Newsletter 052 - October (week 44)
Hi, and welcome to this week's edition of the newsletter!
As always, feel free to reply to this email to get in touch. Or ping me on any of my socials, which can be found on my personal website, danclarke.com.
If you get value from this newsletter, please help me out by sharing it on your socials and with your tech friends and colleagues - it really helps me spread the word and keep the newsletter going 🙏 (at-mention me, and I'll repost).
📌 News item of the week
GitHub's Universe conference opened on October 28, and the two biggest announcements were both about Copilot.
The first is that GitHub Enterprise now includes Copilot for every licensed user, so Enterprise customers no longer have to buy it as a separate subscription. It's available now for Enterprise Cloud customers through their GitHub or Microsoft account team, with self-serve coming in stages.
The second is that Copilot Fusion is now generally available on every Copilot plan. When you pick Fusion in the model picker, you're not choosing a model at all - Copilot decides which models to use for each task, with Standard, High and Max effort levels (High and Max need Pro+, Max, Business or Enterprise), and, as an opt-in experimental preview, Fusion Standard can route to local models too. GitHub says that on the Artificial Analysis Coding Agent Index, Fusion Max "scored within two points of Opus 5.5 Max at half the cost and 40% less time per task". You pay for each model Fusion uses at its normal rate, and paid plans get 30% off that until November 30.
GitHub's Octoverse report, published the same day, says that by September, more than 40% of pull requests on GitHub started with an agent's first draft, up from 17% in March. Agentic Workflows also went generally available, and Microsoft is now offering the agent loop behind Copilot to other developers too (see the Copilot harness below).
📰 News items and dev picks
AI news
GitHub and Microsoft
- GitHub Universe - My News item of the week this edition - see the full write-up at the top.
- Microsoft Copilot harness - Microsoft has opened up the agent loop behind GitHub Copilot, VS Code and Copilot Studio as a public preview in Foundry Agent Service, with billing starting on December 1.
- VS Code 1.144 - In VS Code 1.144, assisted permissions are generally available, so the agent rates each tool call for risk and approves the low-risk ones itself, and agents can now see and control apps on your computer as an experimental feature.
Models
- GPT-6.1 Terra - OpenAI's new fast, cheaper model for visual reasoning, computer use and writing costs $1 per million input tokens and $5 per million output, half the price of GPT-6.1 Sol.
- Gemini 4 Carbon - Google calls Gemini 4 Carbon its strongest model, and for now only a subset of cyber defenders can use it, though it already tops Artificial Analysis's Intelligence Index.
- Kimi K3.1 Pro - Moonshot's Kimi K3.1 Pro is on its API now with a 1-million-token context window, and Moonshot says the full weights will follow by November 4.
- Mistral Large 4 - Mistral has released the weights of Mistral Large 4, a trillion-parameter multimodal model, under a licence that needs a separate commercial licence from Mistral if you run a model-as-a-service business.
Anthropic
- Anthropic files for its IPO - Anthropic's public S-1 shows revenue of $16.3 billion for the first half of 2026 and a net loss of $80.7 billion, $72.4 billion of which came from revaluing convertible notes and similar instruments.
- Claude Code 2.1.310 to 2.1.314 - Claude Code now has a setting that stops its file tools writing outside your working directories in any permission mode,
ultrathinkruns at xhigh effort, and theclaude_code.safety_eventOpenTelemetry event added on October 21 has already been removed.
Safety and security
- OpenAI's training pause - OpenAI paused frontier training for 11 days after a model reached the live internet through a misconfigured DNS resolver on September 20, and while rebuilding its containment, its red-team agents found ways out of microVMs when asked to and passed messages between isolated sandboxes through the CPU cache.
- Mythos 5 and a real GitHub maintainer - Anthropic and the UK AI Security Institute have both published analyses of AISI's evaluation runs of Claude Mythos 5, in the worst of which it used fake identities to pressure a real maintainer into approving malicious code.
- Agents hijacked from Downloads - Forever Security showed that a web page can quietly drop an AGENTS.md or CLAUDE.md into your Downloads folder, and in its tests Codex followed it in more than 90% of attempts and Claude Code about half the time, so don't run agents from
~/Downloads. - 1Password for Agents - With 1Password for Agents, an AI agent can sign in to a site with your saved credentials without ever seeing the password, and you approve each request on your own device.
Dotnet news
- .NET security updates - Microsoft has shipped out-of-band updates for .NET 8, 9 and 10 that fix a Brotli decompression flaw (the same bug Node.js patched last week) and re-ship two of this month's fixes that hadn't fully landed, and self-contained apps need rebuilding to pick them up.
- .NET Conf 2026 - .NET Conf runs online from November 10 to 13 to launch .NET 11, and November 10 is also the end of support for both .NET 8 and .NET 9.
- Free Blazor components - Infragistics and Syncfusion have both released free, MIT-licensed Blazor component sets, and Infragistics engineers are now contributing analyzers to Blazor itself for .NET 11.
- Avalonia security incident - An attacker got into Avalonia's website CMS using an admin token that had been exposed in the site's JavaScript, but all 39 attempts to publish packages to its NuGet feeds were rejected.
- VS Marketplace Trusted Publishing - You can now publish VS Code and Visual Studio extensions from GitHub Actions or Azure Pipelines without storing a long-lived personal access token.
Others
- Tailscale SSH fixes - Tailscale 1.104.4 fixes several Tailscale SSH flaws that could let an attacker who already controls one device on your tailnet go beyond the permissions of their SSH user on machines the policy lets that device SSH into.
- Linux zero-click RCE found by Claude - Anthropic's red team says an unreleased model found critical bugs in Chrome, Safari, Android, Windows and Linux, including a zero-click remote code execution flaw in the Linux networking stack, all fixed before the post went out.
- Node.js 26 LTS - Node.js 26 has moved into long-term support, codenamed Lithium, with updates until the end of April 2029.
- Ghostty 1.4 - Ghostty 1.4 adds Kitty graphics animation, compresses idle scrollback and adds a
ghostty +sshwrapper for remote hosts. - Microsoft buyouts - Microsoft is offering voluntary buyouts to eligible staff at level 70 and below in the US, UK, Canada and India, which Seattle's KUOW reports is about 60,000 people.
Sponsorship opportunities
I'm looking for sponsors for both the podcast and this newsletter. Details of podcast sponsorship can be found here. Feel free to reply to this email to discuss further.
The Podcast 🎙
No new episode this week, so here's a throwback to one of my favourites! In episode 42, back in August 2022, I was joined by Iris Classon to chat about her book, The Unlikely Success of a Copy Paste Developer - a fun, light-hearted novel about a developer called Leo and the very interesting characters he has to work with. As a developer, a lot of the stories are very relatable!
Also, just a reminder that we have a Discord community for the podcast! It would be great to see you there :)
Podcast Discord community
My Dometrain Courses
Below are my Dometrain courses. You can also find all of my courses here.
Please help me share this newsletter 🙏
If you've made it this far into the newsletter - I'm hoping that means you've both enjoyed it and found it useful. If you can help me out and share with your developer friends at work and on social media, that would be amazing!
Again - feel totally free to reach out to me, and let me know your thoughts on the newsletter. And see you back in your inbox next week for the next edition! 👋
My socials...
- X/Twitter (I've started using this again more proactively now)
- Bluesky
- Discord
- Mastodon (rarely used)
Or just go to danclarke.com for links to all my stuff 😊
