Day's Snapshot by WRF – 23 Oct 2026
Five stories from the last day: AI coding productivity data, a maximum-severity GitLab flaw, IBM on governed AI agents, 1Password for agents, and eMudhra's certificate exit.
AI coding tools raise output, but finished work barely moves
A study of 718 firms and about 700,000 developers found that AI coding assistants increased lines of code by 12% and AI agents by 30%. Resolved tickets rose only for agents (12%). Review time per pull request rose 49%, and the share of pull requests needing changes doubled.
Why it matters: Ask software agencies how they measure delivered work, not just code produced with AI tools.
Maximum-severity GitLab flaw allows remote code execution
GitLab patched CVE-2026-110264, a perfect-10 vulnerability in self-managed Community and Enterprise Editions going back to version 7.0. An unauthenticated user could run code on the server under certain conditions. GitLab.com and Dedicated are already patched, and self-managed users are urged to upgrade.
Why it matters: If a vendor or agency runs self-managed GitLab for you, ask when it was patched.
IBM: AI agents need governed, current business context
In an interview, IBM's general manager for Confluent and Data said agents making business decisions depend on the information they can reach. IBM pitches a streaming architecture to feed agents current data, and advises defining business terms per agent task and starting with high-value use cases.
Why it matters: This is a vendor view. When agencies propose AI agents, ask how data access and definitions are governed.
1Password lets AI agents sign in without seeing your password
1Password for Agents lets a user approve an AI agent's login request, after which 1Password enters the credentials itself so the agent never receives them. The company says it is working with other AI providers to widen support.
Why it matters: Credential handling is a fair question for any agency building agent workflows.
eMudhra exits the SSL/TLS business after weak CA keys found
Researchers recovered the private keys of eight eMudhra intermediate certificates. The company will leave the global SSL/TLS business, and Chrome plans to stop trusting its root on October 27, affecting about 30,800 unexpired certificates. Operators must replace them with certificates from another trusted authority.
Why it matters: Check whether any site you run or buy managed hosting for uses these certificates, as replacement has a deadline.