Welcome back. As the number of agent-run cyber attacks grow, every dev team is wondering if we can truly trust agents. OpenAI’s answer is yes. They just unveiled a new model for engineering teams to catch security vulnerabilities in your codebases (and teams are already using it).

Also: An insider look into Cloudflare’s engineering interview, Spotify’s new tool to run coding sessions across Claude Code and Codex, and Meta’s new model that runs on your Mac.

OpenAI ships a new model to combat growing AI cyberattack concerns: As a part of its Daybreak program, the ChatGPT maker just rolled out GPT-5.6-Cyber. This model is designed to be more flexible for cybersecurity research. The company says the model has already helped find real flaws in a popular database, an OS kernel, and Chrome's V8 engine. You can apply to join the program now.

Anthropic locks Sonnet 5 pricing while quietly watermarking AI-generated text: The AI lab just officially locked Sonnet 5's pricing at $2 per million input tokens and $10 per million output tokens. The lab also introduced invisible watermarks in Claude-generated text to comply with EU transparency regulations. This decision has sparked major backlash from the developer community, with one dev questioning why a paid plan would include hidden marks within their codebase. See the reaction.

Meta's new model offers a glimpse into Zuckerberg's vision: In a rare personal essay, Meta's CEO argues that everyone should have access to superintelligence. He urges the U.S. to embrace open source, contending that AI developed under a tight concentration of power is fundamentally problematic. He published the essay on the same day the company dropped Muse Glimmer, a 30B model that runs local agents on a single consumer GPU. Check out this prompting guide to get started. 

Your dev stack got an AI upgrade everywhere except the input layer. You're still typing every prompt, every ticket, every review comment by hand.

Wispr Flow closes that gap. Dictate into Cursor, VS Code, Slack, Linear, or anywhere else you work. It's syntax-aware: camelCase, snake_case, acronyms, and file names all come through clean. Mention a file in Cursor or Windsurf, and it auto-tags.

It's the voice layer for an AI-native workflow. Speak your intent. Your tools do the rest.

Available on Mac, Windows, iPhone, and Android. Used by millions of developers, including teams at OpenAI and Mercury.

Try free

The contradiction is real. Most engineering teams have jumped on the AI bandwagon, but very few are actually seeing a real bump in productivity. A former Meta engineer, Vasuman Moza, who now runs an AI agency, argues that a rollout doesn't guarantee adoption. He makes a valid point: one of his clients deployed Claude Cowork to thousands of employees, only to find that productivity barely budged. 

On paper, AI adoption is skyrocketing. But in reality, teams usually fall into three camps: power users (who daily-drive AI by chaining skills and connectors), casual users, and the silent majority who barely touch it. 

Ahead or behind. You don’t need to become a power user overnight. The bigger win is simply using agents more and using them better. Responding to Moza, Google’s engineering leader Addy Osmani breaks down what each group should do next:

Stop counting logins. For engineering teams, a better metric is how much work is still manual, hybrid, or fully automated. Find the power users, give them room to share what they build, and put agents inside the systems people already use so adoption doesn’t depend on learning another tool.

PS: If you’re a dev looking to use AI more effectively, our engineering team put together a Claude Code guide to help you ship 5x faster. For engineering teams, Vasuman’s full thread goes deeper.

How a senior engineer decides when to use Claude or GPT: You'll learn how to select and combine the best AI models and tools for your coding workflow. This senior engineer breaks down how to choose between options like Claude and GPT based on prompt precision, code quality, and how to orchestrate multi-agent setups effectively.

Xirp (by Spotify): An agentic development environment that manages your sessions across Claude Code, Gemini CLI, and OpenAI’s Codex. Already used by developers at Spotify, it’s now available for you to try. 

7 rules for self-improving agent loops (by Google): Self-improving AI loops often game shallow metrics, optimizing for high scores without actually delivering better real-world performance. This guide provides seven practical rules for engineers to define custom, rock-solid evaluation standards that keep autonomous optimization loops honest and on track. 

Codex's /goal command keeps the agent working toward one objective across multiple turns. This works great until the goal is too vague. For example, if you tell it to "improve the checkout flow," it burns through quota just trying to figure out what "improve" actually means.

To fix this, an engineer recommended using OpenAI's official "define-goal" skill. This automatically rewrites loose objectives into something verifiable before Codex locks them in. 

It rejects vague goals like "keep investigating." Instead, it asks a clarifying question whenever the answer changes the outcome. It then establishes a goal with a defined scope, acceptance criteria, and a verify command.

P.S. Get 50+ AI coding hacks for Claude Code, Cursor, and Codex here.

Check out this repo that provides a library of slash commands designed to guide AI coding agents using senior engineering practices for planning, specs, implementation, and reviews.

Grow customers & revenue: Join companies like Google, IBM, and Datadog. Showcase your product to our 300K+ engineers and 150K+ followers on socials. Get in touch.

You can also reply directly to this email if you have suggestions, feedback, or questions.

Until next time — The Code team