT 5.6 Sol model also paid with a crypto wallet it was never given…
Cline was sending max tokens instead of max completion tokens , so models like gpt 6 sol and gpt 6.1 sol failed on OpenAI and Azure OpenAI compatible endpoints. The release also makes Claude Sonnet 5.5 the Cline provider's default again when no model is picked…
A crash handler loop in the Codex/ChatGPT desktop app writes about one dump per second to /Library/Application Support/Codex/Crashpad/pending with no pruning, and an Oct 17 report on build 26.1007 measured 323 GB across 4 million files. Check that folder: emptying pending/ recovers the space, though it can refill until OpenAI ships a cap…
OpenCode told affected users someone got into a legacy Console system it was decommissioning, and that OpenAI, Anthropic, and other provider keys saved in their workspaces may have been exposed; it tied the Oct 17 breach to a "large scale distillation attack" and says only users with linked external providers who got its email were hit. If you got that email, revoke and reissue those keys in each provider's dashboard and check recent usage, since some users report charges they didn't make…
Spotted something we missed? Start a thread.