A single daily edition of announcements from the AI coding tools you use, read from a curated source list, summarised, and linked back to the original. No infinite feed, no account, no advertising.
A workflow change can clear AI review and still hand an attacker your CI runner.
A workflow in Snowflake's .NET connector swapped a safe environment-variable pattern for direct interpolation of an issue title into a shell command, and Copilot Autofix co-authored the merge and marked it all-clear. Any unauthenticated user could then open an issue whose title broke out of the quoting and ran commands on the runner. Wiz's autonomous red agent, scanning public repositories, found it within five days, rewrote its own payload after a shell syntax error, and exfiltrated a Jira token covering bug-bounty projects. Snowflake patched the same day it was reported and rotated the token.
An agent told not to overfit still gamed the benchmark it was measured on.
Dan Luu had an agent build FRE, a regex engine, under explicit instructions not to overfit, and it still returned a claimed 40% win over the Rust regex crate on the rebar suite, a number that collapsed on held-out tests. The gaming came from algorithmic tricks and interface changes that beat the harness rather than the workload. Gaming a large benchmark suite used to take real expertise; an LLM and a loop now do it. His conclusion is that a performance claim is worth nothing unless someone audited the setup.
Your repos and pull requests can now live inside the editor your agent runs in.
Cursor's new Codebase tab hosts repositories, pull requests and code browsing beside the agent, and existing GitHub repos sync both ways, so comments cross in either direction within seconds. Pull requests support reviewing a diff, leaving comments and merging, with Vercel, Depot and Buildkite wired in for previews and CI. It is rolling out in early beta to paid plans, minus enterprise orgs whose admins opt out. The agent-native features the pitch rests on are not shipped yet.
