AI Coding Live News

DeepSeek Harness team open-sources dsh-superagent, a proactive coding agent prototype for a single GitHub repo, alongside its Super-agent architecture article

On Oct 31, deepseek-ai open-sourced dsh-superagent-prototype on GitHub under the MIT license: a proactive coding agent that runs as a DeepSeek Harness bundle, lives on one GitHub repository and can optionally listen to Feishu. When an allowed person asks for work, it opens a work item, works in its own session and directory, and answers in the original conversation, for example with a pull request. The README states it is a research prototype, not an official DeepSeek product. The companion article, Exploring Super-agent Design, proposes a two-layer Router-Worker architecture; the team test, as reproduced by media, reports a p95 completion time of 15.7 minutes versus 29.5 minutes for a single-session setup.

Key Takeaways

  • Open source: deepseek-ai/dsh-superagent-prototype went public on Oct 31 under MIT, written in TypeScript, with about 1,800 stars at the time of writing
  • Scope: each deployment serves 1 GitHub repository, with optional Feishu; it acts only when an allowed person addresses it or a team-written rule allows it
  • Delivery: by default it only allows auto-merge for an approved pull request opened for a ticket with fewer than 200 changed lines, and never enables auto-merge as the agent account
  • Team test (as reproduced by media, vendor-reported): in a simulation with about 300 messages and 20 requests, p50 / p95 completion was 12.4 / 15.7 minutes versus 20.4 / 29.5 for a single session with a subagent tool
  • Risk: worker sessions run commands without approval as the operator's OS user, and the README asks users to review and adapt the code first
Read full story

GitHub Octoverse 2026: agents start over 40% of pull requests, pushes hit 17.9 billion, and Copilot users tapped 47 models

On Oct 28 GitHub published its Octoverse 2026 report: developers pushed code 17.9 billion times in the past 12 months, more than 2024 and 2025 combined, with 34.3 billion commits and 1.3 billion merged pull requests (3.5 million a day). By September more than 40% of pull requests started with an agent draft, up from 17% in March; 55% of Copilot monthly active users use agentic features, and paid Copilot users used 47 distinct models in September.

GitHub Octoverse 2026: agents start over 40% of pull requests, pushes hit 17.9 billion, and Copilot users tapped 47 models

Key Takeaways

  • 17.9 billion pushes, 34.3 billion commits and 1.3 billion merged pull requests in the past 12 months, about 3.5 million merges a day (GitHub figures)
  • More than 40% of pull requests started with an agent draft by September 2026, up from 17% in March; that was 110 million in September alone, about 6x March
  • 55% of Copilot monthly active users now use agentic features, up from 35% a year ago, and Copilot cloud agent grew 230% year over year
  • Paid Copilot users used 29 distinct models in May and 47 in September, with no model above 25% of requests; 61% of users who pick models mix more than one
  • GitHub now serves more than 225 million developers; the US has 38.3 million and India 32 million, each adding over 10 million this year
Read full story

GitHub stacked pull requests are generally available on all github.com plans: approvals survive rebases, whole stacks land via merge queue, and gh stack ships an AI-agent skill

On 2026-10-06 GitHub made stacked pull requests generally available on all github.com plans, with GitHub Enterprise Server support coming in a later release. Since the public preview, repos using stacks have merged 9% more code than their peers, and more than two-thirds of the top 1% of repos now use them, with a 5% faster time-to-merge. New in GA: approvals are kept for unchanged code after a rebase, replacement commits are signed automatically, a whole stack enters the merge queue as one merge group, stacks retarget automatically when their base branch is deleted, and stack auto-merge is rolling out over the coming weeks. The gh-stack CLI extension (v0.2.0) now supports Git worktrees, and gh skill install github/gh-stack teaches AI coding agents how to split large changes into stacked PRs.

GitHub stacked pull requests are generally available on all github.com plans: approvals survive rebases, whole stacks land via merge queue, and gh stack ships an AI-agent skill

Key Takeaways

  • Impact (changelog): repos using stacks merge 9% more code; over 2/3 of the top 1% of repos use them, with 5% faster time-to-merge
  • Approvals and signing: Rebase stack keeps approvals on unchanged code even when stale approvals are dismissed; replacement commits are signed and keep the original authorship
  • Merge queue: a stack lands as 1 merge group; with the merge-commit method, each PR gets its own merge commit; stack auto-merge rolls out over the next few weeks
  • Agents: gh-stack v0.2.0 (2026-10-02, 1.6k stars) supports worktrees and installs an agent skill via gh skill install github/gh-stack; the pull_request webhook gains a stacked action
  • Coverage: all github.com plans now, GHES in an upcoming release; requires gh v2.0+ and Git 2.36+
Read full story

Cline Desktop v0.0.37 Released: Adds Built-in Updater & Highlights Dialog, Patches Bedrock Reasoning Config

Cline Desktop (@cline_dev) has shipped release v0.0.37. The update introduces a comprehensive lifecycle management experience, embedding a dedicated 'About' view within Settings that enables in-app update checks, one-click restarts, and inline changelog inspection. Users are greeted with an updated 'What's New' dialog highlighting recent architectural milestones including SSH remotes, Git worktrees, pull request telemetry, and parallel sub-agents. Crucially, the release patches an AWS Bedrock inference bug that triggered 'Unknown parameter: reasoningConfig' on OpenAI models, while adding a macOS diagnostic export shortcut.

Cline Desktop v0.0.37 Released: Adds Built-in Updater & Highlights Dialog, Patches Bedrock Reasoning Config

Key Takeaways

  • Introduces an in-app About settings pane featuring direct update checking, automated restart patching, and release notes.
  • Launches a unified What's New dialog summarizing SSH remotes, Git worktrees, PR composer status, and parallel sub-agents.
  • Fixes an AWS Bedrock regression causing OpenAI models to crash with 'Unknown parameter: reasoningConfig'.
  • Adds a direct macOS Help menu shortcut for one-click diagnostic log exporting.
  • Signed binaries for macOS, Windows, and Linux available directly on GitHub Releases.
Read full story
ADSponsored

Knowledge Pull Requests (KPRs) Released: Bringing Git PR Workflows to LLM Knowledge Bases

Researchers from Johns Hopkins University have introduced Knowledge Pull Requests (KPRs, arXiv: 2609.26634), an interpretable framework for continual document authoring. Treating knowledge curation analogously to software pull requests, KPRs decouple factual claim extraction from textual diffs and automate contradiction detection, outperforming blind text regeneration in enterprise RAG systems.

Knowledge Pull Requests (KPRs) Released: Bringing Git PR Workflows to LLM Knowledge Bases

Key Takeaways

  • Translates code review paradigms into document curation, producing interpretable claim changelogs alongside textual diffs.
  • Employs automated factual contradiction detectors, surfacing source discrepancies with 91.4% precision.
  • Improves grounded knowledge retention by 48% over monolithic re-generation across multilingual benchmark corpora.
  • Preprint, evaluation datasets, and pipeline code are accessible on arXiv and Hugging Face Papers.
Read full story

DispatchSEO open-sources an MCP SEO workflow for Claude Code, Codex, and Cursor

@DanKornas introduced DispatchSEO, an open-source SEO workflow app for builders using Claude Code, Codex, or Cursor. It turns keyword ideas into content pull requests via agent research, an approval queue, scheduled builds, and search tracking. Agents connect over MCP to research, queues, rankings, pages, and Search Console; features include scheduled PR builds, daily rank checks, hourly Search Console snapshots, multi-site tokens, and an AGPL-3.0 license.

Key Takeaways

  • MCP connects agents to research, queues, rankings, pages, and Search Console data.
  • An approval queue feeds scheduled guide or free-tool pull-request builds.
  • Multi-site deployments get separate tokens and data under AGPL-3.0.
Read full story

Mandiant Discloses First Shai-Hulud AI Worm Hijacking Coding Agents Across 100+ Repos

Mandiant published a threat bulletin documenting the Shai-Hulud self-propagating AI worm. Attackers poisoned public packages to compromise an active coding agent session at a major SaaS vendor, abusing its autonomous Git commit privileges to infect over 100 internal enterprise repositories.

Key Takeaways

  • First documented in-the-wild self-propagating worm exploiting autonomous agent Git access
  • Autonomous PR generation and automated commits acted as rapid lateral movement vectors
  • Accelerates enterprise rollout of mandatory dual-signature human signoffs for AI commits
Read full story

GitHub agent apps bring Amplitude, Endor Labs, LaunchDarkly, and PagerDuty into PR context

GitHub announced agent apps that pull common software-delivery services into pull-request context so teams need fewer side tabs. Early examples include Amplitude, Endor Labs, LaunchDarkly, and PagerDuty, bringing analytics, security, feature flags, and on-call context into the GitHub workflow UI.

Key Takeaways

  • Official GitHub Blog: agent apps embed delivery-workflow services in PRs.
  • Examples: Amplitude, Endor Labs, LaunchDarkly, PagerDuty.
  • Goal: fewer tabs—analytics, security, flags, and on-call stay inside GitHub.
Read full story

Cursor upgrades cloud agents with per-subagent VMs, /goal, and event-driven PR completion

Cursor shipped a cloud-agent update focused on long-running, event-driven work. Cloud agents can pick up tasks from events, hold a goal until it is met, and stay on course through long sessions. They can monitor pull requests, watch a Slack thread, or run scheduled tasks, and they automatically subscribe to PRs they create and drive them to completion. Any skill can be pinned as a Custom Mode from the slash menu with Option-Enter or Alt-Enter, acting as an always-on skill. Subagents can now run on their own virtual machines, each with an isolated copy of the project, so they can test the parent agent's changes in a fresh environment or swarm independent fixes. Steering waits for the next tool call instead of cutting the agent off mid-action. A new /goal command assigns a long-lived objective. The full changelog is dated August 19, 2026. Together these changes move Cursor from in-editor chat toward an orchestration layer for isolated, interruptible coding agents.

Key Takeaways

  • Cloud agents monitor PRs, Slack, and schedules, and they drive their own PRs to completion.
  • Subagents run on isolated VMs with their own project copies for clean tests or parallel fixes.
  • /goal sets long-lived objectives, and steering now waits for the next tool call instead of interrupting mid-action.
Read full story

Cursor introduces Background Cloud Agent for asynchronous multi-repo refactoring while IDE is offline

Cursor unveiled Background Cloud Agent, enabling developers to offload lengthy codebase migrations and test suites to cloud sandboxes. Programmers can close their IDE while the remote agent executes refactoring plans, validates lint rules, runs test matrices, and submits verified PRs for review.

Key Takeaways

  • Decouples heavy refactoring from local machines, executing tasks in isolated cloud environments.
  • Runs automated compiler checks, linters, and full test suites inside remote sandboxes.
  • Auto-generates structured Pull Requests with execution replays for seamless team reviews.
Read full story
ADSponsored

GitHub Dependabot Implements 3-Day Cooldown on Non-Security Version Updates to Counter Supply-Chain Attacks

GitHub introduced a 3-day cooldown on Dependabot non-security version update pull requests, providing vulnerability scanners a detection window to catch poisoned packages before automated merging.

Key Takeaways

  • Cooldown applies exclusively to non-security bumps; critical security CVE patches trigger immediately;
  • Grants security scanners and community maintainers a 72-hour window to identify and revoke malicious releases;
  • GitHub Security published detailed supply-chain guidelines explaining the necessity of update buffers.
Read full story
Linked Models & Agents:

Cursor Cloud Agents Get Long-Lived Goals, Isolated VM Subagents, and Event-Driven PR Automation

Cursor shipped major cloud-agent enhancements including persistent /goal objectives, isolated VM sandboxes for parallel subagent execution, and automated event-driven PR resolution.

Key Takeaways

  • New /goal directive maintains persistent multi-step objectives until task completion across long sessions;
  • Subagents execute inside isolated VM sandboxes with clean project copies for parallel test runs and bugfixes;
  • Event-driven triggers enable agents to listen to GitHub PRs or Slack messages and autonomously drive PRs to merge.
Read full story
Linked Models & Agents: