The week's featured piece is Boris Cherny's extended interview on building Claude Code, covering how a personal bash experiment evolved into one of the… Compiled for immediate developer deployment.
calendar_todaysummarizeWeek 10-2026
article
TAG: RELEASEREAD_TIME: 2_MIN
Copilot Memory now on by default for Pro and Pro+ users in public preview - GitHub Changelog
GitHub has flipped Copilot Memory to on-by-default for all Copilot Pro and Copilot Pro+ subscribers, graduating it from opt-in public preview. The feature lets Copilot agents persist repository-level facts — coding conventions, architectural patterns, and critical cross-file dependencies — across future interactions, with memories scoped strictly to a single repository and validated against the live codebase before use. To prevent staleness, all memories expire after 28 days. Knowledge is shared across the Copilot coding agent, Copilot code review, and Copilot CLI, meaning a fact discovered during a coding session is immediately available to the review agent. Enterprise and organization admins retain policy-level control, and repository owners can audit or delete stored memories under Repository Settings.
Hardening Firefox with Anthropic's Red Team | The Mozilla Blog
Anthropic's Frontier Red Team used Claude to scan Firefox's JavaScript engine and broader codebase for security vulnerabilities, surfacing 14 high-severity bugs and issuing 22 CVEs — all of which are now patched in Firefox 148. Beyond the high-severity findings, the model identified 90 additional bugs across the browser. Critically, every report included a minimal reproducible test case, letting Mozilla engineers begin landing fixes within hours of disclosure. The AI-assisted analysis uncovered distinct classes of logic errors that decades of fuzzing and static analysis had not previously caught, suggesting a large backlog of now-discoverable bugs exists across widely deployed software. Mozilla has since integrated AI-assisted analysis into its internal security workflows and views the collaboration as a model for responsible coordinated vulnerability disclosure.
How to steal npm publish tokens by opening GitHub issues
Security researcher Adnan Khan demonstrated a multi-stage attack chain — dubbed "Clinejection" — that compromised the Cline AI coding assistant's npm publish pipeline. The root cause was a GitHub Actions AI triage bot (using claude-code-action) configured with allowed_non_write_users: "*" and Bash/Read/Write/Edit tool permissions, allowing anyone who opened a GitHub issue to inject arbitrary commands into the runner via the unsanitized issue title. Because the triage workflow shared GitHub Actions' 10 GB LRU cache pool with the nightly release workflow, the attacker could poison the node_modules cache under a predictable key (Linux-npm-{package-lock hash}), causing the release workflow to restore a compromised environment and exfiltrate the NPM_RELEASE_TOKEN. A separate actor later used Khan's published PoC to publish cline@2.3.0 — live for 8 hours, ~4,000 installs — containing a postinstall hook that installed OpenClaw, a background daemon with CVE-2026-25253(CVSS 8.8 auth bypass). Mitigations: set ignore-scripts=true in .npmrc, use npm ci, and run npm audit signatures in CI.
GitHub reports that Copilot code review (CCR) has grown 10x since its April 2025 launch and now accounts for more than one in five code reviews on the platform, with over 12,000 organizations running it automatically on every pull request. A move to an agentic architecture — which retrieves repository context, maintains memory across reviews, and maps an explicit plan for long pull requests — drove an initial 8.1% lift in positive developer feedback. The agent surfaces actionable comments on 71% of reviews and says nothing on the remaining 29%, averaging 5.1 comments per review. GitHub also found that adopting a more advanced reasoning model improved positive feedback rates by 6%, even as review latency rose 16%, a deliberate trade-off the team accepted. Upcoming priorities include deeper personalization and two-way conversational refinement of suggested fixes before merge.
GitHub Copilot in Visual Studio Code v1.110 - February release - GitHub Changelog
The VS Code v1.110 February 2026 release makes Copilot agents substantially more programmable and controllable. New lifecycle hooks let users auto-lint or block commands at key agent events, while a conversation fork feature enables branching from any checkpoint without losing the original path. The /autoApprove (alias /yolo) chat command toggles global auto-approval paired with terminal sandboxing. Agent plugins — currently experimental — let users install prepackaged bundles of skills, tools, hooks, and MCP servers from the Extensions view. Context management sees major improvements: shared agent memory spans the coding agent, CLI, and code review; a built-in Explore sub-agent parallelizes codebase research using lightweight models; and /compact allows manual context compaction with natural-language guidance on what to preserve.
VoidZero announces its sponsorship of npmx, a fast npm registry browser that has entered alpha at npmx.dev. The project is built entirely on the VoidZero toolchain — Vite (via Nuxt) for builds, Vitest for testing, Rolldown through Vite 8 beta for smaller production bundles, oxlint for millisecond linting, and oxfmt for formatting — and the team also previews Vite+, a unified single-package toolchain encompassing all of the above. A concrete feedback loop example: an npmx maintainer discovered that postinstall scripts were making Vite+ lint and fmt commands 3.23x slower than calling oxlint/oxfmt directly; after filing the issue with benchmarks, VoidZero fixed it and reduced the overhead to 1.10x. VoidZero frames the partnership as a model for healthy open-source collaboration where real-world production usage surfaces issues that synthetic benchmarks miss.
Boris Cherny, creator and engineering lead of Claude Code, recounts how a personal bash-based Anthropic API experiment evolved into one of the fastest-growing developer tools — a journey that began when his first handwritten pull request was rejected and he was told to use an early internal agent instead. He describes running 5 parallel Git worktrees, shipping 20–30 PRs per day with zero handwritten lines using Opus 4.5 and Claude Code, and how Claude Code tests itself by spawning sub-processes in CI. Boris also explains the multi-layer prompt-injection defense (alignment, runtime classifiers, and a sub-agent summarizer for web fetch), why agent-based glob/grep search outperformed a vector database RAG approach, and why Anthropic ultimately released the tool publicly — to study agentic safety in the wild.
Boris Cherny, creator and engineering lead of Claude Code, recounts how a personal bash-based Anthropic API experiment evolved into one of the fastest-growing developer tools — a journey that began when his first handwritten pull request was rejected and he was told to use an early internal agent instead. He describes running 5 parallel Git worktrees, shipping 20–30 PRs per day with zero handwritten lines using Opus 4.5 and Claude Code, and how Claude Code tests itself by spawning sub-processes in CI. Boris also explains the multi-layer prompt-injection defense (alignment, runtime classifiers, and a sub-agent summarizer for web fetch), why agent-based glob/grep search outperformed a vector database RAG approach, and why Anthropic ultimately released the tool publicly — to study agentic safety in the wild.
Copilot Memory now on by default for Pro and Pro+ users in public preview - GitHub Changelog
GitHub has flipped Copilot Memory to on-by-default for all Copilot Pro and Copilot Pro+ subscribers, graduating it from opt-in public preview. The feature lets Copilot agents persist repository-level facts — coding conventions, architectural patterns, and critical cross-file dependencies — across future interactions, with memories scoped strictly to a single repository and validated against the live codebase before use. To prevent staleness, all memories expire after 28 days. Knowledge is shared across the Copilot coding agent, Copilot code review, and Copilot CLI, meaning a fact discovered during a coding session is immediately available to the review agent. Enterprise and organization admins retain policy-level control, and repository owners can audit or delete stored memories under Repository Settings.
Hardening Firefox with Anthropic's Red Team | The Mozilla Blog
Anthropic's Frontier Red Team used Claude to scan Firefox's JavaScript engine and broader codebase for security vulnerabilities, surfacing 14 high-severity bugs and issuing 22 CVEs — all of which are now patched in Firefox 148. Beyond the high-severity findings, the model identified 90 additional bugs across the browser. Critically, every report included a minimal reproducible test case, letting Mozilla engineers begin landing fixes within hours of disclosure. The AI-assisted analysis uncovered distinct classes of logic errors that decades of fuzzing and static analysis had not previously caught, suggesting a large backlog of now-discoverable bugs exists across widely deployed software. Mozilla has since integrated AI-assisted analysis into its internal security workflows and views the collaboration as a model for responsible coordinated vulnerability disclosure.
How to steal npm publish tokens by opening GitHub issues
Security researcher Adnan Khan demonstrated a multi-stage attack chain — dubbed "Clinejection" — that compromised the Cline AI coding assistant's npm publish pipeline. The root cause was a GitHub Actions AI triage bot (using claude-code-action) configured with allowed_non_write_users: "*" and Bash/Read/Write/Edit tool permissions, allowing anyone who opened a GitHub issue to inject arbitrary commands into the runner via the unsanitized issue title. Because the triage workflow shared GitHub Actions' 10 GB LRU cache pool with the nightly release workflow, the attacker could poison the node_modules cache under a predictable key (Linux-npm-{package-lock hash}), causing the release workflow to restore a compromised environment and exfiltrate the NPM_RELEASE_TOKEN. A separate actor later used Khan's published PoC to publish cline@2.3.0 — live for 8 hours, ~4,000 installs — containing a postinstall hook that installed OpenClaw, a background daemon with CVE-2026-25253(CVSS 8.8 auth bypass). Mitigations: set ignore-scripts=true in .npmrc, use npm ci, and run npm audit signatures in CI.
GitHub reports that Copilot code review (CCR) has grown 10x since its April 2025 launch and now accounts for more than one in five code reviews on the platform, with over 12,000 organizations running it automatically on every pull request. A move to an agentic architecture — which retrieves repository context, maintains memory across reviews, and maps an explicit plan for long pull requests — drove an initial 8.1% lift in positive developer feedback. The agent surfaces actionable comments on 71% of reviews and says nothing on the remaining 29%, averaging 5.1 comments per review. GitHub also found that adopting a more advanced reasoning model improved positive feedback rates by 6%, even as review latency rose 16%, a deliberate trade-off the team accepted. Upcoming priorities include deeper personalization and two-way conversational refinement of suggested fixes before merge.
GitHub Copilot in Visual Studio Code v1.110 - February release - GitHub Changelog
The VS Code v1.110 February 2026 release makes Copilot agents substantially more programmable and controllable. New lifecycle hooks let users auto-lint or block commands at key agent events, while a conversation fork feature enables branching from any checkpoint without losing the original path. The /autoApprove (alias /yolo) chat command toggles global auto-approval paired with terminal sandboxing. Agent plugins — currently experimental — let users install prepackaged bundles of skills, tools, hooks, and MCP servers from the Extensions view. Context management sees major improvements: shared agent memory spans the coding agent, CLI, and code review; a built-in Explore sub-agent parallelizes codebase research using lightweight models; and /compact allows manual context compaction with natural-language guidance on what to preserve.
VoidZero announces its sponsorship of npmx, a fast npm registry browser that has entered alpha at npmx.dev. The project is built entirely on the VoidZero toolchain — Vite (via Nuxt) for builds, Vitest for testing, Rolldown through Vite 8 beta for smaller production bundles, oxlint for millisecond linting, and oxfmt for formatting — and the team also previews Vite+, a unified single-package toolchain encompassing all of the above. A concrete feedback loop example: an npmx maintainer discovered that postinstall scripts were making Vite+ lint and fmt commands 3.23x slower than calling oxlint/oxfmt directly; after filing the issue with benchmarks, VoidZero fixed it and reduced the overhead to 1.10x. VoidZero frames the partnership as a model for healthy open-source collaboration where real-world production usage surfaces issues that synthetic benchmarks miss.
The week's featured piece is Boris Cherny's extended interview on building Claude Code, covering how a personal bash experiment evolved into one of the fastest-growing developer tools — shipping 20-30 PRs per day across 5 parallel Git worktrees with zero handwritten code. Two critical security stories sit alongside it. Anthropic's Frontier Red Team used Claude to surface 14 high-severity bugs and 22 CVEs in Firefox — all patched in Firefox 148 — demonstrating that AI-assisted analysis can find logic error classes that decades of fuzzing missed. More urgently, the Clinejection attack chain showed how a misconfigured GitHub Actions AI triage bot with open permissions allowed anyone to poison the npm publish cache and exfiltrate tokens, ultimately yielding a supply-chain compromise that reached 4,000 installs.
On the agentic tooling front, GitHub flipped Copilot Memory to on-by-default for all Pro and Pro+ subscribers, sharing repository-level knowledge across the coding agent, code review, and CLI. The VS Code v1.110 release extends this with lifecycle hooks, conversation forking, and experimental agent plugins. Copilot code review also crossed 60 million reviews, with an agentic architecture rewrite driving an 8.1% lift in developer satisfaction. VoidZero's npmx sponsorship previews Vite+, a single-package unified toolchain.
The week closes with two thought-provoking perspective pieces. Justin Searls argues that verifiability — not generation speed — is the unsolved problem in agentic development, drawing a sharp line between "order taker" and "ambitious" developers. A practical guide to writing cross-platform hooks for Claude Code and Cursor completes the picture, showing how to normalize the different stdin JSON shapes from each platform to enforce consistent tooling in AI-assisted workflows.
Key Takeaways
Clinejection is a wake-up call for any team running AI triage bots in GitHub Actions: scope permissions strictly, never allow open write access via allowed_non_write_users: "*", and isolate CI cache pools between workflows.
Copilot Memory going on-by-default and the 60-million-review milestone signal that agentic code review is no longer experimental — teams without an AI review policy now have a gap.
AI-assisted security analysis (Mozilla/Anthropic) found CVE classes that decades of fuzzing missed; integrating LLM-based scanning into security workflows is becoming a competitive baseline.
