Update, October 13: Supabase resolved the Eastern US latency incident on October 6. OpenAI’s current terms specify October 29 as the end of eligible Pro $200 subscribers’ temporary allowance.

This week, coding agents gained access to more of the software around your app. Claude Code mods can change permission handling, while Supabase adds confirmations that depend on the app you use to run your agent. Lovable’s security response shows another boundary to check: who protects an app after you move it to another host?

Coding Agents: Customization and reach

Claude Code mods can change the safety layer

Anthropic introduced Claude Code mods on October 1. Mods are small functions written in TypeScript, a programming language. Each can rewrite prompts, add screen elements, or replace built-in features. Plugins distribute them for the command-line tool and desktop app.

Mods run with Claude Code’s access to your machine and are not sandboxed, meaning they lack a separate enforced access boundary. A mod can alter tool calls or approve permission requests. That makes a plugin’s source and origin part of your security decision. An agent’s reassuring explanation of the code is useful evidence, not proof that the plugin is safe.

Anthropic’s security mod loads first on Team and Enterprise plans and on machines with managed settings, the rules administrators install. It restricts changes such as overriding permission deny rules. Administrators who change which mods load first must include the security mod to retain its restrictions. Test unfamiliar mods in a disposable virtual machine, a separate computer environment, without personal accounts, shared folders, or real credentials. A second project folder on your usual computer does not isolate a mod.

Copilot gained desktop control. Computer use entered public preview on October 1 in GitHub Copilot CLI and the Copilot app on macOS and Windows. It asks before controlling an app, but you can allow future access, so review those saved approvals before using sensitive accounts.

Codex’s plan ratios are changing. In a post this week, Tibo (@thsottiaux) described Plus at 1x, Pro 100 at 5x, and reopening Pro 200 at 10x. He said existing subscribers keep 20x temporarily and receive additional credits. OpenAI’s current Pro terms set October 29 as the transition date for eligible Pro $200 subscribers who keep the subscription active. The ratios alone cannot tell you your actual allowance.

Copilot retired four models on October 2: Gemini 3.5 Flash, Gemini 3.6 Flash, Kimi K2.7 Code, and Claude Opus 4.7. If a saved workflow names one, check that your account and organization policy allow a supported replacement before changing it.

Infra & Deployment: Agents on live systems

Supabase confirmations need client support

Supabase announced MCP elicitations at its Select event on October 2. MCP is the connection standard that lets an agent use Supabase’s tools. Elicitations ask for confirmation before creating paid projects or branches, including the resource, rate, and billing interval. They also ask before SQL statements that could delete data. SQL is the language used to read or change database records.

Your agent app must support these prompts. Confirm it displays them before allowing paid resource creation or data deletion. If a prompt does not appear, stop and check client support. New dashboard access tokens are scoped by default, limiting the organizations, projects, and permissions a tool receives.

Start with read-only access, as Supabase recommends. To check destructive-action confirmation, use a separate test project with fake records and grant only the permission needed for that test. Assume a deletion can run silently: use only disposable records and check that you can decline the action when prompted. Also confirm that a request for a disposable resource outside the agent’s permissions is denied. Permission scope still limits what an approved action can reach.

Cloudflare’s Issues open beta groups repeated Workers errors and can pass diagnostic logs to a coding agent through a configured workflow. Review the diagnostic logs for customer data or credentials and review fixes before deploying.

Vercel’s shared cache stopped storing responses marked Vary: Cookie on September 30; that header signals possible visitor-specific content. If a page becomes slower, ask your agent to inspect its caching settings without removing protections for personalized content.

AI Builders: Hosting determines who applies the fix

Lovable connects apps to company Microsoft data. Its September 28 announcement combines work-account sign-in, data connectors, and publishing into a company’s Microsoft tenant, its managed environment. Publishing remains in public preview. Test record access with the account administrator before enabling writes.

TanStack protection and patching are separate steps

Lovable reported a flaw in TanStack Start, a web framework its apps use, tracked as CVE-2026-102989. A CVE is a public identifier for a security bug. In affected apps, a malicious link could run an attacker’s JavaScript in a visitor’s browser. The attack required vulnerable server functionality and a visitor opening the link; not every TanStack Start app was exploitable.

Lovable says it found no exploitation in the logs it reviewed. It added firewall rules for hosted apps to block attack traffic while maintainers prepared the patch. Affected projects upgrade on the next edit, or through a free update on the project’s Security page. New projects use the patched version.

Those firewall rules do not cover deployments on other hosts. If you exported an affected app, ask your agent to install TanStack’s patched version, run the build, and redeploy. Confirm the installed version matches the TanStack advisory before treating the job as done. Hosting protection and an updated dependency are different things.

Workflow: Costs, tests, and missing reviews

GPT-6.1 Sol keeps base prices and cuts cached-input costs

OpenAI released GPT-6.1 Sol on September 29. Its standard API rates remain $2 per million input tokens and $10 per million output tokens. Tokens are chunks of text processed by the model; API rates apply when software sends requests directly to OpenAI. These rates do not establish a chat subscription’s price or allowance.

GPT-6 Astra costs $10 input and $50 output per million tokens. OpenAI reports that GPT-6.1 Sol matched Astra on DeepSWE v1.1, a test of long software tasks, at roughly one-fifth of the cost. That is OpenAI’s evaluation, not a promise about your app.

Cached input costs $0.10 per million tokens, half GPT-6 Sol’s rate. That discount applies to eligible prompt prefixes the service reuses from its cache. Repeating text alone does not guarantee a cache hit.

If your tool offers both models, compare them on one routine task from the same starting files and prompt. Track whether the result passes your checks, correction prompts, and measured usage over several runs. If your app sets reasoning effort, the model’s thinking budget, check which settings GPT-6.1 Sol accepts before changing the model ID.

Hamel Husain tried Claude Code’s eval tool and said, “I’d hold off for now”, arguing that tests should follow examination of real outputs. An eval checks an AI feature’s behavior; his trial offers sequencing advice, with results limited to one dataset.

Copilot code review failed during a resolved September 28 incident: GitHub reports roughly 70% of requested reviews did not complete between 19:23 and 22:08 UTC. Failed requests were not retried automatically, so re-request any missing review before treating a pull request as checked.

Supabase’s Eastern US latency incident remained unresolved at this issue’s October 3 publication. Supabase marked it resolved on October 6 after reporting recovery for affected users. The incident affected clients connecting from the Eastern US, including those using projects hosted elsewhere.

What mattered

The new controls protect different boundaries. A permission prompt asks whether an action should proceed. A scoped token limits what an approved action can reach. A hosting firewall blocks known attack traffic, while a dependency update removes the vulnerable code. Check which protection your workflow actually uses before giving an agent more access.

What was noise

Arvind Narayanan and Sayash Kapoor argue that AI extinction percentages lack a validated forecasting method in their September 28 essay. A percentage alone does not change this week’s build plan; watch concrete policy proposals that affect model access or require new testing.

What to watch

  • Confirmation support: whether your agent app displays Supabase’s prompts for paid resources and data-deleting SQL.
  • Mod restrictions: whether your installation loads Anthropic’s security mod, particularly when administrators customize the loading order.
  • Codex allowances: your plan’s actual usage limits when eligible Pro $200 subscribers move to the new allowance on October 29.
  • Microsoft permissions: the permissions a published app receives when it writes company records.

End of article