1Password lets agents log in without passwords

Welcome back. Starting with the good news, your AI agents can now finally log in without seeing your passwords, and Canva has dropped a brand-new AI model for you to test out. At the same time, October has turned into a cybersecurity mess. Major attacks keep piling up, and even major U.S. banks are struggling to tell legit agents from rogue ones. 

Also: A senior dev breaks down all you need to know about harnesses, the "Quiet Volunteer" fighting off PHP attacks, and a plan that every software engineer should prioritize right now. 

1Password lets agents log in without seeing your passwords: The password manager just launched 1Password which works with Anthropic’s Claude Duet, OpenAI’s Dots and ChatGPT Work, Grok Bot, Meta’s Muse, and Town’s assistants. When an agent needs to log in somewhere, 1Password verifies its identity with a unique digital key and sends you an approval request. Once you approve it, 1Password fills in the credentials behind the scenes, so the agent can get on with the task without ever seeing your password. Get on the waitlist here.

Canva builds its own image model for devs: The design platform just rolled out Canva Craft, its first image model trained from scratch. Instead of generating straight from your prompt, it plans the layout and text, then renders at up to 2K across 30+ aspect ratios. Canva claims that planning ahead delivers sharper details, legible text, and cleaner edits. You can easily plug Craft into ad builders or e-commerce workflows through Canva's public API, and agent support via Canva MCP is rolling out soon. Try it here.

Microsoft says China-linked hackers used AI to orchestrate attacks: The Windows maker says attackers used ARTEX, an open-source AI security-testing tool, to break into IT firm ConnectWise. Their agents then hijacked ConnectWise’s trusted apps to try logging into 2,250+ customer environments, gaining high-level access at some within three hours. U.S. banks are also reportedly finding unauthorized third-party agents inside customer accounts, mostly let in by customers sharing their own logins, and some taking actions the customer didn't ask for.

Growing Postgres databases eventually hit a wall: queries slow, dashboards lag, and adding another database starts to feel inevitable.

Tiger Data keeps Postgres fast as your data grows with time-series primitives, columnar storage, and automatic partitioning. Same SQL and tooling. No pipelines or second system.

Just Postgres, built to scale with your workload.

Start building for free today. No credit card needed.

Thirty thousand changes a day. Claude writes roughly 90% of Claude Code's own code, so how does the team review it all? They just shared their exact playbook. Anthropic saw daily changes in its monorepo jump from 2,500 in May to over 30,000 in September. Merged pull requests for Claude Code more than doubled between June and September, and the revert rate dropped by more than 40%. 

Reading every line is only a proxy. The real question is what could break and which check will catch it. Here’s what to borrow:

You still need engineers making the big calls. Humans decide what gets built and review billing, CI, the auto-updater, and architecture others will copy. Safeguards that tighten reviews as reverts rise don’t exist yet. And this is Anthropic grading its own tooling.

P.S. If you’re ready to try it start here and have Claude verify its work before every PR, then add the open-source security review action, turn on Code Review and finally tune it with a REVIEW.md.

Deepgram Flux TTS reads the whole conversation rather than isolated text strings, keeping agent speech natural across multi-turn calls, while offering time to first audio as low as 80ms and native interruption handling out of the box.

Test custom scripts, adjust speed & expressivity parameters, and sample 36 voices in real time directly in the Flux TTS Playground.

Test it on your stack.

How to build your own pstack for shipping with agents: This tutorial breaks down the workflow inspired by SpaceX AI/Cursor engineer Lauren Tan’s setup for shipping thousands of PRs. You’ll see how to combine playbooks, reusable skills, subagents, role definitions, and verification loops, then use the whole stack on a real feature instead of just another demo.

Reylo: Import .SQL files straight into TypeScript and get full type inference without an ORM or codegen step. It runs on TypeScript 7.1's new content mappers (still in beta), from Zod creator Colin McDonnell. Reylo checks your queries against the real database schema, catches bad columns or parameters in your editor, and keeps agents from leaving stale types behind when they change SQL.

How to structure Markdown files for better coding agents (by Google Cloud): This guide shows how to split your agent instructions across AGENTS.md for project context, DESIGN.md for UI rules, and SKILL.md for repeatable workflows. The idea is simple: give agents the right context at the right time so they waste fewer tokens, make smaller diffs, and stick more closely to how your codebase actually works.

Auto mode is Claude Code’s default, but the classifier doesn’t know your environment yet. It blocks routine actions, like pushing to another repo in your org or hitting an internal domain. Daniel San, Head of AI at Hedgineer, shared the setup that fixes it.

Claude scans your project, recent sessions, and optionally your shell history, then asks a few questions and drafts trusted repos and domains for your config.

A Chinese creator put Apple’s foldable iPhone Duo through 10,000 folds and extreme stress tests and showed exactly how it holds up.

Grow customers & revenue: Join companies like Google, IBM, and Datadog. Showcase your product to our 350K+ engineers and 150K+ followers on socials. Get in touch.

We put together a few guides on coding agents, agentic engineering, and leadership frameworks to help you level up in your career. Browse all our guides.

You can also reply directly to this email if you have suggestions, feedback, or questions.

Until next time — The Code team