Singapore's handbook for assessing AI coding assistants, and how to use it
CSA Singapore published a security assessment handbook for agentic coding assistants: six attack vectors, 25 tiered controls and a risk method you can reuse.
Blog tag
#AI coding tools
Claude Code, Codex, Gemini CLI, Copilot, Cursor and the tools developers use every day.
The tensorlake npm worm: planted agent settings and a revoke-first trap
A poisoned tensorlake release stole developer credentials, planted Claude Code and VS Code settings in repositories, and punished revoking tokens first.
6 min read
Three Claude advisories in October, for fixes that shipped months earlier
Anthropic published three high-severity Claude Code and Claude Desktop advisories in October. The fixes date from May and June: how to tell if you are behind.
5 min read
Claude Code closed permission bypasses: update before relying on deny rules
Claude Code releases from 3 to 14 October 2026 fixed deny and ask rules that could be skipped. What was fixed, what deny rules never covered, and how to retest.
5 min read
Terminal-Bench 4.0 and honest comparisons of coding agents
Terminal-Bench 4.0 is a new task set, not a harder 2.1, and vendor and independent scores already differ. How to read the numbers before they reach a decision.
4 min read
Copilot computer use is in preview: setting rules for desktop-driving agents
Copilot CLI and the Copilot app can now operate desktop apps, in public preview. What the controls are, where the risks sit, and a starting policy for teams.
5 min read
Copilot's Agents window and worktree cleanup: running many agent sessions
VS Code 1.141 adds a session grid and worktree cleanup for parallel Copilot agents. What changed, and the review and disk habits that parallel sessions need.
Secret scanning now blocks Anthropic keys at push: closing the AI key gap
GitHub now blocks Anthropic API keys at push by default and is previewing AI-based secret detection. What changed, what is still preview, and what to do.
5 min read
Sol, Sonnet 5.5 or Haiku 5.5: a practical coding model map
Three coding-relevant models landed within ten days. Rather than picking one default, map task types to model tiers and check vendor benchmarks with care.
Frontier coding models and cyber safeguards: public vs defender access
Gemini 4 Argon, Claude Sonnet 5.5 and GPT-6.1 Sol ship with cyber restrictions, and defender access is a separate track. How to tell which tier your team has.
5 min read
Copilot CLI now finds local Ollama models: what stays on the machine
GitHub Copilot CLI can discover models from a local Ollama instance. A local model is not offline mode, and telemetry and remote providers still need settings.
Claude Sonnet 5.5: faster mid-tier coding without a list-price rise
Sonnet 5.5 kept Sonnet 5's $2 and $10 token prices, then had its cache-read price halved. What that does to coding costs, and where Opus 5.5 still leads.
5 min read
Browse by tag
- #Security (54)
- #Agents (40)
- #AI coding tools (37)
- #LLM costs (23)
- #MCP (16)
- #Evaluation (14)
- #Observability (12)
- #Compliance (11)
- #Enterprise (9)
- #Platform engineering (9)
- #Data privacy (8)
- #DevOps (7)
- #Model routing (7)
- #Open-weight models (7)
- #Research (7)
- #Tutorials (6)
- #Code review (4)
- #Developer productivity (4)
- #Guardrails (4)
- #Networking (4)
- #OpenTelemetry (4)
- #Budgets (3)
- #Prompt engineering (3)
- #Self-hosting (3)
- #MCP gateway (2)
- #Release notes (2)
- #Skills (1)
- #Testing (1)