The fences are the product: Addy Osmani's quality thesis, an AI worm hiding in Word docs, Claude loose in your browser, and banks putting Devin to work

Claude in Chrome is generally available — and it no longer asks permission at every step. Anthropic's browser extension that lets Claude act inside Chrome — navigating pages, filling forms, doing multi-step web work — is now out of beta and available to everyone. The notable change: it can carry out a task without you approving each individual step along the way. Agents moving from the terminal into the browser is where your non-technical clients will actually see them, because that's where their business work already lives. The dropped per-step approval is the whole story: it's the moment browser agents go from demo to delegation, and it's also the moment governance questions stop being theoretical. The general availability announcement quietly pairs the extension with Anthropic's enterprise offerings (Claude Code for Enterprise, Claude Platform), signalling this is aimed at companies, not hobbyists. claude.com

Faros launches Token Engineering: accounting for AI coding spend, tied to what actually shipped. Faros, the engineering-observability company, launched a platform that tracks what you spend on AI coding tokens and connects it to the work produced — pulling data from desktops, gateways, source control, tickets, CI/CD and incident reports. It includes an evaluation engine, called Time Machine, for working out which models, harnesses and context setups actually produce the best outcomes. This is the conversation your clients' CFOs are already having internally: multi-million-dollar token budgets with no line of sight into what came back. The first credible 'token spend as a managed resource' product is a signal that AI coding spend is becoming a governed budget category, like cloud infrastructure before it. CEO Vitaly Gordon — previously VP of Engineering at Salesforce and founder of Salesforce Einstein — frames the pitch as the question every engineering leader is now fielding about individual engineers' bills. faros.ai

“So, your engineer spent $20K on AI tokens last month. Should you stop them — or promote them?”

The September MCP security roundup should be mandatory reading before your client plugs an agent into anything. Adversa AI's monthly digest of security problems in MCP — the standard plug format agents use to reach tools and data — documents a supply-chain campaign called Deadbugz, three fresh vulnerabilities in widely used MCP servers, and a scan of internet-facing servers that found 91.8% running with no authentication at all. The Deadbugz trick is nasty: a malicious MCP server was pushed at open-source projects through GitHub pull requests, and its payload stays dormant until the client has made exactly three tool calls, so casual testing finds nothing. Your clients are wiring agents into internal systems through MCP servers right now, mostly without thinking about where those servers came from. This digest is the concrete material for that risk conversation — including the detail that one account filed 23 pull requests across unrelated projects in 74 minutes, which is the speed at which this stuff spreads. Among the vulnerabilities: a path traversal in the Atlassian MCP that let any authenticated client read arbitrary files, rated CVSS 7.7, plus a settings tool in an ArcadeDB MCP that handed out the cluster token in cleartext — effectively root access. adversa.ai

“The chain is the breach, and only by observing and reconstructing the whole chain of agentic actions can you stop the damage before it lands.”

An AI worm that spreads through Word documents, via Copilot — disclosed with Microsoft, still unfixed as a class. A researcher has published a coordinated disclosure with Microsoft describing a self-spreading attack against Copilot in Word: hidden instructions embedded in a document (a prompt injection — text the AI reads as commands) make Copilot alter the documents it works on and copy the malicious instructions into other documents it generates or edits, spreading the attack through normal collaboration. The attacker needs no access to the victim's organisation — just the ability to share a document. This is the clearest demonstration yet that prompt injection isn't a theoretical footnote for enterprises running Copilot across SharePoint, Teams and OneDrive. It's the slide to put in front of any client who says their document workflows are 'just drafting, nothing sensitive.' The coordination with Microsoft stretched to 144 days after two extensions; a working self-spreading exploit was reproduced on 2026-07-15 and published on 2026-07-28 — and at publication, no robust mitigation exists for the vulnerability class as a whole. enklypesalt.com

Devin's maker expands into Latin America — with bank-scale numbers to back it up. Cognition, the company behind the Devin AI software engineer, announced an expansion into Latin America starting in São Paulo, building on deployments already running at some of the region's biggest companies. Itaú, Brazil's largest bank, has more than 75% of its technology teams using Devin across over 300,000 documented repositories, and reports a 20–30% lift in engineering throughput. Nubank used Devin to compress a monolith migration from an estimate of years down to weeks, at over 20x lower cost. These are the enterprise case studies your clients will bring up or should hear about: not pilots, but bank-wide rollouts with throughput numbers attached. Latin America's 15.8 million GitHub developers make it the third-largest developer community in the world, and Cognition is hiring there — a sign the AI-engineering market is genuinely global now. The expansion was announced at an event at MASP, the São Paulo modern art museum, with Nubank (roughly 140 million customers) and Itaú as the anchor stories. cognition.com