Now GA for Enterprise (Oct 23), every conversation starts as chat and moves into an Anthropic-managed cloud VM, network egress off by default, when it needs to run code or touch files, and keeps going after you close the laptop. It's off by default for existing orgs until it switches on Nov 16 (Organization settings > Capabilities), and isn't available yet for ZDR, HIPAA-ready or CMEK setups (admin guide).
Shown on HN Oct 23, the 11 tool server reads notes (checklists, tables, tags, OCR'd attachment text) as Markdown from a read only database and writes changes character by character through Apple's private NotesShared framework, refusing an edit if the note changed since your agent read it and keeping 20 backups. It needs macOS 26+ on Apple silicon plus Full Disk Access, and it's a brand new one person project, so try it with brew install cask xiaofeng han/tap/apple notes mcp and consider the Read Only tool preset first…
Forever Security traced a customer's agent trying to install the malicious npm package function color to an AGENTS.md in /Downloads , its working directory, then reproduced the attack on Codex (90% success with a harmless payload) and used a malicious CLAUDE.md to leak Claude Code's OAuth token. There's nothing for vendors to patch, so start agents in the project root, never /Downloads , and read unfamiliar instruction files first…
Out of beta since Oct 22, the gpt 6 luna endpoint for yes/no, pick one and score questions adds prompt caching ($0.01 per 1M cached input tokens, $0.10 uncached, still no output charge), native JSON inputs, images in question instructions, US and EU residency, GPT Live integration, and up to 400 questions per request. Datadog says it scores the risk of agent generated shell commands before running them at 40x faster p95 than frontier models, which makes it a cheap gate for an agent's next step…
Axios reports Morgan Stanley has begun blocking third party agents, and JPMorgan, Bank of America and Citi are restricting them, after banks found agents using customers' own credentials and sometimes acting beyond user instructions. Most banks are moving toward read only access, so if your agent touches finances, plan on open banking APIs rather than a user's login…
Released Oct 25, the fixes stop symlink and path tricks that let the filesystem server write or peek outside allowed directories (Windows only partly fixed), block other web origins from calling the everything server over HTTP, and close SSRF gaps in fetch via IDNA host names and NAT64 addresses. Package managers rank 2.0.1 below old date versions, so install it explicitly, e.g. npm install @modelcontextprotocol/server [email protected] , and update mcp server fetch to 2026.10.24…
Spotted something we missed? Start a thread.
