vibehacker
News
OpenAI ·

OpenAI's Decisions API is now GA, with prompt caching, JSON inputs and 400 questions per call

Out of beta since Oct 22, the gpt-6-luna endpoint for yes/no, pick-one and score questions adds prompt caching ($0.01 per 1M cached input tokens, $0.10 uncached, still no output charge), native JSON inputs, images in question instructions, US and EU residency, GPT-Live integration, and up to 400 questions per request. Datadog says it scores the risk of agent-generated shell commands before running them at 40x faster p95 than frontier models, which makes it a cheap gate for an agent's next step.

Read at openai.com

More news

View all

A web page can drop an AGENTS.md into ~/Downloads and hijack a coding agent started there

Forever Security traced a customer's agent trying to install the malicious npm package function color to an AGENTS.md in /Downloads , its working directory, then reproduced the attack on Codex (90% success with a harmless payload) and used a malicious CLAUDE.md to leak Claude Code's OAuth token. There's nothing for vendors to patch, so start agents in the project root, never /Downloads , and read unfamiliar instruction files first…

BleepingComputer

Major US banks start blocking third-party AI agents that log in to customer accounts

Axios reports Morgan Stanley has begun blocking third party agents, and JPMorgan, Bank of America and Citi are restricting them, after banks found agents using customers' own credentials and sometimes acting beyond user instructions. Most banks are moving toward read only access, so if your agent touches finances, plan on open banking APIs rather than a user's login…

Axios

Official MCP filesystem, fetch and everything servers patch eight vulnerabilities in v2.1.0

Released Oct 25, the fixes stop symlink and path tricks that let the filesystem server write or peek outside allowed directories (Windows only partly fixed), block other web origins from calling the everything server over HTTP, and close SSRF gaps in fetch via IDNA host names and NAT64 addresses. Package managers rank 2.0.1 below old date versions, so install it explicitly, e.g. npm install @modelcontextprotocol/server [email protected] , and update mcp server fetch to 2026.10.24…

GitHub (modelcontextprotocol/servers)

Showboard lets Claude Code, Codex or Cursor answer data questions with dashboards from read-only SQL

The MIT licensed MCP server takes your agent's SQL and a short layout, runs each query read only against Postgres, SQLite, Excel or CSV, and draws charts, tables and headline numbers in a browser or a pane beside your terminal, with every number showing its query. Version 0.4.1 (Oct 22) adds a Claude desktop extension; install in Claude Code with /plugin install showboard marketplace rohanbeingsocial/showboard , and treat the author's 2.7x cost saving as a single dataset test (benchmark breakdown)…

GitHub (rohanbeingsocial/showboard)

Spotted something we missed? Start a thread.