Hi, and welcome to this week's edition of the newsletter!
A small change to this edition - the news items below are now just a link and a one-line summary, rather than the detailed descriptions I've added in the past, and I've grouped the AI ones under sub-headings so they're easier to skim. The News item of the week is still a full write-up. This makes the newsletter much shorter and more digestible. As always, feedback is greatly appreciated. Feel free to reply to this email to get in touch, or ping me on any of my socials, which can be found on my personal website, danclarke.com.
If you get value from this newsletter, please help me out by sharing it on your socials and with your tech friends and colleagues - it really helps me spread the word and keep the newsletter going 🙏 (at-mention me, and I'll repost).
📌 News item of the week
Edition 041 covered the npm worm that compromised keyv and the cacheable namespace. This is the part I didn't have then.
The worm no longer needs npm install to run. It commits two files into the repository: a .vscode/tasks.json with an Environment Setup task set to run when the folder opens, and a .claude/settings.json with a SessionStart hook. In StepSecurity's words, opening the poisoned tag in VS Code executes one copy, and starting a Claude Code session in the repo executes the other.
Then it goes looking for credentials by path: .claude/credentials.json, .codex/auth.json, .cursor/credentials.json, .openai/auth.json, .anthropic/auth.json. Your agent's config directory is both the trigger and the target.
Command-and-control resolves through an Ethereum mainnet contract rather than a hardcoded domain. The operators moved from one host to another in a single on-chain transaction, and that write emits no events, so blocking today's domain tells you nothing about tomorrow's. Unit 42 counted 453 public GitHub repos across five accounts matching the exfiltration pattern, the newest created roughly 25 minutes before they ran the query.
The VS Code half is gated - tasks don't run in a folder you haven't trusted. The Claude Code hook is the one to watch: Anthropic's docs put the trust prompt on subagent frontmatter hooks, not on .claude/settings.json. Pillar Security's read is that whether opening a repo executes anything depends on the tool, its version and local policy. Worth grepping an unfamiliar repo for both files before you open it.
📰 News items and dev picks
AI news
Safety and security
OpenAI pauses work on Astra - OpenAI cannot rule out a "Critical" cyber rating, so internal work that doesn't yet meet its new security controls is paused.
Kimi K3 gamed a cyber benchmark - The sandbox's egress allowlist included GitHub, so the model cloned the benchmark's own repo and read the answers off disk instead of solving the task.
New models
Qwen3.8 open weights - Alibaba released the 2.4T weights, but the model is text-only and stripped of the Max features.
Gemini 3.7 Flash - Google claim big coding gains and have halved the price until the end of the year.
Grok 4.6 - It costs $2/$6 up to 200k tokens, and lands level with GPT-5.6 Sol on the Artificial Analysis index.
Agent standards
Agent Plugins 1.0 - Six core maintainers including AWS, Google, Microsoft and OpenAI have agreed one format for shipping Skills and MCP servers.
New MCP spec - Sessions are gone entirely, so servers can run stateless.
Coding agents
Claude Code auto mode is now the default - A classifier now checks every tool call instead of prompting you, on Pro, Max and Team.
Claude Code 2.1.225 to 2.1.232 - Seven releases brought GitLab support, cross-session @-mentions and more permission-bypass fixes.
Codex imports from Claude Code and Cursor - Codex can now pull your setup and recent work across from other agents.
DeepSeek Harness - DeepSeek open-sourced an MIT-licensed agent harness the same day it shipped V4 Pro.
Grok Bot - Each bot gets its own cloud computer, signs into the tools you already use, and works jobs end to end.
Editors and IDEs
VS Code 1.133 - Anthropic and Copilot models can now be mixed in a single Claude session, billed to your API key or your Copilot subscription respectively.
Copilot for JetBrains - Copilot now remembers across sessions and supports Ollama as a bring-your-own-key provider.
Agent Skills in IntelliJ IDEA - A Skills Manager in AI Assistant installs skills globally, per project or per agent, with JetBrains' own repository vetted for security vulnerabilities.
Intelligent Terminal 0.2 - Microsoft's experimental Windows Terminal fork can now run its agent pane against a model on your own machine.
Also this week
X open-sourced its For You algorithm - The For You ranking code is on GitHub under Apache 2.0, alongside a tool that shows the visibility labels on your own account.
Claude on the Riemann zeta function - An unreleased research model raised the proven lower bound on the fraction of Riemann zeta zeros on the critical line from 41.6% to 67.2%.
Sonnet 5 keeps its intro price - Anthropic have cancelled September's rise to $3/$15.
Claude in Chrome is now Cowork - The side panel has been renamed, and history now follows you between browser and apps.
Microsoft merges its Copilot apps - Microsoft are folding their separate Copilot apps into one and retiring some AI features.
Dotnet news
.NET 11 Preview 7 - C# gains labeled break and continue, and CoreCLR on WebAssembly now passes the full libraries test suite.
ILSpy 11.0 - The decompiler has been ported to Avalonia and now runs on Linux and Mac.
Rx.NET 7.0 - Windows UI support has been split into separate packages to cut deployment size.
Azure Developer CLI extensions - The framework for building custom dev workflows is now generally available.
JetBrains .NET Day Online - The free online event runs on October 7, with talk submissions open until September 4.
Others
The npm worm now plants a Claude Code hook - My News item of the week this edition, written up in full at the top.
Ten CVEs in llama.cpp - Five of the ten are still unpatched, including two unauthenticated remote-code-execution flaws in
llama-server.Stealing reasoning traces - Researchers decoded encrypted thinking blobs using a weaker model from the same provider.
A 16-year-old SQLite bug - A sixteen-year-old data race corrupted Tailscale's control plane nineteen times in six months.
Cloudflare's Kitesurf - Cloudflare built an agent-first browser that runs in V8 isolates rather than Chromium.
"Code was never the hard part" - Senko Rasic defends craft, rejecting both "coding is trivial" and "coding is art".
Sponsorship opportunities
I’m looking for sponsors for both the podcast and this newsletter. Details of podcast sponsorship can be found here. Feel free to reply to this email to discuss further.
The Podcast 🎙
No new episode this week - the last one went out two weeks ago. If you missed any of the recent ones:
088 - Agent Skills - Matt Pocock on his agent skills repo, the death of tactical programming, and whether sprints still make sense.
087 - OpenSpec - Tabish Bidiwale, the creator of OpenSpec.
086 - AI Panel Discussion - Recorded live at DDD South West 2026.
Also, just a reminder that we have a Discord community for the podcast! It would be great to see you there :)
Podcast Discord community
My Dometrain Courses
Below are details of my Dometrain courses. You can also find all of my courses here.
Docker for Developers
This course will teach you everything you need to know about Docker and containers. From what containers and images are; to how to build your own; to security and networking; docker-compose; and much more!
Kubernetes for Developers
Once you understand Docker, containers, images, etc - it’s time to move onto the next level and learn a container orchestrator - and Kubernetes has clearly won the battle here! My Kubernetes course is rammed-packed full of demos (pretty much all the way through), which are easy to follow along with downloadable YAML files and scripts. We start with the basics, then later move on to more advanced topics like service meshes and operators.
JetBrains Rider
Rider is an amazing .NET IDE by JetBrains. This course is 6 hours of content - covering hotkeys, refactoring, navigation, debugging, git, testing, AI, profiling, remote collaboration, and much much more!
Aspire
Aspire is Microsoft's vision for how every .NET developer will develop systems. It is a cloud-ready stack for production-ready, distributed applications using .NET, and it makes it extremely easy to develop, run, and test your systems locally. With unmatched dev-time orchestration, integrations with third-party services, and excellent tooling, .NET Aspire aims to make working with the cloud and technologies like Docker and Kubernetes easier than ever.
If you’ve made it this far into the newsletter - I’m hoping that means you’ve
both enjoyed it and found it useful. If you can help me out and share with your developer friends at work and on social media, that would be amazing!
Again - feel totally free to reach out to me, and let me know your thoughts on the newsletter. And see you back in your inbox next week for the next edition! 👋
X/Twitter (I've started using this again more proactively now)
Bluesky
LinkedIn
Discord
Mastodon (rarely used)
Or just go to danclarke.com for links to all my stuff 😊
