AI Coding Live News

GitHub Agentic Workflows is generally available: write automation in Markdown, compile it to Actions YAML, run Copilot or your own coding agent, now with ARC self-hosting and micro-VM isolation

At Universe 2026 on Oct 28, GitHub made GitHub Agentic Workflows, an open source GitHub Next project, generally available on GitHub Free, Team and Enterprise. Developers describe tasks such as issue triage, CI failure analysis, documentation updates and test writing in natural-language Markdown, and gh aw compiles them into standard Actions YAML run by Copilot or a coding agent of their choice. GA adds self-hosted ARC runners with Docker-in-Docker, a non-experimental gh aw forecast cost estimate, per-workflow model providers and model routing, and Cloud Hypervisor or NVX micro-VM isolation.

GitHub Agentic Workflows is generally available: write automation in Markdown, compile it to Actions YAML, run Copilot or your own coding agent, now with ARC self-hosting and micro-VM isolation

Key Takeaways

  • Availability: GitHub Free, Team and Enterprise on github.com; using the default Copilot CLI engine requires a Copilot license
  • How it works: requirements in Markdown, compiled to standard Actions YAML that reuses existing runner groups and policies; run with Copilot or your own coding agent
  • Safe defaults: read-only permissions, a sandboxed container behind the Agent Workflow Firewall, safe-outputs validation, and a threat detection job before changes are applied
  • New at GA: self-hosted ARC runners with Docker-in-Docker, gh aw forecast out of experimental (with threat detection credits and monthly ranges), per-workflow model providers, model routing, micro-VM isolation and cross-repo enclaves
  • Customer story (Accenture's figures): one lead saved about 29 hours a week, AI authors 91% of the team's commits, and production errors fell from about 11,000 a day to under 1,000
Read full story

LiteLLM Gateway Compromised in v1.107.0 Supply-Chain Attack: Emergency Rollback to 1.106.2 and Credential Rotation Issued

LiteLLM, a widely deployed unified proxy gateway powering millions of LLM and autonomous agent pipelines worldwide (including LangChain and OpenHands), suffered a critical supply-chain compromise. Attackers breached its automated CI/CD release pipeline, pushing a poisoned v1.107.0 release to PyPI and Docker Hub tags ('latest' and 'main-stable') equipped with a credential-harvesting payload targeting system environment variables and cloud API keys. Coordinated with security firms including SlowMist, the maintainers quickly contained the incident, yanked v1.107.0, restored PyPI to 1.106.2, and urged all operators to pin dependency versions and rotate API credentials immediately.

LiteLLM Gateway Compromised in v1.107.0 Supply-Chain Attack: Emergency Rollback to 1.106.2 and Credential Rotation Issued

Key Takeaways

  • LiteLLM release pipeline compromised, publishing trojanized v1.107.0 packages across PyPI and Docker Hub tags
  • Payload secretly exfiltrated host environment variables, harvesting model API keys, database credentials, and cloud secrets
  • Maintainers yanked the malicious package within hours, rolling PyPI and official Docker containers back to stable 1.106.2
  • Urges all agent and LLM platform operators to verify pinned package versions and execute immediate credential rotation
Read full story

LiteLLM 1.107.0 hit by a supply-chain compromise: PyPI wheels and Docker images shipped a credential stealer and backdoor; LiteLLM says it is contained and advises pinning 1.106.2

On October 21 the release pipeline of the popular LLM gateway LiteLLM was compromised. A malicious 1.107.0 was live on PyPI for about two hours (11:39 to 13:23 UTC), and the Docker tags v1.107.0, latest, main-latest and main-stable pointed to a poisoned image from 11:46 to 14:20 UTC. LiteLLM's incident report says the payload steals cloud, SSH, AI-tool and proxy keys on every Python start; the artifacts are pulled, OSS users should pin 1.106.2 and rotate secrets, and the private enterprise registry was not affected.

LiteLLM 1.107.0 hit by a supply-chain compromise: PyPI wheels and Docker images shipped a credential stealer and backdoor; LiteLLM says it is contained and advises pinning 1.106.2

Key Takeaways

  • Scope (vendor figures): all 7 PyPI wheels of litellm==1.107.0, live 11:39:51 to 13:23 UTC; 4 Docker Hub and GHCR tags poisoned from 11:46:56 UTC
  • Attack chain: the attacker held 3 sets of developer GitHub CLI credentials, one belonging to an org owner, used it to disable branch protection and force-push, then had the release workflow build and sign from the lookalike repo Berri-AI/litellm
  • Payload: cook.pth, cook.py and sitecustomize.py run on any Python start and survive uninstalling litellm; a second loader fetches remote code hourly
  • Fix: delete the 3 files and matching .pyc first, then pin litellm==1.106.2 or rebuild from scratch, and rotate every provider key in the proxy DB, the master key and the database password
  • This is LiteLLM's second supply-chain incident of 2026 (versions 1.82.7/1.82.8 in March); the GitHub source tag v1.107.0 itself is clean
Read full story

Docker cagent 1.145.0: ACP request traces via W3C traceparent/tracestate, server spans on 13 handlers, lean TUI scrollback fix

Docker shipped cagent (docker-agent) v1.145.0 on 2026-09-28: ACP requests now propagate W3C traceparent/tracestate with server spans for each of the 13 implemented protocol handlers, plus new lint cops and a lean-TUI fix that preserves scrollback during partial streaming tool calls.

Docker cagent 1.145.0: ACP request traces via W3C traceparent/tracestate, server spans on 13 handlers, lean TUI scrollback fix

Key Takeaways

  • Shipped v1.145.0 — ACP W3C traceparent/tracestate + 13 handler spans
  • Lean TUI keeps scrollback during partial streaming tool calls
  • New FieldsSeqLookup / SlicesConcat lint cops
  • Docs: docker.github.io/docker-agent
Read full story
ADSponsored

GitHub Agentic Workflows 0.89.22: Cloud Hypervisor-only sandbox, hosted-web domain policy, grouped audit

GitHub shipped gh-aw (Agentic Workflows) v0.89.22 on 2026-09-27: docker-sbx/gVisor sandboxes are removed in favor of Cloud Hypervisor only; frontmatter gains network.hosted-web allow/block lists for provider-hosted Claude/Codex web tools; gh aw audit --group aggregates findings by run/code; Copilot prompts over 100 KiB stream via stdin. Also adds repo-memory backend, MCP payload size reporting, and tighter firewall checks.

GitHub Agentic Workflows 0.89.22: Cloud Hypervisor-only sandbox, hosted-web domain policy, grouped audit

Key Takeaways

  • Shipped: v0.89.22 — docs at github.github.com/gh-aw / gh.io/gh-aw
  • Breaking: docker-sbx/gVisor removed; set sandbox.agent.runtime to cloud-hypervisor
  • network.hosted-web frontmatter policies for hosted Claude/Codex web tools
  • gh aw audit --group aggregates findings; MCP payload sizes reported
  • Copilot prompts >100 KiB stream via stdin; repo-memory backend for AIC guardrail
Read full story

Pydantic Monty 1.0.0 GA: Rust Python sandbox for agents — ~0.8ms warm checkout vs ~1500ms remote services

Pydantic shipped Monty v1.0.0 on 2026-09-25 (PyPI pydantic-monty, npm @pydantic/monty, crates.io monty), dropping the experimental label. OSS Monty is a from-scratch Rust Python bytecode VM (Ruff parser) with zero FS/network/env by default—host access only via explicit external functions. Official alternatives table: ~0.8ms warm checkout / ~5ms new pool vs ~195ms Docker exec, ~1500ms remote sandbox services, ~2700ms Pyodide. Built for agent-written code, not full VMs.

Pydantic Monty 1.0.0 GA: Rust Python sandbox for agents — ~0.8ms warm checkout vs ~1500ms remote services

Key Takeaways

  • Shipped: v1.0.0 — uv add pydantic-monty / npm i @pydantic/monty / cargo add monty
  • Official latency: ~0.8ms warm OSS checkout, ~5ms new pool vs ~195ms Docker, ~1500ms remote services, ~2700ms Pyodide
  • Default deny FS/network/env; host reachability only via explicit external functions
  • OSS Monty (MIT package) + commercial Full Monty (~2ms warm); Python ≥3.10
  • Powers Pydantic AI Code Mode; docs at pydantic.dev/docs/monty
Read full story

DeerFlow 2.1.0: 772-PR milestone — verifiable subagent delegation, pluggable memory, five remote sandboxes

ByteDance’s DeerFlow shipped v2.1.0 on 2026-09-24, closing the milestone with 772 merged PRs (~83k GitHub stars). Focus: trust and ops—verifiable subagent delegation, optional durable batch_task, pluggable memory (DeerMem / OpenViking / mem0 HTTP), plus E2B, BoxLite micro-VM, Tenki and OpenSandbox providers. Breakings: unconditional X-Trace-Id, reserved /mnt/skills, memory config under memory.backend_config, Docker bind defaults to 127.0.0.1.

DeerFlow 2.1.0: 772-PR milestone — verifiable subagent delegation, pluggable memory, five remote sandboxes

Key Takeaways

  • Shipped: v2.1.0 — 772 PRs; site deerflow.tech
  • Verifiable subagent delegation + tamper-evident tool stamps; optional durable batch_task
  • Pluggable memory.manager_class; FTS5/BM25; OpenViking & mem0 HTTP backends
  • Sandbox: E2B replicas cap; BoxLite / Tenki / OpenSandbox among new providers
  • Breakings: always-on X-Trace-Id, PAT auth, loopback Docker bind — read CHANGELOG before upgrade
Read full story

ByteDance Releases DeerFlow 2.0: Ground-Up Rewrite of 83K-Star Long-Horizon SuperAgent Harness

ByteDance launched DeerFlow 2.0.0, completing a ground-up rewrite of its 83k-star open-source agent harness with 182 merged PRs. Built around a SuperAgent architecture, DeerFlow 2.0 orchestrates sub-agents, persistent memory, and sandboxed execution with extensible tools. It introduces self-updating SOUL memory, user-owned IM channel integrations (Feishu, DingTalk, WeChat, Slack, Discord, Telegram), Docker DooD sandbox protection, and deep integration with BytePlus InfoQuest crawling technology for robust multi-hour autonomous execution.

ByteDance Releases DeerFlow 2.0: Ground-Up Rewrite of 83K-Star Long-Horizon SuperAgent Harness

Key Takeaways

  • Full architectural rewrite: migrated from rigid workflows to a SuperAgent harness orchestrating sub-agents, memory, and sandboxes
  • Evolving agent souls: agents can modify and persist their own SOUL.md and YAML configs across chats with strict user isolation
  • Universal IM gateway: native support for Feishu/Lark, DingTalk, WeChat/WeCom, Slack, Discord, and Telegram integrations
  • Enterprise-grade sandbox: DooD Docker isolation with automated zip-bomb protection and sensitive MCP credential masking
  • Production observability: Langfuse distributed tracing with parent-child attribution and thread-indexed O(1) query acceleration
Read full story

Docker Agent (cagent) 1.144.0: ACP v1 sessions/terminals/remote MCP; sandbox --cloud without local Docker

Docker Engineering shipped docker-agent/cagent v1.144.0 on 2026-09-25. It widens ACP v1 compatibility: session delete + elicitation, model reasoning/safety options via session/set_config_option, shell via client terminal/create, client-supplied Streamable HTTP/SSE MCP on session new/resume/load, host credential auth/logout, audio prompts with bounded history replay. Sandbox gains --cloud and v3 kit so sandboxes run without a local Docker dependency. Plus TUI render wins and sandbox/filesystem confinement fixes. Aimed at teams embedding agents in IDEs/gateways over ACP.

Docker Agent (cagent) 1.144.0: ACP v1 sessions/terminals/remote MCP; sandbox --cloud without local Docker

Key Takeaways

  • Shipped: v1.144.0 — docker agent / docker-agent binary
  • ACP: session delete, elicitation, set_config_option, client terminals, remote MCP, host creds, audio prompts
  • Sandbox: --cloud + v3 kit without local Docker; confinement fixes
  • Install: Docker Desktop 4.63+ or brew install docker-agent; docs at docker.github.io/docker-agent
  • See agentclientprotocol.com; MCP still first-class
Read full story

Crawl4AI 0.9.4: three Docker SSRF/env-leak advisories closed; PruningContentFilterLXML ~10× faster

unclecode shipped Crawl4AI v0.9.4 on 2026-09-23 (PyPI crawl4ai 0.9.4). It closes three coordinated advisories: blind SSRF via robots.txt (GHSA-f77g-77vp-r96v), SSRF with response disclosure via link_preview (GHSA-wh5w-hmj3-vgg7, high), and a dict-wrapper trust-boundary bypass that let non-admin clients read server env vars (GHSA-5w5p-vcv6-mm3f, high). A process-wide egress_policy wires the Docker PinningProxy into library HTTP clients. Default pruning switches to lxml-native PruningContentFilterLXML (~10×: 134→13 ms medium page; 2200→260 ms on a 6000-card page). Self-hosted Docker servers should upgrade.

Crawl4AI 0.9.4: three Docker SSRF/env-leak advisories closed; PruningContentFilterLXML ~10× faster

Key Takeaways

  • Shipped: v0.9.4 / PyPI 0.9.4; Docker: unclecode/crawl4ai:0.9.4
  • Security: three GHSAs closed; robots + link_preview SSRF and env-leak via dict laundering; pinning egress proxy
  • Perf: PruningContentFilterLXML default ~10× faster pruning with byte-identical output
  • Ops: CRAWL4AI_MAX_TIMEOUT_MS; pool max_pages_before_recycle=200
  • Install: docs.crawl4ai.com + pip install crawl4ai==0.9.4
Read full story
ADSponsored

LiteLLM 1.102.1: Claude Code safeguards on stable + TypeSafe Jev router/guardrails backported

BerriAI shipped LiteLLM v1.102.1 on 2026-09-23 (PyPI litellm 1.102.1). Versus 1.102.0 it backports Anthropic/Bedrock/Vertex safeguards→safeguard_results passthrough so Claude Code Auto mode through a LiteLLM gateway can show Auto mode server: Enabled, and cherry-picks seven TypeSafe Jev changes (passthrough, complexity router, relevance compaction guardrail, auto-router classifier, OpenRouter jev-1.13 pricing, etc.) from the 1.103 RC onto stable/1.102.x. Docker images keep cosign verify instructions.

LiteLLM 1.102.1: Claude Code safeguards on stable + TypeSafe Jev router/guardrails backported

Key Takeaways

  • Shipped: v1.102.1 / PyPI 1.102.1
  • Claude Code: gateway forwards safeguards and returns safeguard_results (#42538) so Auto mode server can stay Enabled
  • TypeSafe Jev: seven PRs backported to stable/1.102.x (#42595)
  • Deploy: pip install litellm==1.102.1; cosign-verify ghcr.io/berriai/litellm:v1.102.1
  • Docs: Proxy Quick Start + Anthropic provider pages
Read full story
Linked Models & Agents:
⚡ Claude⚡ TypeSafe Jev⚡ jev-1.13🤖 Claude Code🌐 berriai🌐 Anthropic🌐 openrouter

Prime Intellect opens Prime Sandboxes: MicroVMs for agentic RL, claimed ~3× cheaper

Prime Intellect (@PrimeIntellect) GA’d Prime Sandboxes—hardware-virtualized MicroVMs for agentic RL. Full Linux VM fidelity (Docker Compose, background jobs, kernel workloads), elastic to tens of thousands concurrent, with verifiers/prime-rl/Prime Tunnels integrations and 365k+ prebuilt environments. Blog: ~30M sandboxes created internally; default 1,024 concurrent; tier-free pricing claimed ~3× cheaper than peers through Dec 22 (e.g. vCPU $0.02/hr).

Prime Intellect opens Prime Sandboxes: MicroVMs for agentic RL, claimed ~3× cheaper

Key Takeaways

  • Blog: hardware MicroVMs with guest kernels vs gVisor—better for Docker Compose and system-level agent envs.
  • ~30M sandboxes created internally; product page shows live concurrent/total counters.
  • 365,000+ prebuilt envs; verifiers / prime-rl integrations.
  • Default 1,024 concurrent; sample price vCPU $0.02/hr, RAM $0.0125/GiB/hr; claimed ~3× cheaper through 2026-12-22.
  • CLI: prime sandbox create / run; docs: sandboxes overview.
Read full story

Open Managed Agents open-sources a self-hosted managed-agent platform for Node, Docker, or Cloudflare

@DanKornas highlighted Open Managed Agents (github.com/openma-ai/open-managed-agents), an Apache-2.0 self-hosted platform for builders who want managed-agent workflows without vendor lock-in: durable sessions, sandboxed tools, memory, encrypted credentials, and crash recovery on Node+Docker or Cloudflare Workers, with Claude Managed Agents API and OpenAI SDK paths via /openai/v1.

Key Takeaways

  • Self-host managed-agent workflows with durable sessions, memory, and crash recovery.
  • Supports sandboxed tools, private tools, and MCP; bring your own model keys.
  • Runs on Node/Docker or Cloudflare Workers; Claude Managed Agents API and OpenAI SDK compatible.
Read full story

YC founder warns coding-agent sandboxes can be marked up 15–68x

@AniC_dev (boat.dev / Ascii, YC F26) published a YC Bookface warning: big sandbox vendors hand out large credits, then bills around $30k can imply ~50x markup vs bare metal. His team built long-running agent VMs for QA, PR review, docker compose, and Rust builds; boat.dev still takes 50–70% gross margin at about 6–19x below incumbents, and he says Claude Code can stand up an internal stack in an afternoon.

Key Takeaways

  • Sandbox vendor choice is framed as a company-level decision alongside fundraising and hiring.
  • Incumbent sandboxes fit short sessions, not hour-long cloud coding agents.
  • Claimed 6–19x lower prices imply customers may overpay 15–68x vs raw compute.
Read full story
Linked Models & Agents:

lpm open-sources a native macOS desktop workspace for services, terminals, and coding agents

@DanKornas shipped lpm (github.com/gug007/lpm): an MIT native macOS desktop app that keeps project services, terminals, and AI coding agents in one workspace—one-click start/stop with live terminal output, duplicate projects for parallel feature work, profiles for service subsets or one-off test/migrate/deploy actions, and native (no-Docker) service management beside Claude Code, Codex, and other agents.

Key Takeaways

  • Native macOS workspace for project services, terminals, and coding agents.
  • One-click start/stop, project duplication for parallel work, and profiles for tests/migrates/deploys.
  • MIT open source; native services without Docker; runs Claude Code/Codex alongside.
Read full story
Linked Models & Agents: