Key Signals

• Anthropic doubles Claude Code rate limits after SpaceX partnership delivers 300+ MW of GPU compute. The deal gives Anthropic access to SpaceX's Colossus 1 supercomputer — over 220,000 Nvidia GPUs including H100, H200, and GB200 accelerators. Claude Code's five-hour rate limits are now doubled for Pro, Max, Team, and Enterprise plans, peak-hour throttling is removed, and Claude Opus API rates see massive increases (e.g., Tier 1 input tokens per minute jump from 30,000 to 500,000). This directly addresses the wave of developer complaints about hitting limits mid-session and shifts workflows "from cautious prompt budgeting to deeper reasoning, bigger tasks, and more complete engineering output." [1]

• GitHub ships a packed Copilot day: CLI v1.0.44 with hook bypass, SDK beta.3 with plan mode handlers, and org-level secrets for cloud agent. Copilot CLI v1.0.44 introduces userPromptSubmitted hooks that can return responses directly without making a model call, multi-skill invocation in a single message, and a prerelease argument for copilot update. The Copilot SDK v1.0.0-beta.3 adds exitPlanMode.request and autoModeSwitch.request callbacks plus structured tracing diagnostics across .NET, Python, and Rust. Meanwhile, Copilot cloud agent now supports dedicated "Agents" secrets and variables at the organization level, eliminating per-repo duplication for shared configuration like package registry tokens and MCP server credentials. [2][3][4]

• OpenAI Codex v0.130.0 adds a headless remote-control command and a Chrome extension for browser-native agent operation. The new codex remote-control command provides a simpler entrypoint for starting a headless, remotely controllable app-server, while the separately launched Chrome extension lets Codex agents operate inside a user's live browser session — accessing authenticated apps, working across tabs, and handling workflows without screenshots-and-click loops. Plugin sharing now exposes discoverability controls, and Bedrock auth supports AWS console-login credentials. Together these moves position Codex as both a coding tool and a general-purpose agentic platform. [5][6]

• Airbnb reports 60% of new code is now AI-generated, up from negligible levels a year ago. CEO Brian Chesky stated in the Q1 2026 earnings call that AI gives "huge leverage — where you might have needed a team of 20 engineers before, an engineer can now spin up agents to do a lot of work under supervision." The company's customer support bot also now resolves 40% of issues without human escalation. These figures join a growing wave of enterprise AI-code adoption metrics from Google (30%), Microsoft (30%), and Spotify. [7]

• GitHub publishes its defense-in-depth security architecture for agentic CI/CD workflows. The design uses sandboxed ephemeral environments, read-only defaults with staged write operations, secret isolation through trusted proxies, constrained tool access with network isolation, and comprehensive activity logging across trust boundaries. The architecture acknowledges that "agents are non-deterministic — they consume untrusted inputs, reason over live repository state, and can act autonomously at runtime," and treats prompt injection, privilege escalation, and unintended actions as first-class risks. [8]

• Model deprecation wave hits GitHub Copilot: GPT-4.1 sunsets June 1, Grok Code Fast 1 sunsets May 15. GPT-4.1's suggested replacement is GPT-5.5, while Grok Code Fast 1 users are directed to GPT-5 mini or Claude Haiku 4.5. The Grok deprecation is accelerated due to the model provider's own retirement timeline. Enterprise administrators need to enable alternative models through Copilot model policies before the cutoff dates. [9][10]

AI Coding News

• OpenAI launched a Chrome extension that lets Codex agents operate inside a user's live browser session. The extension connects Chrome to the Codex desktop app on Windows and macOS, giving agents access to signed-in websites, cookies, and authenticated workflows. Unlike the traditional "screenshot, reason, move the mouse" loop, the extension works directly within Chrome to navigate multiple tabs in parallel. OpenAI developer experience lead Dominik Kundel explained: "Sometimes there is no plugin, or there is one, but the thing you need is only available in the full web app. And sometimes the context is actually the existing logged-in Chrome session." The extension requests access to browsing history, tab groups, downloads, bookmarks, and debugger functionality — a broader permission surface reflecting the shift toward browser-native agent workflows. [6]

• Developers reacted to Cursor's new SDK with cautious optimism, calling it a "promising but still-moving platform." The SDK, released last week, lets developers build agents using Cursor's runtime, harness, and models. George Jacob of Faire praised it as "a path to running our own programmatic agents on that same cloud runtime, without managing VMs or working around memory limits." However, Curtis Pyke of Kingy AI warned that "tool call schemas are not stable and should be parsed defensively," and Khalid Abdelaty noted Python support is absent — TypeScript only, with Python users needing the Cloud Agents REST API. The SDK is public beta; production use should start with low-risk tasks. [11]

• Amp, the Sourcegraph spinoff, unveiled "Neo" — a rebuilt CLI designed for remote-controllable, plugin-powered agent workflows. The architecture moves the agent loop into the cloud, sending "~95% less data to/from the server" while streaming live updates to a web interface for remote monitoring and control. Neo joins GitHub Copilot CLI and Claude Code in offering remote control capabilities, reflecting a broader industry shift from agents living inside a single editor toward autonomous, multi-environment operation. Roo Code went further, shutting down its VS Code extension entirely in favor of its cloud-based Roomote agent. [12]

• Cloudflare launched "Artifacts" in beta, bringing Git-style version control to AI agent outputs. The system creates persistent, versioned records of agent-generated code, configurations, and reasoning steps, enabling teams to trace changes, compare versions, and roll back when needed. The launch addresses a growing production challenge: AI agent outputs are often ephemeral and non-deterministic, lacking the lineage and auditability that traditional software engineering demands. Cloudflare positions Artifacts as a governance layer for collaborative AI development where multiple agents and humans interact with shared outputs. [13]

• OpenAI published a detailed account of how it runs Codex securely in production. The blog post covers sandboxing, approval workflows, network policies, and agent-native telemetry, positioning these practices as a template for safe and compliant coding agent adoption across organizations. [14]

• Thousands of applications built with AI "vibe coding" tools are exposing corporate and personal data on the open web. Platforms like Lovable, Base44, Replit, and Netlify let anyone build web apps in seconds, but the resulting code often lacks proper security controls, authentication, and data protection. The reports underscore the tension between AI-accelerated development velocity and the security expertise gap that grows as non-developers increasingly ship production code. [15]

• Airbnb disclosed that 60% of its new code was AI-generated in Q1 2026. CEO Brian Chesky said an engineer can now "spin up agents to do a lot of work under supervision" in areas where a 20-person team was previously needed, particularly for API partner tooling. The company's AI customer support bot now resolves 40% of issues without escalation, up from 33% earlier this year. Chesky also candidly noted that "no one has figured out AI for travel or e-commerce yet," citing chatbot weaknesses in comparison, direct manipulation, and multiplayer booking workflows. [7]

• GitHub detailed its defense-in-depth security architecture for agentic workflows in CI/CD pipelines. The layered model uses sandboxed ephemeral environments, read-only defaults, secret isolation through trusted proxies outside the agent boundary, constrained tool access, and full execution traceability. Eddie Aftandilian, Head of Platform Engineering at XBOW, noted: "These guardrails are what make it possible to bring agentic automation into real production repositories." The architecture treats prompt injection and privilege escalation as first-class risks for non-deterministic agent systems. [8]

• Cloudflare cut 1,100 jobs — roughly 20% of its workforce — citing AI efficiency gains. CEO Matthew Prince said the company no longer needs as many support roles, even as revenue hit a record high. The layoffs, Cloudflare's first at this scale, exemplify the emerging template in tech: record revenue, AI-driven headcount reductions, and market uncertainty about what comes next. [16]

Feature Update

• GitHub Copilot CLI v1.0.44 introduces hook bypass, multi-skill invocation, and prerelease updates. The release adds userPromptSubmitted hooks that can handle requests directly without making a model call — a significant extension point for custom CLI integrations. Slash commands can now appear mid-input with multiple skills invoked in a single message, and a new prerelease argument on copilot update and /update fetches the latest prerelease build. Bug fixes address shell command handling across all configurations, quota display for Free users, autopilot permission persistence after /clear, effort level switching via the /model picker, Ctrl+C hanging during permission prompts, and startup crashes from invalid URL entries in settings.json. The timeline now shows resolved models for rubber-duck sub-agents (e.g., Rubber-duck(claude-opus-4.7)). [2]

• GitHub Copilot SDK v1.0.0-beta.3 adds plan mode handlers, tracing diagnostics, and session telemetry controls. Applications can now register callbacks for exitPlanMode.request and autoModeSwitch.request from the Copilot runtime, giving full control over plan-mode transitions and automatic model switching after rate-limit events. The .NET, Python, and Rust SDKs gain structured diagnostic logs covering CLI startup, TCP connection, JSON-RPC timing, session lifecycle, and error paths. A new enableSessionTelemetry session option lets applications explicitly toggle the runtime's internal session telemetry. Bug fixes address C# enum deserialization failures and Rust binary tool result MIME types. [3]

• Claude Code v2.1.136 ships auto mode hard deny rules and over 50 bug fixes. The release adds settings.autoMode.hard_deny for classifier rules that block unconditionally regardless of user intent, and CLAUDE_CODE_ENABLE_FEEDBACK_SURVEY_FOR_OTEL for enterprise feedback surveys via OpenTelemetry. Major fixes address MCP servers disappearing after /clear in VS Code, JetBrains, and the Agent SDK; MCP OAuth refresh token races causing daily re-authentication; a login loop from concurrent credential writes; --resume/--continue failures with underscored project paths; and plan mode incorrectly allowing file writes with matching Edit allow rules. WSL2 image paste from Windows clipboard now works via PowerShell fallback. Dozens of additional fixes improve slash command dialogs, CJK terminal rendering, plugin lifecycle management, and fullscreen mode behavior. [17]

• OpenAI Codex v0.130.0 introduces codex remote-control and plugin sharing with discoverability. The new codex remote-control command provides a simpler entrypoint for starting a headless, remotely controllable app-server — a key building block for autonomous agent workflows. Plugin details now show bundled hooks, and plugin sharing exposes link metadata plus discoverability controls. App-server clients can page large threads with unloaded, summary, or full turn item views. Bedrock auth now supports AWS console-login credentials from aws login profiles, and view_image resolves files through selected environments for multi-environment sessions. Bug fixes address live thread config reload, turn diff accuracy across apply-patch operations, and Windows sandbox user access. [5]

• GitHub deprecates Grok Code Fast 1 across all Copilot experiences on May 15, 2026. The deprecation is accelerated due to the model provider's own retirement timeline. Suggested alternatives are GPT-5 mini and Claude Haiku 4.5. Enterprise administrators should enable access to alternative models through Copilot model policies before the cutoff date. [10]

• GitHub deprecates GPT-4.1 across all Copilot experiences on June 1, 2026. The model will be removed from Copilot Chat, inline edits, ask and agent modes, and code completions. The suggested alternative is GPT-5.5. [9]

• Copilot code review comment types are now available in the usage metrics API. A new copilot_suggestions_by_comment_type array reports aggregated counts by category, including total suggestions and applied suggestions per type. The breakdown is available in single-day and 28-day rolling window reports at enterprise and organization levels. [18]

• Copilot cloud agent gets dedicated "Agents" secrets and variables at the organization level. Previously, secrets and variables had to be configured one repository at a time in a copilot environment under Actions settings. The new "Agents" type sits alongside "Actions", "Codespaces", and "Dependabot", enabling organization-level configuration shared across repositories with per-repo access controls. [4]