Mandiant says an attacker hijacked an active AI coding-assistant session at an unnamed SaaS firm, got a poisoned PyPI package accepted via the assistant’s recommendation, then spread the Shai-Hulud worm across about 100 internal repos and stole GitHub OAuth tokens and source. Defenders should checksum AI-recommended deps, keep secrets out of extension reach, and route installs through internal registries.
Shown on HN Oct 31, the account free agent drafts a shared spec in plan mode, implements it in build mode and lets you annotate code in review mode to send revisions back, with every file action going through Lua scripts whose C++ bindings pass a permission layer. Its author says it supports 50+ providers including OpenAI subscriptions and local models, handles MCP, skills and instruction files, and starts at 8 to 11 MB of RAM (site)…
Rolling out since Oct 28 on all Copilot plans, GitHub verified MCP servers like Slack, Figma, Notion, Sentry, Linear, Cloudflare and Vercel need one sign in (in Copilot CLI, /mcp then the Connectors tab) and then work across the Copilot app, CLI, VS Code, cloud sessions and GitHub Mobile with nothing to install. On Business and Enterprise, an admin must enable the Editor preview features policy, and orgs with an MCP allowlist must add these servers to it…
If your agent calls the Gmail, Drive, Docs, Calendar or Chat MCP servers, tick "Use this client for an AI powered agent" on its OAuth client in Google Auth Platform Clients before Nov 11, when unmarked clients start getting rejected. After Nov 12 the setting locks, so a missed client means creating a new agentic one and updating your MCP config; REST only apps aren't affected (setup guide)…
Published Oct 31 under MIT as a bundle for DeepSeek Harness, it watches one GitHub repo (and optionally Feishu), opens a work item when an allowed person asks, works in its own session and directory, and replies in the original thread, for example with a pull request, while a web panel shows what needs a human. DeepSeek labels it research code, not an official product, and setup is meant to be done by asking your coding agent to follow its SETUP.md…
As of Oct 31, Smithery's proxy, accounts, API keys, Connect, Toolbox, CLI and SDKs are gone, and smithery.ai stays only as a public directory now powered by Arcade.dev, with paid plans refunded back to Aug 5. Search your .mcp.json or .cursor/mcp.json for run.tools , server.smithery.ai and @smithery/cli and swap each for the vendor's official URL, like https://mcp.linear.app/mcp (migration list)…
Spotted something we missed? Start a thread.