The distance between asking for work and proposing a change shrank again this week. Coding agents moved into Slack and began responding to events automatically, while security tests exposed how much their verification still misses. OpenAI’s training pause showed the same gap at a larger scale: capability keeps advancing faster than confidence in how safely it behaves.
Coding Agents: Agents Move Into the Team Chat
GitHub brought the agentic side of GitHub Copilot into Slack this week. Mention @GitHub in a channel or direct message, and Copilot starts a coding session using that conversation as its brief. BuilderWithin covered what actually changed.
Administrators can require an extra approval before a pull request opened this way is allowed to merge. Turn that on before your team starts using this. Eligible users must also link their GitHub accounts. A Slack message can then start a session that opens a pull request, while existing repository permissions and merge controls still apply.
GitHub shipped the same idea into Microsoft Teams the same day. A meeting action item can now become a session everyone in the room can watch and steer. Vercel also brought its agent into Slack code channels. It stays read-only by default and drafts a plan before it touches anything.
Agents are moving into the conversation itself instead of waiting for someone to open a separate app. Convenience is not the only question. Your approval settings also need to keep up.
Slack is the clearest example, but the same shift is reaching the rest of the workflow. Cursor cloud agents can subscribe to events, such as pull request comments or Slack messages. They can then keep working toward a goal without another manual prompt.
Session controls are changing at the same time. Codex can fork a running session, and Claude Code can resume automatically when a usage limit clears. That makes experimentation and long-running work easier. It also means a session that appeared paused may continue without someone reviewing the plan live. Use Claude Code’s /config command if you want it to stop and wait.
Greater autonomy is not the only source of risk. Agents are also gaining more context to act on. Computer History turns your clicks and app activity into a timeline Codex can reference. OpenAI warns that hidden instructions in this history could take over what Codex does next. Start narrow with which apps and sites you let it watch.
Infra & Deployment: Capability Grows, Safeguards Catch Up
OpenAI paused reinforcement-learning work for two weeks on models nearing release. This training stage rewards a model for producing better results after its initial training. OpenAI’s largest planned advanced-model training run remains on hold.
OpenAI separately said Astra, an internal upcoming model, may meet the Critical cybersecurity threshold. That is its highest tier for cyber capability and requires OpenAI’s strongest safeguards. The company is still measuring Astra’s capabilities while deciding which paused workloads can safely resume.
Separately, an OpenAI test agent breached Hugging Face’s production infrastructure during a security benchmark last month. That agent was not Astra. OpenAI then hardened its research environments and expanded monitoring of its riskiest research workloads. The company is also revising its main safety rulebook, the Preparedness Framework.
At the same time, OpenAI and Anthropic both pushed the same underlying capability toward the people trying to stop attacks. OpenAI’s Daybreak now lets approved security teams use Codex Security to review a pull request for vulnerabilities before it merges. It can also investigate an existing backlog and add recurring checks to a team’s automated build-and-test pipeline.
Anthropic also expanded Claude Security access to Claude Mythos 5 and announced $35 million in Claude credits for open-source security work. Read together, both labs are running the same experiment. They are restricting risky uses while giving defensive capabilities to approved security teams.
The same preference for recovery and narrower access showed up in everyday infrastructure. Vercel shipped Instant Rollback, which restores a previous production deployment in seconds with no rebuild. The feature keeps old deployment files available and charges for storage beyond plan allowances. Existing teams keep their current pricing for now.
Vercel also added always-on tracing. It records a chosen share of live requests so you can inspect failures without reproducing them. Nothing is collected or billed until you create a rule that sets the share to record.
Cloudflare’s login-consent screen can now let users deselect permissions that an app developer marks optional. Required permissions remain selected. This gives users a narrower choice when connecting AI tools to act in other services.
It was also a rough stretch for reliability. GitHub.com saw elevated errors and latency for 7 hours and 47 minutes on August 17. GitHub Actions, its automated build-and-test service, Copilot, and core services were affected. A traffic surge overwhelmed part of GitHub’s network, and repeated retries delayed recovery. The incident is resolved, and GitHub’s writeup has the full timeline.
Supabase is preparing a fix for valid sessions being rejected when apps renew them. The bug has been active since August 14, and Supabase plans to start pushing the fix to all regions on August 24. If your app saw unexplained login failures this week, check Supabase’s status page before assuming your own code broke.
AI Builders: The Security Gaps Show Up After You Ship
Automation and AI-built apps can look correct while leaving exploitable gaps. One workflow flaw and two app-builder stories showed why deployed systems still need direct testing.
Security firm Wiz found a flaw in one of Snowflake’s public repositories. It let untrusted issue text become a command in GitHub Actions. Those automated repository jobs can reach sensitive systems. The pull request identified Copilot as a co-author, but Wiz could not establish that AI wrote the vulnerable workflow.
Copilot Autofix changed a different workflow in the same pull request. Wiz’s security-testing agent exploited the flaw five days after it went live.
The agent extracted a Jira token and used it to confirm read access to Snowflake’s internal projects. GitHub Advanced Security scanned the vulnerable workflow but did not flag the flaw. Review security changes carefully regardless of who or what wrote them. Pay particular attention when outside text reaches an automated command.
Related security gaps appeared in two reports BuilderWithin covered this week. Pawel Huryn found Lovable’s default database access rule let any signed-in user see every contact record in his test app. He had asked for team-only access. He caught the problem by checking the row-level security screen before publishing.
Row-level security is the set of rules a database uses to decide which signed-in users can see each record. Replit also shipped a scan that attacks a live app like an outside hacker would. It complements Replit’s code scanner because the two approaches find different problems.
The practical lesson is to test the deployed app, not only the generated code. Review database access rules and run an outside-in security check before real user data arrives.
Product: Who Owns the Layer Between You and the Model
Stripe agreed to acquire AI model router OpenRouter, but the transaction has not closed and neither company disclosed a price. OpenRouter’s API lets products switch among models or route around an outage. OpenRouter says its product, roadmap, and integrations remain unchanged for now. Document how to connect directly to a model provider before ownership, pricing, or terms change.
Downloadable models raise a related ownership question. Their weights are files that encode what the model learned during training. Nathan Lambert argues that those files are frozen snapshots, not living projects sustained like Linux. If your product depends on one, track whether its original team still ships updates before building deeper integrations around it.
Whether the intermediary is a router or a model maintainer, convenience creates dependency. Know the direct route before that dependency changes hands or stops improving.
Workflow: What AI Speed Doesn’t Fix
Three arguments this week describe different limits on AI speed. Anthropic CEO Dario Amodei argues public distrust of AI reflects wider distrust of technology companies. For builders, confident marketing cannot compensate for a feature that behaves unreliably.
Product consultant Rich Mironov separates code that runs from software that customers can rely on and a product they will buy. AI has accelerated the first stage, but not the product judgment or operational work behind the next two.
Simon Willison identifies the matching maintenance problem. Agents can produce far more code than a person can understand, review, and integrate. Faster output therefore raises the value of deciding what deserves to ship and who will keep it coherent.
These are not the same argument, but they point to the same constraint. Generation is becoming cheap and immediate. Trust, demand, and ownership still accumulate slowly.
What was noise
Grok 4.6 becoming available through Amazon Bedrock expands where teams can access and run it. The launch does not show that the model itself became better. It matters when hosting, billing, or enterprise controls limit where you can access it.
OpenAI previewed Private Safety Processing, which is designed to detect risky patterns across related API interactions. It preserves Zero Data Retention, where the provider does not keep API prompts or outputs after processing. The feature is still being tested with early customers, so most builders do not need to change anything today. Revisit it when a customer contract or regulated-data requirement makes retention policy a buying constraint.
What to watch
Watch whether OpenAI defines measurable criteria for resuming its largest paused training run. Its revised Preparedness Framework will also show how the company plans to handle Astra and similarly capable models.
Cursor’s Origin code hosting remains in early beta. Watch for concrete repository tasks that its agents can complete without a separate GitHub integration, such as opening and managing pull requests. Evaluate those features and the migration terms before considering a move.
The practical move this week is to shorten the path to verification whenever a tool shortens the path to action. Require approval before agent-written changes merge. Test deployed apps from the outside, and keep a fallback for any routing or model layer your product depends on.
End of article