Stack Overflow’s 2026 survey shows many developers run, compare and inspect AI-generated code. Self-reported habits are not proof of correctness, but they point to review steps organisations can capture.
A new preprint holds tasks and policies fixed while changing agent-visible wording. Procurement tests should add controlled representation variants before ranking models or defences.
NIST’s draft guide shows three useful CSF 2.0 workflows and repeatedly requires qualified review. Teams should preserve the source-to-output trail before using any generated profile in a risk decision.
A Google, DeepMind and MIT study combines 15 million Gemini interactions, 2,600 specialist models and a survey of more than 600 scientists. Capacity planning should follow the bottleneck downstream.
The AI cybersecurity standard is entering publication. Teams can use its threat catalogue now, but should record the risks and actors it does not cover before calling the result complete.
Trillium Labs promises data, code, evaluations, checkpoints and failed runs from post-training experiments. Research buyers should convert that promise into a reproducibility and risk-release checklist.
Apple says future macOS releases will add controls when AI agents request Full Disk Access. Security teams should convert broad, durable consent into bounded task grants with expiry and review.
NVIDIA reports that DOCA agent skills lifted a model from 19% to 100% on 65 vendor-designed prompts. The useful next step is local reproduction across hardware, smoke tests and rollback.
OpenAI says it notified more than 100 third parties after reviewing agent activity. A notification is an evidence-handling trigger, not proof that every recipient suffered a compromise.