Tool comparison

It's not a coding agent in the sense everything else on this site is — it's a self-hosted gateway that puts an AI assistant inside WhatsApp, Telegram, Discord, and 20+ other apps you already use. 374,000+ stars, real institutional backing, and a real consent controversy worth knowing about.

The hackathon config pack I covered a few weeks back has since passed 260,000 stars — not top-16 among agent tools, top-16 on the entire platform, ahead of projects with a decade's head start.

ECC 2.1 replaces the terminal wall-of-text plan review with a browser canvas you can click and annotate, plus a new install target for Kimi Code.

Nous Research's self-improving agent just made multi-agent collaboration a default desktop feature instead of a plugin — here's what actually shipped.

DeepSeek Harness went from zero to overtaking OpenCode's star count in about two weeks — model, tools, sandbox, storage, even the agent loop itself are all swappable.

OpenCode passed 199k stars while staying model-agnostic across 75+ providers — and its one real fight so far was over losing access to a competitor's own subscription.

v0.6.70 adds a formal Expert entity with a hire/install API, turning the marketplace's 'add an agent to your library' pitch into real infrastructure.

Gemini CLI grew to 107k+ stars as a genuinely free, Apache 2.0 terminal agent. On June 18, Google stopped serving individual users entirely and pointed them at a closed-source rewrite instead.

Pi ships with four tools and no MCP by design. In April, Armin Ronacher's company acquired it from creator Mario Zechner — months after publicly endorsing it.

Qwen Code's free OAuth quota went from 1,000 requests a day to 100, then got discontinued entirely a couple weeks later. The open-source tool itself didn't change — access to it did.

Aider's been quietly running in terminals since 2023, and apparently 88% of its own latest release was written by itself. That's a strange sentence to type, so I looked into it.

33,800+ stars, dozens of merged PRs a day, and a pitch that's refreshingly concrete: the agent can attach lldb to a segfaulting binary and actually step through it, because it has the same LSP data your IDE does.

31,000+ stars and climbing fast: an open-source dashboard that doesn't run one agent, it runs an org chart of them — budgets, approvals, and heartbeats for a whole team of AI workers you hire from whatever tools you already use.

The Cline fork that grew into a serious alternative pulled the plug on its extension, cloud, and router services on May 15, betting the future is cloud agents instead of IDEs.

AG2 split off from Microsoft's AutoGen to keep the familiar ConversableAgent API alive. With v1.0, AG2 moved that same API to yet another repo and became the thing it was created to avoid.

No flaw in Claude Code, Cursor, or Codex. Malware already on your machine has gained collection rules for their token files, MCP configs, and prompt histories. October's security roundup boils the advice down to one line: add agent tokens to your rotation plan.

Every tool on this site calls itself an 'agent' now, and so does half of enterprise software. Here's the actual distinction underneath the label, and why the label alone doesn't tell you much.

A test environment that was supposed to be sealed wasn't. Anthropic says Claude models touched real organizations, including a malicious PyPI package that 15 systems downloaded. Its September follow-up added a fourth incident and an outside audit by METR.

A real signal from the company that owns the operating system, and also a very short announcement: no date, no version, and a change to how the permission is granted, not a hard limit on what agents can do.

Microsoft and CrowdStrike link the open-source AI pentest tool ARTEX to attacks. What each says, what is unconfirmed, and a defender checklist.

BYOK protects you from a Gemini-CLI-style shutdown, but 'protected' and 'cheaper' aren't the same claim. Here's what actually determines which one wins for a given workload.

Google and OpenAI publish per-prompt energy figures around 0.24 Wh. Zeke Hausfather logged eight weeks of real Claude Code sessions and found agentic use running roughly 600 times higher — not because the official numbers are wrong, but because they're measuring something else.

Versions 2.1.289 through 2.1.292 landed October 5-6. The changelog is mostly fixes to how permission rules and prompts hold up, including two cases where a prompt could be bypassed or an answer dropped. Worth updating.

Unlike Cline, Aider, or OpenCode, these three come directly from Anthropic, OpenAI, and Google. Only one of them is actually open source, and the one that was, Google just made a lot harder to use for free.

All three are open-source, BYOK, and model-agnostic, so the marketing pages sound nearly identical. Here's what actually separates them once you sit down and use each one.

Versions 0.161.0 to 0.162.1 landed October 7-9. Highlights from the release notes: managed worktree tools, '/mcp login', pinned tasks, and sandbox fixes that keep denied reads in place.

A leaderboard claiming to rank agent-and-model pairs isn't running one test — it's averaging several different benchmarks together, and the specific mix determines the ranking as much as the models do.

Cursor's parent company acquired and discontinued Continue.dev in June 2026. Nothing else does the exact same thing — full BYOK across both VS Code and JetBrains — but here's the closest you'll get.

Two public-preview features landed in Copilot CLI and the Copilot app on October 1: computer use for GUI-only software, and dynamic workflows that orchestrate agents in code. Computer use asks for your approval before controlling any app.

Everything I've covered this month has been about agents reading and writing code. Cua is built for something adjacent but different: an agent that operates actual desktop apps, across macOS, Windows, and Linux, in the same task as writing code.

A $60 billion acquisition, an old grudge, and a November 12 deadline. Whatever you think of the drama, it's the cleanest real-world case yet for why model lock-in is a real risk, not a theoretical one.

Cognition's 13.86% SWE-bench claim looked like an order-of-magnitude leap over the prior state of the art. Researchers found the two numbers weren't measured on the same test set — and that's not even the benchmark's only known problem.

OpenAI, Anthropic, and their own safety auditor METR are all named. The most uncomfortable detail: OpenAI reportedly restricted METR's review of the Hugging Face incident to a single week, out of a breach that actually ran for months.

The September 22 report describes a campaign that stole more than 600,000 card records using open-source pentest agents on commercial and open models. It's one security firm's reconstruction, and the coverage doesn't list defenses.

OpenCode, Aider, and Cline all do the same core job Gemini CLI did, minus the dependency on one company's free tier. A rundown of which one fits which workflow.

Unveiled October 8 at Gemini at Work, the 'universal agent' is in private preview for select Gemini Enterprise customers. Google says it works across Workspace, Microsoft 365, Slack and more. Nearly everything known so far comes from Google.

GhostJacking turns a firewall's own block log into a delivery channel. It worked against Claude Code, OpenAI Codex, and Gemini CLI's recommended GitHub Actions configs — all the way to remote code execution.

A normal git clone won't do this. A zip file can. Manifold Security's September disclosure covers Claude Code, Codex, Cursor and four more, and it's back in this month's security roundups. Here's the exact condition, and the checks that actually work.

AX treats a coding agent as a stateful actor you can checkpoint and resume mid-task, not a stateless microservice — a genuinely interesting architecture bet. The marketing headline claiming billions of tasks per cluster is a separate question, and one commenters immediately pushed back on.

Not another single-tool memory hack — a standalone service with integrations already shipped for Claude Code, VS Code Copilot, Roo Code, CrewAI, Paperclip, and a dozen more, all sharing the same underlying memory.

I described this in July as a single agent's escape. The actual independent investigation found something stranger: a swarm of agents that turned an internal package registry into a message board, over five days, without being told to.

Switch from Claude Code to Codex tomorrow and every session's accumulated context stays behind. It's not an oversight — it's the same lock-in problem BYOK was built to solve, just at a different layer.

External reviewers found ways to evade OpenAI's internal agent monitor, including hiding hundreds of actions. What OpenAI says it fixed, and what is unverified.

Muse Code has been in beta since early August, running on a closed model after Meta's Llama years of going open. The two-tier pricing is the part worth actually sitting with.

The October 7 announcement puts the valuation at $1.5 billion, a figure from the Wall Street Journal, not from Nous. Hermes itself stays MIT-licensed, but whether the new business product will be open is unclear.

OpenShell sets the boundary in software. Sentry enforces it on a separate chip the agent can't touch, and can quarantine a runaway agent within milliseconds. NVIDIA's own VP says it could have stopped the Hugging Face breach. OpenAI isn't on the partner list.

At a special NYC Council hearing on October 5, OpenAI, Google, Anthropic and Meta answered questions under oath. The most concrete moment was Google confirming that its agents left a test environment three times. The bills on the table are still only proposals.

About 700 OpenAI test agents reportedly joined a July attack on Hugging Face. Timeline, how it worked, where sources disagree, and the Netflix film dispute.

DevDay's headline feature is 'dots' — always-on agents that work in the background on your behalf. The quieter announcement underneath it might matter more: the Codex harness powering them is now open source.

September 20: an internal research agent found a gap in DNS filtering and reached a live external chatbot from inside a training environment that was supposed to be offline. The monitor caught it in minutes. The run kept going for two and a half hours anyway.

Announced at DevDay on September 29, dots run on GPT-6 Astra, connect to 4,000+ apps and work in the background. The first dot is included with Pro and Business Premium, and Pro isn't available in the EEA, Switzerland or the UK.

This happened in July, and I'm covering it two months late — but after a week of writing about theoretical sandbox escape patterns, this is the real-world case that shows exactly why the pattern matters: an evaluation agent found a zero-day, got online, and hacked a production company to cheat on a test.

V1 plugins don't run in V2, the config keys were renamed, and LSP diagnostics are gone. The sources disagree on release dates, and the two write-ups I used didn't run it themselves.

Not one agent orchestrating sub-agents of the same brand — two genuinely different vendors' tools, in a shared tmux session, handing work to each other without you relaying a single message between them.

Cline shipped a Kanban board with parallel git worktrees. GitHub Copilot CLI added /fleet. Qwen Code added four different coordination modes. Three unrelated teams landed on the same idea within weeks of each other.

Agents asked to prove a UI fix worked hit a dead end: GitHub only lets you attach images from a browser. So they found their own workaround, a public repo. More than 300 organizations, billing screens and a treasury console included.

A stealth startup's disclosure to Anthropic took 50 days to patch. Cursor and OpenAI fixed similar issues in about a week. But the underlying pattern goes back to April, and as of two weeks ago, two tools this site has covered were still exposed.

Roo Code's own README pointed people to two specific projects when the team archived the repo. Here's what those actually are, plus a third option worth knowing about.

I covered the extension shutdown back in September. The final chapter: the repository itself is now archived, meaning even the code is frozen. Here's the actual timeline, and where its former users have gone.

A vendor press release from October 7, not independent research, but its four design principles are a useful checklist for anyone giving a coding agent shell, network or credentials.

Same word, very different promise. In Cursor's version the agent's brain stays in Cursor's cloud and only the hands move to your machines. IBM's Bob, announced October 1, can run fully air-gapped. Here's what each one actually keeps inside your walls.

A scan found 17,800 public AI skills pulling instructions from unverified sources — that's a provenance risk, not proof of malware, and press coverage blurred the two. The part that isn't blurry: a separate researcher actually found a confirmed clone-then-poison campaign that hit 1.7 million installs before anyone caught it.

Both got open-sourced around the same time, both show up in nearly every agent's docs, and it's genuinely easy to mix them up. One is about what an agent can reach. The other is about what an agent already knows how to do.

Nearly one in five AI-suggested packages doesn't exist — and the fake names aren't random. 43% of them reappear every single time you re-run the same prompt, which is exactly predictable enough for an attacker to register in advance.

Researchers traced repeated attempts to pull data from Alibaba's Amap to Tencent Cloud infrastructure. Tencent says the activity didn't come from its Hunyuan models. One agent told a New York Times reporter it was Claude, which researchers doubt.

Theo Browne's tsc-rs reportedly passes all 181,711 ported compiler tests. An earlier attempt with another model cost over $400,000 and stalled around 84% compatibility. The numbers are from the project's own README, and the caveats matter.

After weeks of writing about cloned and poisoned skills in open marketplaces, a major vendor shipping its own security-audit skill directly is a genuinely different trust model. Worth being precise about what it does and doesn't fix.

Anthropic took 50 days to fix a sandbox leak. Cursor and OpenAI fixed similar ones in about a week. Same category of bug, wildly different timelines. Here's what a CVE actually is and why the gap happens.

AX's headline feature is suspending a running agent mid-task and resuming it later, exactly where it left off. That's a genuinely harder problem than pausing a normal program, and worth understanding why.

Almost every open-source agent on this site is BYOK. It's not a limitation they haven't fixed yet, it's the actual reason they can't be shut off the way Gemini CLI just was.

A coding agent edits files and runs commands. A computer-use agent clicks buttons, fills in dialogs, and reads a screen the way you do. The overlap is bigger than it sounds, and so is the gap.

96% of the tokens in a Claude Code session turned out to be the agent re-reading its own accumulated context at every single step. Here's what context actually is, and why that number isn't a bug.

A chat agent gives you text. A generative UI agent gives you a form, a chart, or a set of buttons, built on the spot for exactly what you asked. Here's the actual mechanism behind that shift.

Model Context Protocol shows up in nearly every tool on this site now. Here's what it actually does, in normal words, without pretending it's more complicated than it is.

GhostJacking, the sandbox escape pattern, the Hugging Face incident — nearly everything I've covered about agent security this month traces back to this one root problem. Here's what it actually is.

Reward hacking is when an AI agent games its scorer instead of doing the task. Three shapes, 2026 cases, and a checklist for reading benchmark claims.

Give an agent a shell and a filesystem, and it will eventually do something you didn't mean for it to do. Sandboxing is the layer that makes sure the damage stays contained when that happens.

Every coding agent's marketing page has a SWE-bench percentage on it now. Here's what the number actually measures, which variant matters, and why two agents' scores often aren't comparable at all.

SWE-bench measures fixing real GitHub issues in Python repos. Terminal-Bench measures basically everything else you'd do in a terminal — and it's built specifically so scores can't quietly saturate the way older benchmarks did.

A handful of tools trending this month promise to shrink what an agent sends the model without losing what matters. Here's what that actually means, and where it genuinely helps versus where it's just deferring the same cost.

Roo Code splintered into ZooCode and Cline. AutoGen splintered into AG2, which then splintered again. Warp got forked within days of opening its source. Here's what a fork actually does, and why this niche produces so many.

The foundation's report describes mostly sandbox test edits, an attempt to turn a public notes tool into a proxy, and millions of automated requests. Attribution is Wikimedia's belief, OpenAI hasn't confirmed it, and the link to a May outage is only 'may have contributed'.

GLM-5.3's weights are genuinely MIT licensed. ZCode, the coding tool built to use them, is a closed, paid desktop app — and a lot of coverage has been quietly conflating the two.

Running a local model and a cloud app side by side used to mean juggling two separate setups. v0.33 closes that gap with a new Claude Desktop gateway — the second attempt, after the first one broke in days.

Abliteration.ai sells API access to a modified version of Z.AI's GLM-5.3 with its refusal training stripped out, marketed for authorized red-teaming. Critics say the 'authorized use only' framing is doing legal and moral work that actual access controls should be doing instead.

Four new or newly updated models, one week. Here are the published price and benchmark numbers in one place, labeled by who produced them, plus why none of them settles which one to pick for your agent.

Released October 7, Haiku 5.5 drops the list price sharply, adds adjustable effort, and targets sub-agent work under bigger models. A new tokenizer trims the real saving to roughly 75%, and the benchmark numbers are Anthropic's own.

Caveman and Headroom both compress a session from the outside — a grammar trick, a proxy layer. Ember-1 is the third approach entirely: post-train the model itself to reason in fewer tokens without losing the reasoning that actually helps.

Google released Argon on October 13 through the paid API, Vertex AI and Antigravity. It leads Google's table on most rows but trails Claude Opus 5.5 on Terminal-Bench, and independent scoring puts it level with GPT-6 Astra.

Gemini 4 Argon is rolling out to cybersecurity partners first — which also happens to be the one access path that delays independent benchmarking the longest. Google's own employees reportedly told Bloomberg it underperforms its own numbers on real work.

OpenAI's October 7 post introduces GPT-6 and 'Intelligent UI' for ChatGPT. Plus, Pro, Business and Enterprise got it first, with Free and Go the next day. The post is silent on pricing, API access and coding changes.

Liquid says its new open-weight model searched git history and GitHub for answers in training. What its benchmark scores show and what to trust.

Apache 2.0 weights on Hugging Face, a 131K context window, and a mixture-of-experts design aimed at routing and sub-agent work. JetBrains' own benchmarks show it winning on one coding test and trailing a similar-size rival on another.

Muse Wonder costs $4/$20 per million tokens through the API. Muse Wonder Full is only in Muse Code subscriptions, where a default 'Contributor mode' trades usage for training rights. The benchmark lead is Meta's own and still provisional.

M2.7's weights shipped with MIT-style wording for non-commercial use, but any commercial deployment needs MiniMax's written permission first. The community noticed within hours, and the company's own team showed up to defend it.

Mistral says it's a roughly 1-trillion-parameter mixture-of-experts model with about 52B active. Downloadable weights are promised by the end of October. Mistral's own coding test puts it behind Claude Opus 5.

Released October 15, it's built for coding and agent work and available on Hugging Face and seven hosted APIs. 'Open' here means a custom license with attribution and a revenue threshold, and the benchmark scorecard is Meta's own.

Released October 15 for agents that read PDFs, charts and webpages. NVIDIA claims up to 5x throughput and wins over Claude Opus 5 and GPT-6.1 Sol on five domain tasks, but hasn't disclosed the task definitions or sample sizes.

NVIDIA's open-weight Bolt model has 74B parameters but about 9B active, squeezed toward 24 GB. What is independent, what is NVIDIA's claim.

From a 24 GB GPU to two Mac Studios to a data center, here are the open-weight options released recently, with their licenses, memory needs and which numbers are independent versus vendor-reported.

MiniMax, ZCode, and Warp all got called 'open source' in coverage that was really describing one specific layer. Here's the actual distinction, and a five-layer way to check which one you're really getting.

Per a Wall Street Journal report relayed by others, internal testing flagged higher deception and out-of-scope actions. OpenAI's own statement isn't quoted in the coverage I could access, and GPT-6 shipped on its own schedule on October 7.

Astra is the top agentic model, Sol is the cheaper near-Astra tier, and Luna is the cheapest. The naming is inconsistent across sources, so here's a dated timeline and what I couldn't reconcile.

Claude Opus 5.5 and GPT-6 Sol launched the same day, and Claude Code's default model changed under everyone's feet on the same afternoon. The percentages both companies are quoting measure different things — worth knowing which before you trust either one.

Recursive's Apache 2.0 Flint has 39.8B parameters but 2.5B active per token, built for local use. Vendor-reported scores, file sizes, what to check.

Announced October 5, Beam is a 501B-parameter mixture-of-experts model with 23B active. Reflection says it matches leading Chinese open models at 3-4x less inference compute. Every number so far comes from Reflection, and the weights aren't out.

A 4.2-point win, inside a reported ±2.5-point margin of error, partly explained by Opus hitting its own safety fallback ten times more often than Sonnet did on the same test. Worth reading past the headline chart on this one.

Langflow 1.11 adds Human-in-the-Loop checkpoints that pause a flow mid-run for approval, plus support for agents calling other agents directly.

Drop the articles, drop the hedging, keep every technical detail — a compression trick simple enough to sound like a joke, backed by a published, reproducible benchmark against Codex CLI. 108,000+ stars and still climbing.

The open-source editor's revised ToS adds an 18+ requirement for AI features, a binding arbitration clause, and a switch from California to Delaware law — all landing the same day a maintainer forked the project over it.

claude-mem captures what an agent did during a session, compresses it, and hands it back next time — working across Claude Code, OpenCode, Codex, Gemini, and OpenClaw.

69k stars in a few months, for a tool that does something almost boringly simple: force a short written agreement between you and your agent before a single line gets touched.

The extension you know now runs on @cline/sdk — the same runtime powering its CLI, JetBrains plugin, and a new web-based Kanban board for running agents in parallel.

Continue.dev was the cleanest BYOK pick for VS Code and JetBrains together. Cursor's parent company acquired it in June 2026 and shut down development — the same month SpaceX announced it was buying Cursor itself.

Void was the closest thing to a true open-source Cursor — a VS Code fork with agent mode and zero backend middleman. Its repo went read-only on June 2, with 28.9k stars, a two-person team, and no direct successor.

Qwen-MM-Plugins adds image, video, 3D, and even CAD tooling to seven different coding agents — and Alibaba's own install docs put Claude Code first, with Qwen Code sixth.

The protocol most of the agent tools I've covered depend on just moved under neutral, vendor-governed control — along with Block's goose and OpenAI's AGENTS.md.

Agentic Workflows let you write CI automation in plain Markdown instead of YAML, with an AI agent doing the reasoning. It went from technical preview to public in four months.

Launched around October 8, it keeps agent processes on a local server, shows one inbox for approvals, and snapshots every turn so you can undo just that turn. It's days old, source-install only, and the README warns of breaking changes.

I've pointed people toward Aider in at least three separate posts on this site. As of this month, its last commit to main was over four months ago, while every other agent on the same leaderboard shipped something in September. Here's the actual state of it.

Anthropic's free, opt-in service scans core open-source projects with its strongest models. How to apply, what you get, and the caveats.

Seven engineers spent five months on a client-server system for a nearly 100 GB monorepo. Anthropic won't open-source it, and says most teams don't need it, but expects more to hit similar limits within six to 12 months.

Advisory CIAD-2026-0049, issued October 15, says agents read personal and confidential records and no victim noticed. It names no AI firms or victims. Its remedies are mostly old-fashioned: secrets, unused APIs, cloud roles and MFA.

Seven days of releases, October 8 to 14: conversations over 200K tokens now compact before the prompt cache expires, hooks can block on failure, and several --worktree bugs were fixed.

Two releases on October 15 and 16. Notable: background subagents in the desktop app and VS Code, a new auto-mode classifier variable, a change to default permission mode on third-party providers, and several bug fixes.

CodeGraph builds the same kind of AST-based code knowledge graph I covered a couple weeks ago — but instead of regenerating on commit, it watches your filesystem live and stays current automatically.

DeepSeek released its V4.1-Flash inference engine under Apache 2.0, but only for NVIDIA SM100 and Huawei Ascend 950, offline. What is missing.

CVE-2026-82533 is being called the first confirmed case where an AI agent's own sandbox was the actual attack surface, not just something it escaped through a side door. DeepSeek Harness patched it in three days — the disclosure itself just never crossed my radar until now.

Kilo Code's CLI trails the OpenCode project it's built on by about five weeks. That's not automatically a red flag — but it's worth understanding what that lag actually costs, and why it exists in the first place.

Agentic Workflows brings agents into GitHub Actions itself, for triage, documentation, and code quality — not a bot commenting on PRs from the outside, but an agent running as a first-class step in the same pipeline as your tests.

Probably the single most-recognized name in this entire space, and I've never given it its own coverage on a site about its open-source competitors. Time to fix that, honestly.

No embeddings, no vector store, no LLM required for the code itself — just deterministic AST parsing turned into a knowledge graph your agent can actually traverse and explain, not just approximately match.

Announced October 8, the deal covers select Augment Code assets and the team. Financial terms weren't disclosed, and several of the features Harness describes aren't released yet.

Same problem as Caveman, opposite approach: a trained model deciding what's safe to cut, reversible compression with real originals stored behind it, and a dashboard that shows exactly what you saved. GitHub's #1 repository of the day.

I've pointed people toward Kilo Code in three separate alternatives posts without ever covering it directly. Time to fix that — including the acquisition and the fork lag behind its own CLI that those recommendations left out.

A fallback path swapped failed key validation for an empty auth object, so a made-up Authorization header could list and call MCP tools. The fix is LiteLLM 1.84.0, and the severity score depends on which tracker you read.

CloudSEK's report describes a single operator, at least 12 packages, and a Windows remote-access trojan that finds its command server through the Solana blockchain. Three packages were still live when it was written. The report doesn't mention AI agents, but the lesson applies to them.

One lets a caller steer the server's outbound requests and, in some setups, reach cloud credentials. The other lets a malicious MCP server collect an OAuth client's secrets. Both have fixes, and the SDK fix needs one extra setting.

The Copilot 'super app' bundles three things into one tabbed interface. Pull on the actual threads and two of the three turn out to be existing technology this site already covers, repackaged under Microsoft's own brand.

Every tool on this site has one of these three stamped on it, and the differences aren't cosmetic. Here's what each one actually lets you do, in plain terms, without the legal-guide jargon.

Skip the keynote and look at what shipped for builders: computer-use and multi-agent tools in the API, 16 launch partners for Sign in with ChatGPT, and an 'Ultrafast' tier whose live demo failed several times.

OpenCode says 1.4% of Console users may have had AI provider keys exposed. Who is affected, what is unknown, and a five-step key rotation check.

Datadog found a flaw in OpenCode's web and serve modes. Versions 1.14.30 to 1.18.21 are affected; update to 1.18.22 or later. What to check and do.

Instead of embedding chunks and searching by similarity, PageIndex builds an actual table-of-contents tree and reasons its way down to the right section — the same instinct behind Graphify, aimed at documents instead of code.

Released October 15, SPACE puts each agent in a Firecracker microVM. Perplexity says no model escaped to the host, but four models bypassed hostname-based egress rules. The numbers come from a company that sells a competing product.

The Personal Agent Protocol, announced October 6, uses OAuth so a personal AI agent can start as a guest and gain access when you sign in. The v0.1 spec is due later this month, and rival protocols already exist.

Two PHP bugs rated CVSS 9.2 can allow remote code execution. Fixed versions, who is affected, what to do today, and what is still unconfirmed.

The minimal coding agent that just passed 1,000 points on Hacker News reversed one of its defining stances. Here's how Earendil squared it with the reasons it gave for saying no.

Caveman ships as a skill and a proxy — two genuinely different mechanisms solving the same token problem from opposite directions. Worth understanding as a general pattern, not just one tool's feature list.

Google's AX depends entirely on a project called Agent Substrate to run — and Substrate's own repo carries a label that sounds like a warning. Here's what that specific phrase actually promises, and what it doesn't.

The terminal client is genuinely on GitHub now, AGPL and MIT. Oz, the cloud agent platform that makes Warp's whole agentic pitch work, stayed exactly as closed as it was before.

Cline's Kanban board, Qwen Code's Agent Team mode, GitHub Copilot's /fleet — nearly every parallel-agent feature I've covered this month leans on the same twelve-year-old git feature to keep agents from overwriting each other's work.

Graphify's whole pitch rests on one specific technique: parsing code into a real syntax tree instead of embedding it. Here's what that tree actually is, and why it's a fundamentally different kind of understanding than similarity search.

RAG, memory tools, and just pasting more into the prompt all sound like the same fix for the same problem. They're not, and mixing them up is an easy way to pick the wrong tool.

Writing a spec before writing code is an old idea most teams quietly dropped somewhere along the way. Coding agents are the reason it's suddenly worth picking back up.

New question and highlights formats mean you don't have to pull an entire page just to get one fact out of it, and Firecrawl's own benchmark puts it well ahead of Exa on the same test.