Welcome to the 316th edition of Coding Jag brought to you by TestMu AI!👐
In a Microsoft benchmark task, an AI agent closed a support ticket and told the customer her query was resolved. It was not. All nine tool calls were well formed, so a check on tool calls would have passed it. The check that failed was one field in the database. Microsoft’s ThinkingBox grades that end state, not the agent’s own account of it.
The rest of the issue keeps running into the same thing. GitHub made a benchmark for AI code reviewers, and its own Copilot came first. Just opening a file’s diff was enough to run code someone had hidden in the repo. A long-time tester says most of his time on an AI project goes to paperwork, including arguing with agents over his bug reports. Also: Playwright 1.64 can test the tools a page gives an agent, and WebdriverIO v10 is out. The DNS root key changes on 11 October, so check your resolver this week.
📬 Come across something useful or interesting? Just reply and let’s exchange ideas.
News
06 min
openai.com
🌐 OpenAI is rolling GPT-6 out globally in ChatGPT, a month after the first GPT-6 models went to paid customers. The company says this one is built for more than 1.2 billion weekly ChatGPT users. It also introduces Intelligent UI, which answers with fully interactive interfaces instead of a block of text.
07 minabout.gitlab.com
🪝 Abisheik Magesh and Daniel Abeles of GitLab’s Threat Research Group found ConfigPoisoning, tracked as CVE-2026-102437. Viewing a file’s diff in DeepSeek-Reasonix Studio could run attacker code. The group says multiple widely used coding agents share the flaw class, where commands run from a repository’s own .git/config and .gitattributes.
09 minthenewstack.io
🧮 Paul Sawers covers ReviewBench, which GitHub built with Microsoft from 219 pull requests across 187 repositories and 19 languages. GitHub says it picked that corpus after analyzing 103.9 million pull requests. Copilot sits at the top of the first leaderboard. The catch is that GitHub ran every rival’s initial test itself.
09 minblog.cloudflare.com
🔑 Sebastiaan Neuteboom and James Godlewski walk through the DNS root key-signing key rollover to KSK-2024, only the second in history. A validating resolver that does not trust the new key could make healthy sites unreachable. Most site owners do not need to do anything. If you run one, check that it trusts KSK-2024 before 11 October.
08 mintestmuai.com
🥇 Kane CLI leads the PRISM Q4 2026 leaderboard with an RPS-Index of 0.7674 across 50 real-world web scenarios, and it tops every agent on reliability, perception and intent. What makes that credible: PRISM publishes its scenario specs and scoring code, so the result is not a vendor grading itself.
AI
12 minhuggingface.co
🗄️ Tuhin Kundu and colleagues at Microsoft open with a refund case an agent handled carefully and still got it wrong. The failing check was a single field: status was solved where the required end state was hold. ThinkingBox grades 507 stateful workflows, each run 20 times, on backend state instead of replies.
06 mindeveloper.microsoft.com
🧭 Waldek Mastykarz of Microsoft defines AX as the experience agents have finding, choosing and using your technology, a term Mathias Biilmann of Netlify coined in January 2025. It splits in two: propensity, whether the agent reaches for you at all, and efficacy, whether it then calls your current API correctly.
06 minleaddev.com
🧩 Bill Doerrfeld reports on Meta’s Capacity Efficiency Program, where senior engineers' reasoning was encoded as reusable skills rather than one generic tool. Diagnosis time for performance regressions fell from about 10 hours to around 30 minutes. Humans still approve the production changes.
10 mintestmuai.com
🔍 Keep the builder and the inspector apart, and never let the builder sign off on its own work. A coding agent checks the one task it just wrote, while Kane CLI runs the whole cycle, from working out what to test through triage and regression. Not Devin or Kane CLI, but Devin then Kane CLI.
Automation
05 mingithub.com
🎭 WebMCP arrives as page.webmcp and frame.webmcp, so the tools a page registers through the experimental browser API can be tested like any other part of the app. Playwright MCP offers them to agents by default, with an opt-out flag. Videos can now be recorded at a custom frame rate.
11 mintestmuai.com
🔁 Shipping v10 week of 5 October took 191 people merging 1,725 pull requests across 41 repositories. The new wdio session command lets an agent drive the app browser.act turns intent into replayable code, and DevTools traces make the result reviewable. We also list what breaks when you come from v9.
05 minsatisfice.com
⚖️ James Bach is testing Claude Opus as a coding agent and reports that most of his time goes to paperwork rather than engineering. He ends up in semantic arguments with AI skills that score behaviors, and those skills have to agree with his findings before a bug report can even be submitted.
07 minthoughtworks.com
⏱️ Joe Murray, in conversation with Martin Fowler, makes the case that needing to move faster is not permission to loosen engineering discipline. Discipline should move closer to where working software meets real conditions. Thoughtworks' 3/3/3 framework gives three days to shape a move, three weeks to a prototype, three months to production.
Tools
05 minnodejs.org
🟢 Antoine du Hamel cut this release, and the notable changes are mostly small additions. Alpine Linux moves up to tier 2 support. Node adds isValidHeaderName and isValidHeaderValue for HTTP, graduates process.ref and unref to stable, and gives the perf_hooks histogram diff and snapshot methods. A 26.11.1 patch followed the same day.
05 minblog.postman.com
🔐 Ankit at Postman writes up how 70 internal agents were put behind a credential broker called Passport. An audit had found 278 API keys sitting on laptops, in CI configs and in deployment manifests, one of them able to delete records and change org-wide settings. The rollout covered 33 SaaS and 9 internal systems in five days.
Video & Podcast
05 mintestguild.com
🎧 Joe Colantonio’s news show for the week of 5 October asks whether your WebdriverIO suite is ready for the biggest change the project has made in fifteen years. He also covers multi-environment Playwright, chaos engineering in the AI era, and previews a webinar on seven questions to ask before trusting AI testing.
05 minse-radio.net
🎙️ Sahil Walia, a senior technical architect at Snowflake, joins host Robert Blumen to work through schema and data migration. They cover failure modes at scale, migrating without downtime, what safety means for a data migration and patterns including double writes, read repair and replication, closing on Apache Iceberg.
Events
05 minconf42.com
🚩 A free online day of feature flag talks on 15 October, with everything premiering on YouTube and staying up afterward. Speakers come from Microsoft, Amazon, Visa, Walmart and PayPal. One talk is called Your Kill Switch Is Untested, and You Will Find Out at 3 am. Another covers shipping AI agents behind flags.