It's been six weeks since the last one of these landed in your inbox. Not because nothing happened — because my own reporting pipeline went dark during an infra migration and I didn't notice for over a month. More on that below, because the lesson turned out to be more interesting than the outage. Meanwhile: GPT-6 shipped (badly), Claude Code and Copilot both dropped real updates, and the EU quietly turned on a rule that makes your AI-written bugs a legal deadline now.

This Week in AI Coding

• OpenAI shipped GPT-6 Astra — and apologized for it the next day. Rolled out September 3 in phases (cybersecurity partners first, then ChatGPT Plus/Pro/Business/Enterprise + API + AWS). Altman called it "a new capability level" that changed his own workflow. Then the staged rollout left paying subscribers without access, and he was publicly apologizing for a "messy" launch by September 4. Watch this one before you rebuild a workflow around it — the model claims are real, the plumbing wasn't ready.
• Claude Code hit v2.1.270 (Sept 12) with claude plugin eval. You can now run a plugin's eval suite against Claude Code and get scored, reproducible results as JSON + an HTML report — actually useful if you're shipping plugins instead of just using them. Also: /output-style now works over Remote Control and headless sessions, and they finally fixed git commands randomly asking for permission mid-session.
• GitHub Copilot's Sept 10 weekly release brought Project HydraFusion — adaptive semantic routing between local, cloud, and compound models in Copilot CLI, plus a Jira integration and a unified review/run/preview pane in the Copilot app. Same release quietly deprecated MAI-Code-1-Flash across all Copilot surfaces.
• The EU Cyber Resilience Act's 24-hour vulnerability reporting rule went live September 11. If you ship anything with EU customers, an actively exploited vulnerability now needs an early warning within 24 hours, a full report in 72, and the law does not care whether a human or an AI agent wrote the vulnerable code. Fines run up to €15M or 2.5% of global revenue. If you've been shipping AI-generated code without an SBOM, this is the week that stops being free.
• Open-weight models had their densest 48 hours since August: DeepSeek V4.1 Flash landed September 10, and Sakana AI shipped both Fugu Max and Fugu Ultra v2.0 on September 11. The open-source gap to frontier keeps closing faster than the closed labs would like.
• The AI job market keeps bifurcating. Junior developer hiring is down 35% from 2023 levels while AI Engineer postings are up 300%; agentic systems and Forward Deployed Engineering are the fastest-growing niches, and "prompt engineer" is fading as a standalone title. One senior dev with good AI tooling is now doing what used to take a team of 3-4 juniors — which is great for senior devs and brutal for anyone trying to break in.

What We Shipped

Honest one this week. Veridux's own daily-ops routine went dark for 6 weeks — Hetzner went umbrella-only on Sept 11 and the automated reporting cycle quietly stopped running while it moved to a local Sunday-morning batch. Nobody was watching the dashboards for over a month. Here's what that taught me: the business didn't care. Traffic kept compounding the whole time it was unobserved — visitors up 56%, pageviews up 50%, over those 6 weeks (roughly the same ~8%/week rate as when I was checking daily). The reporting is a mirror, not the engine.

The interesting anomaly in that data: LLMHire had the single biggest traffic jump this log has ever recorded — +529%, 78 visitors to 491. Before I take credit for anything, the site's own shorter-window trend field reads -54%, and there were zero commits to the repo in that window. That smells like a fading spike (a backlink or a forum hit), not durable SEO growth, so I'm checking the referrer data before writing an "SEO is compounding" victory lap I can't back up.

Smaller items: the YouTube trending-topics pipeline, dark for 9+ cycles, came back alive on its own the same morning I ran this check — didn't touch it, don't know why, not complaining. Also found a new bug: the weekly-digest analytics endpoint can't reach its database anymore (a self-signed cert in the chain), unrelated to everything else that's working. And CyberOS shipped a scoped release-evidence pilot + business review loop this week — small, mostly plumbing, part of building the actual revenue evidence I need before deciding whether it stays live (that decision is now on day ~151 of being undecided, which has become its own running joke).

Tool of the Week

claude plugin eval (shipped in Claude Code this week). If you build or maintain Claude Code plugins, this runs the plugin's eval suite against the actual CLI and gives you scored, reproducible JSON + HTML output instead of "seems to work on my machine." Small feature, but it's the difference between shipping a plugin and shipping a plugin you can regression-test.

Quick Links

• GitHub Copilot weekly releases — September 7 — Project HydraFusion, Jira integration, MAI-Code-1-Flash deprecation.
• OpenAI announces rollout of GPT-6 Astra model — the "new capability level" announcement, before the rollout got messy.
• EU Cyber Resilience Act: September 11, 2026 reporting deadline — what the 24-hour reporting rule actually requires.
• Security Harness for AI Coding Agents, September 2026 — GitSpawn now hits 7 coding agents from the repo side; worth reading if you let an agent open arbitrary repos.

Building VeriduxLabs in public — a portfolio of AI products run by a small team of AI agents (and me).

endofcoding.com · vibecodingebook.com · llmhire.com · @endofcoding on YouTube