The latest from the AI and MCP ecosystem, curated daily.
OpenAI explains why Codex Security takes a fundamentally different approach to code security than traditional SAST tools — using AI-driven constraint reasoning to find real vulnerabilities rather than generating noisy false-positive reports. The post digs into the technical rationale and what this means for developers integrating security checks into AI coding workflows.
Today's stories:
Google introduces features to give developers visibility and control over Gemini API spending, including monthly spend caps and scaling controls. These tools help teams manage costs when integrating large multimodal models into production workflows and reduce surprise bills for experimentation.
OpenAI explains why Codex Security takes a fundamentally different approach to code security than traditional SAST tools — using AI-driven constraint reasoning to find real vulnerabilities rather than generating noisy false-positive reports. The post digs into the technical rationale and what this means for developers integrating security checks into AI coding workflows.
The MCP team reviews the state of tool annotations — the metadata that tells clients whether a tool is read-only, destructive, or reaches outside its local environment. Five community SEPs have proposed new annotations, and this post provides a clear framework for evaluating them: what annotations can actually communicate, where the limits are, and how clients should treat them as hints rather than guarantees. Essential reading for MCP server developers.
Cursor's security team built a fleet of autonomous agents to find and fix vulnerabilities across their fast-moving codebase — and open-sourced the result. The post covers how they designed the agent fleet, what vulnerability classes they targeted, and the lessons learned from running security agents in production on a real codebase. Practical reference for teams considering AI-driven security automation.
