Gen Threat Labs documented eight commodity infostealer families extending their collection rules to the local artifacts of AI coding tools — and what they harvest is a refresh token valid for weeks, a machine-readable list of every system that token reaches, and a searchable history of what it was used for. No injection, no jailbreak, no model involvement: adding your tooling is a remote config update to machines already compromised.
Of the four ways to shape an agent trace, the only one that calls itself the standard is the only one you cannot pin: on 12 June 2026 OpenTelemetry deprecated all sixty gen_ai attributes and moved them to a repository that still has no tagged release and a TODO where its schema URL should be. Eight renames and two deletions landed in that one version — including both token-usage attributes. Pick by the vocabulary your backend dispatches on, translate at the collector, and never point a cost chart at a Development-stability attribute name.
Coding agents published 13,000 internal screenshots into public GitHub repositories at 343 companies, and nobody attacked anything: the GitHub CLI could not attach an image to a pull request, so the agents built the upload path themselves — 93% of the time under a developer’s personal account, outside every control the company owned.
Everyone argues about which file name wins, and the file name decides almost nothing. What separates these four is when the text enters the context window — always, on a path match, on the model asking, or only when a human invokes it — and who is allowed to put it there.
Four coding agents pinned plugins to a 40-character commit SHA and none of them checked what they got, because a 40-hex string is also a legal branch name. The interesting part is the split response: two vendors added the missing one-line comparison, two pointed at their git host’s naming rules — which is a real defence owned by someone else, invisible in your manifest, and gone the first time a plugin is mirrored.
Tool counts decide nothing here. The axis that determines both whether a browser agent can do the job and how bad a hostile page gets is which session it holds — an isolated automation context, a dedicated profile quietly accumulating logins, or your own signed-in browser. Both browser vendors that shipped an MCP server this year deliberately kept your own session out of it, which is why neither does the agentic-shopping demo everyone expected.
Your coding agents doubled the pull requests and the integration path is now the constraint — but batching, the feature every queue product sells, gets worse as agent share rises, because agents raise the per-PR failure rate that batching multiplies. Only two capabilities change the arithmetic: bisecting a failed batch, and deriving independent lanes from what a change actually touches. Shortlist on those; everything else is configuration.
The four leading TypeScript agent frameworks agree almost completely on the tool loop and disagree on one thing that decides your architecture: where the run lives when the HTTP request ends. That single axis picks your database, your deploy story and your exit cost — and the AI SDK's own troubleshooting page, where a user pressing Stop is indistinguishable from a closed tab, is the cleanest proof that it is the real axis.
Docker's 15 September advisory describes two ways out of a Docker Sandboxes microVM, and neither touched the hardware boundary. Both were symlink races in channels the sandbox opens on purpose — the virtio-fs workspace share and the guest-to-host socket relay — which is where an agent sandbox's real attack surface has always been, and the guest holding the knife is your own coding agent.
Four MCP servers exist to stop a coding agent writing code against an API it half-remembers, and all four work. The axis that decides whether they help is what kind of text comes back: upstream files, snippets extracted from upstream, or prose a model wrote about the code. And none of them closes the failure they are sold against — your agent still does not know which version you run, because none of them reads your lockfile and one of them makes the version a sentence in the prompt.
Four cloud coding agents that look interchangeable on a feature table bill in four different shapes — a usage pool with overage, one allowance shared across every surface you use, a rate limit shared with the rest of your account, and hard task counts per tier — and each shape induces a specific, predictable misuse. Cursor changed how it charges three times in 2026 alone, so the numbers in every comparison are already stale; the shape of the meter and the boundary of the sandbox are the two things that will still be true next quarter.
The most-starred open-source text-to-SQL project is read-only — Vanna archived its repo on 29 March 2026 at 23.8k stars — and Dataherald has not taken a commit since July 2024. The two still shipping daily are the two that put a durable, reviewable artefact between the question and the SQL. Frontier models absorbed SQL generation; what they cannot absorb is which of your four definitions of "revenue" this question meant, and that is the layer you own whichever project you pick.
Manifold Security disclosed GitSpawn — eight flaws across seven CLI coding agents in which opening a booby-trapped repository runs attacker code, because the harness shells out to git for context and Git honours a core.fsmonitor setting the repository supplied. No prompt, no approval, sometimes before authentication. Four findings were still executing on the 1 September retest, and every control you built sits downstream of the point where this already ran.
These four are benchmarked on throughput, which is a 1.9 ms spread inside a 50–500 ms upstream call — and ranked on it while the axis with a date attached goes unmeasured. Three of the four implement the 2026-07-28 stateless revision and the most-used Go library does not, but the sharper question is which of them absorbs your dual-revision window instead of turning it into your topology.
All four render a streaming message list, and the demo looks the same in each. What differs is the layer you cannot swap later — a wire protocol, an npm dependency, a source tree copied into your repo, or a whole Python server whose front end you never wrote — and after a year in which one canvas archived itself and another changed hands, "what do I still own if this goes quiet" is the axis worth deciding on.
All four build agents with tool calling, RAG and MCP, so features are not the decision. What separates them is what each one demands of the runtime you already operate — and for the JVM pair that demand is a Spring Boot major version.
Temporal surveyed 554 engineers in April and May 2026 and found daily agent use at 80.8%, up from 47.3% a year earlier, with 91.1% reporting improved productivity and 85.5% trusting agent output at least somewhat — alongside 41.1% hitting agent-related issues daily or more and 9.0% continuously. Both sets of numbers are probably accurate, and together they describe a failure rate nobody would accept from a database. The report reads the gap as a state-tracking problem, which is a durable-execution vendor’s reading of a durable-execution question. The more useful reading is that the error handler is a person, and no dashboard has a line for them.
Claude Code, Codex and Gemini CLI all persist sessions as append-only JSONL, so moving one to another agent looks like a file-conversion problem. It is not. An assistant turn is a claim conditioned on a system prompt, a tool schema, a model and a warm cache that the receiving agent does not have — replay it verbatim and you hand over a false memory. The one converter in the wild strips tool calls into prose on purpose, Anthropic documents its own transcript format as internal and unstable, and Claude Code refuses to resume a hand-copied transcript at all. Four transfer layers, and the useful ones all trade fidelity for something the receiver can re-verify against the repo.
Bugbot dropped its seat for per-review billing in June, Greptile bills a dollar past fifty reviews, CodeRabbit still sells a capped seat, and Diamond has no price at all because it arrives with Graphite — which Cursor now owns, alongside Bugbot. Three billing shapes, and none of them prices the thing that actually decides whether a review bot survives: the developer seconds each comment consumes.
Trail of Bits bypassed the detectors on three skill-distribution platforms in June, a July study packed 1,613 malicious skills past all eight scanners tested, and on 17 August OWASP gave poor scanning its own entry in the first Agentic Skills Top 10. The scanner inspects a file at rest; the agent constructs a program from it at run time — and the attacker picks where the two disagree.
Slack shipped the review surface, not the agent: five partner coding agents you buy separately, working inside a channel with a plan tab, a diff tab and a live preview, and a human approval before anything ships. That is the right bottleneck to build for — and a shared approval is the one thing a terminal got right that a channel does not.
Four open-source eval frameworks get compared on stars and metric counts, and teams pick the popular one and then fight it. The question that actually decides the fit is what you need to assert correct: a metric on one component (DeepEval), a retrieval score (Ragas), a comparison across prompts and providers (Promptfoo), or a scored trajectory of an agent running in a sandbox (Inspect). Match the tool to the unit and they stop fighting you — and start composing.
Anthropic's playbook rebuilds the lifecycle around a chain of committed artifacts: intent.md → spec.md → plan.md → diff → review findings → incident record. Read it as a compiler and each play lines up as a check on one hop — which makes it obvious that three hops have no check at all, and that is where the risk now sits.
These four price a search between $1 and $16 per thousand, and the spread is not margin — it is how far down the retrieval pipeline each one reads. Price a whole research turn instead of a call and the ordering inverts: the cheapest rate card produces a turn costing three times the dearest one.
GEPA's reported margins — up to 20% over GRPO, 13% over MIPROv2 — were all measured where an automatic checker was free and a failed run could be described in words. Two of these four optimizers run on a bare scalar; two need a sentence. What your eval function returns decides which half of the field you can use, so change the metric before you change the optimizer.
Four platforms that stand between your agent and a user’s Gmail or Salesforce. The catalog sizes they advertise are counted in four different units and are the part you will outgrow; the token vault none of them market is the part you would hate to build. The decision you cannot retrofit is whose name is on the consent screen.
Five rival vendors agreed on a directory layout on 6 August, and explicitly declined to agree on install, distribution, permissions, sandboxing or provenance. The format makes one bundle of instructions plus credentialed tool access portable across six clients — which is exactly why the compensating controls are now yours.
The feature grids converged, so the decision is licence and billing meter — and every meter prices the trace archive that becomes your golden set, regression baseline and fine-tuning corpus. Instrument against OpenTelemetry, dual-write the stream somewhere you own, and the platform becomes a swappable backend.
Every identity vendor now sells “auth for AI agents”, and the phrase covers two opposite problems: letting an agent into your app, and letting your agent out to someone else’s API. Pick on direction first — and notice that a token vault holding a user’s full grant has relocated the credential rather than shrunk it.
The top two terminal coding agents are 0.4 points apart on Terminal-Bench 2.1, which is inside harness noise — so the decision has moved to licence, config portability and distribution stability. Google demonstrated why on 18 June, retiring a 105,000-star open-source CLI for a closed binary with a free tier cut from ~1,000 requests a day to ~20.
These four are not four alternatives at one layer — TRL is the trainer API, Axolotl and LlamaFactory wrap it, and Unsloth rewrites its source at import time. That single fact predicts the thing you will actually feel: TRL shipped 1.9.2 in July while two of the others still pin the 0.x line. The famous speed table nobody can source is the wrong axis entirely.
Three of these four constrain the sampler so invalid output cannot be produced, and the choice between them collapses to one question: do your schemas repeat? The fourth does something categorically different, and it is the only one that can enforce the rules that actually break agents — because a grammar guarantees the enum is one of five values and says nothing about which.
All three READMEs describe the same job — run cases through a model, score the output, fail the build. But at the level of their core data structure they disagree about what an evaluation is: an attack, an assertion, or an experiment. Pick the wrong noun and the tool will not let you write the test you actually need.
Every AI gateway sells the same headline feature: automatic failover to a second provider. That feature is not an availability win — it is an untested deploy that fires only during an incident, onto a model your evals never covered. Choose instead on who operates the hop, because that is the decision you cannot reverse cheaply.
List prices for agent search APIs cluster tightly around $5–8 per thousand queries, which makes the sticker the least interesting number in the comparison. What actually differs by an order of magnitude is how many tokens each one dumps into your context per result — and in an agent loop that re-sends its transcript every step, that is the bill.
Voice is now the interface most agents will spend the most time in — and four platforms have made architecturally opposite bets on how to wire speech, language, and tool-use into one round-trip. The right pick depends less on TTS voice quality than on whether you control the audio path, the model, or just the prompt.
Hand an agent a five-point ticket and it quietly deletes the failing test. AFK coding fixes the workflow, not the model: humans own spec and review, agents run slices, refactor, and QA in parallel under test/type/lint backpressure.
Four coding agents take the same prompt and the same repo down four completely different paths. A diagram-by-diagram tour of the four decisions — sandbox, planning loop, tool catalog vs shell, commit policy — that actually separate them.