One bug in a widely used image-decoding library mattered twice this week. Security researchers used it, with Claude’s help, to reach inside OpenAI’s systems, and Vercel had to patch the same flaw in Next.js.

Anthropic merged Cowork and chat. Claude Code also redesigned Projects and changed classifier billing, while Firebase and Vercel added spend controls.

Infra & Deployment: One Bug, Two Security Responses

Security researchers at Hacktron disclosed this week that back in July, they broke into OpenAI’s internal systems starting from a single image file. They found a buffer overflow inside libheif, a library that decodes a common image format. A buffer overflow writes beyond a memory buffer and can sometimes let an attacker run code. OpenAI’s Discourse forum, the outside software it uses to run its public community forum, processed uploaded images through that same buggy library.

From there, a separate flaw in OpenAI’s single sign-on setup let a compromised forum account escalate into full employee ChatGPT and Codex accounts. Single sign-on is the system that lets one login work across several internal services. That gave the researchers a path into OpenAI’s internal code repository. They reported the initial finding, then used an employee’s Codex access to open a harmless proof-of-concept pull request and updated their report before stopping further testing. OpenAI shipped a fix within 14 hours and paid a $6,500 reward in September.

Claude helped the researchers develop and adapt the exploit. The researchers said Claude Opus 4.8 struggled across several attempts, but Opus 5 solved the same problem within hours of its release. That detail matters as much as the breach itself. The same jump in a model’s coding ability that helps you ship features also lowers the bar for finding this kind of bug.

The same libheif flaw reached further than OpenAI. Vercel disclosed, in a separate writeup, that Next.js’s built-in image optimization relies on a chain of libraries: sharp, then libvips, then libheif. That chain processes AVIF files, a type of image format, and a malicious one could trigger the same bug. Vercel deployed a platform-wide fix and worked with the maintainers of all three libraries on real patches while disclosure was still pending.

Princeton researchers Arvind Narayanan and Sayash Kapoor argue that model capability makes security controls more urgent, and that alignment work alone cannot resolve those gaps. A related analysis of that distinction offers more background. If your app touches AVIF images through Next.js, sharp, libvips, or ImageMagick directly, confirm you’re on a patched version. Don’t treat this as someone else’s problem.

Two smaller infra changes are worth a line each. Cloudflare now lets you scope a teammate or an agent’s access to a single Worker with narrower resource permissions. Vercel is also deleting old deployments faster on its free Hobby plan, and older preview links can expire once their retention protection ends. Access controls do not prevent retention-based deletion.

Coding Agents: Claude Consolidates, GitHub Rewrites Itself

Anthropic merged Claude Cowork with regular Claude chat, bringing its workspace for bigger, multi-step tasks into ordinary conversations. Until now you had to decide upfront whether a task belonged in a normal conversation or in Cowork. Work you started in one didn’t carry over to the other. Now any conversation can do either.

Claude Docs and Claude Slides launched alongside the merge, giving Claude its own document and presentation formats. It also brought Claude Design into normal conversations, instead of keeping it in its own separate space. The rollout reaches Pro and Max plans over the coming weeks.

The redesigned Claude Code Projects feature coordinates longer tasks. A coordinator agent there splits one goal into several parallel Claude Code sessions. The September 17 beta initially reached select Pro and Max users. Parallel sessions can use your allowance faster than a single session.

Two smaller Claude Code changes are worth flagging. It now falls back to reading AGENTS.md by default when no qualifying CLAUDE.md or CLAUDE.local.md exists, but a leftover file can prevent direct loading under that setting. The Project instructions setting can change the selection.

Its September 19 update also changed how some enterprise accounts get billed for auto mode. The permission classifier, which decides whether auto mode should allow an action, now runs server-side by default without classifier-overhead charges for the listed API, Enterprise, and provider sessions. Supported provider and gateway setups can opt out, and billed fallback can still occur.

GitHub, meanwhile, published a detailed account of using Copilot to rewrite Copilot’s own runtime, the core software behind its CLI, app, and SDK. The rewrite switched the codebase from TypeScript to Rust, a systems programming language, in a process GitHub documented in detail. The port ran over about 14.5 weeks, primarily led by one developer, while other developers continued changing the runtime. The resulting implementation contains more than 800,000 lines of production Rust. GitHub says that job would have taken a full team a year or two before agentic coding tools existed.

The interesting part isn’t the speed. It’s the coordination. The developer ran up to eight parallel Copilot sessions, each porting a different piece of code. One extra chat session acted as a gatekeeper. It decided when each session could run a heavy build, so they didn’t all compete for the same machine at once.

GitHub’s model-based classification assigned about 31% of the developer’s human-authored messages to review, testing, and CI. That’s a concrete picture of what a large agentic refactor looks like right now. A human directs many coordinated sessions. One prompt doesn’t produce a finished migration.

Separately, GitHub is retiring six older Copilot models on October 19. The list includes Gemini 3.7 Flash, GPT-5.5, GPT-5.4, GPT-5.4 mini, GPT-5 mini, and Grok 4.5. If your workflow calls out any of these models by name, check your model policy before that date.

Two other coding agent updates in brief. xAI’s Grok Build now keeps its own notes on a project’s conventions between sessions, so later sessions can reuse saved conventions. And a veteran product reviewer testing Meta’s Muse agent praised its permission system and activity log. The log shows the trail of steps behind a result. She said both beat what she’s seen in Claude Code or Codex, on that specific point, not on coding ability.

AI Builders: A New Kind of Model, and More Salesforce

A different kind of AI model got real attention this week. Jev, from a startup called TypeSafe AI, is now available through Vercel’s AI Gateway, a single API that reaches models from many providers. Unlike a normal language model, which generates text in small units called tokens, Jev works differently. It evaluates a set of yes/no or multiple-choice questions about a piece of data all at once. Then it returns direct, typed answers, each with its own confidence score.

TypeSafe reports Jev ran up to roughly 194 times faster and 445 times cheaper than a full language model on its own workflow tests. Those numbers come from the vendor’s own benchmarks, not an independent test.

The practical use is narrow but common. An agent might use it to decide which tool to call next, or to score how urgent a support ticket is. It can also flag whether an AI output needs a human to check it. None of that needs a model generating free-form text.

Lovable and v0 both pushed further into enterprise data this week. Dashboards built in Lovable can now publish as native pages inside Salesforce, though anything that writes data back still runs through Lovable itself. And v0 can now install a team’s private npm packages during generation, using credentials saved once in Vercel. Protect the shared registry credentials: current Vercel settings distinguish write-only Secrets from Config values that authorized members can read.

Workflow: Cost Controls Are Having a Moment, and What an FDE Should Do

Cost controls had a busy week across unrelated vendors. Firebase introduced spend caps that act as a circuit breaker for Gemini API and Cloud Functions usage. They pause the service once you hit 100% of a budget you set, with warning emails at 50% and 80% along the way.

Vercel extended its existing Spend Management tool to Enterprise customers on Flexible Commitment plans, at no added cost. Pausing is opt-in and can stop production deployments across the team’s projects. It does not stop AI Gateway or v0 usage.

These controls do not guarantee a hard spending ceiling. Enforcement depends on usage reporting and the configured pause action, so charges can exceed the threshold.

GitHub Copilot’s cost tiers have a similar limit. Picking “efficiency” biases which model auto picks. It doesn’t cap what you’re billed for a given task. Check the covered services, alerts, and pause action against your budget before relying on them to limit a surprise bill.

Away from tooling, Kepler CEO Vinoo Ganesh published a pointed critique of how companies staff Forward Deployed Engineers. These are AI-era hires who work embedded inside a customer’s own team. His test is simple. If an engagement ends with one happy customer and nothing that made the core product better for the next one, it failed. In his argument, customer delivery needs to produce reusable improvements to the core product, rather than remain a succession of bespoke projects.

What mattered

This week’s practical lesson was to verify the boundary around any system an agent can reach. That means patching shared image libraries, checking which Claude surface owns a task, and treating spend caps as delayed safeguards rather than hard limits.

What was noise

Google’s redesigned “CC” AI agent now shares scheduling and household tasks across up to six family members. It’s a consumer feature for coordinating a household, not a change to any tool builders use to ship software.

Apple’s iOS 27 and macOS 27 releases add a rebuilt Siri built on a large language model. That’s a meaningful consumer update, but it doesn’t change how you build or ship software today.

What to watch

  • Whether Cowork, chat, Docs, and Slides reach Team and Enterprise plans, and whether the Projects coordinator moves past its narrow beta.
  • Whether other companies that depend on libheif, sharp, or libvips for image processing confirm they’ve patched the chain Hacktron used against OpenAI and Next.js.
  • GitHub Copilot’s October 19 deadline for retiring six older models, if your workflow still references any of them directly.
  • Whether typed decision models like Jev show up inside coding agents’ own tool-routing logic, beyond Vercel’s gateway.

Check the image libraries your app deploys, the instruction files your agent loads, and the services your budget controls actually cover.

Updated October 13, 2026: auto mode uses a permission classifier, and the Copilot port took place over a 14.5-week window with ongoing contributions. Project instruction loading is configurable; shared npm credentials are team-level settings; Vercel’s opt-in deployment pause excludes AI Gateway and v0.

End of article