One bug in a widely used image-decoding library mattered twice this week. Security researchers used it, with Claude’s help, to reach inside OpenAI’s systems, and Vercel had to patch the same flaw in Next.js.

Anthropic merged Cowork and chat. Claude Code also redesigned Projects, while spend caps spread across Claude Code, Firebase, and Vercel.

Infra & Deployment: One Bug, Two Security Responses

Security researchers at Hacktron disclosed this week that back in July, they broke into OpenAI’s internal systems starting from a single image file. They found a buffer overflow inside libheif, a library that decodes a common image format. A buffer overflow is a memory bug that lets an attacker run their own code by feeding a program more data than it expects. OpenAI’s Discourse forum, the outside software it uses to run its public community forum, processed uploaded images through that same buggy library.

From there, a separate flaw in OpenAI’s single sign-on setup let a compromised forum account escalate into full employee ChatGPT and Codex accounts. Single sign-on is the system that lets one login work across several internal services. That gave the researchers a path into OpenAI’s internal code repository. They wrote a harmless pull request just to prove they’d gotten in, then stopped and reported everything through OpenAI’s bug bounty program. OpenAI shipped a fix within 14 hours and paid a $6,500 reward in September.

Claude did the technical work of building the exploit. The researchers said Claude Opus 4.8 struggled across several attempts, but Opus 5 solved the same problem within hours of its release. That detail matters as much as the breach itself. The same jump in a model’s coding ability that helps you ship features also lowers the bar for finding this kind of bug.

The same libheif flaw reached further than OpenAI. Vercel disclosed, in a separate writeup, that Next.js’s built-in image optimization relies on a chain of libraries: sharp, then libvips, then libheif. That chain processes AVIF files, a type of image format, and a malicious one could trigger the same bug. Vercel deployed a platform-wide fix and worked with the maintainers of all three libraries on real patches while disclosure was still pending.

This is exactly the failure mode Princeton researchers Arvind Narayanan and Sayash Kapoor described in BuilderWithin’s coverage of their essay. They call it an ordinary security gap in shared infrastructure, not evidence that AI is slipping out of anyone’s control. If your app touches AVIF images through Next.js, sharp, libvips, or ImageMagick directly, confirm you’re on a patched version. Don’t treat this as someone else’s problem.

Two smaller infra changes are worth a line each. Cloudflare now lets you scope a teammate or an agent’s access to a single Worker instead of your whole account. Vercel is also deleting old deployments faster on its free Hobby plan, and preview links that used to be protected can now disappear.

Coding Agents: Claude Consolidates, GitHub Rewrites Itself

Anthropic merged Claude Cowork with regular Claude chat, bringing its workspace for bigger, multi-step tasks into ordinary conversations. Until now you had to decide upfront whether a task belonged in a normal conversation or in Cowork. Work you started in one didn’t carry over to the other. Now any conversation can do either.

Claude Docs and Claude Slides launched alongside the merge, giving Claude its own document and presentation formats. It also brought Claude Design into normal conversations, instead of keeping it in its own separate space. The rollout reaches Pro and Max plans over the coming weeks.

That sits next to the redesigned Claude Code Projects feature BuilderWithin covered separately. A coordinator agent there splits one goal into several parallel Claude Code sessions. That feature is still in a narrow beta, and it can burn through your usage allowance faster than working in a single chat.

Two smaller Claude Code changes are worth flagging. It now falls back to reading AGENTS.md when a project has no CLAUDE.md, but a leftover CLAUDE.md silently blocks that fallback. Its September 19 update also changed how some enterprise accounts get billed for auto mode. Picking a model now runs on Anthropic’s servers by default, and that no longer adds a separate charge. Some enterprise gateways can still opt back into the old billing.

GitHub, meanwhile, published a detailed account of using Copilot to rewrite Copilot’s own runtime, the core software behind its CLI, app, and SDK. The rewrite switched the codebase from TypeScript to Rust, a systems programming language, in a process GitHub documented in detail. One developer did it in about 14.5 weeks, producing more than 800,000 lines of Rust. GitHub says that job would have taken a full team a year or two before agentic coding tools existed.

The interesting part isn’t the speed. It’s the coordination. The developer ran up to eight parallel Copilot sessions, each porting a different piece of code. One extra chat session acted as a gatekeeper. It decided when each session could run a heavy build, so they didn’t all compete for the same machine at once.

About 31% of the developer’s human-authored messages focused on review, testing, and CI, not code generation. That’s a concrete picture of what a large agentic refactor looks like right now. A human directs many coordinated sessions. One prompt doesn’t produce a finished migration.

Separately, GitHub is retiring six older Copilot models on October 19. The list includes Gemini 3.7 Flash, GPT-5.5, GPT-5.4, GPT-5.4 mini, GPT-5 mini, and Grok 4.5. If your workflow calls out any of these models by name, check your model policy before that date.

Two other coding agent updates in brief. xAI’s Grok Build now keeps its own notes on a project’s conventions between sessions, so you stop re-explaining the same context every time. And a veteran product reviewer testing Meta’s Muse agent praised its permission system and activity log. The log shows the trail of steps behind a result. She said both beat what she’s seen in Claude Code or Codex, on that specific point, not on coding ability.

AI Builders: A New Kind of Model, and More Salesforce

A different kind of AI model got real attention this week. Jev, from a startup called TypeSafe AI, is now available through Vercel’s AI Gateway, a single API that reaches models from many providers. Unlike a normal language model, which generates text one word at a time, Jev works differently. It evaluates a set of yes/no or multiple-choice questions about a piece of data all at once. Then it returns direct, typed answers, each with its own confidence score.

TypeSafe reports Jev ran up to roughly 194 times faster and 445 times cheaper than a full language model on its own workflow tests. Those numbers come from the vendor’s own benchmarks, not an independent test.

The practical use is narrow but common. An agent might use it to decide which tool to call next, or to score how urgent a support ticket is. It can also flag whether an AI output needs a human to check it. None of that needs a model generating free-form text.

Lovable and v0 both pushed further into enterprise data this week. Dashboards built in Lovable can now publish as native pages inside Salesforce, though anything that writes data back still runs through Lovable itself. And v0 can now install a team’s private npm packages during generation, using credentials saved once in Vercel. That’s a real convenience, but only if you remember to mark the credential sensitive. Otherwise it’s visible in plain text to teammates who can view that environment scope.

Workflow: Cost Controls Are Having a Moment, and What an FDE Should Do

Cost controls had a busy week across unrelated vendors. Firebase introduced spend caps that act as a circuit breaker for Gemini API and Cloud Functions usage. They pause the service once you hit 100% of a budget you set, with warning emails at 50% and 80% along the way.

Vercel extended its existing Spend Management tool to Enterprise customers on Flexible Commitment plans, at no added cost. The tool can pause a team’s production deployments once usage crosses a budget.

None of this works like a hard spending cap in the way it sounds. Firebase and Vercel pause a service after you cross a line you set. They don’t stop a request that’s already expensive mid-flight.

That’s the same catch BuilderWithin found in GitHub Copilot’s new cost tiers. Picking “efficiency” biases which model auto picks. It doesn’t cap what you’re billed for a given task. Test any of these against a real budget number before trusting one to protect you from a surprise bill.

Away from tooling, Kepler CEO Vinoo Ganesh published a pointed critique of how companies staff Forward Deployed Engineers. These are AI-era hires who work embedded inside a customer’s own team. His test is simple. If an engagement ends with one happy customer and nothing that made the core product better for the next one, it failed. The company just paid an engineer’s salary for work a contractor would have done just as well.

What mattered

This week’s practical lesson was to verify the boundary around any system an agent can reach. That means patching shared image libraries, checking which Claude surface owns a task, and treating spend caps as delayed safeguards rather than hard limits.

What was noise

Google’s redesigned “CC” AI agent now shares scheduling and household tasks across up to six family members. It’s a consumer feature for coordinating a household, not a change to any tool builders use to ship software.

Apple’s iOS 27 and macOS 27 releases add a rebuilt Siri built on a large language model. That’s a meaningful consumer update, but it doesn’t change how you build or ship software today.

What to watch

  • Whether Cowork, chat, Docs, and Slides reach Team and Enterprise plans, and whether the Projects coordinator moves past its narrow beta.
  • Whether other companies that depend on libheif, sharp, or libvips for image processing confirm they’ve patched the chain Hacktron used against OpenAI and Next.js.
  • GitHub Copilot’s October 19 deadline for retiring six older models, if your workflow still references any of them directly.
  • Whether typed decision models like Jev show up inside coding agents’ own tool-routing logic, beyond Vercel’s gateway.

The common thread this week: check what you actually depend on. That might be a shared image library, or a vendor’s definition of a spending cap. Find out before you’re the one who gets the surprise.

End of article