Coding-agent telemetry now shows who acted and what was stopped
Copilot can now attribute activity to a user without capturing content, and Claude Code logs stopped tool calls. What to collect and how to read it.
Blog tag
#AI coding tools
Claude Code, Codex, Gemini CLI, Copilot, Cursor and the tools developers use every day.
GitHub's package firewall preview: a checkpoint between coding agents and npm
GitHub's package firewall checks npm installs from CI runners and coding agents against age, malware and attestation rules. How it works, and its limits.
6 min read
Claude Code's idle compaction: a summary instead of a cache rebuild
Claude Code now compacts long idle sessions just before the one-hour prompt cache expires. What that saves, what it costs, and how to see it in telemetry.
Copilot model policies now have a REST API: managing model access as code
GitHub's new endpoints read and set which Copilot models each enterprise, team, app and organisation may use. How the policy states work and what to automate.
Three Copilot models retire on 16 November: what to check before then
Claude Opus 4.8, Claude Opus 5 and GPT-5.6 Terra leave GitHub Copilot on 16 November 2026. What the replacements cost, and a routine for the next retirement.
Copilot managed settings can now fail closed: forced refresh and minimum versions
Copilot clients can now be made to fetch current policy at startup and refuse to run on a stale copy. What that buys, what it costs, how to roll it out.
An MCP login link that ran code: opencode's fix shipped without an advisory
A remote MCP server could run commands on Windows and WSL machines through opencode's OAuth flow. The fix is out, but no CVE or advisory will flag it.
5 min read
An MCP server entry is a command: three October flaws and headless runs
Junie CLI, ZCode and the Claude Agent SDK all had paths from untrusted input to an MCP server launch. What they share, and where trust prompts disappear.
6 min read
Copilot code review in October: who pays, how deep it looks, and what it skips
Balanced is now the default, organisations can take over the bill, and an API arrived. What Copilot code review costs per pull request, and the settings to set.
Roo Code's five unpatched approval bypasses: retiring an abandoned AI extension
Five high-severity CVEs let injected prompts slip denied commands past Roo Code's auto-approve. No fix will ship. How to find and remove dead AI tools.
Infostealers now collect AI coding assistant credentials: what to change
Symantec and Elastic found malware taking AI coding tool credentials from developer machines. What was taken, and how to limit the damage.
When a repository's git config runs code: ConfigPoisoning and coding agents
GitLab researchers showed a coding tool running attacker code from a repository's own git filters. Why deny-lists fail, and what to ask of tools that run git.
5 min read
Browse by tag
- #Security (54)
- #Agents (40)
- #AI coding tools (37)
- #LLM costs (23)
- #MCP (16)
- #Evaluation (14)
- #Observability (12)
- #Compliance (11)
- #Enterprise (9)
- #Platform engineering (9)
- #Data privacy (8)
- #DevOps (7)
- #Model routing (7)
- #Open-weight models (7)
- #Research (7)
- #Tutorials (6)
- #Code review (4)
- #Developer productivity (4)
- #Guardrails (4)
- #OpenTelemetry (4)
- #Budgets (3)
- #Networking (3)
- #Prompt engineering (3)
- #Self-hosting (3)
- #MCP gateway (2)
- #Release notes (1)
- #Skills (1)
- #Testing (1)