person
VP and practice lead for software lifecycle engineering and AI-native software engineering at The Futurum Group, an IT industry analyst firm.
No evidence-backed relationships are recorded.
GitLab's September 10 patch release closes CVE-2026-85706, a CVSS 10.0 path confinement failure in the repository commits API. GitLab.com was already patched, so the exposure sits with self-managed servers.
Perspective Coverage
3 publishersReality
IBM's Bob coding agent now runs air-gapped inside customer networks on two supported local models, Nvidia's Nemotron and Poolside's Laguna. Banks can keep their code in-house, though fully local work runs on a shorter model list than the Claude, Mistral and Granite mix IBM pitches for Bob.
Reality
AWS's Deception Benchmark found AI vulnerability scanners catch up to 95% of real bugs but flag 41% to 99% of safe code. Its samples were built to fool models, so teams still need their own false-alarm count before sizing the triage work.
Reality
Git 2.56 adds a staging flag that aborts on leftover conflict markers and cuts one Chromium diff from about eight minutes to 0.07 seconds. Teams get the speed by upgrading, but they get the safety only by editing the scripts their developers and coding agents run.
Reality
GitHub's agentic autofix now saves a pattern from each security fix it creates in Copilot Memory and passes those patterns to code review and the cloud agent. Teams that enable Memory now decide whether an agent's fixes deserve to guide reviews across a repository.
Reality
Anthropic has redesigned Claude Projects so one development goal can run as several Claude Code sessions at once. What used to be one chat to read is now several branches, and the usage allowance moves with it.
Perspective Coverage
3 publishersReality
Enterprise Cloud owners can now pull owner, scope, expiry and last-use data for SSH keys, PATs and app tokens as a CSV. The export stops at credentials GitHub issued, so secrets pasted into repositories stay out of scope.
Reality
The new Strands harness ships the tools, memory and context handling most teams assemble themselves, and AWS attributes its 28% saving to offloading bulky tool output to files and reusable caches across six unnamed benchmarks.
Reality
Cycode's Workstation Protection, now in early access, screens installs against a threat intelligence feed and holds back packages updated too recently to vet. It ships inside the device management module Cycode already installs.
Reality
Z.ai has disabled the feature, deleted the cloud data and commissioned two outside assessments. For teams buying coding assistants, the test this leaves behind is measuring what the process sends before approving it.
Reality
Version 2.1.277 reads a shared AGENTS.md when no CLAUDE.md is in scope. The documented exceptions cover first sessions, telemetry-disabled runs, Bedrock, Vertex and Foundry, and the hooks governance tooling watches.
Reality
Oren Yomtov of Accomplish found two ways out of the Codex sandbox, both silent and neither stopped by an approval prompt. OpenAI patched them within eight days, and other researchers have found the same design in rival agents.
Reality
GitHub's workflow execution protections went generally available on September 17, and the evaluate mode that shows what a rule would block before enforcement is documented as an Enterprise Cloud capability.
Reality
The tool boots the running app once an agent finishes a feature, sends findings to Claude Code or Copilot, and rescans to confirm the fix. It costs $10 a seat a month and meters that loop at 50 scans.
Reality
Java 27 shipped ML-KEM hybrid key exchange for TLS 1.3 on September 15. Oracle's published plan gives it to JDK 25 in October and to JDK 8 and 11 in the second half of 2027, and The Futurum Group's Mitch Ashley says that order inverts the risk.
Reality
Wiz reports multiple threat actors independently exploiting three patched JFrog Artifactory flaws, and its telemetry puts 49% to 62% of scanned instances still missing the fixes weeks after release. Two of the three chain into admin.
Reality
Version 1.133 runs agents in a standalone host that survives window closes and can be reached over SSH, and the session protocol is now an MIT-licensed spec.
Reality
After five incidents in August 2026, GitHub says its shared infrastructure has not kept up with Actions growth. Which services failed together is the part platform teams can plan around before the next one.
Reality
Mid-size engineering teams can now run GitHub Advanced Security against their own repositories for 30 days without a sales call, and then they have to decide what a good result looks like. Mitch Ashley of The Futurum Group says the bottleneck was procurement.
Reality
The Rust compiler team's first debugging survey found that 46% of respondents use a debugger, and the reasons given are about legibility rather than taste, with 74% reporting poor value rendering and 55% unable to reliably inspect a variable.
Reality
Product · September 9, 2026 · 1 publisher
Product · September 9, 2026 · 1 publisher
Product · September 8, 2026 · 1 publisher
Product · September 2, 2026 · 1 publisher
Product · September 1, 2026 · 1 publisher
Product · August 31, 2026 · 1 publisher
Product · August 31, 2026 · 1 publisher
Product · August 31, 2026 · 1 publisher
Product · August 27, 2026 · 1 publisher
Build · August 21, 2026 · 1 publisher
Product · August 20, 2026 · 1 publisher
Product · August 20, 2026 · 1 publisher
Product · August 19, 2026 · 2 publishers
Product · August 19, 2026 · 1 publisher
Product · August 19, 2026 · 2 publishers
Product · August 19, 2026 · 1 publisher
Product · August 17, 2026 · 1 publisher
Product · August 16, 2026 · 1 publisher