AI-Assisted Software Development
Every finding this slice selected, newest first. Filter by topic, open any card's source, share any page: the URL is the state.
Following opens with early access — sign up for early access to register your interest; it does not switch following on today. Everything you follow will land on one page, in your account menu.
All coverage
Everything Intel has read, newest first. Each title opens at its original publisher.
- Dev Tooling & Infra
A hidden instruction in a Word document can now copy itself into the next document
Every document your assistant reads is now potentially a carrier, and it spreads through ordinary drafting - the file-sharing habits of a normal team are the attack surface.
- Dev Tooling & Infra
Vercel Sandbox can fork itself — branch an agent off a saved snapshot instead of rebuilding it
A fan-out of agents over one prepared environment stops meaning N cold builds — the setup cost is paid once and forked.
- Dev Tooling & Infra
npm now scans every newly published package before anyone can install it
Any release automation that installs its own package immediately after publishing will now intermittently fail - a one-line assumption in a lot of pipelines that has just stopped being true.
- Dev Tooling & Infra
GitHub Actions will hold a suspicious workflow for approval instead of running it
The attack this blocks is the cheapest full compromise of a build pipeline there is: hold a token, push a workflow, harvest every other secret the pipeline owns.
- Dev Tooling & Infra
Vercel’s AI Gateway can now pin inference to the US or the EU with a single field
Data residency is usually the reason an AI feature stalls in legal review; a provider-agnostic region flag turns that from an architecture problem into a configuration line.
- Dev Tooling & Infra
GitHub gives admins a dedicated policy for Copilot app access — and pushes managed settings into the cloud agent
Once a coding agent runs in the cloud under enterprise settings, the admin policy surface IS the security boundary — and the telemetry configuration is what makes any of it auditable afterwards.
- Dev Tooling & Infra✓ verified
There is a resale market for stolen LLM tokens, and an unprotected endpoint is its supply
Any team that exposes an LLM-backed endpoint without a spend cap is now a supplier to a priced, tooled market that actively hunts for one.
- Dev Tooling & Infra
Vercel workflow steps can now run 30 minutes, up from just over 13
Long agent steps have been split across invocations purely to dodge a timeout; a 30-minute ceiling removes a chunk of that plumbing.
- Dev Tooling & Infra
Vercel puts its web application firewall in front of Blob storage
Object storage is the quiet soft spot in agent-built apps — uploads and generated artefacts land there, and the firewall used to stop at the edge of the application.
- Dev Tooling & Infra
Anthropic cut over 80% of Claude Code's system prompt for the Claude 5 generation — and says nothing measurable broke
Most agent harnesses still run the previous generation's playbook — long rule lists, worked examples, everything front-loaded. If the vendor's own harness got dramatically shorter without getting worse, the prompt you are maintaining is probably carrying dead weight.
- Dev Tooling & Infra✓ verified
Ruff turns on 413 lint rules by default, up from 59
A sevenfold jump in default rules lights up existing repositories on the first run — which is exactly the kind of large, mechanical, well-specified cleanup a coding agent absorbs better than a human afternoon.
- Dev Tooling & Infra
GitHub Issues gets a throttle for autonomous agents — approvals, confidence scores, a reason for every action
A confidence threshold you can dial is the first practical answer to "how much do I let the agent just do?" — the same shape VS Code shipped for tool calls a week earlier.
- Dev Tooling & Infra✓ verified
VS Code 1.130 lets the model judge risk before an agent tool call asks for approval
A shipping example of an LLM risk-prefilter layered ahead of hard approval gates — the pattern agent-tooling teams are converging on.
- Dev Tooling & Infra✓ verified
PyPI now blocks adding new files to releases older than 14 days — a supply-chain hardening move
Python teams with slow multi-platform build pipelines should confirm all their wheels publish within 14 days; everyone else just got a safer dependency chain.
- Dev Tooling & Infra
Vercel opens up Vercel Agent — an AI that investigates incidents, fixes builds, and reviews PRs
A production agent that triages incidents and reviews code is the applied edge of the coding-agent wave — always-on autonomy a team can switch on without building it.
- Dev Tooling & Infra✓ verified
GitHub Code Quality reaches general availability — and billing starts automatically
Admins who enabled the preview are now paying for it — audit enablement today — and coverage thresholds can now be enforced mechanically through rulesets.
- Dev Tooling & Infra
VS Code 1.129 ships a dedicated agent host and an editor panel inside the Agents window
The editor most developers use keeps reorganizing itself around agents — worth ten minutes to learn the new agent host before your team asks about it.
- Dev Tooling & Infra✓ verified
Dependabot now waits 3 days by default before proposing dependency updates
A default-on cooldown is a supply-chain defense that reaches every repo using Dependabot — worth knowing whether you keep it or opt out.
- Dev Tooling & Infra
Vercel now redacts Sensitive Environment Variable values from build logs
If you deploy on Vercel, one of the easiest ways to leak a key — echoing it in a build step — is now masked by default.
- Dev Tooling & Infra✓ verified
Meta ships Muse Spark 1.1 — its first coding model with an API
Another credible coding-agent with open API access — more competition and portability for teams picking an AI coding tool.
- Dev Tooling & Infra
VS Code 1.128 ships multi-chat agent sessions, Copilot Vision (GA), and BYOK agent models
The most widely used code editor just made parallel agent sessions and vision-attached chat mainstream defaults — a direct read on where day-to-day developer AI workflows are heading.
- Dev Tooling & Infra✓ verified
JetBrains publishes a 105-task Kotlin benchmark for coding agents
Nearly every public agent benchmark is Python. A language-specific, test-verified suite is the only honest way to know whether a headline score transfers to the stack you actually ship.
- Dev Tooling & Infra
Claude Code: subagents run in background by default + auto-open draft PRs; permission default now "Manual"
If you drive Claude Code day to day, the defaults just changed: parallel subagents run in the background and can push branches + open PRs on their own, and the safer "Manual" permission default means you approve more actions explicitly — re-check any hooks or automation that assumed the old behavior.
- Dev Tooling & Infra✓ verified
Claude Code has been quietly running on Bun's Rust rewrite since mid-June — and almost nobody noticed
The runtime under one of the most-used AI coding tools was swapped out in production across millions of devices without incident — 'boring is good' is what a successful large-scale rewrite looks like.