Nov 3, 2026
What changed in the last two days in AI agents and coding tools, and whether it matters to you. 90 seconds, no hype.
1. GitHub will block pull_request_target in public repos from Dec 2
Actions will block pull_request_target by default in every public repo unless an Actions event policy explicitly allows it. Enforcement was meant to start Nov 2. Two brownouts (temporary enforcement) come first: Nov 9 and Nov 16, 16:00–18:00 UTC (Nov 10 and Nov 17, 5–7 AM NZDT), when blocked runs fail with an error annotation. Private and internal repos aren't affected.
Does it matter to you? Yes if a bot or agent reviews fork PRs through this trigger. It runs with your repo's secrets, which is the point of the block. Check Insights, then allow only the workflows you trust.
Source: GitHub Changelog
2. Trigger.dev says an attacker accessed some customers' environment variables
The background-jobs platform disclosed on Nov 1 that an attacker accessed environment variables for a subset of organizations. It says the exploit is blocked and impacted account owners have been emailed with steps to mitigate.
Does it matter to you? If you keep LLM API keys or database URLs in Trigger.dev env vars, check your inbox. Got the email? Rotate those secrets now. More details are promised.
Source: Trigger.dev
3. Momentic's QA agent Mo is out of beta, with a bug-hunting benchmark
Mo explores your running app and reports bugs; a separate agent reproduces each one first. It can test PR preview deployments. On Momentic's own benchmark (4 open-source apps, 60 minutes), Mo found 269 bugs, Codex 86, Claude Code 59 and Devin 27. Codex was slightly more precise (86% vs 84%) and cheaper per bug ($0.80 vs $2.67).
Does it matter to you? It's a vendor's own benchmark, but the dataset and harness are public, so you can check it. Worth a look if agents now ship code faster than you can test it.
Source: Launch HN · Momentic
Try this today
Run grep -rln "pull_request_target" .github/workflows in each public repo you own. No hits on your main branch? Dec 2 likely won't affect you. Any hits: before the Nov 10 brownout, decide whether each one really needs your secrets.
That's today. Hit reply and tell me which tool you want tested next. See you tomorrow.
Want your agent to do more out of the box? Grab the Vibe Check Agent Skills Pack.
Know someone who'd find this useful? Forward it, or send them to https://thevibecheck.beehiiv.com/subscribe