OpenAI drops the approval gate on its defensive cyber tier in Codex, and GitLab finds a git-config flaw class across coding agents

A 1,050,000-token context window now sits behind Codex Security Cloud, and the access gate in front of it is gone. Per AlphaSignal’s October 2 issue, OpenAI upgraded the product to scan an entire GitHub repository, review every new commit automatically, dedupe alerts, and prepare a ready-to-review fix. Daybreak Blue, OpenAI’s defensive security tier, is bundled by default, where the stronger cyber models previously required a separate approval process. You install the plugin in Codex desktop or web, connect a repo, and it runs with your laptop closed. The same issue led with yesterday’s Claude Code mods story at 16,862 likes against 4,388 for Codex Security, and it repeats the warning that mods run with full access to your machine.

That warning has a concrete shape as of October 2. GitLab’s Threat Research Group disclosed CVE-2026-102437 in DeepSeek-Reasonix Studio, a desktop git client for AI-assisted development, where viewing a file’s diff could execute attacker-supplied code. The tool’s git wrapper already neutralized core.fsmonitor and maintenance.auto and passed --no-ext-diff and --no-textconv on diffs, but it left filter.<driver>.clean open, and because .gitattributes selects that driver per file, no fixed deny-list closes it. The fix shipped September 30 in Studio 2.21.0 and npm 1.39.3. GitLab says several other widely used coding agents carry the same class of flaw and are under coordinated disclosure, and it names the vector specific to agents: a prompt-injected agent with the developer’s filesystem access can write the poisoned .git/config into a normally cloned repo, with no malicious archive required. If you build anything that shells out to git, their advice is to read blobs with git cat-file and diff in-process, or override every command-running key on every call.

The trust problem extends from repo config to skills. Chaining Skills to Hijack LLM Agents, posted October 1, introduces APEX, which builds adversarial skill chains where an upstream skill gets the agent to write a record of task progress containing a false claim of user approval, and a downstream skill cites that record to trigger the attacker’s action. Across six models on SkillsBench the chains succeeded in 512 of 690 attempts (74.2%). On GPT-5.4 the full chain worked 84.3% of the time against 17.4% when the same workflow was packed into one skill, so splitting the attack across handoffs is what makes it land. The prompting defense they tested, asking the agent to check skill-produced files against the original request, cut attack success to 59.1% and dropped the benign test-pass rate from 86.7% to 56.3%, a cost few teams would accept.

GitHub widened what Copilot can touch. Computer use is in public preview in Copilot CLI and the Copilot app on macOS and Windows as of October 1: Copilot reads app content, clicks, types, scrolls, and drags through GUI-only software that has no API, CLI, or MCP integration. It asks for approval before controlling an app, and organization-managed settings can turn the feature off; /computer on starts it in the CLI. A day later, Copilot code review became callable through the REST and GraphQL APIs with a per-request effort level, and Balanced became the default effort.

Cloudflare’s Birthday Week added a Web Search API through AI Gateway on October 2, launching with Ceramic.ai, Exa, and Linkup. Search calls bill against AI Gateway credits at the providers’ list prices with no markup, show up in the same logs as inference, and support bring-your-own-key. The condition on partners is the interesting part: their crawlers must meet Cloudflare’s Verified Bots requirements and every result must link to the crawled source. Native server tools in the gateway are listed as coming next.

For anyone picking models off leaderboards, Agent Evaluation Reliability applies a Bayesian variance decomposition to 22 benchmarks from the Holistic Agent Leaderboard and Harbor Index. Fixed model-plus-scaffold systems are ranked reliably (0.935 to 0.994), while rankings of the underlying model range from 0.148 to 0.841. When scaffold coverage is the limiting factor, infinitely many additional tasks improve model-ranking reliability by at most 0.097. Pooling diverse benchmarks raises projected reliability from 0.44 to 0.75 at the same task budget.

Outside the agent stack, Supabase announced it is acquiring Turso, the SQLite-focused database company; the post reached 150 points and 80 comments on Hacker News on October 2.

Worth watching: which coding agents appear in GitLab’s follow-up disclosures, and whether OpenAI’s decision to drop the approval gate on its defensive cyber tier draws a matching move from the other labs.

Feed note: the mirror’s status endpoint reported a last sync of 2026-09-01, but items in this issue were ingested through the morning of October 3; dates are given per item.