Coding agents get budgets, new model suppliers and containment plans

Coding agents become a budget line

Agentic coding now has a visible price tag. Uber caps every employee at $1,500 a month across tools like Claude Code, and Simon Willison argues that teams need per-seat cost visibility, not only org-wide spend totals. Tomasz Tunguz proposes a way to decide where that money goes: leaders should judge models by intelligence per dollar or tokens per result instead of leaderboard rank. Anthropic's guide to running an AI-native engineering org addresses the organizational side, covering how roles, review processes and tooling should change once agents are a default part of the workflow.

The models behind those tools are also changing. Microsoft introduced seven MAI models, including MAI-Thinking-1. Its efficiency-focused MAI-Code-1-Flash now powers agentic coding in GitHub Copilot for VS Code, which suggests Microsoft wants more of Copilot's inference running on its own lower-cost models instead of OpenAI's. AWS has added GPT-5.5, GPT-5.4 and the Codex agent to Bedrock. Teams standardized on AWS can now use them through their existing IAM, VPC and billing setup, without separate OpenAI accounts. More providers serving the same coding workloads may make Tunguz's cost-per-result comparison easier to run in practice.

Open weights compete on growth rate

Google's Gemma 4 12B is a unified, encoder-free multimodal model. It handles several modalities without a separate vision tower, which should simplify serving and fine-tuning on modest hardware. MiniMax launched a 1M-token context model and promises M3 weights, although those weights have not been released yet. An Interconnects essay argues that open and closed models are on different exponentials: open releases keep compounding capability gains while closed labs pull ahead on raw scale. If that is right, the pace of open releases matters as much as any single model's scores.

Agents as bug hunters and attack surface

Coding agents are proving useful for security work. A Calif blog post describes how OpenAI's Codex uncovered a hidden HTTP/2 denial-of-service bug in production infrastructure, effectively working as an automated security researcher. The same reasoning ability can also drive attacks. University of Toronto researchers built a proof-of-concept AI worm that uses an LLM to adapt its exploit to each target, and they claim it could threaten almost any internet-connected device. A separate analysis argues that AI agents are the new insiders, a useful frame for any agent that holds repository or credential access.

Conventional credential risk remains. Researchers disclosed a GitHub.dev flaw that lets an attacker steal a developer's OAuth token with one click. The stolen token exposes the account and its connected repositories through the browser-based VS Code editor. Teams that rely on GitHub.dev should check their token scopes and session handling.

Containing Claude as deployments get riskier

Anthropic is taking Claude into higher-liability settings. TechCrunch reports that the company scaled Claude Mythos into critical infrastructure in more than 15 countries. Separately, its Project Glasswing security-access program added 150 more companies with a focus on critical infrastructure. Anthropic's engineering post on how it contains Claude across products details the sandboxing, permissioning and monitoring layers it uses, which makes it a concrete reference for limiting blast radius when a model has real tool access. For testing such setups from outside, the open-source Claude-Red repo packages red-teaming utilities for probing Claude-based agents for jailbreaks and unsafe tool use.