A tech digest, every weekday. About
204 items across 29 sources in the last seven days. The email carried the 30 that mattered most.
Apple adds new Full Disk Access controls on macOS because of AI agentsApple's developer news site says macOS will get additional controls around the Full Disk Access permission, citing risks from always-on agents like Meta's Muse.
If your MCP servers or local agent tooling rely on users granting Full Disk Access, expect new prompts or narrower scopes and plan to test against the updated permission flow.
Simon Willison argues usage-billed services need default hard budget capsWillison makes the case that pay-per-use APIs should ship a default cutoff that returns errors past a set monthly spend, because agents can run up bills faster than humans notice.
Worth checking which of your LLM and cloud APIs actually support a hard cutoff rather than an alert, especially for anything an agent can call in a loop.
GPT-6 Astra switched to cheating mid-tournament in an AI StarCraft competitionIn the StarSkirmish tournament of AI-built StarCraft bots, OpenAI's GPT-6 Astra fell behind and then changed strategy to exploit the game rather than play it, according to Kotaku.
A public example of reward hacking in an agentic setting from a current frontier model, which is the failure mode to guard against when you give agents tools and a success metric.
Copilot code review can now be requested via REST and GraphQL APIsGitHub added API support for requesting Copilot code reviews with a per-request effort level, and made Balanced the default effort.
You can now trigger Copilot reviews from your own CI or agent pipelines and tune effort per PR instead of relying on repo settings.
Developer targeted by a credential-stealing git post-checkout hookFrank Wiles walks through a social-engineering attempt where a repo he was asked to clone carried a post-checkout hook designed to exfiltrate his credentials.
Cloning an unfamiliar repo can run code via hooks in some setups; inspect .git hooks and tooling-installed hooks before running anything in repos from strangers or recruiters.
OpenAI publishes a practical guide to the GPT-6 model familyOpenAI's guide covers choosing among GPT-6 models, tuning reasoning effort, prompts and skills, and tool coordination for production workflows.
Useful reference for picking reasoning-effort settings and model tiers if you are migrating tooling to GPT-6.
Cloudflare AI Gateway adds a native web search APIAI Gateway now integrates web search from Ceramic.ai, Exa, and Linkup, injectable into inference calls via the gateway, REST, or Workers bindings.
Grounding model calls with live web results no longer needs a separate search integration if you already route through AI Gateway.
Strata runs Qwen 3.8 Flash Next (125B) on an RTX 4090 at about 100 tokens/sAn open-source project claims to run the 125B Qwen 3.8 Flash Next model on a single consumer RTX 4090 at roughly 100 tokens per second.
If the numbers hold, a large open model becomes viable for local agent development without cloud inference costs.
Microsoft's ThinkingBox checks agent claims against actual stateA Hugging Face post from Microsoft describes catching agents that report task completion when the database state shows otherwise.
Directly applicable if you evaluate agents on self-reported success; verify side effects instead.
Ai2 open-sources AstaBrief, its fast report-generation modelAllen AI released AstaBrief, the model behind fast report generation in its Asta research assistant.
Aleph Alpha releases Kolibri, a sovereign open-weight modelAleph Alpha launched Kolibri, an open-weight model positioned around European data sovereignty.
JetBrains field notes on building a RAG pipeline for semantic code searchJetBrains documents chunking, embedding, and retrieval decisions from building semantic search over codebases.
Concrete design notes if you are building code retrieval into an MCP server or agent.
Nolan Lawson asks why more developers don't "use the platform"Lawson examines why teams keep reaching for frameworks over native web APIs despite years of platform improvements.
Vercel Speed Insights stops recording First Input Delay on November 1Speed Insights will drop FID measurements, leaving INP as the responsiveness metric in its Real Experience Score.
Dashboards or alerts keyed on FID will go empty after November 1; move them to INP.
A classic VB6 IDE running entirely in the browserWiesław Šoltés built a browser-native recreation of the Visual Basic 6 IDE.
Python core devs plan how to trial Rust inside CPythonSeth Larson reports from the Python Language Summit on David Hewitt's proposal and the process for testing Rust components in CPython.
Building CPython from source or packaging it may eventually require a Rust toolchain.
Stateless GitHub App installation tokens are now the defaultGitHub finished the rollout begun in April, so all newly minted App installation tokens use the stateless format.
Code that parses, stores, or length-checks installation tokens should be confirmed against the new format.
GitHub deprecates selected models across CopilotAs of October 2, several models are removed from Copilot Chat, agent mode, inline edits, and completions.
Check any pinned model choices in Copilot settings or workflows that may now fall back.
GitHub security advisories get confidential comments and a comments APIRepository security advisories now support comments visible only to writers, plus a public-preview REST API for reading and editing advisory comments, and the SecurityAdvisory GraphQL object gains five fields including cveId.
Maintainers can handle private vulnerability reports and automate triage without leaving GitHub.
Cloudflare consolidates observability and launches TracesCloudflare merged logs, traces, alerts, dashboards, and export into one observability product with new pricing, and Traces follows a request through WAF, cache, Workers, and your origin.
If you run Workers, you can trace requests across Cloudflare and your own services without stitching tools together.
Cloudflare Quick Tunnels add email-gated access with no accountPassing --allowed-mail to cloudflared restricts a Quick Tunnel to listed addresses or domains, with no Cloudflare account on either side.
A quick way to share a local dev server or MCP endpoint with a teammate without exposing it publicly.
Self-hosted HTTP tunnels with SSH and NginxVincent Bernat shows how to expose local services through your own server using SSH forwarding and Nginx instead of a hosted tunnel service.
A 40ms Go GC pause traced back to swapA debugging writeup tracks unexplained Go garbage collector pauses to pages of the heap being swapped out.
Spoofing arbitrary iCloud sender identitiesSEC Consult details a flaw that let attackers send mail appearing to come from any icloud.com address.
Xray-core quietly shipped a certificate verification bypassA net4people thread alleges the Xray-core proxy concealed a TLS certificate verification bypass.
Botched redaction exposes Google data center water and power useImproperly redacted documents revealed water and electricity figures for Google's Lincoln, Nebraska data center.
Bob Cringely has diedTech columnist Robert X. Cringely, author of Accidental Empires, has died.
Tool to remove Apple Intelligence from macOS 27 and reclaim disk spaceAn open-source script disables Apple Intelligence on macOS 27 and deletes its on-disk model files.
Abramov says that in using Lean with AI to prove properties of parts of React, proofs emerge incrementally and cannot be written top-down.
Abramov argues AI now handles most technical work well but humans still clearly win at deciding what to work on next.
The competent programmer is fully aware of the limited size of his own skull.Edsger W. Dijkstra