Astra for Law pairs GPT-6 Astra with a legal search index covering more than 230 million URLs of US case law, statutes, regulations, court rules, and administrative decisions, including CourtListener's collection from the Free Law Project. Across 200 questions from the private validation set of Vals AI's Legal Research Bench, OpenAI reports the legal configuration clearing the overall correctness check on 54.0% of questions against 38.7% for GPT-6 Astra with web search alone, both at highest reasoning effort, per its launch writeup carried by Artificial Lawyer. Latham & Watkins, Ropes & Gray, Cooley, and Sullivan & Cromwell are named early adopters, access runs through Trusted Access in ChatGPT and Codex, and no price has been published.

Those are vendor numbers on a private set, and the headline figure still leaves half the answers short of the bar. Buy it as a citation-traced accelerator for the associate who checks the work, not the checker. No published price means no procurement math yet, so the move this quarter is a Trusted Access slot and a test against your own matter files.

AIR Security disclosed Plugin4Shell on September 17. An attacker who controls a plugin repo creates a branch named exactly like the pinned 40-hex commit, makes it the default branch, and the agent's git checkout resolves the ref instead of the commit object. Review passed, the pin looks honored, attacker code runs. Background plugin auto-update, the default in Claude Code and Codex, is what makes it zero-click on a plugin you already trust. Patch state per AIR's disclosure: Anthropic fixed it in Claude Code 2.1.179, OpenAI in Codex 0.146.0, GitHub Copilot has shipped nothing, and Google will not fix Gemini CLI at all because it is deprecated.

Why it matters. SHA pinning is the control most internal plugin reviews rest on, so the teams doing this by the book are exactly the ones who thought they were covered. Upgrade anything below Claude Code 2.1.179 or Codex 0.146.0 this morning. On Copilot and Gemini CLI, treat every marketplace plugin from a repo you do not own as unreviewed until a fix lands. If you also have to show an auditor which agent versions your engineers run, Comp AI automates that evidence trail for SOC 2 and ISO 27001.

Safari 27.0 went out September 17 with an MCP server built on safaridriver, so an agent drives a real Safari window with no extension involved. Enable Safari > Settings > Advanced > Show features for web developers, then Safari > Settings > Developer > Allow remote automation and external agents, then point claude mcp add safari-mcp at /usr/bin/safaridriver using the exact line in WebKit's post. The agent gets screenshots, page content as markdown or HTML, computed styles, console logs, per-request network detail, and JavaScript evaluation. Apple says the server runs entirely local, makes no network calls of its own, and cannot reach AutoFill data.

Safari-only layout bugs used to be the ones you described to an agent in prose and hoped. Now it reads the render, the console, and the network waterfall itself. Pages you do not control stay a separate job: Firecrawl returns those as LLM-ready markdown over an API.

Released September 17. The GitLab MCP server picked up tools across CI/CD, merge requests, repositories, work items, and vulnerability triage: get_job returns a failed job's trace so the agent can diagnose the build, save_merge_request_review leaves batched line-level comments, and accept_merge_request merges once checks pass, per the 19.4 release notes. Those tools now sit in the same GitLab Duo governance panel as internal Duo tools, where read-only defaults to Always Allow and write or delete defaults to Always Ask.

That default is what makes this pilotable without a security review fight: Claude Code, Cursor, or Cline can run the whole merge request loop, and the merge still stops at a human unless somebody flips the mode. Confirm in group settings that nobody already set the write tools to Always Allow before you hand out a token.

OpenAI began testing Sponsored Agents with select US advertisers on September 16. The ad click starts a labeled session with a business-backed agent, kept separate from the user's own thread. HubSpot customers connect a ChatGPT Ads account inside the CRM, US Shopify merchants get a ChatGPT Ads app with catalogs already synced, and supported international markets open September 23, per OpenAI. An Ads Manager plugin for ChatGPT Work shipped alongside it, taking campaign creation and analysis as plain text.

No performance data exists for the test group yet, so nobody can tell you whether a conversation converts better than a landing page. Act on the Ads Manager plugin instead, which moves campaign work to the surface your marketers already sit in. Read the format breakdown.

A motion unsealed September 17 in the publishers' case against OpenAI and Microsoft puts the defendant's internal traffic analysis in the record. Click-through rates from Bing Chat ran 87% to 93% lower for the Times' sites and 83% to 91% lower for the Daily News plaintiffs' sites, measured against traditional Bing searches on comparable queries, per TheWrap's read of the filing. The same filing quotes a Microsoft director of applied science calling the copying perhaps the "largest theft of labor in human history".

Every estimate of answer-engine cannibalization until now came from the people losing the traffic. This one comes from the logs of the company serving the answers, and it is worse. Budget 2027 content against a referral base that does not come back: own the email list, and spend to be the source cited inside the answer instead of the tenth link under it.

Six of the seven named Agentforce agents are generally available and Hunter stays in pilot until November, so the only live question is which one you turn on. Casey pays back first when support tickets are your expensive repeatable volume; Piper wins when the bottleneck is inbound leads sitting unqualified in a form. Customer-facing agents bill at $2 per conversation on Salesforce's pricing page, so the conversation math picks your first deployment, not the feature matrix. Read the guide.