If your agent uses Python, old package tools can still trust compromised certificates after an operating-system update. Replit’s new auto-publish option lets its agent put fixes live without another approval.

Infra & Deployment: Check the tools behind your live app

Python package tools need their own security updates

The Python security announcement warns that older pip installations can still trust compromised eMudhra certificates after operating-system updates. Pip installs the packages a Python project uses, including when your coding agent runs it. Certificates help software check that it is talking to the real website.

The notice’s recommendations include these common tools and packages:

  • pip 26.2.2, the package installer.
  • uv 0.13.4, a tool for managing Python projects and packages.
  • certifi 2026.10.19, a list of trusted certificates used by Python software.

Pip includes its own certificate list, so updating certifi elsewhere does not update pip’s copy. Ask your agent to check every existing project environment, the separate set of packages that project uses.

Upgrade pip first using the notice’s download command, which checks the file against its expected contents. Use that updated pip to upgrade certifi and uv wherever the project uses them. Check the notice’s full list for other affected tools. For containers, reusable packages of an app’s software, ask your agent to rebuild without reusing cached layers of old software.

PHP fixes go beyond updating your app

If your app runs PHP, ask your hosting provider to confirm that its PHP software has the October 21 security fixes. The October 23 PHP advisory also covers a rare setup that can remain exposed after those updates. Ask your provider to check its session.upload_progress.enabled setting against that advisory. This controls a feature that tracks file uploads and may need disabling until the next regular fix.

Updating a plugin or your app’s code alone does not fix the underlying server software.

Schedule checks with access that cannot change data

Supabase’s Agent prompts are instructions for checking a live project and reporting problems. Supabase suggests hourly health and performance checks, and daily security and resource checks. You choose and configure the schedule.

Its example limits the agent to one project with read-only access, so it can inspect data without changing it. Each finding includes a measured value, the level that triggered the alert, and a next step. If a check cannot fetch the information it needs, it reports that it cannot assess the project; silence alone does not prove health.

Payment credentials can have narrower access. Vercel Connect can create a separate restricted Stripe key, a credential for the payment service, for each agent. A reporting agent can read charges without getting permission to create customers.

A Vercel budget pause can take live apps offline. Vercel’s new budget command requires Owner or Billing permissions on Pro teams or Enterprise teams using Flexible Commitment. Setting a budget alone does not stop usage, but enabling its optional pause makes production apps across the team’s projects unavailable when spending reaches that budget.

Vercel Agent groups approval around a plan. Vercel says its agent investigates with read-only access, then proposes a plan for changes and the additional permissions they require. Approving a plan grants those permissions together; read-only access can still expose sensitive information.

AI Builders: Choose whether Replit publishes fixes automatically

Replit’s Monitoring Agent investigates errors in apps you have published on Replit. With alerting and auto-fix enabled, Replit says it finds the cause, validates a fix, and emails you a summary. The earlier App Monitoring feature only alerted you that something broke.

Auto-publish is a separate, optional setting. With it enabled, the agent can deploy its fix to your live app without asking first. For apps handling payments, logins, or customer data, leave auto-publish off so you can review each fix before it goes live.

Coding Agents: Reuse instructions without surrendering oversight

Codex adds saved prompts and credential masking. Codex 0.164.0 adds ten numbered slots for reusable prompts and commands. You can also choose the model and permissions by typing them directly into the relevant commands. It masks credentials in supported remote command sessions, where commands run on another computer, keeping secret values out of displayed output.

Frequent suggestions become easy to ignore. Dan McAteer reports that his Claude Code mod ran on 99 of 111 turns. He says that frequency made its suggestions easy to skim past. Mods are plugins that change Claude Code’s behavior and run with its access to your machine, so installed code can see your prompts.

1Password expands approved agent sign-ins. The company announced 1Password for Agents, which fills approved sign-ins without sending passwords to the model. Availability depends on the integration; its announcement describes the Claude Duet connection as forthcoming.

Copilot applies defaults to unconfigured features. GitHub is rolling out its global default policy through October 26 for Copilot Business and Enterprise. Eligible fully released features follow the selected default: Enabled, Disabled, or Let organizations decide. Explicit choices stay intact, and preview features remain opt-in.

The rollout sets those previously unconfigured features once. Changing the default later does not change those choices. Administrators can review the setting under AI Controls, then Copilot, then Default policy for new features.

End of article