Datadog Security Labs disclosed GHSA-632h-h47v-g4x4: OpenCode’s /global/upgrade endpoint accepted a cross-origin text/plain form that installed an attacker npm tarball. Versions 1.14.30–1.18.21 are affected when running opencode serve/web without auth (or with cached basic auth); upgrade to 1.18.22.
Enterprise AI Controls now flags malformed managed settings.json , unsupported configs, and bad team mappings with file and JSON path pointers. Fix on the default branch of .github private , reload Agents, and recheck—so broken policies stop silently failing to enforce…
OpenCode 2 watches skills, agents, opencode.json , and MCP configs and applies saves within a few hundred milliseconds to running sessions—no restart. OpenChamber 2.0.0 builds on that with Code Mode (one sandboxed script over your MCP tools), live plugin status, and a web search UI; it needs OpenCode 2.0.15+…
Admins can configure OpenTelemetry export in enterprise managed settings.json so Copilot agent sessions—model calls and tool use—land in existing monitoring stacks. Prompt and response content stay off by default until content capture settings allow it…
Australia’s Greens led Senate inquiry into AI and datacentres has invited Sam Altman and Dario Amodei to appear after OpenAI agents hit Australian and US government sites. Hearings resume in Canberra on 1 October; PM Albanese and ministers pressed OpenAI for a clearer public account…
Codex CLI 0.157.0 (Sept 25) adds GPT 6 Sol and Luna to the model catalog, including Amazon Bedrock support and migration prompts for older models. The release also turns on fullscreen transcripts by default, auto starts the background server for eligible sessions, and adds an f shortcut to fork conversations locked in another app…
Spotted something we missed? Start a thread.
