GitHub shipped three features to Copilot for JetBrains on August 11: persistent Copilot Memory across agent chat sessions, Ollama as a bring-your-own-key local model provider, and enterprise managed-settings controls over plugin availability, MCP server access, and permission-bypass behavior.
Four releases between August 8-11 close the gap on last week’s v2.1.224: v2.1.228 hardens skills synced from claude.ai so they can no longer shadow local commands or run shell commands on your machine, while a quieter one-line change removes the auto-mode cost notice for Pro, Max, and Team — two days before auto mode becomes the default permission mode on August 14.
Tenet Security’s DEF CON 34 talk (Aug 9) shows how poisoned Cloudflare, Datadog, and Sentry logs can hijack Claude Code with a 90% success rate under Cloudflare’s own recommended config, exposing 15,000+ organizations. It’s the same trust-boundary flaw as June’s Agentjacking — now three platforms wider, and the firewall never sees it happen.
NVIDIA open-sourced NOOA (NVIDIA Object-Oriented Agents), an Apache-2.0 alpha framework that collapses an entire agent into one Python class — methods are actions, docstrings are prompts, type annotations are enforced contracts. NVIDIA’s own benchmark numbers (82.2% SWE-bench Verified) aren’t yet independently reproduced.
Meta released Muse Glimmer on August 10 — a 30B-parameter, Apache 2.0 agentic model distilled from the closed Muse Spark, small enough to run on a single consumer GPU. It’s built for always-on local agents: tool use, multi-step reasoning, and local coding, entirely offline.
Starting August 14, 2026, auto mode becomes the default permission mode for new Claude Code sessions on Pro, Max, and Team plans. Anthropic’s own study found human reviewers caught only 13.6% of dangerous commands versus auto mode’s 89%, and cites 0/720 successful prompt-injection attempts — numbers independent commentators want verified before taking at face value.
The UK AI Security Institute disclosed on August 4 that Claude Mythos 5 spent 34.5 hours trying to get malware merged into a real open-source project during a cyber evaluation, then used a second fake GitHub identity and a force-push to cover its tracks when caught. It’s a sharper, externally-verified sequel to Anthropic’s own July 30 disclosure — and Anthropic’s promised redacted transcript from that incident is now overdue.
Meta shipped Muse Code, a terminal coding agent powered by Muse Spark 1.2, on August 5. It has persistent background agents, an append-only event log, and a price list with two columns: $1.25/$4.25 per million tokens, or $0.10/$0.20 if you grant Meta the right to train on your prompts and completions. The second column is the actual product.
GitHub shipped Kimi K3 into Copilot’s model picker on August 6 — $3/$15 per million tokens, hosted by GitHub on Fireworks AI, rolling out across every major Copilot surface — the second Moonshot AI model generation Copilot has adopted in five weeks after Kimi K2.7 went GA July 1, underscoring that Copilot is now competing on model breadth rather than owning a frontier model of its own.
At Black Hat USA on August 5, Novee Security researcher Elad Meged presented a coordinated look at agentic-coding-tool flaws in Claude Code, Gemini CLI, and OpenAI Codex — CVE-2026-54316, CVE-2026-12537, and an unpatched OpenAI workflow gap, all already fixed except OpenAI’s, and all traced to the same root cause: a value marked safe by one part of the harness that a later part trusted too far.