What if AI-assisted discovery now produces a month of critical disclosures in a single day, and your real security exposure is set by how many days a patch takes to reach production?

Interconnects calls the late-October run of critical disclosures, including PHP2Shell and GitLab, "Black October," and says it marks the moment AI-driven cyber risk stopped being theoretical ^[24]. Practitioners describe a month of breaches landing in one day ^[23]. A Chinese team reports 99.4% on CyberGym, a benchmark of AI agents reproducing real vulnerabilities ^[58]. These are early signals, not settled measurements. Still, finding flaws is no longer the slow part. Exposure is now the number of days between disclosure and the fix running in production. A flaw learned Monday and deployed the following Thursday means ten days of published risk.

Parameter Labs took over ChatGPT accounts by escaping the sandboxed iframe behind its HTML previews ^[28], and many internal tools copy that pattern. One defense is an upgrade pipeline: an agent drafts the dependency bump and CI proves it. The platform team runs the pipeline, and application security sets priority and patch deadlines. The cost is more changes, more regressions and heavier load on the tests that gate merges. Every service still needs a named owner, because a patch with no owner waits.

Separately, from December 2 GitHub Actions blocks pull_request_target events in public repositories unless an Actions event policy allows them ^[34]. That trigger runs workflows for untrusted pull requests with the base repository's secrets and write token. The fix goes in each repo's workflow YAML and the org-level policies, and it has a fixed date (act now).

AWS now lets Step Functions workflows serve as agent tools through Amazon Bedrock AgentCore Gateway. The agent picks when to run a workflow and what input to pass, and Step Functions runs each step exactly as defined ^[20]. Separately, GitHub Next made GitHub Agentic Workflows generally available. The open-source project automates issue triage, CI failure analysis and documentation updates ^[6]. Amazon Connect flows can call the same MCP (Model Context Protocol, a standard way to expose tools to agents) tools, so a customer-contact flow and an agent share one tool definition instead of separate Lambda glue ^[35].

The control is now a reviewed, version-controlled definition with its own permissions, not shell commands the agent improvises. GitHub's October local sandboxing and assisted permissions releases limited what Copilot can touch, and these releases limit how it changes things. The cost is that every action has to exist as a workflow first. That takes authoring time and narrows what the agent can do on day one, and novel situations still fall back to a human.

Both releases are generally available, so this is in progress. Service teams own the workflows that agents reach by tool call, and the platform team owns the catalog and the permission model. Honeycomb's Team Agents work toward goals a team defines, with autonomy matched to risk ^[38]. The open questions at Honeycomb's Innovation Week were organizational: what a good goal looks like, how an agent earns more autonomy, and what stays human ^[43].

OpenAI has paired its updated Model Spec (its public document describing how its models should behave) with layered monitoring. The monitoring detects misalignment and unauthorized agent behavior so that responders can step in ^[17][18]. One of the most detailed behavioral specs in the industry comes from a lab that does not treat it as the control. OpenAI's September misalignment reporting framework defined what gets reported, and this work describes how it gets caught.

Most internal agent fleets have only the spec half: a system prompt, and nothing watching what the agents actually do. The other half needs three things: tool-call logs (records of each action an agent takes), a definition of "unauthorized" for each agent, and a responder who is on call. Every monitor also adds cost and false positives that someone has to triage. Checking agents before deployment is not enough, because self-evolving agents degrade as hidden rules pile up. Behavior that passed an early check can drift with use ^[36].

Human reviewers are not automatically independent either. Anthropic found that an agent's framing shifts what experts decide ^[8], so a reviewer who reads the agent's summary first has already been influenced. The platform or security team runs the monitoring, reading tool-call logs and identity events outside the prompt, since monitors run by each team miss patterns across agents. Each agent's owner defines what that agent may do. This is standard practice at the labs and early-stage elsewhere (watch), where the first step is capturing tool-call logs at all.

Microsoft Research's PDD Kit lets developers review the intent behind agent-written code instead of every line ^[49]. It turns that intent into a specification for Verus (a formal verification tool for Rust), then proves the code meets the specification for every input, falling back to tests where a proof isn't practical. It targets the reason an essay on Martin Fowler's site gives for why excellent developers are wary of coding agents: code that compiles and demos is not code that works in production ^[16]. Formal specs take expertise to write and check, though, and a proof covers only what the spec says. The kit is early-stage (watch). It fits as a spec-and-proof step in CI before merge, and the team that owns one narrow, high-risk module is the right place to pilot it.

Separately, GitHub's Copilot usage metrics API now reports, per repository per day, how much of Copilot code review's feedback developers actually addressed ^[50]. An addressed rate is not a catch rate: a developer can fix the cosmetic comments and ignore the one that mattered. Still, it is the first vendor-supplied signal of whether automated review changes the code. It is available now, so the platform team can feed it through the API into existing dashboards next to reverts and follow-up fixes on AI-written code.

GitHub has made Copilot Fusion generally available. A developer selects Fusion, and Copilot decides which models handle each task and how to combine them ^[4]. An experimental preview sends some tasks to models running on the developer's own machine ^[5], and those calls leave no record on the cloud side. Neither the developer nor the platform team chooses the model.

Separately, Anthropic gave Max and Team subscribers API credits equal to their plan price, and the credits expire. OpenAI now does the same on its $100, $200, and $500 monthly ChatGPT plans ^[13]. Because the credits expire, developers have a reason to spend them. When they spend them on work, that usage falls outside procurement and outside data agreements. Nothing records which model touched which code. Interconnects' first note on the size of the open-model economy ^[44] points to a third route: open-weight models (models whose weights anyone can download) that run locally with no subscription.

Without a gateway, where does visibility come from? Copilot's enterprise settings control whether Fusion and the local preview are on and whether usage logs show which model ran. Whoever administers the Copilot organization owns those settings. Expense and acceptable-use policy decides whether personal plans can be used for work, and engineering leadership owns it together with finance. A gateway costs more to build, and it still would not see on-device calls. Both changes are live now (act now).