A six-month real-world comparison shows AI code-review agents and specialised fuzzers find substantially different V8 vulnerabilities. Replacing fuzzing with agents would leave gaps, and cost per bug remains unknown.
Cloudflare Computer 0.7 makes agent code resumable and interruptible. The important catch: recovery replays code, and unrecorded external actions can be repeated even if they already succeeded.
Hydrogen 2026-10 is generally available as a JavaScript commerce library with React Router and Next.js starters and examples for other frameworks. Existing Hydrogen storefronts still work; migration is optional.
gopls 0.24.0 and VS Code Go 0.56.0 ship interactive refactorings for struct tags and interface implementations; the broader Language Server Protocol extension is still a proposal, with cross-file moves in preview.
A small but foundational JavaScript HTTP framework has reached v2 with a web-standards rewrite. Builders must test route wildcards, forwarded-header trust and explicit response returns before migrating.
Rashomon's experimental local recorder can expose discrepancies between a coding agent's closing claims and its tool execution. It is an observability aid, not a sandbox or tamper-proof security product.
CLM-8B targets the same narrow decision layer as Jev, but with open weights, local deployment and a contrastive architecture that separates state and action representations. The headline speed and coding results are researcher-produced and need careful interpretation.
The important change is economic rather than another flagship benchmark win. OpenAI is making capable agent and coding workloads materially cheaper, with Luna approaching older Sol-class results at a tiny fraction of the task cost and GPT-6 prompt caching discounting reused input by up to 90%.
This is not one headline vulnerability fix. Gemini CLI 0.60 is a coordinated hardening pass across the plumbing that lets extensions, sandboxes, filesystem paths and MCP authentication influence an agent’s execution environment.
Google has turned its Ads API helper into a reusable agent plugin rather than a standalone project. For developers maintaining ad-tech integrations, the material change is that agent workflows can now ground themselves in current Protobuf schemas and execute validated reporting against real Google Ads accounts instead of relying only on model memory.
Laravel now has a framework-native approval flow for AI tools: approvable tools can pause an agent, surface arguments and reasons, then resume the same persisted conversation after a human decision.