project
Microsoft's free, open-source code editor supporting many languages, extensible via a marketplace of plugins including AI coding assistants.
No evidence-backed relationships are recorded.
Claude Desktop's custom connectors offer only OAuth sign-in for remote MCP servers, while five other clients take a static API key in a header. Servers that authenticate with plain keys need an OAuth front or a local mcp-remote bridge for Desktop users.
Reality
Pluto Security says the SleepyDuck operator re-listed fake Solidity extensions on Open VSX within hours of a takedown, in a stage it calls EtherDuck. Each wave stayed up about 19 hours, long enough for a single install to leave persistent access that the takedown did not remove.
Reality
Microsoft's Go port of the TypeScript 7 compiler cut VS Code's full build from 125.7 to 10.6 seconds in its benchmarks. Tools that import TypeScript as a library may still need the TypeScript 6 API, so the upgrade belongs on a throwaway branch first.
Reality
One OpenAI Codex prompt spawned 826 child agents and burned about $78,000 in credits, according to the user's own reconstruction. Nearly all the counted tokens trace to an alpha client build, and only OpenAI's servers can turn them into dollars.
Reality
The August 17 postmortem describes a sidecar that hit its concurrency limit while its autoscaler measured the host, then a VS Code retry bug that kept Copilot down hours after everything else returned.
Perspective Coverage
3 publishersReality
Oizom's orchestrator gives each approved ticket its own branches, services and database copy, so one developer can run several AI agent tasks at once. Its team lead says the setup is mostly scripts, so the limit is how many live stacks one person can test.
Reality
The stable build includes a Custom Endpoint provider that speaks Chat Completions, Responses and Messages, so a compatible API and your own key are enough to get streamed chat and tool calls inside the editor.
Reality
Vendor pages for Claude Code, Cursor, Codex, VS Code and Windsurf, re-checked on 2026-09-12, show that all five resume a previous session. The complaint about agents forgetting points at the other three questions.
Reality
Manifold Security's GitSpawn findings cover eight issues across seven coding agents. The path runs through core.fsmonitor, where a background git status starts a helper the repository chose, outside the agent's sandbox and with no prompt.
Reality
Akamai says the May 11-12 wave poisoned a CI cache and minted publish credentials from inside a trusted build, so the attestation it produced was honest. Any gate that only checks for provenance would have passed it.
Reality
The plugin.json schema sets additionalProperties:false while section 5.2 tells clients to report unknown fields and carry on loading, so the four-line validate-and-reject loader fails the spec in exactly two places and looks correct everywhere else.
Reality
Google stopped asking developers to change editors and shipped Antigravity into four of them. What arrives with the extension is a background service on your machine with file, terminal and browser reach, and that is the part worth reviewing.
Reality
Agent tool calls look like ordinary HTTPS, so Cloudflare's new controls match on protocol headers rather than on destinations. They only see traffic you already decrypt, which is where the adoption cost sits.
Reality
The repository shipped setup instructions for a tool that did not exist, and the payload only arrived later, pulled from a DNS TXT record and handed to a shell. Approving the final command covers less of that than most teams assume.
Reality
Amazon OpenSearch Service now returns interactive visualizations inside MCP tool calls. The claim is that the browser tab, not the query, is what costs an engineer time.
Reality
Microsoft's Go rewrite ships no new syntax and promises identical type-checking results. The work it creates is in runner sizing and in anything that imported the compiler as a library.
Reality
A new tool diffs a Git checkpoint instead of trusting a coding agent's summary, with no LLM in the analysis path. The baseline is the clever part; the risk weights are the part still unpublished.
Reality
A dev.to walkthrough hardens node:14 to distroless with two Copilot prompts. The arithmetic says the Alpine stage already banks 98 percent of the size win, so distroless is a blast-radius call.
Reality
Unit 42 says a worm hidden in more than 400 npm packages read GitHub Actions runner memory for temporary OIDC tokens. An SBOM generated at the end of the build would not have seen any of it.
Reality
A bundled MCP server lets Claude Code, Cursor, Codex and Antigravity edit live scenes. There is no headless option, and no documented way back from exported code into the source file.
Reality
Build · August 20, 2026 · 1 publisher
Science · August 19, 2026 · 1 publisher
Invest · August 18, 2026 · 1 publisher
Build · August 18, 2026 · 1 publisher
Build · August 16, 2026 · 1 publisher
Security · August 16, 2026 · 1 publisher
Build · August 16, 2026 · 1 publisher
Build · August 15, 2026 · 1 publisher
Build · August 15, 2026 · 1 publisher