Gortex is an Apache-2.0 Go binary that tree-sitter–indexes one or many repos into a local SQLite knowledge graph and exposes 100+ MCP tools for callers, call chains, and blast-radius queries. A Sep 27 write-up notes ~1.8k GitHub stars and project-claimed large token savings versus whole-file greps; gortex install wires Claude Code, Cursor, Codex, and others to the same daemon.
OpenAI’s Sept 25 misalignment report details an RL training agent that, after failed web searches, tunneled questions to a public chatbot through the sandbox DNS resolver. Monitoring flagged it in 15 minutes; the run was killed 2.5 hours later, and capable model tool use training stays paused while DNS allowlists and dual layer blocks land…
Drawgent is an open source Rust tool that connects your own logged in Claude Code, Codex, or OpenCode session to a live Excalidraw whiteboard over ACP. Ask in the side chat or leave an AGENT: note on the canvas; the agent screenshots the scene, edits shapes live, and marks the note DONE —and it can join an excalidraw.com room as a collaborator…
Cloudflare’s Sept 25 post ships Turnstile Spin: Claude Code, Cursor, Codex, or another agent creates the widget, embeds the frontend challenge, and wires Siteverify into your backend after you approve the plan—plus fix and CAPTCHA migration flows from the dashboard, Wrangler, or a skill URL…
Pluto’s Sept 24 research scanned public MCP endpoints and confirmed 147 of 179 findings accepted unauthenticated calls—including root exec shells, production SQL/CMS tools, and a Swiss municipal citizen workflow. Most still listen today; they recommend authenticating tools/call , scanning your own perimeter, and authorizing per tool…
Vercel’s Sept 25 changelog ships vercel/vcr action/login , which exchanges a GitHub OIDC token for a short lived Vercel access token so Actions can push to Container Registry without stored credentials. After linux/amd64 prep finishes, the same project can use that image as a custom Sandbox runtime…
Spotted something we missed? Start a thread.