AI Coding Live News

Modern AI coding agents such as Claude Code, Codex, and terminal assistants routinely execute agent skills—instructions and executable scripts bundled in SKILL.md specifications—with full local user privileges. Developers share these skills primarily by copying files across repositories, inadvertently forging a shadow software supply chain without centralized registries, semver tagging, or provenance tracking. A seminal empirical audit by Fahd Seddik (arXiv:2610.11169) introduces Skill Constellations, constructing the first dated copy network of agent skills derived from git provenance across 2,193,119 skill adoptions on GitHub. The investigation demonstrates that a minuscule set of root repositories generates nearly all downstream copies, yet GitHub star counts correlate poorly with true lineage sources. Critically, downstream copies almost never adopt upstream security patches. By fitting a predictive copy network model, auditing just the top 100 identified root repositories halts 14.9% of subsequent high-risk skill adoptions (compared to a negligible 0.5% when inspecting the top 100 starred repos), proving the urgent necessity for decentralized package ecosystems to adopt versioned references over loose copies.

OpenAI said it is ending its partnership with Cursor following Cursor’s acquisition by SpaceX, proposing that Cursor’s direct access to OpenAI models end on November 12. The move hits developers who rely on OpenAI models inside Cursor and reshapes the coding-agent model supply chain. OpenAI pledged to go above and beyond to support users through the transition.