Weekly AI Dev News Digest: October 24 - October 30, 2026

Cursor found a tampered Claude Code extension in its marketplace on October 29. Version 2.1.313 tried to install persistent SSH access to developers’ machines. Cursor removed it, rebuilt the marketplace and helped get the attacker’s server taken offline. Some steps failed because they needed administrator rights, but the package could still collect information and install persistence. Affected users need to follow Cursor’s cleanup guidance and rotate accessible credentials from a trusted machine. This was a modified marketplace package, separate from Anthropic’s official distribution. (Cursor)

Forever Security found an attack that starts with something much less conspicuous: an instruction file in Downloads. Open an agent in that folder and the file can try to talk it into installing a package or changing its own configuration. The researchers demonstrated different chains in Codex and Claude Code, where approvals and sensitive writes affected what worked. A file the agent is built to read becomes the attacker’s way of giving orders. (Forever Security)

Forever Security also published findings about the browsers built into coding tools. In its tests, opening a hostile local HTML file in Codex, Claude Desktop or VS Code let the page read files outside the project. Other findings involved command execution in Cursor and a fake address in Copilot’s browser bar. The researchers say Cursor and Copilot had already fixed their issues; Codex and VS Code remained unpatched when the report appeared. Treat an unfamiliar file opened inside an assistant as something that can reach your machine. (Forever Security)

Cloudflare’s failure happened inside the service running the model. Long prompts sent to its hosted GLM model sometimes produced text from another customer’s request. A configuration mismatch and a bug in SGLang’s error handling left old cache data available to the next request. The exposure happened in August and September and was fixed in September; this is the newly published explanation. Cloudflare says no other Workers AI model was affected and it found no evidence of deliberate exploitation. (Cloudflare)

Claude Code added an option to block its Write, Edit and NotebookEdit tools from changing files outside approved working directories. Release 2.1.314 also fixes sandbox protections failing to apply in a resumed worktree. Those are concrete controls to check if an agent works across several folders. The write setting covers those named editing tools; other ways of running code still need their own boundaries. (Anthropic)

Google’s Gemini 4 Carbon is aimed at demanding security work, including finding, validating and fixing vulnerabilities. Access starts with selected cyber defenders and trusted partners. Google plans to bring it to more developers later, so the announcement doesn’t give everyone a new API to call yet. (Google)

Devin is putting stronger security models into an enterprise product. Its deep scans can use Claude Mythos and other cyber-capable models without a customer arranging separate model access. Cognition says Devin builds a threat model with the team, reproduces problems and prepares fixes in isolated environments. It can also propose lowering a finding’s priority, but those risk adjustments need human approval. Reducing exposure through an infrastructure change leaves the underlying flaw open. Cognition also announced that Corridor is joining the company to work on Devin Security. (Cognition, Corridor announcement)

OpenAI described how it watches its strongest agents for unauthorized behavior, including attempts to evade oversight. External monitoring covers supported tool-using Responses API conversations on certain deployments, rather than every API call; Chat Completions is outside that coverage. The system can pause a conversation and notify the customer. OpenAI also published weaknesses found by outside testers and said one fix was still in progress. Monitoring can help catch a run going wrong, but it needs testing too. (OpenAI)

Entire launched a Git forge with a different way to review a change. Its Trails put agent evaluations, findings and the history behind the work together, with fresh reviews on each push. A repository can require cleared findings, passing CI and human approval before merging. It supports native hosting and GitHub mirrors, plus CI integrations with Buildkite and Depot. So a team can try Trails without moving its source of truth away from GitHub. (Entire)

GitHub Copilot can approve a pull request, and that approval can count toward the approvals the repository requires. It’s generally available on supported paid plans, off by default, and administrators can limit it by file path. The separate Max review mode is in public preview: several models review the change independently, then their findings are combined. That takes longer and uses more credits than the lighter modes. (GitHub)

Agent Merge handles the nagging work between opening a pull request and getting it merged. Ask Copilot to watch for failing Actions checks, merge conflicts, or both, and it attempts repairs in the cloud. Paid Copilot users can combine it with auto-merge, subject to their organization’s policies. Once the repository’s requirements are met, GitHub can merge the change. Those requirements deserve a close look before the whole sequence runs unattended. (GitHub)

Harmonic’s Aristotle is moving into C and Verilog. It proposes properties to check, reports what it could prove and under which assumptions, and lets a team run those checks again in CI. That gives a reviewer something more specific than an agent saying the code looks fine. Someone still has to decide whether the properties describe what the software should do. Access is self-serve and billed by consumption, with separate enterprise options. (Harmonic)

OpenAI released GPT-6.1 Terra for visual reasoning, computer use and everyday writing. It’s available through the API, ChatGPT Work and Codex. OpenAI reports better command-line coding results than the previous Terra, while still pointing to Sol and Astra for the hardest coding tasks. The lower rates make repeated attempts cheaper. The cost of finishing a job still depends on how much retrying and checking it needs. (OpenAI)

Copilot Fusion is generally available and takes model selection off the developer’s hands. Pick an effort level and it decides whether to use one model, escalate the task, or have another model critique a draft. Administrators choose which models are allowed. Each model it calls is billed at its own standard rate, with a temporary discount on paid plans. It works in VS Code, the Copilot app, Copilot CLI and JetBrains IDEs. (GitHub)

OpenCode 2.2.3 adds Claude Agent, which runs an installed copy of Claude Code and can use its subscription login. You need Claude Code on the same machine as the OpenCode server; remote workspaces aren’t supported. OpenCode supplies the tools and permissions, while Claude Code makes the model calls. Your existing Claude Code hooks, memory and configuration files don’t carry over. That last detail matters if those settings are how you control what an agent can do. (Release notes, Provider docs)

Mistral released the weights for an improved Large 4 after its earlier hosted preview. It can run on a developer’s own infrastructure or through hosted services. Published API rates are $0.70 per million input tokens and $2.10 per million output tokens. The license allows modification and commercial use, but businesses running a Model-as-a-Service offering need a separate agreement. The coding results in the announcement are Mistral’s reported evaluations. (Mistral)

OpenRouter changed its default provider routing to consider speed and reliability alongside price. It applies when a request has no explicit provider sort or order. The company’s experiment found fewer rate-limit errors and faster responses, with a modest increase in spending. If cheapest-provider routing was part of your cost assumptions, set provider.sort: "price" explicitly. Leaving the default alone now asks the service to make a different tradeoff. (OpenRouter)

Liquid AI went small with LFM3, a family covering text, vision, audio and other tasks. The weights are available, and the text model is built to run locally and be fine-tuned for a particular job. That’s a different question from choosing the strongest general coding model: can a smaller model do the specific work an app needs, on the hardware it has? (Liquid AI)

GitHub is including Copilot access for licensed Enterprise users who buy through a GitHub or Microsoft account team. The usage bill remains: this bundle has no monthly AI-credit allowance, and applicable usage is metered from the first request. Self-serve customers can’t switch to it yet; existing subscriptions stay as they are. The standalone option in the announcement covers people inside that enterprise account who don’t have an Enterprise license. (GitHub)

Google is winding down Jules. You can finish sessions until November 11; after that it becomes read-only, before shutting down on December 31. Google provides an export for settings, memories, session history and code patches. Code and pull requests already in GitHub stay there. Google says what it learned from Jules is shaping products including Antigravity. Exporting an agent’s history is now part of moving tools, along with taking your code. (Google)

GitHub intelligence brings memory, context upkeep and code search together. Copilot Memory is generally available on paid plans, so preferences and repository conventions can carry between sessions. Dreaming is a separate, opt-in preview that curates memories and proposes changes to checked-in instructions through pull requests. Those background runs use AI credits. The code-search tools can also investigate related repositories without cloning every project first. (GitHub)

LangChain’s Managed Deep Agents can hand a long job to a subagent and keep talking while it runs. It also gets a browser with a handoff for login: the person enters their credentials in the remote window. Each conversation gets its own browser by default, or a developer can choose a user-scoped browser that keeps logins across conversations. That choice determines where authenticated access carries over. (LangChain)

LangChain also published the code behind Content Studio, its internal design agent. It takes requests in Slack, but getting useful work out of it involved designers writing down their principles, giving it a persistent sandbox and making it inspect its renders. Approval still comes before shipping. The team also removed old workarounds as models improved. Keeping every rule forever would have preserved yesterday’s limitations along with the useful guidance. (LangChain)

Copilot Projects is in public preview for work spanning repositories, documents and connected context. The app coordinates agents and brings back results for review. Computer use is also in preview on macOS and Windows, with approval before it controls an app. Organizations can disable that feature. A project can now include work around the code as well as changes to the code itself. (GitHub)

GitHub Agentic Workflows is generally available for jobs such as triaging issues, investigating CI failures and updating docs. Write the instructions in Markdown and it compiles them into Actions YAML. Agents start read-only, run behind a firewall and pass proposed changes through checked outputs and threat detection. Existing runners and policies still apply. Different coding-agent engines are supported; the default Copilot CLI engine needs a Copilot license. (GitHub)

---

Amp can attach a cloud Mac to a coding thread. Most work stays on a Linux orb, while the Mac handles Xcode builds, simulators and app checks. That avoids making the whole backend run on macOS just to test an Apple app. macOS Satellites is a waitlisted beta. Mac time uses the orb allowance included in the plan first, then Amp credits; the hourly figure above covers the Mac, not the whole agent run. (Amp)

Android Studio Rabbit 2 makes Bring Your Own Agent stable through the Agent Client Protocol. External agents can use the IDE’s understanding of the project, builds, previews, emulator and logs. Google also announced agentic change review and a benchmark for longer Android tasks. Check the individual feature before planning around it: some of the accompanying performance and migration tools are still Canary-only or coming later. (Google)

Akamai announced managed inference and Agent Sandbox. The sandbox uses WebAssembly through the open-source Spin framework, separating code an agent generates from the agent’s own runtime. It sets limits on compute, memory, outbound connections and system capabilities. Whether it fits a job depends on what that code needs to run; a constrained function environment and a full virtual machine serve different workloads. (Akamai)

Vercel Sandbox now accepts standard input while a command is running. That lets a process exchange messages with a stdio MCP server, for example, instead of receiving all its input at startup. Both the TypeScript and Python SDKs support it. Any service reached through that connection still needs its own permissions. (Vercel)

---