Search stories, models, companies…
Subscribe

Popular topics

OpenAI83Anthropic81Google Gemini45Claude Code27Coding agents51Model Context Protocol (MCP)13
The week in AI, in one email.
Category

Developers

How software gets built now: coding agents, developer platforms, APIs, SDKs and the open-source projects around them.

42 stories
Developers · ExplainerCursor Agent SDK explained: agents as a folder of code, no separate price, and how it differs from the Claude Agent SDK and OpenAI's Agents SDKCursor's Agent SDK, generally available since October 20, 2026, lets teams define an agent as a folder of Markdown and TypeScript, test it with evals and deploy it to Cursor or their own servers. Cursor publishes no separate price for it. Here's what it is, what it costs, and how it compares with the Claude Agent SDK and OpenAI's Agents SDK.·8 min read
Developers · AnalysisStack Overflow questions per month: the 'fewer than 1,000' claim, what the data query counts, and what Stack Overflow says about AI·9 min read
Developers · AnalysisWikipedia AI-generated content: how editors find it, delete it and now ban it, and what the numbers show·8 min read

All Developers stories · 42

Developers · NewsMLflow RCE CVE-2026-116692 (CVSS 9.8), Google's MCP Toolbox file-exfiltration flaw and a critical LiteLLM advisory: which versions fix themThe MLflow RCE CVE, CVE-2026-116692, is a CVSS 9.8 flaw in third-party scorer loading, fixed in MLflow 3.17.0. It was published on October 27, 2026, a day after Google's CVE-2026-93328 for MCP Toolbox for Databases and alongside a CVSS 10.0 LiteLLM Enterprise advisory. Affected and fixed versions for all three.·7 min readDevelopers · ExplainerWhat is context engineering? How it differs from prompt engineering, and where the practice stands in October 2026What is context engineering? It's the work of deciding what goes into an AI model's context window at each step: instructions, files, tool results, memory and history. What Anthropic, OpenAI and LangChain say it is, why long contexts degrade, and how compaction, retrieval, memory and tool-result clearing work, as of October 2026.·9 min readDevelopers · AnalysisOpen source AI-generated code policy: r/opensource bans AI-made and solo projects, and where Debian, Linux, curl, Gentoo and QEMU draw their linesOpen source AI-generated code policy is now being set by communities as well as projects. On October 24, 2026, Reddit's r/opensource moderators banned projects that use AI, are made by AI or are intended for AI. Here's that rule next to the documented policies of Debian, the Linux kernel, curl, Gentoo, NetBSD, QEMU and Firefox, with dates and exact wording.·9 min readDevelopers · GuideClaude auto mode is now the default: what it does, how it differs from accept edits and bypass permissions, and how to turn it offClaude auto mode has been Claude Code's default since August 14, 2026, and on October 22 Anthropic said Claude's web, desktop and mobile apps will follow. How the classifier works, how it compares with accept edits and bypass permissions, and how to switch back to manual.·9 min readDevelopers · NewsHTTP2Shell (Node2Shell, CVE-2026-111497): the Brotli flaw OpenAI's Codex Security team reported, what's affected and which versions fix itHTTP2Shell, first called Node2Shell, is CVE-2026-111497: an out-of-bounds write in Google's Brotli decoder that Node.js credits to OpenAI Codex Security. Brotli 1.2.1, 1.1.1 and 1.0.10 fix it, as do Node.js 22.23.4, 24.22.1 and 26.12.1, Python's Brotli 1.2.1 and Envoy 1.40.0. Here's what else is affected and what to patch.·7 min readDevelopers · NewsCalif's iPhone hack: an iOS 27.0.1 jailbreak shown at Hexacon, what Apple has patched, and what role AI playedCalif's iPhone hack, shown at Hexacon in Paris on October 16, 2026, was a reboot-persistent jailbreak of an iPhone 18 Pro on iOS 27.0.1, plus Signal and iMessage demos. Calif hasn't published the bugs or said whether AI found them. What's confirmed, what Apple has patched, and what's only reported.·5 min readDevelopers · NewsCursor Computer Use: Cursor's agent can now drive desktop apps and the iOS SimulatorCursor Computer Use, announced October 23, 2026, lets Cursor's agents click and type in desktop apps such as the iOS Simulator to test what they build. What Cursor has confirmed, what its docs say about permissions, and what it hasn't said yet.·5 min readDevelopers · ExplainerOpenAI CLI explained: what OpenAI's official command-line tool does, and how it differs from Codex CLIThe OpenAI CLI is OpenAI's official `openai` command for calling its API from a terminal: Responses, files, images, audio and admin endpoints, with an API key. Codex CLI is a coding agent. How to install the OpenAI CLI, what it covers and how the two tools differ, as of October 23, 2026.·7 min readDevelopers · NewsStorm-0940 and ARTEX: what's confirmed about the ConnectWise Cloud Backup breach, and what the 2,250 Microsoft 365 tenants figure really meansMicrosoft says Storm-0940, a China state-aligned group, was behind the ConnectWise Cloud Backup compromise and used ARTEX, an AI agent framework, to try sign-ins at more than 2,250 Microsoft 365 tenants. That figure counts attempts, not breaches. What Microsoft, ConnectWise, Huntress and others have confirmed, and what to check.·6 min readDevelopers · NewsLinux kernel vulnerabilities posted to a public mailing list: what ZDI sent, the two CVSS 9.0 ksmbd flaws, and whether AI reports are the causeLinux kernel vulnerability reports from Trend Micro's Zero Day Initiative reached public mailing lists on October 21, 2026, without patches. What was disclosed, who is exposed, what maintainers and ZDI said, and what the kernel's May 2026 rule on AI-found bugs has to do with it.·7 min readDevelopers · NewsPHP2Shell (CVE-2026-109618 and CVE-2026-109619): the AI-assisted PHP flaws, affected versions, patches and early exploitationPHP2Shell is the name for two critical PHP remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, fixed on October 21, 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Who found them with AI, which versions are affected, what Amazon says about exploitation, and the stopgaps if you can't patch yet.·8 min readDevelopers · GuideLiteLLM 1.107.0 PyPI compromise: which versions and Docker tags were affected, how to check, and what to rotateThe LiteLLM 1.107.0 PyPI compromise put a credential stealer and a GitHub-driven backdoor into every 1.107.0 wheel and four Docker tags on October 21, 2026. Which versions are safe, how to check your machines, and what LiteLLM says to rotate.·8 min readDevelopers · CompareTorchTPU vs TorchNeuron: running PyTorch on Google TPUs and AWS Trainium compared (October 2026)TorchTPU vs TorchNeuron: in the same week of October 2026, Google and Amazon open-sourced native PyTorch backends for their AI chips. Both register a new device through PyTorch's PrivateUse1 hook and replace an older PyTorch/XLA path. Here's how they compare on status, chips, PyTorch versions, torch.compile, distributed training and the code you change, per the official docs.·Checked Oct 23Developers · NewsAmazon TorchNeuron: a native PyTorch backend for AWS Trainium, now open source and in public betaAmazon's TorchNeuron lets standard PyTorch code run on AWS Trainium2 and Trainium3 through a native 'neuron' device, replacing the older PyTorch/XLA path. It went into public beta with Neuron 2.33.0 on October 19, 2026, and Amazon open-sourced it on October 20. Here's what changes for developers, per the docs.·5 min readDevelopers · ExplainerAI web search APIs compared (October 2026): DeepSeek Search/Fetch vs OpenAI, Anthropic, Google and PerplexityAn AI web search API comparison for October 2026: DeepSeek's new $0.75-per-1,000 Search and Fetch APIs against OpenAI's and Anthropic's $10-per-1,000 search tools, Google's grounding at $14 per 1,000 after a free allowance, Perplexity's Search and Agent APIs, and Brave, Exa and Tavily, with what each returns, free tiers, limits, citation rules and data retention.·11 min readDevelopers · GuideHow to detect and block AI agents on your website: what CERT-In, OpenAI, Anthropic, Google and Cloudflare documentHow to detect and block AI agents on your website, using only official guidance: the user agents, IP lists and signed requests OpenAI, Anthropic and Google publish, Cloudflare's verified-bot controls, and CERT-In's October 15, 2026 advice for agents that don't identify themselves.·6 min readDevelopers · NewsOpenCode breach: provider API keys stored in OpenCode Console may have been exposed. What happened and what to doThe OpenCode breach, disclosed on October 17, 2026, hit about 1.4% of OpenCode Console users who had linked their own OpenAI, Anthropic or Google keys, according to OpenCode's post on X. Here's what's known, who is affected, and how to revoke and replace exposed keys using the providers' own guidance.·7 min readDevelopers · ExplainerClaude Code review, explained: how Anthropic's Claude Code team reviews AI-written code, and the /code-review, ultrareview and Code Review tools you can useOn October 15, 2026, Anthropic described how the Claude Code team does code review when Claude writes about 90% of the code: parallel AI reviewers, risk-based human approvals and fast reverts. Here's what the post says, what Hacker News pushed back on, and how Claude Code review works for you: the /code-review command, ultrareview, the Code Review service, skills, GitHub and cost.·11 min readDevelopers · NewsPostgres 19 delayed to November 19: what the release team said, and what AI code review had to do with itPostgreSQL 19 is delayed: the release team moved general availability from October 29 to November 19, 2026, and added a second release candidate. A PostgreSQL committer says LLM-assisted code review surfaced defects faster than developers could fix them, contributing to 8 to 10 reverted features. Here's what's confirmed and what the 'AI reviewers' headlines overstate.·6 min readDevelopers · NewsStolen AI API keys are paying for autonomous attack scans, and an Archon flaw exposes AI coding agents: what developers should checkBitsight says criminals are selling MONST3R-AI, an autonomous hacking tool that runs on stolen OpenAI, Anthropic and Google API keys, so the key's owner pays for the attacks. Separately, CVE-2026-111322 leaves the Archon AI coding agent's control API open without a login by default. What happened, how to check your exposure and what the vendors' guidance says.·8 min readDevelopers · GuideCodex CLI background daemon: what it does, why it starts by default and how to turn it offSince version 0.157.0 (September 25, 2026), Codex CLI starts a shared background server that outlives your terminal and updates itself hourly. What the Codex CLI background daemon does, what it costs in disk and network, and how to turn it off with the commands and settings OpenAI ships.·8 min readDevelopers · AnalysisQGIS bans AI-assisted code: which open-source projects ban AI contributions, and whyQGIS now rejects any AI-, LLM- or agent-assisted code in its main repository. It joins Gentoo, NetBSD, QEMU and Servo among open-source projects banning AI contributions, while LLVM, curl, llama.cpp and the Linux kernel allow AI help with disclosure. Here's what each policy says and the reasons behind it.·9 min read

Nothing in this format on this page — try another filter or the next page.