EN 18286, the first AI Act harmonised standard: what it covers and who needs it
The EU has published its first harmonised standard under the AI Act, for quality management. What a presumption of conformity means and who should act.
6 min read
Blog
The SpanDock blog
News, how-tos and researched articles on AI coding tools, agents, MCP, cost and governance, from the SpanDock team.
Claude Code's idle compaction: a summary instead of a cache rebuild
Claude Code now compacts long idle sessions just before the one-hour prompt cache expires. What that saves, what it costs, and how to see it in telemetry.
Copilot model policies now have a REST API: managing model access as code
GitHub's new endpoints read and set which Copilot models each enterprise, team, app and organisation may use. How the policy states work and what to automate.
MCP servers over HTTP: the SDK resource limits you now have to set
Recent MCP SDK advisories added size, batch, session and validation limits to HTTP servers. Some need a code change, not just an upgrade. What to check.
Reflection's Beam: what a 501B open-weight model's safety report tells agent teams
Beam arrived on 16 October under Apache 2.0 with a long safety report. Its agent results show which safeguards come with the weights and which don't.
The 2026 Stack Overflow survey on AI: cost controls, trust and what to measure
Daily coding agent use is the norm, cost controls are mostly blunt limits, and developers switch tools for quality, not price. What leaders can take from it.
Three Copilot models retire on 16 November: what to check before then
Claude Opus 4.8, Claude Opus 5 and GPT-5.6 Terra leave GitHub Copilot on 16 November 2026. What the replacements cost, and a routine for the next retirement.
Copilot managed settings can now fail closed: forced refresh and minimum versions
Copilot clients can now be made to fetch current policy at startup and refuse to run on a stale copy. What that buys, what it costs, how to roll it out.
An MCP login link that ran code: opencode's fix shipped without an advisory
A remote MCP server could run commands on Windows and WSL machines through opencode's OAuth flow. The fix is out, but no CVE or advisory will flag it.
5 min read
Open-weight model risk, model layer first: the Microsoft and NVIDIA guidance
Microsoft and NVIDIA published a joint risk taxonomy for open-weight models. What it covers, what it leaves for later, and how coding teams can use it.
Agent skills that point at bad domains: what a 5.5 million URL scan found
Manifold checked every URL in public agent skills, MCP servers and plugins; 121 components use a high-risk domain. What that means for reviewing skills.
MITRE ATT&CK v20 adds prompt injection techniques: how to use the new IDs
ATT&CK v20 gives direct and indirect prompt injection, AI-enabled exfiltration and two related behaviours their own IDs. What changed, and the gaps to plan for.
6 min read
Browse by tag
- #Security (54)
- #Agents (40)
- #AI coding tools (37)
- #LLM costs (23)
- #MCP (16)
- #Evaluation (14)
- #Observability (12)
- #Compliance (11)
- #Enterprise (9)
- #Platform engineering (9)
- #Data privacy (8)
- #DevOps (7)
- #Model routing (7)
- #Open-weight models (7)
- #Research (7)
- #Tutorials (6)
- #Code review (4)
- #Developer productivity (4)
- #Guardrails (4)
- #Networking (4)
- #OpenTelemetry (4)
- #Budgets (3)
- #Prompt engineering (3)
- #Self-hosting (3)
- #MCP gateway (2)
- #Release notes (2)
- #Skills (1)
- #Testing (1)