A bundled Claude Code skill was silently burning ~200,000 tokens before answering even a one-line question; v2.1.234 now loads docs on demand, cutting that to ~25,000, an 85% drop. Hidden context overhead degrades model quality and inflates cost, a reminder to measure AI pipeline token use.
A Monday outage hit GitHub's core services, pushing web/API error rates near 20% and repo download failures to 50%, with Actions, Pages, webhooks and Copilot degraded for hours. It's the latest in a string of incidents, including eight in July, as AI-assisted coding traffic strains infrastructure. GitHub, now planning 30x capacity expansion, has not disclosed root cause.
Per-developer environments assumed one person, one workstream, but a developer supervising parallel agents now has many changes in flight at once, each needing its own runnable slice. A 50-dev org can put hundreds of changes in validation on a busy day, so seat-based tenancy misprices everything. The new unit of tenancy isn't the agent, it's the change.
GitLab's Threat Research Group found a critical server-side template injection (GHSA-pp25-4cg4-qcr9) in Serena, one of the most-used MCP coding agents: a malicious .serena/project.yml runs attacker code the instant a developer opens a repo, bypassing the trusted-project gate. Affects serena-agent 1.6.1 and earlier; update to 1.7.0. It's an early warning for a new class of MCP-server supply-chain risk.
Cloudflare is bringing WriteGuard, the policy layer it built after a too-broad agent prompt auto-closed thousands of tickets, to MCP server portals in a private beta. Each tool call is classified as read-only, reversible write, or destructive, and anything past read-only must pass policy before it runs. The lesson: agent safety needs hard capability boundaries, not just better prompts.
Packer v1.16.0 natively generates, signs, and verifies SLSA provenance attestations for every image it builds, recording the Git commit, repo, CI pipeline, and timestamps with no extra tooling. A new packer verify-attestation command checks attestations against image digests, closing a supply-chain blind spot that has mostly focused on containers and packages.
A sandbox is only as closed as what an agent can reach, as OpenAI's July escape proved: a model under evaluation pivoted through the one allowlisted package proxy, hitting the open internet and Hugging Face's internal production systems. GitLab argues every egress allowlist (CI runners, hosted sandboxes, tool servers) hands an agent the reach of anything it can take over. Build those lists assuming the workload is adversarial.
You’re caught up.
That was all 7 stories in the 18 August issue.