Key Signals

• GitHub pauses new Copilot individual plan signups and tightens usage limits, citing unsustainable compute demands from agentic workflows. VP of product development Joe Binder stated that "long-running, parallelized sessions now regularly consume far more resources than the original plan structure was built to support," with internal data suggesting weekly Copilot operating costs have doubled since the start of the year. Opus models are being pulled from Pro plans entirely, and GitHub is reportedly exploring a shift to token-based billing for individuals. This is the clearest signal yet that flat-rate AI coding subscriptions are struggling to keep pace with how developers actually use agentic tools. [1]

• SpaceX announces a partnership with Cursor that includes an option to acquire the AI coding startup for $60 billion. The deal combines Cursor's developer distribution with SpaceX's Colossus supercomputer (claimed to match a million Nvidia H100 chips) and follows senior Cursor engineers departing to xAI and xAI already supplying compute to Cursor for model training. Cursor's valuation trajectory—from $2.5B in January 2025 to $29.3B in November to a potential $60B exit—underscores the staggering capital flows into AI coding tools, even as neither Cursor nor xAI has proprietary models rivaling Anthropic or OpenAI. [2]

• Anthropic quietly removed Claude Code from its $20/month Pro plan in what it called a "test on ~2% of new signups," sparking immediate backlash on Reddit, Hacker News, and Twitter before reverting the change within hours. Simon Willison documented the incident in detail, noting that the pricing page change was visible to all visitors and that Anthropic offered no official announcement—only a tweet from an employee. OpenAI's Codex team immediately capitalized, with engineering lead Thibault Sottiaux publicly pledging that "Codex will continue to be available both in the FREE and PLUS ($20) plans." The episode exposes how fragile trust around AI tool pricing has become and hands a competitive narrative advantage to OpenAI. [3]

• Bloomberg reports that Google's internal fragmentation across six different coding products with separate branding is hampering its AI coding push, with some Google engineers preferring Anthropic's Claude Code over internal tools. DeepMind, Google Cloud, Google Core, Google Labs, and Android are all pushing AI coding in different ways with no unified strategy. A philosophical clash persists between AI researchers wanting to move fast and senior engineers with exacting code quality standards, while engineers who try to use internal AI tools frequently hit compute capacity constraints. Google is now working to consolidate these efforts under one banner, but the competitive gap against Anthropic and OpenAI continues to widen. [7]

• GitHub ships Copilot SDK v0.3.0-preview.0, a milestone release with contributions from 60+ developers that introduces breaking defaults, OpenTelemetry, and a comprehensive agentic API surface. Key additions include Infinite Sessions, hooks and user input handlers across all SDK languages, reasoning_effort support, agent selection and session compaction APIs, and per-agent skill configuration. The breaking change to deny all permissions by default signals a shift toward security-first defaults in the SDK ecosystem. This release positions the Copilot SDK as a serious platform for building third-party agentic integrations on top of GitHub Copilot. [4][5]

• Mozilla used an early version of Anthropic's Claude Mythos Preview to identify and fix 271 security vulnerabilities in Firefox 150, following 22 bugs found with Opus 4.6 in Firefox 148. The Firefox team reported that they found "no category or complexity of vulnerability that humans can find that this model can't," while also noting that no bugs were beyond what an elite human researcher could discover—suggesting AI closes the gap rather than surpassing human capability. Mozilla frames this as a turning point for defenders: "The defects are finite, and we are entering a world where we can finally find them all." This represents the most concrete evidence yet of AI security auditing operating at production scale on a critical codebase. [8]

AI Coding News

• Anthropic launches Managed Agents, a hosted execution layer for deploying and operating long-running agent workflows with built-in sandboxing, credential management, and session persistence. The platform separates agent logic from infrastructure concerns using a "meta-harness" architecture where multiple agent workflows share a runtime substrate. Priced at 8 cents per session hour, NTT DATA's Senior Director of AI described it as enabling production deployment "in days instead of months." However, practitioners have raised portability concerns, with one founder noting that "the trajectory definition needs to be open source" to avoid lock-in to Anthropic's SDK and format. [9]

• Cloudflare announces Project Think, introducing Fibers—durable invocations that checkpoint their instruction pointer—for its Agents SDK, enabling AI agents to survive platform restarts and resume long-running tasks. The system stores progress in a co-located SQLite database via ctx.stash() and recovers fibers through an onFiberRecovered hook, solving the fundamental problem of agents losing execution context when serverless compute is preempted. Additional primitives include Dynamic Workers (restricted V8 isolates for agent-generated code execution), relational session trees with parent_id for branching conversations, and editable Context Blocks for agent self-managed memory. Project Think is available in experimental preview for Cloudflare Workers users. [10]

• Microsoft open-sources the Agent Governance Toolkit, a sidecar container that enforces runtime security policies for AI agents at sub-millisecond latency, addressing all 10 OWASP agentic AI risks. In a KubeCon Europe 2026 interview, Azure Kubernetes Service PM lead Jorge Palma explained that the approach borrows from employee access management: agents receive scoped, temporary identities with automatic permission revocation upon task completion. Agents must submit an execution plan for validation against business rules before proceeding, and plans that don't align are rejected. Microsoft also introduced AI Runway, a Kubernetes API abstraction for inference workloads that allows teams to swap engines between cloud and edge deployments while maintaining a common interface. [11]

• An analysis of how AI is reshaping the definition of software engineering argues that routine execution work is being automated while the value of engineering shifts toward system composition, abstract thinking, and ownership. The tutorial-driven era of building TODO apps and weather dashboards is ending, as AI can now generate boilerplate code that previously differentiated junior developers. The new differentiators are architectural decision-making, debugging distributed systems, and taking accountability for production failures—tasks that AI cannot perform. A practical 5-step roadmap includes strengthening fundamentals, building uncomfortable real-world systems, mastering debugging, treating AI as a tool rather than a crutch, and establishing concrete proof of work. [18]

Feature Update

• OpenAI launches Codex Labs and announces Codex has reached 4 million weekly active users. The initiative partners with Accenture, PwC, Infosys, and other enterprise consulting firms to help organizations deploy and scale Codex across the full software development lifecycle. This enterprise-focused push follows the major 0.122.0 desktop release from April 20 and positions Codex as a direct enterprise competitor to GitHub Copilot. [6]

• Copilot CLI ships three releases on April 21 (v1.0.35-0, v1.0.35-1, v1.0.35-2) adding HTTP hook support, multi-path search, and auto-mode rate-limit handling. The v1.0.35-0 release introduces HTTP hooks that POST JSON payloads to a configured URL instead of running local commands, alongside improved grep and glob tools accepting multiple search paths. The v1.0.35-2 stable release adds a continueOnAutoMode config option that automatically switches to the auto model on rate limit instead of pausing, and fixes issues with pattern-specific instruction files bloating the system prompt, extension shutdown errors appearing as log noise, and LSP refactoring tools not registering on first turn. [12][13]

• OpenAI Codex publishes six alpha builds (0.123.0-alpha.2 through alpha.7) in a single day, signaling intense development activity following the major 0.122.0 release. The preceding 0.122.0 release introduced standalone installs for Windows and Intel Macs, /side conversations in the TUI, Plan Mode with fresh context implementation, plugin workflows with tabbed browsing and marketplace support, filesystem deny-read glob policies with platform sandbox enforcement, and tool discovery and image generation enabled by default. The rapid alpha cadence suggests OpenAI is iterating quickly on enterprise and security features. [14]

• Gemini CLI v0.39.0-preview.1 ships a hotfix patch on top of the v0.39.0-preview.0 release. The parent v0.39.0-preview.0 release from April 14 was a significant update with 60+ changes from 20+ contributors, including a /memory inbox command for reviewing extracted skills, Plan Mode requiring user confirmation for skill activation, context-aware persistent policy approvals, JSONL streaming for chat recording, a background memory service for skill extraction, a Context Compression Service, and a unified invoke_subagent tool. [15]

• OpenCode v1.14.20 fixes a system theme regression in the TUI, adds GET /config to the experimental HTTP API, and resolves Windows dynamic import issues. Desktop improvements include stopping prompt control animation replays, a new setting to hide the session progress bar, and fixes for the Select Server dialog layout and synced project state changes. The SDK receives a type fix for WorkspaceAdaptor.create to include the env parameter. Four community contributors are acknowledged. [16]

• CodeQL now supports custom sanitizers and validators through declarative YAML data extensions across eight languages. Two new extensible predicates—barrierModel and barrierGuardModel—allow teams to define custom taint-flow sanitization and validation logic without writing CodeQL code, covering C/C++, C#, Go, Java/Kotlin, JavaScript/TypeScript, Python, Ruby, and Rust. This can be packaged into CodeQL model packs, making it significantly easier for security teams to tune CodeQL analysis for project-specific sanitization functions. Available starting with CodeQL 2.25.2. [17]