Welcome to the 314th edition of Coding Jag brought to you by TestMu AI!👐
What if your model could never hand back a malformed answer? TypeSafe AI’s Jev returns typed decisions instead of text, picking from answers you declare up front in 70 to 500 milliseconds. It can’t go outside your schema. It can still pick the wrong option, and that is exactly where testing comes in.
Also this week: of 225 vulnerabilities credited to one AI bug-hunting program, exactly one has been exploited in the wild. Gemini reached the live internet during a safety evaluation and broke into three real companies. Opus 5.5 got cheaper while quietly changing how much it reasons. And your "flaky" test may simply have eaten its own test data.
Our new TestMu AI Build vs Buy: AI Testing Agent Whitepaper is out. It prices both paths over year one: what an in-house agent built on coding agents costs, what a purpose-built platform costs at list price, and how to make the call. Written for engineering and QA leaders. Free to download.
📬 Come across something useful or interesting? Just reply and let’s exchange ideas.
News
08 min
thehackernews.com
🕵️ Ravie Lakshmanan reports that Gemini reached the open Internet during a May evaluation run by Irregular and broke into three real companies. It guessed one password and found the credentials for the other two in a public repository. A fictional company name used in the exercise happened to match a live domain.
07 mintheregister.com
📊 Jessica Lyons covers a tracker kept by VulnCheck researcher Patrick Garrity. Of 225 vulnerabilities attributed to Anthropic or its Project Glasswing program, exactly one has been confirmed to be exploited in the wild: a critical SQL injection flaw in Ghost. That is under half a percent, and a useful counterweight to the panic.
08 mintypesafe.ai
💳 TypeSafe AI’s first model returns typed decisions, not text. You declare up to 255 valid answers per field, and Jev picks one with a calibrated probability in 70 to 500 milliseconds, at $0.042 per million input tokens. It can’t answer outside the schema, but it can still choose the wrong option within it.
07 minblog.jetbrains.com
🛠️ JetBrains folds six months of agentic experiments into one system spanning its IDEs, a CLI, shared context, and cloud agents. The framing is the notable part. After 26 years of building the individual developer workbench, the company is now building for how agentic work gets initiated, reviewed, and governed.
10 minsurveys.lambdatest.com
📊 Our annual survey on how teams actually use AI in testing and quality engineering is still open. Roughly ten minutes to complete. Every response is handled with the utmost confidentiality, and we publish the results, sharing the most impactful insights with the global quality community. Honest answers sharpen the picture for everyone.
AI
06 minthenewstack.io
⚠️ The migration guide lists four breaking changes that make an Opus 5 request return a 400 error on Opus 5.5. Switching thinking off is gone, and the default effort level quietly drops from high to medium, so anything that omits the parameter now reasons less than it did before.
08 mindevblogs.microsoft.com
📅 Waldek Mastykarz set out to measure how much a model actually knows about a product and found no consistent boundary. Its knowledge of a given product can end months before the stated cutoff, or be missing entirely. He had to rebuild the information boundary first, because a local install leaks the answer.
07 minhuggingface.co
📐 Benchmark results are published across formats and outlets with too little detail to reproduce them. The UK AI Security Institute and EvalEval are answering that with a shared reporting schema called Every Eval Ever. An open platform of Evaluation Cards carries the methods alongside the numbers.
07 minabout.gitlab.com
🧩 GitLab’s Flow Registry compiles YAML configuration into working flows from reusable components, and it cut the code its own engineers write per agentic flow by 45%. That is a concrete answer to a question most teams are still guessing at: how much of an agent workflow should be configuration?
09 mintestmuai.com
🤐 Vipul Verma walks through OpenAI’s disclosure that models wrote concealment instructions into their own compaction summaries, the handoff notes a long-running agent leaves for its successor. One note said to be transparent only if asked. The testing takeaway: judge agents by observable effects, not by their own accounts of what they did.
Automation
07 mindev.to
🧪 Oleksandr Riaboshtanov draws a line most teams blur. A flaky test fails and passes with no pattern, and you fix it by waiting for the right condition. A test that passes once and then fails every time afterward has consumed its own data. The fixes are opposite, so a longer timeout just hides the bug.
08 minsatisfice.com
🧭 James Bach separates two things the industry keeps merging. Quality engineering is the work of creating quality, and developers are the ones who do it. Testers analyze the product and feed that back. His Quality Engineering Tetrad starts from first principles: quality is value to some person who matters.
06 mincypress.io
🙈 Mark Noonan explains that Test Replay now replaces password and payment values with asterisks before it captures the DOM, on every Cypress Cloud project by default. You keep the full form structure for debugging. Only owners and admins can turn it off, and masking is a safety net rather than test data hygiene.
05 mingithub.com
⚡ The load testing tool adds a scenario flag, so you can run one named workload without editing the script or splitting it in two. A once flag reuses the same script for smoke and functional checks, and experimental async group support keeps metrics in the right group across an await.
Tools
06 mincode.visualstudio.com
🧰 The latest release makes large agent session lists load faster. Dev Container support now extends to remote projects, so agents run inside your project’s container over SSH, Tunnel, and WSL. The agent host runs harnesses in a dedicated process, allowing several windows to attach to a single session.
07 minblog.cloudflare.com
🐍 Two years after the preview, Python is a fully supported language on Cloudflare’s developer platform. A WebAssembly-compiled interpreter and Pyodide do the work, so FastAPI and the packages you already use connect to the same bindings as the TypeScript runtime. Production-ready rather than experimental.
05 minnodejs.org
⚙️ A quieter release than last month’s. A new crypto call parses PKCS12 bundles, and the foreign function interface can now load libraries from a mounted virtual file system. The file system module gains a synchronous blob opener. A bound socket can also be handed to threads and child processes.
Video & Podcast
12 mintestguild.com
🎤 Joe Colantonio asked thirteen people building AI testing tools which parts of the job they will not hand to a machine. This episode is from his Testear.la 2026 conference session, drawn from a year of interviews on the show, and it ends with the tasks every one of them still keeps in human hands.
10 minstackoverflow.blog
💬 Rob Seaman, the general manager of Slack, argues that most work with coding agents ends up as siloed context nobody else can see. Putting developers and agents in one channel flattens code writing and review into a single conversation. Worth a listen if your agent output lives in private terminals.
Events
05 minhustef.com
🇭🇺 Three days in Budapest from 6 to 8 October, run in English. The keynote lineup leans into where testing is heading, including observability for AI and a rethink of testing automation principles. Registration is open, although the discounted rate closed earlier in September.
05 minvlctesting.es
🇪🇸 Two days on 27 and 28 October, the first in person at La Rambleta in Valencia and the second online. It runs three parallel tracks and bills itself as the largest software testing festival. Sessions are in Spanish, which is worth knowing before you book.