Researchers from DX (Atlassian), Capital One, GitHub, UVic, and Google published CAFE(S) in ACM Queue: Clarity, Actionability, Fidelity, Efficiency, and Security as a shared vocabulary for reviewing context handed to coding agents—not a measurement system yet.
Published Nov 4, the open source agent runs from CLI, browser workspace, desktop, VS Code, SDK, and GitHub Action, with hosted providers or local servers like Ollama, llama.cpp, and vLLM. It adds a post edit verification gate, weakened test detection, git safety snapshots, and refusal of unrequested commits or pushes, but the sandbox is off by default and small local models still fail many tasks…
Upstash ran seven coding agents through live Redis tasks and found agents couldn't enable daily backups, probed Redis logs that don't exist, read 0 stats right after traffic, and deleted a named database with no confirmation. After adding redis set daily backup , clearer tool text, and a type the name delete check, backups went from 0/15 to 15/15 and delete confirmation from 1/15 to 15/15…
OpenAI is acquiring Pierre Computer Company, maker of the Code Storage API and the open source Trees and Diffs libraries, to add source control and review to Codex on top of its internal Pando Git backend. Trees and Diffs stay open source, and the deal still needs regulatory approval…
Cyclr's report (research cutoff Aug 20) found products with a verified official MCP server rose from 47 to 100 of the same 816 (5.8% to 12.3%). Servers documenting workflow or operational actions grew from 10 to 21, while 57% of products still have no official server…
Published Nov 3, Endor Labs found that CVE 2026 103916 let an agent plant a workspace symlink so a later sbx cp read or overwrote host files such as cloud credentials or SSH keys. Upgrade Docker Sandboxes to 0.51.0 or later, since the first fix in 0.48.0 was incomplete…
Spotted something we missed? Start a thread.