The one thing
01Five vendors agreed on a plugin format. Read what they agreed not to standardise.
Agent Plugins 1.0.0 published yesterday: a vendor-neutral package format for the things people already write for coding agents. A plugin is a directory — plugin.json names it, skills/ holds Agent Skills, mcp.json describes MCP servers, and reverse-domain folders let a client add its own behaviour without touching the portable core.1 The technical steering committee is Amazon, Cursor, Microsoft, OpenAI and Vercel. It is not a press release with a roadmap: Codex shipped support the same day, and you can install portable plugins and search local, personal, workspace and remote catalogues from the CLI today.2
The specification draws the line itself. Portability covers the layout; distribution, installation, permissions and user experience stay under each client's control.1 So a plugin written once still lands in a different installer, a different trust model and a different approval flow in every tool that reads it. That is a real floor, and it is a floor deliberately laid below the parts that actually hurt.
Deeper — the objection, and why it is not noise
- Mario Zechner, who maintains a competing harness, read the specification and posted: "after reading the spec, this actually solves nothing... just like with the skills 'standard', which to date nobody has implemented properly, because for that you basically have to reverse Claude Code's slop."8 Both sides are describing the same document. The disagreement is about whether an interoperability floor that excludes installation and permissions deserves the word standard.
- Governance is public — proposals go through GitHub Discussions and are expected to establish a portability need plus implementer support before landing.1 That is the part most vendor consortia skip, and it is the reason to take this more seriously than the last format announcement.
- The practical test is the second client that can install a plugin written for the first without editing it. Nobody has demonstrated that yet.
Shipped
04Codex 0.147.0
Installs and searches Agent Plugins across local, personal, workspace and remote catalogues; adds --approve-for-me for automatically reviewed approvals; opts into the MCP 2026-07-28 protocol; imports Cursor-managed skills without duplicating conversations.2
Claude Code 2.1.224
claude self-hosted-runner turns your own machines or containers into a place web, mobile and desktop sessions run, on Team and Enterprise plans. Plugins can now install from a zip over HTTPS with optional SHA-256 pinning — no git, no npm.3
Pydantic AI 2.26.0
Function tools can stay hidden until revealed — by tool search, load_capability, or a ToolReturn — using each provider's native deferral channel. Run cancellation lands as AgentRun.cancel() and RunContext.cancel().4
Kimi K3 in GitHub Copilot
The open-weight model is generally available in Copilot, billed at provider list pricing under usage-based billing. The changelog carries an editor's note dated the same day: rollout has resumed.5 A rollout that resumed is a rollout that stopped, and the note does not say why.
Promised, not shipped
Grok 4.6 in Cursor — "very soon", no date · Agent Plugins in Cursor, GitHub Copilot and Vercel — announced as compatible; only Codex ships it in a release today
The conversation
01A browser game that put developers in the approval seat collected 40,000 plays and 409,000 approve-or-deny decisions. Mean accuracy was 66.3% — one threat in three was approved. Commands that exfiltrate credentials were missed three times as often as obviously destructive ones: 35.0% for scope violations like cat ~/.aws/credentials against 11.7% for rm -rf /. The single most-missed command was npm run analyze at 64.7%, with the malicious script body printed in the log directly above the prompt.6
- @Wirbelwind · the author, on Hacker NewsFirst-hand, and states its own limits
"It's just a game, but I found the stats still interesting... Even with the warning up front, 1 in 3 threats were missed, and the history log above" the prompt went unread.7 The post is equally plain that 34% of commands shown were threats and a clock was running — proportions no real week has.
- @continuational · Hacker NewsReads the pattern, not the number
"It's kinda funny there is still software coming out whose security model is 'constantly ask the user for permission, and hope they never make a mistake'. It's been tried so many times before, and it never worked."7
- @VladVladikoff · Hacker NewsThe pushback that lands
Several prompts were genuinely ambiguous about whether they were risky, and people disagreed at the time about which were which — a flaw in the instrument, not only in the players.7 The author concedes the same point about
cat ~/.zshrc, harmless or a credential dump depending on a setup the agent cannot see.
Notice the timing. On the same day this circulated, Codex shipped a flag that reviews approvals for you.2 That is vendors agreeing with the evidence, not ignoring it. If the human gate leaks a third of the time, moving the gate is the right response.
But it relocates the safety story, and the question you ask a vendor changes with it. The question becomes what is the sandbox, and what can the agent still reach when it decides for itself. The number to carry out of this is not 66.3%, which is an artefact of a game. It is the ratio: danger dressed as routine gets through three times more often than danger that looks dangerous.
Community layer today: the X accounts digest — 95 accounts, collected 05:30 UTC, 180 posts seen and 45 kept — plus Hacker News. The Reddit digest has not started collecting yet and the X keyword digest did not run in this window. Stated rather than hidden.
Skip this
05AMD acquires Taalas to etch models into silicon. 749 points and a real acquisition, but nothing you install, pin or budget for this quarter turns on it.
"Software development with AI is starting to feel like cooking steak." 404 comments of agreement about a metaphor. No artefact, no measurement, nothing to verify.
"Taste Is All That's Left." The month's essay about craft. Read it on a Sunday; it changes no decision on a Friday.
New Mexico court orders Meta to pay $567m over harms to children. A serious story on the wrong beat. It belongs in your news reading, not a toolchain briefing.
Google's WeatherNext 2 forecasting model. Genuinely impressive and not a developer tool. We cover what you build with, not what the labs can do.
Everything we saw
103103 candidates scanned · 14 used in this issue — the rest, with the reason each one was left out
| Item | Source | Signal | Call |
|---|---|---|---|
| Agent Plugins 1.0.0 specification | agent-plugins.org | spec, 5 vendors | led the issue |
| Codex rust-v0.147.0 | github releases | 12h | shipped |
| Claude Code v2.1.224 | github releases | 10h | shipped |
| Pydantic AI v2.26.0 | github releases | 11h | shipped |
| Kimi K3 in GitHub Copilot | github changelog | 21h | shipped, with a question |
| Humans missed 1 in 3 threats approving agent commands | scalex.dev · HN 326 | 228 comments | the conversation |
| GitHub Actions degraded — critical, 10.7 hours | githubstatus · HN 439 | critical, 10.7h | reported here: your CI can be gone for a working day |
| GitHub Pages deployment lag — minor, 1.3 hours | githubstatus | minor, 1.3h | same outage window, smaller blast radius |
| Cursor: degraded performance for Grok 4.5 — 0.5 hours | cursor status | minor, 0.5h | too short to be a story |
| Cloudflare launches WebMCP developer preview | x accounts digest | 2217 likes | preview, not shipped — watching |
| Cloudflare: MCP v2 stateless core on Workers | x accounts digest | 123 likes | watching for the SDK migration path |
| Codex can review every GitHub pull request for security | x accounts digest | 1044 likes | vendor claim, primary not yet opened |
| fchollet: a harness is a neurosymbolic architecture | x accounts digest | 3141 likes | a good frame, not a fact |
| Gemini CLI v0.54.4 | github releases | 9h | three patch bumps and a revert |
| Vercel AI SDK ai@7.0.56 | github releases | 12h | package-level release, nothing that changes a decision |
| Netlify adds open models and OpenCode agent runners | x accounts digest | 55 likes | platform news, no primary opened |
End of feed. That is everything from the window worth your time.
Next issue tomorrow, 06:00 UTC — and if nothing ships, it will say so in two hundred words.