AI engineering news, this week
5 fresh updates: security fixes, backend QA and test debugging. The theme: verify what agents ship.
Copilot fixes security alerts, then checks its work
GitHub Agentic Autofix is generally available: it edits code, reruns CodeQL and opens a draft PR for human review.
Enterprise Cloud + Code Security/Advanced Security. Default-branch alerts only. Uses AI Credits and Actions minutes.
AI Scan expands PR security coverage
GitHub AI Scan is generally available for languages and frameworks beyond CodeQL coverage, including PHP, Bash, Terraform and Dockerfiles.
Advisory only: it cannot block merges. Fork and Dependabot PRs are excluded. Uses Code Security AI Credits.
Kerno v1 tests the running backend
From an MCP-compatible coding agent, Kerno maps user flows and tests APIs, queues and databases against your running stack. Tests stay in your repo for CI.
Vendor announcement, not an independent evaluation. Pilot in a controlled test environment before trusting coverage.
Agents can inspect Playwright traces piece by piece
Currents launched a trace API for agents: start with a summary, then fetch the relevant steps, DOM, network calls or failure frames instead of the whole trace.
Trace API links are public and need no login. Check traces for sensitive data before sharing a link.
AISLE adds evidence to vulnerability reports
Its October rollout adds exploit attempts in an authorized test environment, reproducible memory-safety checks, an MCP server and a package firewall.
Vendor-reported rollout. A failed exploit attempt does not prove a finding is safe; verify feature availability for your setup.
That is all for this week
Checked 18 Oct 2026. Summaries are from the linked primary sources. Vendor claims are not independent test results. Images are AI-generated illustrations, not photos from the articles. This is a weekly snapshot, not a live feed.