Claude Code Mods turn the agent into a platform; a KVM escape under every sandbox; AWS open-sources an agent inbox

Pizza Bot — is a free, self-hosted app from a group of AWS engineers that gives background agents an email-style inbox: you hand over a task, it runs on a schedule or a trigger, asks for approval before anything consequential, and returns a thread you come back to later. It is exactly the approval-and-queue shape enterprise clients keep asking for, available as something you can copy rather than specify from scratch. Apache 2.0, with state and logs in a local folder and credentials in the OS secret store; it is a community project, so no AWS support or SLA. InfoQ

“You don’t send an email and then sit watching the outbox until the reply lands.”

MCP Events — is OpenAI's new documentation for letting ChatGPT subscribe to events from a connected tool server, so an agent reacts when a bug report or a review comment arrives instead of waiting for a timer or for you to ask. Event triggers are what turn a demo agent into something that does work while nobody is watching — and what makes approval design the next conversation with the client. Webhooks only, signed, one event per request and capped at 256 KiB; the docs warn to treat incoming comment text as data, never as instructions. explainx.ai

“Event-driven triggers are a huge deal.”

OpenAPPA — is an open-source engine from Archestra that sits outside the agent's loop and decides what data may flow where, from one configuration file describing data sources, audiences and trust levels. It answers the approval-fatigue problem in every rollout: a second model judging each tool call can be argued with, while rules the agent never sees cannot be. Reading an untrusted web page marks the session untrusted, which then blocks a database migration; Archestra reports zero successful attacks across two agent-security suites. InfoQ

Strata — is a free installer and engine that runs a 125-billion-parameter open Qwen model on an ordinary Windows or Linux gaming PC, serving it on localhost behind OpenAI- and Anthropic-compatible endpoints so tools like Claude Code can point at it. It is the practical answer for the client whose code genuinely cannot leave the building. It wants a 12 GB graphics card, 32 GB of RAM and about 80 GB of disk, and the machine may stop responding for one to three minutes while the model loads. GitHub

Meta Muse — is Meta's consumer agent app, and a product designer's widely shared post argues it wins on packaging rather than capability: one chat with no model picker and no chat-versus-work switch, a free tier paid for by advertising, and an agent with a name and a face. Nothing in it is new to anyone who uses a coding harness, which is the point worth repeating to executives: the gap was presentation, not capability. It topped the free US App Store chart above ChatGPT, and Meta granted a billion tokens per invited user at launch. Mete Polat

Vercel Sandbox bounty — paid out $50,000 for a reported full escape from a guest virtual machine to root on the host in KVM, the Linux hypervisor most of the cloud — and most agent sandboxes — rest on. Vercel's CEO confirmed the report publicly and promised a write-up. "It runs in a microVM" is the isolation story half the agent platforms sell, so expect to be asked whether your client's sandbox is in scope. As of 4 October there was no public CVE and no patch; Vercel places each sandbox in its own Firecracker microVM on a bare-metal EC2 host. explainx.ai

Super Intelligence Force — is the federal task force Trump announced in a Truth Social post, chaired by national intelligence director Jay Clayton, with vice chairs drawn from the FTC, the War Department and the federal personnel office. It is the direction of travel for US rules, and the framing matters: the charter reportedly pairs responding to threats with avoiding overregulation. Reportedly 120 days to produce a report on AI's risks and opportunities; it follows an executive order rebranding AI as "super intelligence". TechCrunch

Open Source Software Vulnerability Rewards Program — has been paused as of 1 October, with Google blaming a sharp rise in automated submissions that are mostly invalid and, per Tom's Hardware, often full of hallucinations that exhausted engineers and maintainers. A preview of the bottleneck every client hits: agents produce submissions far faster than humans can triage them, and the intake process is what breaks first. Google promises an update in the first quarter of 2027 and points researchers at its other bounty programmes meanwhile. TechCrunch

Simon Willison — argues that usage-based services and APIs should cut you off by default when a spend limit is reached rather than send a warning email, because agents make it trivially easy to stand up something that spends money all night. It is the cheapest control you can hand a client this quarter, and a question worth adding to vendor reviews. AWS launched spend limits on 16 September, pausing a project for the month when it hits its limit; Google Cloud shipped Spend Caps in July. Simon Willison

“I expect that most businesses and individuals would prefer errors to a surprise $10,000+ bill.”

COSMIC — the Rust desktop environment that ships with Pop!_OS, now asks contributors to certify that a pull request contains no LLM-generated content at all — code, comments and the description text included. Maintainer backlash is turning into written policy, which matters directly if your agents open pull requests against outside projects. System76's lead developer said AI brought in many first-time contributors but their changes were unplanned and rarely accepted; the rule is a checkbox, since no reliable detector exists. explainx.ai