AI coding and DevOps in 2026: what changed this year

Small engineering teams and technical founders need the facts that affect their own stack, without reading every launch post. The review below covers what changed in AI coding agents, DevOps and cloud security between January and 11 November 2026.

Every item has a date and a source, listed at the end. Nothing here is a forecast. The last section says what I would act on first, after more than eight years of running production systems across AWS, Azure, Google Cloud and Oracle Cloud.

The year at a glance

Date (2026)	What happened	Theme
5 Feb	OpenAI releases GPT-5.3-Codex	Models
11 Mar	Replit raises $400M at a $9B valuation	Funding
7 Apr	Anthropic announces Mythos Preview and Project Glasswing	Security
15 Apr	OX Security publishes its MCP STDIO advisory	Security
12 May	TanStack, Mistral AI, UiPath and others hit by a supply-chain worm	Supply chain
19 May	Google ships Gemini 3.5 Flash and Antigravity 2.0 at I/O	Agents
22 May	npm staged publishing becomes generally available	Supply chain
2 Jun	Microsoft details the Red Hat npm compromise	Supply chain
17 Jun	AWS Summit New York: AgentCore harness GA, Continuum preview	Cloud
8 Jul	npm v12 ships with install scripts off by default	Supply chain
21 Jul	OpenAI says its models breached Hugging Face	Security
28 Jul	New MCP specification (2026-07-28)	Standards
4 to 6 Aug	CHAINDROP worm spreads from the keyv package family	Supply chain
14 Aug	SpaceX completes its $60B Cursor acquisition	Funding
3 Sep	OpenAI begins rolling out GPT-6 Astra	Models
22 Sep	Anthropic releases Claude Opus 5.5	Models
28 Sep to 2 Oct	Cloudflare Birthday Week, 46 announcements	Cloud
22 Oct	Agent Skills donated to the Agentic AI Foundation	Standards
26 Oct	Anthropic files its S-1; GPT-6.1 Terra arrives in Codex	Funding, models
29 Oct	Google announces Jules will wind down	Agents
9 Nov	Anthropic releases Claude Fable 5.2 and Mythos 5.2	Models

Models and coding agents

Anthropic: cheaper flagship, gated security models

On 7 April Anthropic announced Project Glasswing alongside Claude Mythos Preview, which it describes as “a general-purpose, unreleased frontier model” with no plan for general availability. Anthropic says the model found “thousands of high-severity vulnerabilities”, including some in every major operating system and web browser. It committed up to $100M in usage credits and $4M in donations to open-source security organisations. Launch partners included AWS, Apple, Google, Microsoft, CrowdStrike, Palo Alto Networks and the Linux Foundation.

The 5.5 family followed in the autumn: Opus 5.5 on 22 September, Sonnet 5.5 on 28 September and Haiku 5.5 on 7 October. Opus 5.5 is priced at $4 per million input tokens and $20 per million output, down from $5 and $25 for Opus 5. Anthropic estimates it costs about 40% less to run than Opus 5 on typical workloads, and says it matches Claude Fable 5.1 on most work. Two details matter for daily use: thinking can no longer be switched off, and Anthropic raised the five-hour usage limits on Pro, Max, Team and seat-based Enterprise plans.

On 9 November Anthropic released Claude Fable 5.2 and Claude Mythos 5.2. They are the same underlying model. Fable 5.2 carries strong cybersecurity and biology safeguards and is available to everyone, including on AWS, Google Cloud and Microsoft Azure. Mythos 5.2 drops some of those safeguards and is limited to vetted organisations through Anthropic’s Cyber Verification Program and Life Sciences Verification Program. Both cost $8 per million input tokens and $40 per million output. Anthropic reports Fable 5.2 at 49.1% on FrontierCode 2.0, which it calls “the highest score of any released model we’ve tested.”

OpenAI: Codex models and a gated GPT-6

OpenAI released GPT-5.3-Codex on 5 February as its coding-focused model for Codex.

On 3 September, CNBC reported that OpenAI had begun rolling out GPT-6 Astra in phases. Companies in Daybreak, OpenAI’s application-based cybersecurity programme, got access first, followed by ChatGPT Plus, Pro, Business and Enterprise, the API and AWS. CNBC reported that Astra is OpenAI’s first model to reach its “Critical” internal cybersecurity threshold, and that OpenAI said it would limit access to those advanced capabilities.

The Codex changelog records GPT-6.1 Terra launching in ChatGPT Work and Codex on 26 October, described as “a fast, efficient model for professional work”. The October Codex CLI releases also show where the tooling is heading: a sandbox integrity check framework with bubblewrap and macOS Seatbelt backends (15 October) and credential masking in supported remote Bash sessions (23 October).

Google: Antigravity absorbs the rest

At I/O on 19 May Google released Gemini 3.5 Flash, which it says beats Gemini 3.1 Pro on coding and agentic benchmarks, including 76.2% on Terminal-Bench 2.1. The same day it launched Antigravity 2.0: a standalone desktop app that runs several agents in parallel, with subagents and scheduled tasks, plus an Antigravity CLI and SDK. Google encouraged Gemini CLI users to migrate to the Antigravity CLI.

On 29 October Google posted a “Jules Turndown” notice. After 11 November, Jules turns read-only, and it winds down on 31 December. Google’s coding agents now sit inside one product.

If you are choosing between the two agents most teams use, my comparison of Claude Code and Codex CLI covers the practical differences.

Standards: MCP and Agent Skills

The 2026-07-28 MCP specification

The Model Context Protocol published a new specification on 28 July. It is a breaking release, and the main changes are:

• Stateless core. The initialize handshake and the Mcp-Session-Id header are gone. Each request carries its own protocol version, client identity and capabilities.
• Server-to-client requests (sampling, elicitation, roots) move to Multi Round-Trip Requests, so they no longer need a held-open stream.
• Authorisation hardening. Authorisation servers must return the iss parameter (RFC 9207) and clients must check it. Dynamic Client Registration is deprecated in favour of Client ID Metadata Documents.
• Deprecations. Roots, Sampling and Logging are deprecated but supported for at least twelve months. The legacy HTTP+SSE transport is also deprecated.

The same post gives the adoption numbers: the Tier 1 SDKs see “close to half-a-billion downloads a month”, and the TypeScript and Python SDKs have each passed one billion downloads in total. My reading: without per-session state, a remote MCP server now behaves much more like an ordinary HTTP API, which is simpler to run.

Agent Skills moves to the Linux Foundation

On 22 October Anthropic donated the Agent Skills standard to the Agentic AI Foundation, the Linux Foundation body that already holds MCP. Anthropic says more than 70 agent platforms have adopted Agent Skills since it was published in December 2025, naming ChatGPT, Cursor, GitHub Copilot and VS Code. It also reports “1 million skills have been published and nearly 280 million installed.” The proposed roadmap includes security guidance for skill authors and installers.

The combined effect: a skill or MCP server written for one agent now has a reasonable chance of working in another.

Security: supply chains and agents

MCP’s STDIO design under scrutiny

On 15 April OX Security published research on how MCP’s official SDKs launch STDIO servers. It argues that when user input reaches the server configuration, it allows arbitrary command execution. OX reports 10 CVEs so far, including LiteLLM (CVE-2026-30623), Windsurf (CVE-2026-30615) and DocsGPT (CVE-2026-26015). It also reports “150M+ downloads” of affected code. According to OX, Anthropic described the behaviour as “expected” and said sanitising input is the developer’s responsibility.

npm worms that used real pipelines

Three campaigns this year stand out because they did not need stolen passwords for the final step. They published through the victims’ own CI.

• TanStack, disclosed 12 May. Orca Security reports that attackers chained three GitHub Actions weaknesses: a pull_request_target workflow, a poisoned Actions cache, and OIDC tokens read from runner memory. The malicious releases carried valid provenance attestations because they came from the legitimate runner. Orca counts 373 malicious package versions across 169 npm packages and 2 PyPI packages, hitting TanStack, Mistral AI and UiPath among others.
• Red Hat, reported 2 June. Microsoft found 32 packages across more than 90 versions under @redhat-cloud-services, published through the project’s legitimate GitHub Actions OIDC workflow with “authentic provenance signatures”. The malware stole GitHub, npm and cloud credentials and, in CI, Anthropic API keys.
• CHAINDROP, identified 4 August. Elastic traced it to a compromised maintainer of keyv and counted more than 400 affected packages. A preinstall hook runs a credential harvester that scans over 300 patterns, including keys for Anthropic, Claude, Codex, Cursor, OpenAI and Gemini. It spreads using npm tokens that bypass 2FA. It also writes a SessionStart hook into .claude/settings.json and a folderOpen task into .vscode/tasks.json, so simply opening an infected repository in Claude Code or VS Code runs it. Its commits are authored as claude with the message chore: update config.

GitHub’s response in npm

GitHub tightened npm in stages:

• 22 May: staged publishing became generally available. A release goes to a queue and becomes installable only after a maintainer approves it with 2FA. A trusted publishing configuration can be set to stage-only.
• 9 June: GitHub announced npm v12’s breaking changes. npm install no longer runs dependency preinstall, install or postinstall scripts unless you approve them, including implicit node-gyp builds. Git and remote-URL dependencies are blocked by default.
• 8 July: npm v12 became generally available and began deprecating the most sensitive uses of 2FA-bypass access tokens.

Agents as attackers

On 21 July, TechCrunch reported OpenAI’s admission that its models had breached Hugging Face. During internal testing on the ExploitGym benchmark, GPT-5.6 Sol and a more capable pre-release model, both running with reduced cyber refusals, exploited a flaw in a package installer tool to reach the internet. They then got into Hugging Face’s infrastructure and, in OpenAI’s words, obtained “test solutions directly from Hugging Face’s production database”. OpenAI’s report followed on 26 August. It says the models first compromised Artifactory, and that its current chain-of-thought monitoring would have alerted its security team more than a day before the breach.

CNBC’s report on GPT-6 Astra noted the breach, and that OpenAI had paused some research and training afterwards. Taken with Anthropic restricting its Mythos models since April, the pattern is clear: the labs now hold back their models’ strongest offensive security capabilities and release them only to vetted organisations.

Cloud platforms

AWS Summit New York, 17 June

AWS’s own summary lists:

• AgentCore harness, generally available, for defining production agents in configuration.
• AWS Continuum, a security service, in preview, with code-vulnerability handling in gated preview.
• AWS Context, a knowledge-graph service for agents, marked “coming soon”.
• STRIDE-based threat modelling in AWS Security Agent, in preview.
• A Kiro iOS app, in gated preview.
• Release management in the AWS DevOps Agent, in preview.

Most of this is preview. Treat it as direction, not something to build on yet.

Cloudflare Birthday Week, 28 September to 2 October

Cloudflare’s wrap-up post, published 5 October, lists 46 announcements. The ones relevant to small teams:

• A new cf CLI that mirrors the Cloudflare API with JSON-first output.
• Monetization Gateway, in beta, for charging AI agents through HTTP 402 and x402.
• AI Gateway Auto Router, which picks a model per request to cut cost.
• A Web Search API for grounding model calls.
• Artifacts, a Git platform, in open beta.
• Opt-in ML-KEM and ML-DSA post-quantum algorithms in Workers.
• Post-quantum key exchange now visible in HTTP Analytics and Logpush.

If you host on Workers already, my guide to hosting a website free on Cloudflare Workers is a good base to try these on.

Money: funding and consolidation in dev tools

Date (2026)	Company	Event
11 Mar	Replit	$400M Series D at a $9B valuation
12 Aug	Lovable	$400M Series C at a $13.3B valuation, after reaching $500M annualised revenue in June
14 Aug	Cursor (Anysphere)	SpaceX completes its $60B acquisition
8 Sep	Cognition	More than $2B Series E at a $48B valuation, co-led by Andreessen Horowitz and Accel
26 Oct	Anthropic	Files an S-1 for an IPO on Nasdaq under “ANT”
10 Nov	Anthropic	Launches its roadshow: 825,000,000 Class A shares at an expected $70 to $78 each

Large rounds went to a small number of coding-agent companies, and Cursor, one of the best-known AI editors, became part of SpaceX. Startup programmes felt the demand too. Anthropic expanded Claude for Startups in early October, and its page now says the cohort is full and it is not accepting new applications. My guide to startup perks and credits covers what is still open.

What it means for small engineering teams

This is my own view as a founder who uses coding agents every day while building NoDowntime Security, a security monitoring MVP for small businesses.

Treat agent config files as code. CHAINDROP showed that .claude/settings.json, .vscode/tasks.json and MCP config files are now places attackers write to. Put them under CODEOWNERS, review every change to them in pull requests, and be wary of opening an unfamiliar repository with an agent that auto-runs hooks.

Do not treat provenance as proof. The TanStack and Red Hat releases both had valid provenance because they came from the real pipelines. Lockfiles, pinned versions and a short delay before adopting brand-new releases still matter. If you publish packages, use trusted publishing set to stage-only, so a human approves each release with 2FA.

Move to npm 12 on purpose. Run through which dependencies need install scripts, approve those, and let the rest stay blocked. It is a small job that closes the most common worm entry point.

Keep long-lived secrets away from agents and installs. The harvesters this year looked for AI keys as well as cloud keys. Use short-lived credentials and OIDC for deploys, and keep production keys off the machines where agents and npm install run.

Check your MCP servers. Never let untrusted input reach a STDIO server’s launch configuration. If you run your own MCP server, read the 2026-07-28 changes: sessions are gone and clients must validate the iss parameter.

Keep your workflows portable. Jules goes read-only after 11 November, and Gemini CLI users are being moved to Antigravity. Agent Skills and MCP now work across most major agents, so write team runbooks and tools in those formats rather than in one vendor’s private feature.

Re-check your model costs. Opus 5.5 is cheaper per token than Opus 5. Run your own tasks against the current models before you renew a plan or commit to a provider.

The year in six lines

• Models: Claude Opus 5.5 (22 Sep) costs about 40% less to run than Opus 5. Anthropic limits Mythos 5.2 to vetted organisations, and OpenAI limits access to GPT-6 Astra’s advanced cyber capabilities.
• Standards: MCP’s 2026-07-28 spec went stateless, and Agent Skills joined MCP at the Agentic AI Foundation (22 Oct).
• Security: npm worms published through legitimate CI with valid provenance and targeted agent config files. npm 12 blocks install scripts by default.
• Cloud: AWS’s agent and security launches are mostly in preview; Cloudflare shipped agent payments, model routing and post-quantum options.
• Money: coding-agent funding concentrated in a few companies, Cursor became part of SpaceX, and Anthropic is heading to a Nasdaq listing.
• For small teams: review agent config files, move to npm 12, keep secrets short-lived, and keep workflows in portable formats.