Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-09-12 · high
The release also stops one stuck conversation from taking down every other agent thread with it.
Why now: LangChain released the patch on September 11.
LangChain's deepagents-talon 0.0.8, released September 11, patches a bug that let a URL slip past the tool's auto-approve guard after a user had approved a different one. That's a confused-deputy flaw, the kind where an agent applies a decision made about one thing to something else. Anyone running deepagents-talon with OAuth-connected MCP tools could have a tool call execute against a URL the user never approved.
The deepagents-talon's 0.0.8 release notes list it alongside a broader hardening pass on MCP OAuth. That pass covers the device-flow handshake and credential storage, and preserves refresh tokens across the change. A separate fix stops configuration updates from silently wiping settings the update wasn't touching.
The release also fixes a second failure mode: one conversation hanging or crashing could drag every other active thread down with it. 0.0.8 gives background subagent work recoverable start and stop points, adds scheduled-job delivery, and suppresses results from turns that got discarded before they finished. send_message now reports progress instead of going silent mid-task, and conversation deletion targets a single thread rather than clearing more than asked. Tool approval management now happens through tools.json.
The release notes don't say how long the bug existed before the fix, or whether an approval got exploited before September 11.
Each link below shares sources, entities, or timing with this story.
PR #29081, merged August 26 and in nightly v0.59.0-nightly.20260827, enforces RFC 9728 §7.7 and RFC 8414 constraints across MCP OAuth metadata discovery, dynamic client registration, and token exchange. It requires HTTPS for remote endpoints with HTTP allowed only for loopback...
holaboss-ai/holaOS puts Claude Code, Codex and its own agent in one Electron workspace where context and history live as editable local files rather than a hosted database, so memory persists across sessions *and* across agents. Built-in frontier models (Kimi K3, GLM 5.2, GPT...
It now dedupes local CLAUDE.md files against checked-in ones, proposes trimming content it can derive from the codebase, ranks unused skills, MCP servers, and plugins by context cost, and flags slow hooks. Background subagents run by default and, when launched from claude agen...
Cline 0.0.23 fixed one wedged MCP server blocking the rest from shutting down and leaking their processes. Copilot CLI 1.0.83-5 fixed MCP tools becoming uncallable after a server restart, and 1.0.83-4 fixed agent-configured servers disappearing after built-in sub-agent turns....
TrustMeBro is a Go tool at 327 stars, created August 26, that intercepts commands invoked by Codex, Claude Code and pi through PATH shims alone. No plugin, no hook, no MCP. Rules decide whether to fabricate output, rewrite stdout while preserving stderr and exit status, block,...
MCPConfig.tools now accepts Agent, Team and Workflow instances plus Toolkit objects, exposing each as its own named MCP tool. You call chief, not run_agent(agent_id="chief"). Toolkits publish one MCP tool per registered method, narrowed by the toolkit's own enable/include/excl...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.