Published Nov 3, Endor Labs found that CVE-2026-103916 let an agent plant a workspace symlink so a later sbx cp read or overwrote host files such as cloud credentials or SSH keys. Upgrade Docker Sandboxes to 0.51.0 or later, since the first fix in 0.48.0 was incomplete.
Published Nov 4, the open source agent runs from CLI, browser workspace, desktop, VS Code, SDK, and GitHub Action, with hosted providers or local servers like Ollama, llama.cpp, and vLLM. It adds a post edit verification gate, weakened test detection, git safety snapshots, and refusal of unrequested commits or pushes, but the sandbox is off by default and small local models still fail many tasks…
Upstash ran seven coding agents through live Redis tasks and found agents couldn't enable daily backups, probed Redis logs that don't exist, read 0 stats right after traffic, and deleted a named database with no confirmation. After adding redis set daily backup , clearer tool text, and a type the name delete check, backups went from 0/15 to 15/15 and delete confirmation from 1/15 to 15/15…
OpenAI is acquiring Pierre Computer Company, maker of the Code Storage API and the open source Trees and Diffs libraries, to add source control and review to Codex on top of its internal Pando Git backend. Trees and Diffs stay open source, and the deal still needs regulatory approval…
Cyclr's report (research cutoff Aug 20) found products with a verified official MCP server rose from 47 to 100 of the same 816 (5.8% to 12.3%). Servers documenting workflow or operational actions grew from 10 to 21, while 57% of products still have no official server…
Google Cloud's Data Agent Kit is now generally available as a free set of MCP tools and open source skills that let Claude Code, Codex, Antigravity, and VS Code based editors inspect schemas, run queries, and read job logs across 15+ Google data services. GA adds BigQuery Graph, Bigtable, and Managed Service for Apache Spark, and the agent runs with your own IAM permissions…
Spotted something we missed? Start a thread.