At DevDay (Sept 29), OpenAI shipped Dots—always-on GPT-6 Astra agents that run in their own cloud VM and browser, reach 4,000+ apps, and can kick work to Codex. Rolling out to ChatGPT Pro and Business Premium (Enterprise beta off by default); Custom Rules gate what a Dot may do alone.
Codex Security Cloud (research preview) watches connected GitHub repos for new commits, builds a project threat model, validates suspected vulns in an isolated sandbox, and proposes patches for human review—plus a CLI for local/CI use…
Factory CEO Matan Grinberg says he fired board adviser Chris Degnan after learning Degnan held recurring talks with Cognition while advising Factory; Degnan says he resigned and joined Cognition as CRO, denying any confidential sharing. Cognition CEO Scott Wu also denied the claims…
Laravel patched laravel/ai 1.0.0 (SSRF via unvalidated file URLs in the Vercel/AG UI adapters; CVSS 5.3) and laravel/mcp (low severity OAuth redirect validation). Upgrade to laravel/ai 1.0.1 and laravel/mcp 0.9.6 or 1.0.1—neither advisory has a CVE yet…
Between mid September and Sept 30, Okta Agent SSO, SSOJet, Rubrik MCP, GitHub Copilot’s MCP auth customizer, and Operant’s Okta linked gateway each shipped MCP authentication—none interoperable—after LiteLLM’s CISA KEV bypass and Cycode’s MCP Python SDK OAuth theft. Identity is catching up; NSA noted RBAC at connect time is still open…
Bitdefender opened a free macOS public beta of AI Guardian (Oct 1): a local policy layer that allows, flags, or blocks Claude Code 2.1.121+ and OpenClaw 2026.6.6+ tool calls, MCP tools, skills, and credential access before they run…
Spotted something we missed? Start a thread.
