Summary

Today's ten signals trace AI agents maturing from novelties into governed, monetized infrastructure. Security dominates: a malicious npm release (jscrambler 8.14.0) specifically harvested MCP server configs and API keys from Claude Desktop, Cursor, Windsurf, and VS Code, while Perplexity's Firecracker-based SPACE sandbox and VS Code 1.127's default terminal sandboxing on macOS and Linux point to hardware-isolated execution plus credential separation as the emerging safety baseline. In parallel, platforms are turning themselves into multi-agent hosts — Notion 3.6 External Agents, GitHub's Codex provider in JetBrains, Hugging Face Spaces, and Sourcegraph Batch Changes all let external coding agents act inside the workspace. And two pricing philosophies are hardening at once: Warp's usage-metered credits for dev compute versus Salesforce's outcome-based pay-per-resolution for enterprise service.

Key themes

  • Agent security converges on isolation + credential separation: Perplexity SPACE (Firecracker microVMs, secrets kept outside the sandbox) and VS Code 1.127 (network-blocked, filesystem-restricted terminal commands by default) both make hardware-level isolation the default trust substrate for autonomous, tool-using agents.
  • MCP config files are now a named attack target: the jscrambler npm supply-chain compromise deliberately extracted Model Context Protocol credentials from AI coding tools, elevating developer workstations to a front line for AI credential theft and raising the bar for how agent tools store secrets.
  • Platforms are becoming neutral multi-agent hosts: Notion (Claude + Cursor as addressable, auditable teammates), GitHub (Codex selectable alongside Claude and Copilot in JetBrains), Hugging Face (build-with-an-agent Spaces), and Sourcegraph (streaming agent reasoning in Batch Changes) all expose their surfaces to external agents.
  • Agent pricing splits into usage-metered vs. outcome-based: Warp now burns platform credits for every cloud agent run as flat tiers give way to compute-linked metering, while Salesforce's Agentforce Help Agent charges only on autonomous end-to-end resolutions — two answers to the cost of long-running agents.
  • Enterprise governance moves from capability to control: Quiq's Verified Intelligence control layer, Notion's audit logs for custom agent actions, and GitHub's admin-configured custom models and MCP management all target the oversight gap slowing production agent rollouts.

Notable items

  • npm supply-chain attack (jscrambler 8.14.0) used a preinstall hook to drop native binaries that harvested MCP server configs and API keys from Claude Desktop, Cursor, Windsurf, and VS Code — the day's highest-impact signal (Socket analysis).
  • Perplexity launched SPACE, a Firecracker-microVM sandbox for its Computer agent with pausable/resumable/branchable sessions and out-of-sandbox credentials, reporting 1.25M sandbox creations and 11.9M reconnections in a week of internal testing.
  • VS Code 1.127 turned on terminal-command sandboxing by default on macOS and Linux, blocking network and restricting filesystem access unless a command needs to elevate.
  • Notion 3.6 shipped External Agents with Claude and Cursor as the first two, letting teams assign tasks from shared boards and @-mention agents like colleagues, plus five new MCP connections and audit logs.
  • Salesforce made Agentforce Help Agent generally available with pay-per-resolution pricing — no charge if the customer asks for a human or leaves unhappy — the sharpest contrast to Warp's shift to credit-based, usage-metered agent pricing.
  • GitHub added OpenAI Codex as a selectable agent provider in JetBrains IDEs (public preview) with hooks, MCP management, and admin-configured custom models, turning Copilot into a multi-agent host.

Source coverage

Source rows used: 10