Update, October 13, 2026: The September 27 gateway promotion and October 7 cloud-credit claim deadline have passed. Copilot local sandboxing reached general availability on October 7.

OpenAI cut its GPT-6 Sol and Luna API rates, and Anthropic estimates Opus 5.5 costs less to run on typical token-billed work. xAI kept Grok 4.7 at the same listed price as Grok 4.6; Vercel’s 40% offer is a temporary gateway promotion.

GitHub added separate ways to manage Copilot approvals and local access. Cursor introduced bots that review changes from pull request to production. Cloudflare and Lovable also made common setup and planning tasks easier to hand off to an agent.

Coding Agents: Lower Costs, Clearer Limits

Model costs and the temporary Grok offer

OpenAI expanded the GPT-6 family with Sol and Luna and cut their API rates by at least 50% compared with GPT-5.6’s promotional prices. Sol costs $2 per million input tokens and $10 per million output tokens. Luna costs $0.10 and $0.50. GPT-6 Astra remains at $10 and $50.

Tokens are pieces of text that an API counts and charges for processing. These are usage rates, so they do not automatically lower the price of a fixed subscription. If you are choosing a model for coding, compare the total bill and the amount of correction work on the same routine task before changing your default.

Anthropic estimates Claude Opus 5.5 costs about 40% less to run than Opus 5 on typical token-billed workloads. That is an estimate for total usage, not a 40% cut to every price or plan. Anthropic’s aggregate Claude Code usage data from March to September showed 3.3 times longer work per prompt and 2.6 times more context per request.

Claude Code added a usage reset that users activate from Claude.ai or Desktop Usage settings. Check its availability and any expiry before choosing when to use it. Anthropic’s ClaudeDevs account also announced a one-time launch credit of $100 for existing Pro subscribers and $250 for Max, with an October 7 claim deadline.

xAI says Grok 4.7 launched at the same API price as Grok 4.6, with better performance on longer tasks.

Separately, Vercel offered 40% off Grok 4.7 through September 27 on AI Gateway. That promotion does not change xAI’s base price.

GitHub adds separate approval and access controls

Copilot for JetBrains 1.18.0 added assisted approvals in public preview. GitHub says low-risk tool calls receive automatic approval, while higher-risk calls still prompt you. Check which actions receive automatic approval in the JetBrains preview and where your installation records them before relying on it.

Local sandboxing arrived in the Copilot app, initially in public preview and off by default. GitHub made local sandboxing generally available on October 7. The sandbox limits project files, network access, and saved GitHub credentials available to an agent. This setting is per project and covers local sessions, not cloud, remote-host, or Copilot CLI sessions.

To enable it, open the project’s settings in the Copilot app, choose Sandbox, and turn on Sandbox new sessions. Use /sandbox on to enable it for an active local session. Assisted approvals decide which tool calls need a prompt. Sandboxing limits what an agent can reach if a call is approved anyway.

Cursor reviews from pull request to production

Cursor’s Rollouts and Security Reviewer bots start before code ships. Rollouts follows a pull request through deployment. It needs connected source control, a deployment system, and a telemetry service that tracks app behavior. Before merge, it writes a monitoring plan.

After deployment, Rollouts compares live behavior with a pre-deploy baseline. It can alert the team, pause a staged release, or open a revert pull request for a person to approve. A staged release sends the change to a small group before a wider launch.

Security Reviewer runs on every pull request before merge. It checks for injection bugs, where user input can alter database queries or commands, as well as missing login or permission checks and exposed secrets. It also flags unsafe data parsing, unvalidated redirects, vulnerable dependencies, and insecure infrastructure settings. It explains findings and proposes a one-click fix for you to review.

At launch, both bots were available only on Cursor’s Teams and Enterprise plans. Rollouts will not help much if you have no deployment or metrics setup to connect. Security Reviewer has a simpler starting point, but read each proposed fix before applying it.

Infra & Deployment: Python and Bot Protection

Python Workers reached general availability on Cloudflare’s platform. You can run frameworks such as FastAPI, Django, and Flask, and connect Python code to Cloudflare’s other services. The runtime uses Pyodide, a version of Python compiled to WebAssembly, a compact format for running code in a sandbox. Some packages that rely on compiled C or Rust code still need a compatible version. Check Python Workers package compatibility before building around a library.

Turnstile Spin lets a coding agent set up Cloudflare’s free CAPTCHA alternative. Turnstile needs both a browser widget and a backend verification call. Without that backend check, the widget can appear to work while the site still accepts bot submissions. Turnstile’s dashboard can flag widgets without a matching check and offer a Spin fix for you to review.

AI Builders: Free Chat and Narrower Access

Lovable’s daily free chat allowance lets you discuss an idea or question an existing app without spending credits, up to the daily limit. Generating images or video still costs credits. Handing work to Lovable’s Plan or Build modes also consumes credits. The current terms run through October 31. Check the terms again after that date.

Microsoft’s new Copilot Code feature lets people describe an app, tracker, dashboard, or workflow in natural language. It is a Microsoft 365 Copilot product, separate from GitHub Copilot, and uses the same underlying technology. Microsoft scheduled Code’s Frontier early-access rollout for the end of September, followed by wider availability in the coming weeks. Microsoft says Code uses usage-based billing, where charges vary with use rather than a fixed monthly license, so check the cost model before building a workflow around it.

UpGuard’s Supabase security study examined roughly 300,000 domains with signs of Supabase use. It found 16,326 databases with readable tables. More than half had table-schema indicators of personal information. The researchers assessed schemas rather than reading every row, and did not attribute the findings to specific AI app builders such as Bolt or Base44.

If your app uses Supabase, check which users can read each table and review its row-level security rules, the rules that limit which records an account can access. Test signed-out and ordinary-user access with fake records before storing real customer data.

Workflow: Data-center debt, unused AI capability, and open models

Four people across three stories focus on different questions. Ed Zitron’s newsletter post estimates that finance has supplied $100 billion to $150 billion in debt for AI data centers outside the largest cloud providers. He argues many companies building those facilities lack experience with AI data centers or power procurement. His infrastructure argument concerns how providers finance the compute builders depend on.

Ethan Mollick’s essay calls the gap between what current models can do and what people actually use a capability overhang. He argues that much of today’s ability is still sitting unused. Ben Thompson uses overhang to discuss different pressures on frontier labs, including whether releasing models more slowly addresses risks from models already in use. Their uses of overhang concern different pressures, rather than a direct disagreement about the same claim.

Nathan Lambert says Chinese models’ share of open-model usage on OpenRouter rose from about 70% to over 80%. OpenRouter is one model-routing service, not a measure of all AI use. His briefing names products from Cursor, Perplexity, DoorDash, and Airbnb that use Chinese open-weight models. Lambert’s briefing defines these models as downloadable weights people can run themselves.

For builders, the useful question is which model fits a real task, license, and data-handling need. Try an existing capability on a routine piece of work and measure the result, cost, and review time before making a larger change.

What mattered

The announcements affected costs differently: API rate cuts reduced ongoing usage prices, Vercel offered a temporary discount, and Claude Code announced a one-time cloud-session credit. Check which one matches your workflow before changing plans or defaults.

What was noise

Google’s Gemini 3.8 Live Avatar is available in Gemini Enterprise and supports an API for conversational agents. It is a specialized enterprise feature, not a default choice for most solo builders.

Meta’s Horizon Create and Horizon Studio use AI to help make games for the Horizon ecosystem, with early access available by request. They target game creators rather than general app building.

What to watch

  • Whether GitHub explains which JetBrains agent actions count as low risk and how users can review automatic approvals.
  • Whether Cursor expands Rollouts or Security Reviewer beyond Teams and Enterprise.
  • Lovable’s October 31 end date for its current free chat terms.

End of article