Gemini API Computer Use goes GA, OpenAI backs a shared robots.txt signal for AI training, Claude Code can block writes outside the working directory
Today's thread is putting locks on agents: Claude Code turns write scope into a hard switch, GitHub adds lockfiles for Actions dependencies, OpenAI explains how it monitors agents that overstep, and Gemini's screen-control tool reaches GA with default confirmation policies built in. On the website side, opting out of AI training is turning into one standard shared across providers.
The October 30 changelog entry says the Computer Use tool is generally available (GA) across the Interactions API and the GenerateContent API.
The docs list Gemini 4 Argon, Gemini 3.8 Flash (recommended), Gemini 3.5 Flash-Lite (low latency, lower cost) and Gemini 3 Flash Preview, covering browser, mobile and desktop environments.
The model returns UI actions such as clicks, typing and scrolling with an intent field; your client executes them and sends back a new screenshot, with coordinates normalized to 0–999.
Seven built-in safety policy categories require confirmation or block actions, such as financial transactions, communications, account creation and legal agreements, and responses carry a safety_decision; screenshot prompt-injection detection is opt-in and off by default.
Builder's takeGA means you can now talk about stability and SLAs, but the execution layer is still yours: get one fixed flow working with Playwright in a sandboxed container before wiring it into a product. The first thing I would do is turn on the prompt-injection check that ships off, and I would not casually use disabled_safety_policies to drop the confirmation policies; this fits last week's pattern of letting agents act while hard-coding the boundaries.
OpenAI will honor a shared robots.txt signal to help website operators communicate their AI training preferences.
The signal is aimed at all participating providers: a site writes it once and its training preference reaches every participating AI provider.
Builder's takeFor products like PandaClaws that publish content outward, this is a switch that belongs on the launch checklist: decide whether you want your site used for training, then set it once in robots.txt using the syntax the providers specify. Conversely, if your product crawls the web, start treating this signal as part of your crawl rules now instead of only honoring a few named user agents.
Adds permissions.blockWritesOutsideWorkingDirectories: when on, Write, Edit and NotebookEdit refuse paths outside the working directories in every permission mode.
Adds idle compaction to VS Code and Claude Desktop's Code tab: a 200K+ token conversation left idle is summarized, and the summary is used on the next message if the prompt cache has expired.
Fixes claude -p exiting with code 0 and no output when startup failed; it now prints the error and exits 1. When an admin caps a model's effort, it now lowers the effort, retries and says which level it uses.
Each PreCompact hook's output is now cut at 10,000 characters, so compaction no longer fails or repeats.
Builder's takeTeams running claude -p in CI should upgrade first: until now a failed startup still returned 0, so the pipeline counted a run that did nothing as a success. I would put the outside-the-working-directory write block into the team's managed settings and, together with the hook concurrency cap from the 10-28 issue, treat it as the baseline that keeps agents in bounds even in auto mode.
Built on NVIDIA Multi-Instance GPU (MIG), each GPU splits into up to 7 partitions, each with its own memory and compute.
You configure it when creating an endpoint that hosts inference components, and your application still calls each model by name.
AWS cites fine-tuned model variants, embedding models, rerankers and classifiers; supported instances are P4d, P5, G7 and G7e.
It launches in 7 Regions: N. Virginia, Ohio, Oregon, Singapore, Tokyo, Frankfurt and Ireland.
Builder's takeAI Cloud Drive's retrieval path is exactly this case, with a small embedding model and a small reranker each holding a whole card: put both on two partitions of one GPU, load-test latency, then check the bill. Note that partitions are hard-isolated with fixed memory each, so model size and concurrency have to be recalculated against the partition size.
OpenAI uses layered monitoring to detect frontier model misalignment and unauthorized agent behavior.
The goal is to let responders intervene before incidents escalate.
Builder's takeRead it alongside the new Model Spec from the day before: the spec says what should happen, monitoring catches when it does not. Agents in your product need both layers too; my minimum is a log for every side-effecting action plus an out-of-scope alert, rule-based or from a small model, so someone can stop things in time.
The gh actions-lock CLI extension generates .github/workflows/actions.lock covering actions and their transitive dependencies; Actions runs the locked commits even if tags or branches move.
Workflows are onboarded one at a time, admins can apply a Require lockfile policy at the enterprise, organization or repository level, and a non-modifying stale-lockfile check can run in CI.
Dependabot version updates for onboarded actions regenerate the matching lockfile entries in the same pull request.
GitHub notes that lockfiles guard against unexpected changes but do not show a dependency is safe, so review before locking.
Builder's takeRead with the LiteLLM poisoning in the 10-24 issue, the supply-chain problem now reaches CI itself. I would lock the workflows that hold secrets and publish first, like this site's own release flow, then turn on Require lockfile at the repository level rather than waiting for a full migration.
Choose Watch and fix in the pull request merge box, then pick whether Copilot handles failing workflows, merge conflicts or both.
When a selected blocker appears, Copilot fixes it in a cloud development environment; you can turn it on by default for all your PRs in Copilot settings.
It combines with auto-merge so GitHub merges once all requirements pass; it is for paid Copilot plans, subject to organization and enterprise policies.
Builder's takeMaking CI green is the easiest thing for an agent to do badly: skipping tests or loosening assertions also turns it green. Before turning it on, make test and workflow files require human review through branch protection, enable it by default only for low-risk PRs like dependency bumps, and widen the scope after two weeks of reading its changes.
Each automation combines prompts, triggers and tools, and Copilot runs it autonomously in the cloud with only the tools the team allows; example triggers are an issue opening, a PR marked ready and a production incident from a monitoring tool.
Anyone with read access can see a shared automation and anyone with write access can edit it; actions are attributed to Copilot, and change history tracks prompts, triggers and tools.
AI credits bill the organization or user that owns the repository; organization repositories need an admin to enable the Allow use of Copilot cloud agent billed to the organization policy.
It is rolling out to Copilot Pro, Pro+, Max, Business and Enterprise, and the type cannot be changed after creation.
Builder's takeOwnership moving from a person to the repository is the real change here: automations no longer leave with people, but the costs quietly land on the organization. Set an organization budget for the Copilot cloud agent before enabling the policy, and start with read-only flows such as an incident triggering an automatic investigation.
The npm package is @aws/agentcore 1.0.0, rebuilt for faster startup and a consistent command structure, covering more AgentCore resources.
You can use the project workflow or work directly with harnesses, runtimes, memory, identity, gateways and payments without adding them to a project first; existing resources can be invoked by ID or ARN.
Commands share global flags for region, JSON output, debugging and version; existing projects move to 1.0 with agentcore migrate.
Builder's takeJSON output plus invoking by ARN means agent deployment and checks can be handed to scripts, or even to a coding agent. If you are on the old CLI, run agentcore migrate in a test account before touching production, and pin to 1.0.x.
The GitHub Copilot SDK is being renamed the Microsoft Copilot SDK, the programmable interface to the Microsoft Copilot harness, the shared agent foundation across Microsoft and GitHub products.
The repository is planned to move to the Microsoft organization, with branding and docs updated; the migration happens in phases with no dates given.
Existing package names and namespaces stay for now, existing users need no immediate changes, and support is unchanged.
Builder's takeRead with the Copilot harness in Foundry from the 10-29 issue, Microsoft is turning GitHub's agent foundation into a company-wide platform. Teams that wired up the SDK with the server-to-server auth from the 10-28 issue should pin the version, watch the repository move announcement, and upgrade together on the day the package names actually change.
Researched and drafted with AI assistance; editorial standards and views set by Darius.
Every Monday, the week in AI in one email
Every Monday morning: the 6 AI stories that mattered most in the past seven days, with my take, in your inbox.
Your email is only used to send the weekly and is never shared. Every email has a one-click unsubscribe link. See the latest issue →