Unix

Lost Unix v4 Possibly Recovered on a Forgotten Bell Labs Tape From 1973 (theregister.com) 42

"A tape-based piece of unique Unix history may have been lying quietly in storage at the University of Utah for 50+ years," reports The Register. And the software librarian at Silicon Valley's Computer History Museum, Al Kossow of Bitsavers, believes the tape "has a pretty good chance of being recoverable." Long-time Slashdot reader bobdevine says the tape will be analyzed at the Computer History Museum. More from The Register: The news was posted to Mastodon by Professor Robert Ricci of the University of Utah's Kahlert School of Computing [along with a picture. "While cleaning a storage room, our staff found this tape containing #UNIX v4 from Bell Labs, circa 1973..." Ricci posted on Mastodon. "We have arranged to deliver it to the Computer History Museum."] The nine-track tape reel bears a handwritten label reading: UNIX Original From Bell Labs V4 (See Manual for format)...

If it's what it says on the label, this is a notable discovery because little of UNIX V4 remains. That's unfortunate as this specific version is especially interesting: it's the first version of UNIX in which the kernel and some of the core utilities were rewritten in the new C programming language. Until now, the only surviving parts known were the source code to a slightly older version of the kernel and a few man pages — plus the Programmer's Manual [PDF], from November 1973.

The Unix Heritage Society hosts those surviving parts — and apparently some other items of interest, according to a comment posted on Mastodon. "While going through the tapes from Dennis Ritchie earlier this year, I found some UNIX V4 distribution documents," posted Mastodon user "Broken Pipe," linking to tuhs.org/Archive/Applications/Dennis_Tapes/Gao_Analysis/v4_dist/.

There's a file called license ("The program and information transmitted herewith is and shall remain the property of Bell Lab%oratories...") and coldboot ("Mount good tape on drive 0..."), plus a six-page "Setup" document that ends with these words...

We expect to have a UNIX seminar early in 1974.

Good luck.
Ken Thompson
Dennis Ritchie
Bell Telephone Labs
Murray Hill, NJ 07974

Nintendo

'Nintendo Has Too Many Apps' (theverge.com) 18

The Verge's Ash Parrish writes: Nintendo has released a new store app on Android and iOS giving users the ability to purchase hardware, accessories, and games for the Switch and Switch 2. When I open my phone and scroll down to the N's, I get a neat, full row dedicated entirely to Nintendo. That's four apps: the Switch app, the music app, the Nintendo Today news app, and now the store. (The tally increases to five if you're a parent using the Switch Parental Controls app.) And it is entirely too much.

Nintendo has always been the one company of the big three publishers that does its own thing, and that's worked both for and against it. The company hasn't chased development trends with the same zeal as Microsoft and Sony. That insulates Nintendo when those trends don't pan out, like exorbitant spending on live-service games that fail. But also hurts it when it comes to performance and user experience. Console-native voice chat, for example, has been a standard on other platforms for a long time, but was only offered on a Nintendo console with the Switch 2 this year.

With the deployment of these apps, Nintendo is both trying to innovate and playing catch-up with results that feel confusing and overwhelming. Do we really need four distinct apps? That's not to say these apps shouldn't exist; they serve valuable and necessary purposes. But when I look at all the programs I have to manage in my Nintendo life, it just feels like it's too much...
Further reading: Nintendo Won't Shy Away From Continuing To 'Try Anything'
Businesses

Automattic Inc. Claims It Owns the Word 'Automatic' 53

An anonymous reader shares a report: Automattic, the company that owns WordPress.com, is asking Automatic.CSS -- a company that provides a CSS framework for WordPress page builders -- to change its name amid public spats between Automattic founder Matt Mullenweg and Automatic.CSS creator Kevin Geary. Automattic has two T's as a nod to Matt.

"As you know, our client owns and operates a wide range of software brands and services, including the very popular web building and hosting platform WordPress.com," Jim Davis, an intellectual property attorney representing Automattic, wrote in a letter dated Oct. 30.

"Automattic is also well-known for its longtime and extensive contributions to the WordPress system. Our client owns many trademark registrations for its Automattic mark covering those types of services and software," Davis continued. "As we hope you can appreciate, our client is concerned about your use of a nearly identical name and trademark to provide closely related WordPress services. Automattic and Automatic differ by only one letter, are phonetically identical, and are marketed to many of the same people. This all enhances the potential for consumer confusion and dilution of our client's Automattic mark."

United States

US Software Firm SAS Exits China After 25 Years (scmp.com) 27

An anonymous reader shares a report: US software company SAS Institute has withdrawn from mainland China and dismissed its local staff, according to a Beijing-based employee affected by the move, as the analytics specialist ended more than two decades of operations amid intense domestic competition and geopolitical tensions. The company on Thursday announced the lay-offs via an email and hosted a short video call, in which executives thanked local employees for their contribution and cited "organisational optimisation" for the exit, according to the employee.

"SAS is ceasing direct business operations in China," an SAS spokeswoman said on Friday in response to the Post's inquiry. "This decision reflects a broader shift in how we operate globally, optimising our footprint and ensuring long-term sustainability." The company would continue having a presence on the mainland via third-party partners, according to the spokeswoman.

Games

'Grand Theft Auto' Studio Says Fired Employees Were Leaking Information (msn.com) 32

Rockstar Games, the company behind the hit Grand Theft Auto franchise, said that the dozens of employees it fired last week were leaking company secrets, disputing allegations by labor leaders that it was disrupting workers' attempt to unionize. From a report: The employees had been sharing company information in a forum that included non-employees, a Rockstar spokesperson said in a statement to Bloomberg on Wednesday. "Last week, we took action against a small number of individuals who were found to be distributing and discussing confidential information in a public forum, a violation of our company policies," the spokesperson said. "This was in no way related to people's right to join a union or engage in union activities." The company, part of Take-Two Interactive Software, fired between 30 and 40 employees across offices in the UK and Canada for what it said was "gross misconduct." The Independent Workers' Union of Great Britain, the first to organize video-game workers in the UK, told Bloomberg that the employees had all been involved with union efforts at Rockstar, calling the firings "one of the most blatant and ruthless acts of union busting in the history of the games industry."
Hardware

Manufacturer Bricks Smart Vacuum After Engineer Blocks It From Collecting Data (tomshardware.com) 35

A curious engineer discovered that his iLife A11 smart vacuum was remotely "killed" after he blocked it from sending data to the manufacturer's servers. By reverse-engineering it with custom hardware and Python scripts, he managed to revive the device to run fully offline. Tom's Hardware reports: An engineer got curious about how his iLife A11 smart vacuum worked and monitored the network traffic coming from the device. That's when he noticed it was constantly sending logs and telemetry data to the manufacturer -- something he hadn't consented to. The user, Harishankar, decided to block the telemetry servers' IP addresses on his network, while keeping the firmware and OTA servers open. While his smart gadget worked for a while, it just refused to turn on soon after. After a lengthy investigation, he discovered that a remote kill command had been issued to his device.

He sent it to the service center multiple times, wherein the technicians would turn it on and see nothing wrong with the vacuum. When they returned it to him, it would work for a few days and then fail to boot again. After several rounds of back-and-forth, the service center probably got tired and just stopped accepting it, saying it was out of warranty. Because of this, he decided to disassemble the thing to determine what killed it and to see if he could get it working again. [...] So, why did the A11 work at the service center but refuse to run in his home? The technicians would reset the firmware on the smart vacuum, thus removing the kill code, and then connect it to an open network, making it run normally. But once it connected again to the network that had its telemetry servers blocked, it was bricked remotely because it couldn't communicate with the manufacturer's servers. Since he blocked the appliance's data collection capabilities, its maker decided to just kill it altogether.

"Someone -- or something -- had remotely issued a kill command," says Harishankar. "Whether it was intentional punishment or automated enforcement of 'compliance,' the result was the same: a consumer device had turned on its owner." In the end, the owner was able to run his vacuum fully locally without manufacturer control after all the tweaks he made. This helped him retake control of his data and make use of his $300 software-bricked smart device on his own terms. As for the rest of us who don't have the technical knowledge and time to follow his accomplishments, his advice is to "Never use your primary WiFi network for IoT devices" and to "Treat them as strangers in your home."

Privacy

The Louvre's Video Surveillance Password Was 'Louvre' (pcgamer.com) 90

A bungled October 18 heist that saw $102 million of crown jewels stolen from the Louvre in broad daylight has exposed years of lax security at the national art museum. From trivial passwords like 'LOUVRE' to decades-old, unsupported systems and easy rooftop access, the job was made surprisingly easy. PC Gamer reports: As Rogue cofounder and former Polygon arch-jester Cass Marshall notes on Bluesky, we owe a lot of videogame designers an apology. We've spent years dunking on the emptyheadedness of game characters leaving their crucial security codes and vault combinations in the open for anyone to read, all while the Louvre has been using the password "Louvre" for its video surveillance servers. That's not an exaggeration. Confidential documents reviewed by Liberation detail a long history of Louvre security vulnerabilities, dating back to a 2014 cybersecurity audit performed by the French Cybersecurity Agency (ANSSI) at the museum's request. ANSSI experts were able to infiltrate the Louvre's security network to manipulate video surveillance and modify badge access.

"How did the experts manage to infiltrate the network? Primarily due to the weakness of certain passwords which the French National Cybersecurity Agency (ANSSI) politely describes as 'trivial,'" writes Liberation's Brice Le Borgne via machine translation. "Type 'LOUVRE' to access a server managing the museum's video surveillance, or 'THALES' to access one of the software programs published by... Thales." The museum sought another audit from France's National Institute for Advanced Studies in Security and Justice in 2015. Concluded two years later, the audit's 40 pages of recommendations described "serious shortcomings," "poorly managed" visitor flow, rooftops that are easily accessible during construction work, and outdated and malfunctioning security systems. Later documents indicate that, in 2025, the Louvre was still using security software purchased in 2003 that is no longer supported by its developer, running on hardware using Windows Server 2003.

Security

Danish Authorities In Rush To Close Security Loophole In Chinese Electric Buses (theguardian.com) 43

An anonymous reader quotes a report from the Guardian: Authorities in Denmark are urgently studying how to close an apparent security loophole in hundreds of Chinese-made electric buses that enables them to be remotely deactivated. The investigation comes after transport authorities in Norway, where the Yutong buses are also in service, found that the Chinese supplier had remote access for software updates and diagnostics to the vehicles' control systems -- which could be exploited to affect buses while in transit.

Amid concerns over potential security risks, the Norwegian public transport authority Ruter decided to test two electric buses in an isolated environment. Bernt Reitan Jenssen, Ruter's chief executive, said: "The testing revealed risks that we are now taking measures against. National and local authorities have been informed and must assist with additional measures at a national level." Their investigations found that remote deactivation could be prevented by removing the buses' sim cards, but they decided against this because it would also disconnect the bus from other systems.

Ruter said it planned to bring in stricter security requirements for future procurements. Jenssen said it must act before the arrival of the next generation of buses, which could be even "more integrated and harder to secure." Movia, Denmark's largest public transport company, has 469 Chinese electric buses in operation -- 262 of which were manufactured by Yutong.
Jeppe Gaard, Movia's chief operating officer, said he was made aware of the loophole last week. "This is not a Chinese bus problem," he said. "It is a problem for all types of vehicles and devices with Chinese electronics built in."
Android

Smartphone Maker Nothing Retreats on Bloatware After User Backlash (androidauthority.com) 40

Nothing has announced that it will allow users to delete Facebook, Instagram and other Meta services from its mid-range and entry-level phones after users objected to the company's decision to pre-install these apps. The update will arrive by the end of November for devices running the Android 16-based OS 4.0 on the Phone (3a) series. Nothing said it will continue to pre-install partner apps on non-flagship devices in most regions.

Devices in the United Kingdom, European Union and Japan will also come with TikTok installed by default. The company defended the practice by saying most users rely on these apps and that pre-installing them allows faster cold starts. Carl Pei's company blamed razor-thin margins on mid-range devices for the decision to bundle third-party software. Nothing did not address whether users can uninstall the service that powers newly introduced lock screen advertisements, which the company previously described as disabled by default and standard across the industry.
Software

Apple Brings Its App Store To the Web (theverge.com) 15

Apple has officially launched a web-based version of its App Store that lets users browse apps across all Apple devices through a redesigned interface. "There's no way to download apps from the App Store on the web, however," notes The Verge. "Apple just gives you the option to share an app or open it directly inside the App Store installed on your device." From the report: Now, when you navigate to apps.apple.com, you'll see the revamped interface instead of a webpage that just contains information about the App Store. [...] Along with the ability to switch between listings of apps for the iPhone, iPad, Mac, Vision Pro, Apple Watch, and Apple TV, you can check out recommendations on the Today tab as well as sort apps by category, such as productivity, entertainment, adventure, and more. The new web-based App Store also serves as a portal where you can search for apps, too.
Privacy

Data Breach At Major Swedish Software Supplier Impacts 1.5 Million (bleepingcomputer.com) 6

A massive cyberattack on Swedish IT supplier Miljodata exposed personal data from up to 1.5 million citizens, prompting a national privacy investigation and scrutiny into security failures across multiple municipalities. BleepingComputer reports: MiljÃdata is an IT systems supplier for roughly 80% of Sweden's municipalities. The company disclosed the incident on August 25, saying that the attackers stole data and demanded 1.5 Bitcoin to not leak it. The attack caused operational disruptions that affected citizens in multiple regions in the country, including Halland, Gotland, Skelleftea, Kalmar, Karlstad, and Monsteras.

Because of the large impact, the state monitored the situation from the time of disclosure, with CERT-SE and the police starting to investigate immediately. According to IMY, the attacker exposed on the dark web data that corresponds to 1.5 million people in the country, creating the basis for investigating potential General Data Protection Regulation (GDPR) violations. [...] Although no ransomware groups had claimed the attack when Miljodata disclosed the incident, BleepingComputer found that the threat group Datacarry posted the stolen data on its dark web portal on September 13.
The leaked database has been added to Have I Been Pwned, which contains information such as names, email addresses, physical addresses, phone numbers, government IDs, and dates of birth.
Windows

Windows 10 Update Incorrectly Tells Some Users They've Reached End-of-Life, Despite Having Extended Support (tomshardware.com) 21

An anonymous reader shares a report: Microsoft officially ended mainstream support for Windows 10 last month, nudging users to upgrade to Windows 11. While that led to almost an overnight technological revolution in Japan, elsewhere, it has caused a lot of confusion. Certain versions of Windows 10, like Enterprise LTSC -- and those enrolled in the ESU program -- are still scheduled to receive security updates through at least 2027, but they're starting to see out-of-support messages in Settings.

Various users over the past few days reported that they're being subjected to end-of-life warnings in Windows, despite already qualifying for extended security updates through the ESU program. Windows 10 Enterprise LTSC 2021 and âIoT Enterprise are business-oriented editions of the OS, so they're already supported up to 2032, but even they saw these incorrect messages. This widespread bug started to occur after the KB5066791 updates were pushed on October 14, 2025.

Microsoft has already acknowledged this mishap and said, "The message, 'Your version of Windows has reached the end of support, might incorrectly display in the Windows Update Settings page," confirming it as a mistake. The company has already released a cloud config fix that should remove the message, but you need to be connected to the internet for that, and a restart is also required.

Businesses

IBM To Cut Thousands of Roles in Focus on Software Growth (reuters.com) 52

IBM will cut thousands of roles this quarter while it continues to shift focus to higher-growth software and services, Bloomberg News reported on Tuesday. From a report: "We routinely review our workforce through this lens and at times rebalance accordingly," Bloomberg quoted a company spokesperson saying. "In the fourth quarter we are executing an action that will impact a low single-digit percentage of our global workforce."
United States

What Happened When Small-Town America Became Data-Center, USA (msn.com) 48

Amazon's data-center expansion turned Umatilla, Oregon into an unlikely nerve center for American infrastructure investment. The community of roughly 8,000 residents has seen home prices double and local government budgets surge from $7 million in 2011 to a hundred and $44 million in the past fiscal year. Yesenia Leon-Tejeda, a Realtor and daughter of Mexican-born farmhands who once worked 12-hour shifts at a distribution center, is now on pace to close 35 deals this year.

Federal data shows investment in software and information-processing equipment drove most of America's GDP growth in the first half of 2025. Goldman Sachs estimated that roughly 72% of all server-farm capacity sat in just 1% of counties as of July. The region's hydroelectric dams and cheap power attracted Amazon Web Services more than a decade ago. Growth has brought rising costs for housing and child care. Political tensions over spending erupted this year when Mayor Caden Sipe sued the city manager and council members.
AMD

AMD Will Continue Game Optimization Support For Older Radeon GPU's After All (tomshardware.com) 27

An anonymous reader quotes a report from Tom's Hardware: After a turbulent weekend of updates and clarifications, AMD has published an entire web page to assuage user backlash and reaffirm its commitment to continued support for its RDNA 1 and RDNA 2-based drives, following a spate of confusion surrounding its recent decision to put Radeon RX 5000 and 6000 series cards in "maintenance mode." This comes after AMD had to deny that the RX 7900 cards were losing USB-C power supply moving forward, even though the drive changelog said something quite different.

Just last week, AMD released a new driver update for its graphics cards, and it went anything but smoothly. First, the wrong drivers were uploaded, and even after that was corrected, several glaring errors in the release notes required clarification. AMD was forced to correct claims about its RX 7900 cards, but at the time clarified that, indeed, RX 5000 and 6000 graphics cards were entering "Maintenance Mode," despite some RX 6000 cards being only around four years old. Now, though, AMD has either rolled back that decision or someone higher up the food chain has made a new call, as game optimizations are back on the menu for RDNA 1 and RDNA 2 GPUs.
"We've heard your feedback and want to clear up the confusion around the AMD Software: Adrenalin Edition 25.10.2 driver release," AMD said in a statement. "Your Radeon RX 5000 and RX 6000 series GPUs will continue to receive: Game support for new releases, Stability and game optimizations, and Security and bug fixes," AMD said.
IT

The Curious Case of the Bizarre, Disappearing Captcha (wired.com) 52

Captchas have largely vanished from the web in 2025, replaced by invisible tracking systems that analyze user behavior rather than asking people to decipher distorted text or identify traffic lights in image grids. Google launched reCaptcha v3 in 2018 to generate risk scores based on behavioral signals during site interactions, making bot-blocking technology "completely invisible" for most users, according to Tim Knudsen, a director of product management at Google Cloud.

Cloudflare followed in 2022 by releasing Turnstile, another invisible alternative that sometimes appears as a simple checkbox but actually gathers data from devices and software to determine if users are human. Both companies distribute their security tools for free to collect training data, and Cloudflare now sees 20% of all HTTP requests across the internet.

The rare challenges that do surface have become increasingly bizarre, ranging from requests to identify dogs and ducks wearing various hats to sliding a jockstrap across a screen to find matching underwear on hookup sites.
Games

Linux Gamers on Steam Finally Cross Over the 3% Mark (gamingonlinux.com) 68

"It finally happened," writes the GamingOnLinux site: Linux gamers on Steam as of the Steam Hardware & Software Survey for October 2025 have crossed over the elusive 3% mark. The trend has been clear for sometime, and with Windows 10 ending support, it was quite likely this was going to be the time for it to happen as more people try out Linux...

Overall, 3% might not seem like much to some, but again — that trend is very clear and equates to millions of people. The last time Valve officially gave a proper monthly active user count was in 2022, and we know Steam has grown a lot since then, but even going by that original number would put monthly active Linux users at well over 4 million.

Additional details from Phoronix: The only time Steam on Linux use was close to the 3% mark was when Steam on Linux initially debuted a decade ago and at that time the overall Steam user-base was much smaller than it is today. Long story short, thanks to the ongoing success of Valve's Steam Deck and other handhelds plus Steam Play (Proton) working out so well, these October numbers are the best yet... a hearty 0.41% increase to Linux... landing its overall marketshare at 3.05%. Windows meanwhile was at 94.84% (falling below 95% for the first time in a while) and macOS at 2.11%. For comparison, in October 2024 Steam on Linux was at 2.00%.

The Linux-specific data shows SteamOS commanding around 27% of all the Linux installs at large. SteamOS most notably being on the Steam Deck hardware.

Privacy

Manufacturer Remotely Bricks Smart Vacuum After Its Owner Blocked It From Collecting Data (tomshardware.com) 123

"An engineer got curious about how his iLife A11 smart vacuum worked and monitored the network traffic coming from the device," writes Tom's Hardware.

"That's when he noticed it was constantly sending logs and telemetry data to the manufacturer — something he hadn't consented to." The user, Harishankar, decided to block the telemetry servers' IP addresses on his network, while keeping the firmware and OTA servers open. While his smart gadget worked for a while, it just refused to turn on soon after... He sent it to the service center multiple times, wherein the technicians would turn it on and see nothing wrong with the vacuum. When they returned it to him, it would work for a few days and then fail to boot again... [H]e decided to disassemble the thing to determine what killed it and to see if he could get it working again...

[He discovered] a GD32F103 microcontroller to manage its plethora of sensors, including Lidar, gyroscopes, and encoders. He created PCB connectors and wrote Python scripts to control them with a computer, presumably to test each piece individually and identify what went wrong. From there, he built a Raspberry Pi joystick to manually drive the vacuum, proving that there was nothing wrong with the hardware. From this, he looked at its software and operating system, and that's where he discovered the dark truth: his smart vacuum was a security nightmare and a black hole for his personal data.

First of all, it's Android Debug Bridge, which gives him full root access to the vacuum, wasn't protected by any kind of password or encryption. The manufacturer added a makeshift security protocol by omitting a crucial file, which caused it to disconnect soon after booting, but Harishankar easily bypassed it. He then discovered that it used Google Cartographer to build a live 3D map of his home. This isn't unusual, by far. After all, it's a smart vacuum, and it needs that data to navigate around his home. However, the concerning thing is that it was sending off all this data to the manufacturer's server. It makes sense for the device to send this data to the manufacturer, as its onboard SoC is nowhere near powerful enough to process all that data. However, it seems that iLife did not clear this with its customers.

Furthermore, the engineer made one disturbing discovery — deep in the logs of his non-functioning smart vacuum, he found a command with a timestamp that matched exactly the time the gadget stopped working. This was clearly a kill command, and after he reversed it and rebooted the appliance, it roared back to life.

Thanks to long-time Slashdot reader registrations_suck for sharing the article.
Ubuntu

Bug in Rust-Based Uutils Broke Ubuntu 25.10 Automatic Update Checks (omgubuntu.co.uk) 52

"Ubuntu's decision to switch to Rust-based coreutils in 25.10 hasn't been the smoothest ride," writes the blog OMG Ubuntu, "as the latest — albeit now resolved — bug underscores." [Coreutils] are used by a number of processes, apps and scripts, including Ubuntu's own unattended-upgrades process, which automatically checks for new software updates. Alas, the Rust-based version of date had a bug which meant Ubuntu 25.10 desktops, servers, cloud and container images were not able to automatically check for updates when configured. Unattended-upgrades hooks into the date utility to check the timestamp of a reference file of when an update check was last run and, past a certain date, checks again. But date was incorrectly showing the current date, always.

A fix has been issued so only Ubuntu 25.10 installs withrust-coreutils 0.2.2-0ubuntu2 (or earlier) are affected.

Programming

GitHub Announces 'Agent HQ', Letting Copilot Subscribers Run and Manage Coding Agents from Multiple Vendors (venturebeat.com) 9

"AI isn't just a tool anymore; it's an integral part of the development experience," argues GitHub's blog. So "Agents shouldn't be bolted on. They should work the way you already work..."

So this week GitHub announced "Agent HQ," which CNBC describes as a "mission control" interface "that will allow software developers to manage coding agents from multiple vendors on a single platform." Developers have a range of new capabilities at their fingertips because of these agents, but it can require a lot of effort to keep track of them all individually, said GitHub COO Kyle Daigle. Developers will now be able to manage agents from GitHub, OpenAI, Google, Anthropic, xAI and Cognition in one place with Agent HQ. "We want to bring a little bit of order to the chaos of innovation," Daigle told CNBC in an interview. "With so many different agents, there's so many different ways of kicking off these asynchronous tasks, and so our big opportunity here is to bring this all together." Agent HQ users will be able to access a command center where they can assign, steer and monitor the work of multiple agents...

The third-party agents will begin rolling out to GitHub Copilot subscribers in the coming months, but Copilot Pro+ users will be able to access OpenAI Codex in VS Code Insiders this week, the company said.

"We're into this wave two era," GitHub's COO Mario Rodriguez told VentureBeat, an era that's "going to be multimodal, it's going to be agentic and it's going to have these new experiences that will feel AI native...."

Or, as VentureBeat sees it, GitHub "is positioning itself as the essential orchestration layer beneath them all..." Just as the company transformed Git, pull requests and CI/CD into collaborative workflows, it's now trying to do the same with a fragmented AI coding landscape...

The technical architecture addresses a critical enterprise concern: Security. Unlike standalone agent implementations where users must grant broad repository access, GitHub's Agent HQ implements granular controls at the platform level... Agents operating through Agent HQ can only commit to designated branches. They run within sandboxed GitHub Actions environments with firewall protections. They operate under strict identity controls. [GitHub COO] Rodriguez explained that even if an agent goes rogue, the firewall prevents it from accessing external networks or exfiltrating data unless those protections are explicitly disabled.

Beyond managing third-party agents, GitHub is introducing two technical capabilities that set Agent HQ apart from alternative approaches like Cursor's standalone editor or Anthropic's Claude integration. Custom agents via AGENTS.md files: Enterprises can now create source-controlled configuration files that define specific rules, tools and guardrails for how Copilot behaves. For example, a company could specify "prefer this logger" or "use table-driven tests for all handlers." This permanently encodes organizational standards without requiring developers to re-prompt every time... Native Model Context Protocol (MCP) support: VS Code now includes a GitHub MCP Registry. Developers can discover, install and enable MCP servers with a single click. They can then create custom agents that combine these tools with specific system prompts. This positions GitHub as the integration point between the emerging MCP ecosystem and actual developer workflows. MCP, introduced by Anthropic but rapidly gaining industry support, is becoming a de facto standard for agent-to-tool communication. By supporting the full specification, GitHub can orchestrate agents that need access to external services without each agent implementing its own integration logic.

GitHub is also shipping new capabilities within VS Code itself. Plan Mode allows developers to collaborate with Copilot on building step-by-step project approaches. The AI asks clarifying questions before any code is written. Once approved, the plan can be executed either locally in VS Code or by cloud-based agents. The feature addresses a common failure mode in AI coding: Beginning implementation before requirements are fully understood. By forcing an explicit planning phase, GitHub aims to reduce wasted effort and improve output quality.

More significantly, GitHub's code review feature is becoming agentic. The new implementation will use GitHub's CodeQL engine, which previously largely focused on security vulnerabilities to identify bugs and maintainability issues. The code review agent will automatically scan agent-generated pull requests before human review. This creates a two-stage quality gate.

"Don't let this little bit of news float past you like all those self-satisfied marketing pitches we semi-hear and ignore," writes ZDNet: If it works and remains reliable, this is actually a very big deal... Tech companies, especially the giant ones, often like to talk "open" but then do their level best to engineer lock-in to their solution and their solution alone. Sure, most of them offer some sort of export tool, but the barrier to moving from one tool to another is often huge... [T]he idea that you can continue to use your favorite agent or agents in GitHub, fully integrated into the GitHub tool path, is powerful. It means there's a chance developers might not have to suffer the walled garden effect that so many companies have strived for to lock in their customers.

Slashdot Top Deals