Claude Code hooks can now fail closed when enforcement breaks
Claude Code v2.1.295 adds onFailure: block for command and HTTP hooks so missing scripts, timeouts and unexpected exits deny the action instead of failing open.
Blog category
AI and development
Researched articles on AI coding tools, agents, MCP, LLM cost, governance and security, and engineering practice.
The ICO's agentic AI call for evidence: what engineering teams should prepare
The UK ICO's call for evidence on agentic AI runs 8 October to 20 November 2026. Map security, transparency and ADM evidence now.
4 min read
MCP Python SDK redirected custom headers off-origin
A medium-severity flaw in the MCP Python SDK followed cross-origin redirects and forwarded custom API keys. How it differs from the TypeScript OAuth issuer bug.
GPT-6.1 Sol: near-Astra coding performance at one-fifth the token price
OpenAI's GPT-6.1 Sol lists at $2/$10 per million tokens against Astra's $10/$50. What that changes for default coding models, caching and harness cost.
What the Bank of England told firms about autonomous AI risk
The September 2026 FPC Record treats frontier AI autonomy and open-weight models as cyber and ops resilience issues for firms.
5 min read
AI agents write more code; review still sets how much software ships
A 718-firm study finds AI agents raise code volume and PRs while resolved issues stay flat and review time rises sharply.
Copilot local sandboxing is generally available: what it actually restricts
Copilot local sandboxing is GA in the CLI, app and VS Code Agent Host. What OS limits cover, leave out, and how they sit with policy.
4 min read
MCP TypeScript SDK OAuth flaw: credentials followed the wrong issuer
A high-severity MCP TypeScript SDK flaw let the server choose which authorization server got client secrets. Patch, bind and rotate.
Claude Haiku 5.5 for coding sub-agents: what the price cut changes
Anthropic's Haiku 5.5 makes high-volume subagent work cheap enough to measure. When to route there, and when Sonnet still leads.
Download counts aren't trust: a lesson for AI coding agents
A malicious copy of a popular maths library reached six million downloads in two days. Why agents that pick packages are exposed, and what limits the damage.
3 min read
Capturing prompts in AI telemetry is a privacy decision, not a setting
AI coding tools can export prompts, tool arguments and full API bodies. Why it's off by default, the risks of switching it on, and how to decide.
What NIST is saying about AI agent security, and what to do before it lands
NIST summarised industry responses on AI agent security and is building control overlays for agents. The themes, the status, and steps to take now.
3 min read
Browse by tag
- #Security (55)
- #Agents (41)
- #AI coding tools (38)
- #LLM costs (23)
- #MCP (16)
- #Evaluation (14)
- #Observability (12)
- #Compliance (11)
- #Enterprise (9)
- #Platform engineering (9)
- #Data privacy (8)
- #DevOps (7)
- #Model routing (7)
- #Open-weight models (7)
- #Research (7)
- #Tutorials (6)
- #Code review (4)
- #Developer productivity (4)
- #Guardrails (4)
- #Networking (4)
- #OpenTelemetry (4)
- #Budgets (3)
- #Prompt engineering (3)
- #Self-hosting (3)
- #MCP gateway (2)
- #Release notes (2)
- #Skills (1)
- #Testing (1)