Welcome to the 306th edition of Coding Jag brought to you by TestMu AI!👐
Developers exposed 28.65 million hardcoded secrets in public GitHub repositories last year. Worse, code written with AI agents leaked credentials at about twice the rate of code written by hand. Docker unpacks the failures behind those numbers, including a supply chain attack that turned coding agents into the attack vector.
The rest of the week moved just as fast. Anthropic launched Claude Opus 5 with configurable reasoning depth. The Model Context Protocol received its biggest update since 2024. GitHub taught Copilot code to review your team's own coding standards, Playwright 1.62 overhauled component testing, and more.
And the TestMu AI State of AI in Testing Survey 2026 is open: 10 minutes, confidential, findings published back to the community. Tell us how AI is really landing in your testing.
📬 Come across something useful or interesting? Just reply and let's exchange ideas.
News
08 min
anthropic.com
🤖 Anthropic launches Claude Opus 5 at unchanged pricing: $5 per million input tokens, $25 for output. An effort setting from low up to max decides how hard it works, and a fast mode runs about 2.5 times quicker for twice the price. Available on all platforms today.
08 minsiliconangle.com
🔌 Maria Deutscher at SiliconANGLE covers the largest Model Context Protocol revision since Anthropic open-sourced it in 2024. The handshake gives way to a stateless core that embeds metadata in every request, and authorization is hardened against credential-stealing login attacks. If your test tooling speaks MCP, plan the migration now.
07 minthehackernews.com
🔓 Ravie Lakshmanan at The Hacker News reports a maximum-severity hole in Ruflo, the open-source agent framework with 66,500+ GitHub stars. Its default Docker config exposed an unauthenticated endpoint on every network interface, letting outsiders run commands and poison agent memory. A patch landed in 3.16.3 within 24 hours.
08 mininfoq.com
💸 Steef-Jan Wiggers at InfoQ recounts the July 17 incident where AWS dashboards showed a $1.7 billion estimate on a $5 account, and $7.1 trillion on another. Invoices were fine, yet the wrong numbers stayed up for over 24 hours. Billing pipelines have edge cases too, and someone has to test them.
10 minsurveys.lambdatest.com
📋 The TestMu AI State of AI in Testing Survey 2026 is open. It takes about 10 minutes, responses stay confidential, and the findings will be published back to the community. Tell us how AI is really landing in your testing, then pass it along to a colleague.
AI
09 mindocker.com
🔑 Ajeet Singh Raina, Developer Advocate at Docker, examines real cases of coding agents leaking credentials, including the s1ngularity attack on Nx that stole 2,349 secrets by flipping the agents' own permission-skipping flags. The fix he demos: sandboxes where the agent only ever sees a placeholder, never the real key.
09 minstackoverflow.blog
🛠️ Ryan Donovan at Stack Overflow argues tools earn attachment because they are predictable, and AI agents break that contract. Stack Overflow's own survey found AI usage climbing from 76% to 84% while trust fell from 40% to 29%. Code is nearly free to generate now, so review becomes the bottleneck.
08 minlangchain.com
📊 Liora Korni, Senior AI Engineer at Similarweb, shows how her team grades agent-written research reports with no golden answer: deterministic tool checks, LLM-as-judge rubrics with anchored 0-to-1 scores, and A/B comparisons against accepted baselines. The lesson for QA: read the judge's comments, never just its scores.
Automation
07 mingithub.com
🎭 Playwright 1.62 rebuilds component testing around stories and galleries mounted through fixtures.mount(). Most operations now take a signal option so that stuck actions can be canceled, visual comparisons gain WebP screenshots, and an isolated retry strategy re-runs flaky tests in a single worker at the end.
08 mingetautonoma.com
🤝 Tom Piaggio, Co-Founder at Autonoma, breaks multi-agent testing into three surfaces: the handoff message, the routing decision, and the executed step sequence. Four failure classes dominate, and single-agent tests catch none of them. His patterns run offline with pytest, schema checks, and 101-trial routing votes.
09 mintestmuai.com
🗣️ Akarshi Aggarwal, writing on the TestMu AI blog, walks through testing conversational agents built on ElevenLabs, covering task success, latency, and knowledge-base grounding. Automated simulations then scale the effort, scored on 9 conversation-quality metrics and 30+ telephony metrics. Useful groundwork if a voice agent is on your roadmap.
Tools
07 mingithub.blog
✅ GitHub's Copilot code review can now apply your team's agent skills and MCP context on every pull request, generally available on paid plans. SKILL.md files in .github/skills enforce house standards, MCP calls stay read-only, and the GitHub and Playwright MCP servers are enabled by default.
07 minzed.dev
⚡ Zed 1.12 gives the editor's Git Panel separate Staged and Unstaged sections with inline controls, closing a long-requested gap against VS Code. File and text finders gain multi-select, reference results become filterable pickers, and a follow-up release added Claude Opus 5 support for bring-your-own-key setups.
Video & Podcast
08 mintestguild.com
🎤 Joe Colantonio hosts Keith Klain, a quality engineering director with 25+ years in financial services. Klain argues "the death of test engineering" only kills outdated roles: machines do checking, humans do testing. Frame defects by revenue and reputation impact, and treat AI as a tool, not a competitor.
07 minyoutube.com
📺 Alexandra Klepper of Google's Chrome team shows how to build WebMCP tools, the proposed web standard that exposes a site's functions and forms as structured tools for browser agents. Chrome 149's experimental DevTools panel inspects tool schemas, runs tools manually, and logs every agent-page interaction.
Events
07 mintestmuai.com
🎤 Three weeks to go. TestMu Conf runs August 19 to 21, free and virtual, with 80+ sessions on autonomous QA and AI testing and 75,000+ testers expected from 120+ countries. Keynotes come from Replit CTO Luis Hector Chavez and Entire CEO Thomas Dohmke. Grab your free boarding pass.
08 minagiletestingdays.com
🎤 Agile Testing Days returns to Potsdam, Germany, November 16 to 19: a masterclass day plus three conference days, onsite and online. Expect 800+ attendees, 80+ speakers, and 100+ sessions spanning AI, automation, security, and accessibility. Early-bird pricing runs until September 20; the online pass is EUR 299.