Wiz's autonomous attack agent smuggled shell commands through a GitHub issue title and exfiltrated Snowflake's internal Jira token. Despite reports blaming Copilot Autofix, the commit history shows a 10-month-old branch merge that reverted a December 2025 security fix.
OpenAI, Microsoft, AWS, Cursor, GitHub, and Vercel published Agent Plugins 1.0.0 on August 6. A single plugin.json bundles skills and MCP servers, and Anthropic, which authored both ingredients, is not on the list.
JFrog tried to reproduce six SQLite CVEs and none of them held up. The functions they blamed did not exist in those versions, and the proof-of-concept code never crashed. MITRE rejected all six on July 31, but the GitHub Advisory DB still shows 9.8 Critical.
Nvidia and Microsoft led an open-weights letter now signed by 132 companies, and Anthropic is the one US frontier lab missing. Amodei countered with chip export controls, industrial-scale distillation enforcement, and mandatory pre-release safety testing for every model.
Microsoft shipped MAI-Cyber-1-Flash, its first cybersecurity model, on July 27. A small in-house model takes up to 90% of the work and routes the hard 10% to GPT-5.4, halving cost and scoring 95.95% on CyberGym.
GitHub Agentic Workflows is now in public preview, turning Markdown automation intent into GitHub Actions runs for triage, CI analysis, docs updates, and safe agent outputs.
GitHub added /security-review to Copilot CLI, shifting AI-assisted security review from the PR queue to the pre-commit diff.
Microsoft Work IQ APIs reach GA on June 16, bringing Microsoft 365 work context, ten MCP-style tools, and Copilot Credits pricing to agents.
Microsoft Scout connects an OpenClaw-style always-on agent to Teams, Outlook, shell, browser, MCP, and Agent 365 controls.
Microsoft MAI-Code-1-Flash is rolling into Copilot with 137B MoE, 5B active parameters, 256K context, and new AI Credits economics.
GitHub expanded the Copilot app technical preview to paid users, while canvases move agent work into reviewable plans, PRs, terminals, and browser sessions.
Microsoft introduced Rayfin and Fabric Apps preview so AI-built apps can deploy with Fabric database, authentication, GraphQL, and governance.