Attackers are using malicious Terraform providers and Go modules to distribute Graphalgo malware through the centralized HashiCorp Terraform Registry, creating a new supply-chain risk for infrastructure teams. The payload profiles systems, reports to Slack, and receives encrypted commands through both Slack and Ethereum smart contracts.

Source

Warp is introducing Benchmarks in Warp Factories, a tool for testing coding agents against a team’s real-world tasks. Developers can compare models, harnesses, and configurations, then use the results to improve factory workflows.

Source

Visual Studio Code 1.139 Insiders adds an experimental Agent Merge feature. With it, an AI agent can open a pull request and take it through review and continuous integration (CI) within one session. The build comes shortly after VS Code 1.138 opened the latest Insiders preview cycle. It also adds Cargo completions in the terminal, new CSS color previews and a soft-wrap indicator.

Source

Visual Studio Code 1.140 is now in the Insiders channel, with a milestone due on September 28, 2026. It comes shortly after 1.138 Insiders brought faster terminals and better remote development. The new build focuses on AI chat: users can start chat sessions on remote agent hosts without first choosing a folder, and a hover inconsistency in the chat interface is fixed.

Source

OpenAI’s GPT-6 Sol and GPT-6 Luna are expanding GitHub Copilot with a new choice between careful, multistep coding and fast, low-cost assistance. The rollout also gives Copilot administrators more control over which GPT-6 models are enabled across organizational plans.

Source

GPT-6 Astra climbed from 35% to 53% on the Agents on Rails coding benchmark when reasoning was pushed to maximum, but Gemini went backward despite higher cost and effort. The results show that maximum reasoning is a model-specific tradeoff—not a universal accuracy upgrade—and even rescued GPT-5.6 Luna from a scoreless previous run.

Source

OpenAI has patched two Codex vulnerabilities that allowed malicious repositories to escape the coding agent’s sandbox without triggering an approval prompt. Heapjack could extract a trust token from shared Node.js memory, while Overpatch abused patch permissions to modify files such as `.zshrc`; teams should update Codex CLI to 0.149.0 and Codex Desktop to build 26.818.21641 or later.

Source

Z.ai has released ZCode under the Apache-2.0 license after the coding agent was found packaging workspaces and uploading encrypted archives containing Git histories. The source release makes the client inspectable, but it does not prove what happened to data already sent to Z.ai’s cloud infrastructure; the company is also preparing a zero-data-retention option for its Model-as-a-Service platform.

Source

OpenAI fixed two Codex sandbox vulnerabilities that could let malicious code execute commands on a developer’s host machine. The more serious Heapjack flaw worked even in read-only mode: opening an attacker-controlled repository and asking Codex about its code could be enough to trigger an escape without an approval prompt.

Source

Microsoft has activated a Teams meeting transcript control that blocks Microsoft Graph API access by default. Administrators must explicitly enable the setting before apps or agents can retrieve transcripts, adding an important safeguard for sensitive meeting content.

Source

Microsoft’s experiment found that an AI model’s knowledge cutoff is a poor guide to whether it can work with a specific product. GPT-5.6 Luna passed tasks tied to both older and newer Dev Proxy and SharePoint Framework releases, while failing other tasks released well before its February 2026 cutoff.

Source

Claude Code version 2.1.277 can now use OpenAI’s AGENTS.md instruction files when a repository has no Claude-specific instructions, reducing duplicated guidance for teams using multiple AI coding tools. Anthropic keeps CLAUDE.md,.claude/CLAUDE.md, and CLAUDE.local.md files authoritative when they exist, making the change a fallback rather than a replacement.

Source

GitHub Copilot’s latest weekly release adds controls for balancing model cost, quality, and response time, while making code review and agent usage more manageable for development teams. The update also brings Sentry-powered crash investigation to the Copilot app and highlights how AI agents now help Microsoft ship VS Code weekly—although its release notes warn that Copilot-generated text may contain errors.

Source

Microsoft has released Desired State Configuration (DSC) v3.3.0, the latest version of its cross-platform configuration management platform. DSC lets you describe the desired state of a Windows or Linux system in a YAML or JSON configuration document and then apply, verify, or export that state with the dsc command-line tool. Version 3.3.0 adds three built-in Windows resources, a registry-backed adapter, wider --what-if support, new expression functions, and Linux packages on Microsoft's package repository. The release follows DSC v3.2.0: new Windows resources, version pinning, and Bicep integration, which introduced the first wave of built-in Windows resources.

Source

Microsoft Foundry Local lets you run large language models (LLMs, text-generating AI models) and speech models directly on a Windows PC without sending prompts to the cloud. The runtime handles model downloads, hardware acceleration, and inference (the process of generating a response from a model) on your device. You do not need an Azure subscription. Foundry Local is part of Microsoft Foundry on Windows, alongside built-in Windows AI APIs and Windows ML. This article covers what it does, what hardware you need, how to install it, and where it fits compared to other local AI options.

Source

Microsoft has released Intelligent Terminal 0.2.2572, an update to its experimental, open-source fork of Windows Terminal that integrates AI agents such as GitHub Copilot CLI, Claude, Codex, and Gemini directly into the command line. The release contains more than 60 fixes and improvements and focuses on performance, reliability, and usability. Its main new features are API key support for local and OpenAI-compatible models, automatic approval for supported agents, and slash commands provided by the agent itself. If you are new to the tool, see our earlier coverage in Microsoft Intelligent Terminal 0.1: AI-powered alternative to Windows Terminal.

Source

Microsoft’s new Foundry Dev Pack bundles the main tools needed to build Microsoft Foundry agents into a single installation workflow. It supports Windows, macOS, and Linux, reducing the setup work before developers can deploy and evaluate AI applications.

Source

Visual Studio Code 1.138 is now the latest Insiders build, giving developers an early look at changes Microsoft is evaluating for a future stable release. Published around September 16, 2026, the preview is aimed at testing upcoming editor improvements before wider deployment.

Source

Cline’s new macOS and Windows beta moves its open-source coding agent out of the IDE sidebar and into a standalone workspace. Cline Desktop can import sessions from Claude Code, Codex, and opencode, run recurring engineering tasks, and let users switch among subscription, free, local, and connected-provider models.

Source