Pydantic AI v2.57.0 (Oct 15) adds Harness ApprovalReviewer, which asks a second model one risk question about each tool call marked requires_approval and runs it on a "no", while "yes", "unsure", or a model failure still goes to a person. It never denies or runs calls itself, and pairs with ToolCallJudge when calls should be blocked.
Anthropic's Oct 15 write up says merged Claude Code PRs more than doubled from June to September while the revert share fell over 40%, with most reading moved to Claude reviewers, blocking security review, and classifier set risk tiers where low risk changes from trusted authors need no human approval. After an agent vs agent PR looped through 50+ overnight rounds, the reviewer now stops after three rounds and re reviews only the new diff…
As of Oct 16, Beam (501B MoE, 23B active, 1M context) is on Hugging Face as reflection/Beam 1.0 501B A23B under Apache 2.0, with day 0 Transformers, SGLang, and vLLM support and a free to start API at platform.reflection.ai. Reflection also shipped Mirror CLI in beta, the terminal harness Beam was trained with, which runs parallel agents in separate worktrees and supports MCP, skills, and tool call approval…
OpenAI's deprecations page says the gpt 4o 2024 08 06 , gpt 4o 2024 11 20 , gpt 4o mini 2024 07 18 , gpt 4.1 2025 04 14 , and gpt 4.1 mini 2025 04 14 snapshots leave the API on January 14, 2027, with gpt 6 luna as the recommended replacement for all of them. Fine tunes built on these models shut down on the same date, so agents still pinned to them have about three months to migrate and re test tool calls…
As of Oct 16, Composio sessions can require a person's approval before selected toolkits, tools, or tagged tools execute: set requireApproval ( require approval in Python), catch the input required error, show its requests, then resend the call with the answers. It covers meta tool calls too, and over MCP it uses elicitation, with a deny or allow fallback for clients that can't ask…
As of Oct 14, Kiro IDE (1.3+) and Kiro CLI (2.31+) can run agent executed commands in a kernel enforced sandbox (Seatbelt on macOS, bubblewrap on Linux, AppContainer on Windows) that confines writes to the project, denies common credential paths like /.ssh , and routes network traffic through a domain filtering proxy. It's off by default; enable it with sandbox.json or /sandbox on , and it reuses your existing permissions.yaml rules…
Spotted something we missed? Start a thread.