Black Forest Labs shipped FLUX 3 Image with a machine-readable 0–1000 bounding-box layout so agents can compose scenes, edit one box at a time without touching the rest, pull in up to 10 references, and render native 4K (up to 5456×3072). API and Playground are live; commercial weights are available for self-hosting, with open weights still pending.
MCP’s TypeScript and Python SDKs shipped three Oct 2 advisories: HTTP clients followed cross origin redirects with custom headers and OAuth bodies (upgrade to sdk 1.32.0, client 2.3.0, or mcp 1.30.0/2.2.0), and experimental InMemoryTaskStore let clients share list/read/cancel across sessions (CVSS 8.6). None have CVEs yet, and npm audit / OSV still report zero findings…
Supabase is buying Turso so agents can spin up cheap on demand SQLite databases (Turso Cloud or BYOC) with a path into Postgres as apps grow; Turso keeps running and stays open source, and Glauber Costa joins as Head of Agentic Services. Existing Turso and Supabase users see no change to current databases, APIs, or workflows…
WebSensePro’s free GPL WSP MCP (v2.9.3) exposes a native MCP server on your WordPress site so Claude Code, Cursor, Codex, and Antigravity can draft posts, manage WooCommerce, and edit Elementor—write tools stay off until an admin enables them, with a self hosted audit log of every call. Install from wordpress.org, flip abilities under MCP → Settings, then copy a ready made client snippet from MCP → Connection…
On Claude Code 2.1.287 with a Max login and no managed settings, AINews ran a seven line marketplace mod that returned allow on tool.check and executed a Bash command a deny rule had refused—no prompt. The built in cc plugin sec default guard only seats on Team/Enterprise or managed settings; audit with claude plugin validate , or block installed mods via disableAllHooks / safe mode…
Figma’s remote MCP ( https://mcp.figma.com/mcp ) only connects clients listed in its MCP Catalog—Claude Code, Codex, Cursor, VS Code, Xcode, and others—so new agents hit a waitlist (Pi’s adapter saw Dynamic Client Registration HTTP 403 and fell back to the local desktop server at 127.0.0.1:3845 ). Write to canvas and design to code stay on the remote path for approved clients…
Spotted something we missed? Start a thread.
