The coding-agent conversation shifted from model leaderboards to packaging repeatable agent systems — and shipping them open. The headline move was xAI open-sourcing its Grok Build coding agent under Apache 2.0, but the more telling signal was a run of tools that treat "many agents" as the unit of work.

Fractal spawns a persistent tree of agents over git worktrees, herdr multiplexes agents over SSH with reconnect, and Relay routes work frontier-plan → fast-execute → frontier-review across the major CLIs. Around them, an open vault adds cross-session memory and Brainless open-sources the agent UI itself.

The sharpest security thread wasn't a single CVE — it was the realization that AI coding agents are themselves an attack surface, and vendors are now shipping products to contain them. Anthropic put a Claude Security plugin into beta that scans diffs and whole codebases from the terminal.

The urgency was concrete: a disclosed Azure DevOps MCP flaw showed an invisible PR comment hijacking a developer's agent into exfiltrating data from projects the attacker can't even reach. That's the gap tools like Eyebrow (auditing every installed skill/MCP/plugin) and Kastra's runtime authorization layer are pitching to fill — though Matthew Green cautions it's getting hard to tell real incidents from marketing. New PortSwigger labs now teach the attacks directly.

A fresh angle on the open-weights debate surfaced: open models as the thing you can actually deploy when the closed ones won't cooperate. GLM-5.2 had a visible renaissance after Hugging Face said it leaned on GLM-5.2 during incident analysis precisely because it was open source and the commercial model's guardrails blocked the defensive work.

HF's Thomas Wolf leaned into the "future of cyber defense is open" framing, while builders shipped concrete local drops: a 3B OCR model parsing 100-page PDFs locally in one pass and a hardware-tiered guide to the best models per VRAM tier. The question moved from "can it run locally" to "you may need the open one when the closed one refuses."

Beneath the agent-security noise, the classic actionable feed was strong. The standout home/desktop action item is the 7-Zip XZ archive RCE (CVE-2026-14266), fixed in 7-Zip 26.02 — and since 7-Zip doesn't auto-update, you have to install it yourself.

On the tooling side, practitioners surfaced gowitness for one-command attack-surface screenshotting, KeyHunter for scanning public repos for leaked keys across 45+ providers, and Dalfox for automated XSS testing — all open source and local-only. One researcher also warned they'd found a fresh kernel 0-day they don't plan to report.

The skills conversation matured from "look what I made a skill do" to building skills that manage other skills — plus the first real research on whether the pattern holds up. The lead artifact was a meta-skill that auto-ranks and surfaces the right skill by meaning, not keywords.

Crucially, a proper study on progressive disclosure — the core skills mechanism — found the gains are harness-dependent and don't cleanly scale, a useful counterweight to vibe-driven adoption. Meanwhile MCP-backed skills kept turning into concrete integrations: XcodeBuildMCP drives Xcode builds and simulators, Fli queries real Google Flights results, and Expo shipped an official MCP server.

OpenCut is a MIT-licensed open-source video editor (already ~76k stars) with a multi-track timeline, a plugin architecture, and — notably — an MCP server, so agents can drive edits directly. A rare privacy-friendly, self-hostable take on the CapCut workflow.

Rork Max lets you build, preview and install native iOS/web apps directly on an iPhone, pitched as skipping the Xcode/TestFlight loop entirely. An interesting stab at collapsing the mobile build-and-ship cycle onto the device you're targeting.