Changelog
Updates
Dated changes across all five sections: vendor changelogs, price changes, new security advisories and week-over-week diffs of the data. Subscribe via RSS
November 2026
MCP Inspector: Unvalidated runtimeArguments and identifier in server.json import & unvalidated URL scheme in web ElicitationUrlModalBody
Medium. Status: patched. GHSA-rwv7-mh2c-ff2p. MCP Inspector advisory.
MCP Inspector: MCP App escapes its CSP by navigating its own frame
Medium (CVSS 6.1). Status: patched. GHSA-h9j8-vj8g-v3gg. MCP Inspector advisory.
Four ecosystems now load the portable Agent Plugins format
OpenAI (ChatGPT and Codex), Cursor and GitHub Copilot/VS Code document Agent Plugins 1.0.0 support, with one root plugin.json plus skills/ and mcp.json. Claude Code still uses its own manifest, and an open feature request asks for the standard.
Amazon Q Developer IDE plugins get an end-of-support date
AWS will end support for the Amazon Q Developer IDE plugins (VS Code, JetBrains, Eclipse, Visual Studio) on April 30, 2027, and points users to Kiro.
ACP becomes the bridge between agents and editors
Cursor, Codex, Kiro and Claude now run inside JetBrains AI Chat or Zed through the Agent Client Protocol. Which IDE you use matters less than which agent you pick.
Copilot is still the widest IDE footprint
GitHub's feature matrix lists agent mode and MCP in VS Code, Visual Studio, JetBrains, Eclipse and Xcode. Neovim stays completion-only, and BYOK is GA only in Visual Studio.
MCP Inspector: MCP Inspector can stall on a malicious tool output schema regex.
Medium (CVSS 6.5). Status: patched. GHSA-2fw8-7jmw-r937. MCP Inspector advisory.
Scheduled: Gemini 4 Argon API price doubles on Dec 1, 2026
Gemini 4 Argon moves from $2 / $10 to $4 / $20 per 1M input/output tokens on Dec 1, 2026. Gemini 3.8 Flash doubles to $1.50 / $7.50 on Jan 1, 2027.
Scheduled: one shared ChatGPT and Codex limit for Business in December
OpenAI says Business workspaces move to a single usage limit shared across ChatGPT and Codex in December 2026.
MCP clients: 17 tracked across 10 capabilities
93 of 170 cells are verified against vendor docs and 77 are still marked unknown. The most widely confirmed capability is Remote (HTTP/SSE) (16 of 17).
AI plugins: 10 tracked across 10 capabilities
73 of 100 cells are verified against vendor docs and 27 are still marked unknown. The most widely confirmed capability is MCP-based (10 of 10).
IDE integrations: 13 tracked across 12 capabilities
102 of 156 cells are verified against vendor docs and 54 are still marked unknown. The most widely confirmed capability is Agent mode (13 of 13).
AI security posture: 12 tracked across 10 capabilities
69 of 120 cells are verified against vendor docs and 51 are still marked unknown. The most widely confirmed capability is OAuth for remote MCP (10 of 12).
AI Pricing: 13 products, 65 plans tracked
220 of 413 plan values are verified against official pricing pages and 193 are marked unknown. Plus 16 API models.
MCP C# SDK: Missing user ID claims collapse authenticated principals and allow MCP session hijacking
High (CVSS 7.5). Status: patched. GHSA-x863-g495-4cjc. MCP C# SDK advisory.
Kiro adds a free first-upgrade trial and per-second proration
Kiro's billing docs (updated Nov 1, 2026) add a first-upgrade trial and per-second proration for plan changes.
October 2026
Claude Max 20x becomes Ultra at $200 with no 5-hour limit
Ultra keeps the $200 price, gives 10x Pro weekly usage, removes the 5-hour limit for verified accounts and adds $200 of monthly API credits. Max ($100) becomes 5x Pro with $100 of API credits.
ChatGPT Pro allowances doubled; Pro 200 cut canceled
Pro 100 and Pro 500 get double the ChatGPT Work and Codex allowance, and the Pro 200 reduction announced Sep 29 will not happen. Date as reported by third-party trackers.
A unified Plugins page starts rolling out in Claude
Customize > Plugins is rolling out to Free, Pro, Max, Ultra and Team, and reaches Enterprise on Nov 30, 2026. A plugin installed on your account also syncs into Claude Code.
Cursor VS Code Extension Marketplace: Malicious 'Anthropic.claude-code' 2.1.312 / 2.1.313 in Cursor's extension marketplace
Not Rated. Status: resolved. Cursor says two impersonating versions (Windows / macOS) attempted an SSH backdoor. Cursor removed them, shut down and rebuilt the marketplace, and rotated keys.
ChatGPT Pro and Business now include monthly API credits
Pro 100/200/500 include $100/$200/$500 of API credits per month. Business includes $20 per Standard seat and $100 per Premium seat, pooled and capped at $500 per month. Date as reported by third-party trackers; amounts from OpenAI's guide.
MCP reference servers: mcp-server-git: nested gitdir file bypasses --repository confinement
Medium (CVSS 5.3). Status: patched. GHSA-w766-5x43-whvw. MCP reference servers advisory.
ChatGPT plugins replace new GPT creation for some Enterprise workspaces
Creating new GPTs ended for affected Enterprise workspaces. Plugins, which bundle skills, MCP apps and interactive views, are the path forward.
Claude Code: TOCTOU Race in Edit Tool Allows File Writes Outside the Workspace
High (CVSS 7.7). Status: patched. CVE-2026-88968 · GHSA-5xjx-9qx6-jcrv. Claude Code advisory.
Postman Desktop 12.33.4–12.35.1: Postman Desktop auto-installs Codex / Claude Code plugins and pre-trusts its own startup hook
Not Rated. Status: open. Users report Postman's auto-existing-upgrade step installing Postman plugins into Claude Code and Codex, writing a trusted hook hash into Codex config, adding a SessionStart hook, the remote MCP server mcp.postman.com and a CLI in ~/.local/bin. Postman staff replied on Nov 3 that opt-in will be made clearer and hook approval is under review. No CVE.
MCP reference servers: fetch: private-address guard bypass via IDNA hostnames (check and connect resolve different names)
Medium (CVSS 6.3). Status: patched. GHSA-v38p-wf49-hx2j. MCP reference servers advisory.
MCP reference servers: Cross-Origin Environment Variable Exfiltration in @modelcontextprotocol/server-everything
Medium (CVSS 6.5). Status: patched. GHSA-mvf5-2qqv-rg3c. MCP reference servers advisory.
MCP reference servers: @modelcontextprotocol/server-filesystem list_directory_with_sizes follows symlinks and leaks outside-directory file metadata
Low (CVSS 3.1). Status: patched. GHSA-hhwq-wxfx-cj7g. MCP reference servers advisory.
MCP reference servers: Path traversal via trailing quote/whitespace in validatePath (Check/Use Mismatch)
Medium (CVSS 4.2). Status: patched. GHSA-7rgq-gccq-qphx. MCP reference servers advisory.
MCP reference servers: fetch server: SSRF guard treats the well-known NAT64 prefix 64:ff9b::/96 as public, so a metadata address is reachable on NAT64/DNS64 egress
Low (CVSS 3.1). Status: patched. GHSA-66qx-2266-pmj6. MCP reference servers advisory.
MCP reference servers: Parent-Directory Fallback TOCTOU in @modelcontextprotocol/server-filesystem Permits Arbitrary File Write Outside allowedDirectories
Low (CVSS 2.2). Status: patched. GHSA-53mr-w429-c597. MCP reference servers advisory.
MCP reference servers: Case-variant path bypasses symlink check and allows creating files outside allowed directories in server-filesystem
Medium (CVSS 5.3). Status: patched. GHSA-4gxg-m5jx-9j57. MCP reference servers advisory.
MCP reference servers: robots.txt enforcement bypass via HTTP redirects in mcp-server-fetch
Low (CVSS 3.1). Status: patched. GHSA-3jqg-r5pp-rmp2. MCP reference servers advisory.
MCP Inspector: Missing Authentication for Critical Function in @modelcontextprotocol/inspector
High (CVSS 7.5). Status: patched. GHSA-wmjf-2m46-2352. MCP Inspector advisory.
MCP Inspector: Incomplete fix for CVE-2025-49596: DNS-rebinding info disclosure (API token + stored OAuth tokens) in MCP Inspector
High. Status: patched. GHSA-vcc9-3xgm-p9v4. MCP Inspector advisory.
MCP Inspector: A remote MCP server can execute arbitrary code on the user's machine through the OAuth authorization URL (PowerShell subexpression injection on Windows and WSL)
High (CVSS 8.8). Status: patched. GHSA-q978-78c7-phqw. MCP Inspector advisory.
MCP Inspector: MCP Inspector v2.7.0 — /api/fetch proxy has no size cap on the proxied response body (memory-exhaustion DoS)
Medium. Status: patched. GHSA-m5pj-3536-3xcp. MCP Inspector advisory.
MCP Inspector: /fetch proxy leaks Authorization/Cookie headers across cross-origin redirects (regression from the SSRF hardening in v1.0.0)
Medium. Status: patched. GHSA-f6mc-jg3x-vq53. MCP Inspector advisory.
MCP Inspector: SSE auth/custom headers are logged verbatim by the Inspector proxy
Low. Status: patched. GHSA-8qgq-27v6-55w3. MCP Inspector advisory.
MCP Inspector: Remote MCP App can steal proxy auth token and execute arbitrary local commands (RCE)
Critical (CVSS 9.6). Status: patched. GHSA-6x67-4w4w-9f3w. MCP Inspector advisory.
MCP Inspector: Malicious MCP OAuth callback can switch transport to stdio and execute arbitrary local commands (RCE)
Critical (CVSS 9.6). Status: patched. GHSA-4fc4-wcmh-4g86. MCP Inspector advisory.
MCP Inspector: MCP Inspector leaks proxy session token to query-controlled proxy origin
Medium (CVSS 5.3). Status: patched. GHSA-2rq8-f55p-j2jp. MCP Inspector advisory.
MCP Java SDK: Server/client session dispatch returns raw handler exception messages (and the full cause chain) to the peer → information disclosure
Medium (CVSS 5.3). Status: patched. GHSA-w83x-jw8h-w4rj. MCP Java SDK advisory.
MCP Java SDK: Default stateless Servlet transport accepts browser cross-origin tool calls
High (CVSS 7.1). Status: patched. GHSA-hp8w-r5wh-cw9q. MCP Java SDK advisory.
MCP Java SDK: Unbounded session retention in the Streamable HTTP transport allows an initialize flood DoS
High. Status: patched. GHSA-2hm9-qff2-hrpj. MCP Java SDK advisory.
MCP Apps render inside Gemini Enterprise
Google's developer guide shows MCP Apps rendering in Gemini Enterprise chat, in an iframe, fullscreen or in a side panel. Interactive UI now has three big hosts: ChatGPT, Claude and Gemini Enterprise.
MCP TypeScript SDK: Shared transport or server instances delivered one HTTP client's messages to another
High (CVSS 7.7). Status: patched. CVE-2026-111770 · GHSA-jm63-cq47-j5jp. MCP TypeScript SDK advisory.
MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length
High (CVSS 7.5). Status: patched. GHSA-f897-62hf-6gxq. MCP TypeScript SDK advisory.
MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation
High (CVSS 7.5). Status: patched. CVE-2026-111768 · GHSA-46jr-4wx8-v453. MCP TypeScript SDK advisory.
GPT-5.5 retired from Codex
GPT-5.5 is no longer available in Codex with ChatGPT sign-in, per the Codex pricing page.
VS Code (Copilot Chat / MCP): Security Feature Bypass via Shared MCP Sandbox Permission Approvals
Medium. Status: patched. CVE-2026-102851 · GHSA-qghm-w43w-vx8v. VS Code (Copilot Chat / MCP) advisory.
VS Code (Copilot Chat / MCP): Remote Code Execution via Custom Hook Edits in the Copilot Harness
High. Status: patched. CVE-2026-102232 · GHSA-fq62-m6f5-c7h9. VS Code (Copilot Chat / MCP) advisory.
Claude Code: Uncontrolled Search Path Enables Arbitrary Code Execution via Malicious Git Executable
High (CVSS 7.5). Status: patched. CVE-2026-88066 · GHSA-4p2j-qj3c-6x84. Claude Code advisory.
Cursor moves to the X Subscription: $8 to $200 tiers with a shared Grok pool
Plus $8, Premium $30, Super $100 and Ultra $200 per month (yearly $80 to $2,000). One weekly pool is shared across Grok and Cursor; third-party models bill at API list price from prepaid credit. Legacy Pro plans keep working.
Claude Code: Plugin Commit SHA Pin Bypass Allows Installation of Attacker-Controlled Code
High (CVSS 7.7). Status: patched. CVE-2026-86063 · GHSA-pq7j-f95f-qfcv. Claude Code advisory.
Claude.ai connectors move to the 2026-07-28 protocol
Connectors moved to a new embedded client that negotiates 2026-07-28 and advertises MCP Apps, but no longer advertises elicitation.
Claude Code defaults to MCP 2026-07-28 everywhere
Confirmed on 2026-07-28 by default for HTTP, stdio (v2.1.292+) and claude.ai connectors (v2.1.295+). Opt out with MCP_PROTOCOL_NEGOTIATION=legacy.
Amazon Q Developer for VS Code: Insecure Default File Permissions on Cached Credentials in AWS Toolkit for Visual Studio Code
Medium (CVSS 5.5). Status: patched. CVE-2026-107332 · GHSA-9g5j-qgqm-857j. Amazon Q Developer for VS Code advisory.
MCP Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server
Medium (CVSS 6.8). Status: patched. CVE-2026-116684 · GHSA-w4fh-qvv9-3v23. MCP Python SDK advisory.
MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service
Medium (CVSS 6.8). Status: patched. CVE-2026-111771 · GHSA-rvq5-wwqv-78pq. MCP TypeScript SDK advisory.
Claude Code: Arbitrary File Write via Write-Time Symlink Following (TOCTOU) in Claude Code
High (CVSS 7.7). Status: patched. CVE-2026-103435 · GHSA-5j29-h97v-84ch. Claude Code advisory.
MCP TypeScript SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies
Medium (CVSS 6.5). Status: patched. CVE-2026-111769 · GHSA-6prh-2h8m-c8cw. MCP TypeScript SDK advisory.
MCP Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies
Medium (CVSS 5.9). Status: patched. CVE-2026-116685 · GHSA-5h93-6whr-6q8j. MCP Python SDK advisory.
MCP TypeScript SDK: Experimental tasks were not tied to the session that created them
High (CVSS 8.6). Status: patched. CVE-2026-111767 · GHSA-22jm-h49p-29qw. MCP TypeScript SDK advisory.
September 2026
MCP Python SDK: HTTP server transports and OAuth endpoints read request bodies with no size limit
High (CVSS 7.5). Status: patched. CVE-2026-109527 · GHSA-fmmv-w9g8-j3gc. MCP Python SDK advisory.
MCP Python SDK: Streamable HTTP sessions were never reclaimed by default and kept their initialize payloads
High (CVSS 7.5). Status: patched. CVE-2026-59951 · GHSA-84m7-p3x7-pcfv. MCP Python SDK advisory.
MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server
High (CVSS 7.5). Status: patched. CVE-2026-104850 · GHSA-6qxp-vccf-f47h. MCP TypeScript SDK advisory.
Claude Code: Managed Settings Not Applied When a Stored API Key Was Preferred Over Enterprise Sign-In
Low (CVSS 2.0). Status: patched. CVE-2026-103012 · GHSA-gfvf-j8jh-jxxw. Claude Code advisory.
MCP Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas
Medium (CVSS 6.5). Status: patched. CVE-2026-116686 · GHSA-rwrf-2pqf-9j8j. MCP Python SDK advisory.
MCP Python SDK: OAuth client could send credentials to an authorization server chosen by the MCP server
High (CVSS 7.5). Status: patched. CVE-2026-115563 · GHSA-qx49-fqc8-xw99. MCP Python SDK advisory.
Claude unifies plugins and connectors in one directory
Anthropic merged plugins and connectors into a single directory. Public listings are labeled Verified or Community.
Claude Code: Claude Desktop (macOS): opening a malicious file from a Cowork folder could run commands on the host
High (CVSS 8.5). Status: patched. GHSA-v234-4jrq-mgg6. Claude Code advisory.
Goose 1.50 speaks the latest MCP protocol natively
Goose CLI 1.50.0 negotiates 2026-07-28 natively; form elicitation works over remote HTTP.
VS Code (Copilot Chat / MCP): Information Disclosure through Automatic Remote Image Fetch in Chat
Medium (CVSS 5.3). Status: patched. CVE-2026-81380 · GHSA-vww8-mqc2-4x8v. VS Code (Copilot Chat / MCP) advisory.
VS Code (Copilot Chat / MCP): Azure DevOps access token disclosure through GitHub Copilot Chat workspace settings
Medium (CVSS 6.5). Status: patched. CVE-2026-81381 · GHSA-rvgr-2w56-2j67. VS Code (Copilot Chat / MCP) advisory.
VS Code (Copilot Chat / MCP): Agent Network Filter Bypass Vulnerability
High (CVSS 8.2). Status: patched. CVE-2026-81379 · GHSA-hr37-8jwr-q8p8. VS Code (Copilot Chat / MCP) advisory.
VS Code (Copilot Chat / MCP): Visual Studio Code MCP gallery metadata path traversal
Medium (CVSS 6.5). Status: patched. CVE-2026-81377 · GHSA-g6p5-6xp8-5jwg. VS Code (Copilot Chat / MCP) advisory.
VS Code (Copilot Chat / MCP): Agent Network Filter Security Feature Bypass
High (CVSS 8.2). Status: patched. CVE-2026-81378 · GHSA-4gv7-q2x8-32p8. VS Code (Copilot Chat / MCP) advisory.
VS Code (Copilot Chat / MCP): Remote code execution through workspace-configured remote agent host connections
High (CVSS 8.8). Status: patched. CVE-2026-78462 · GHSA-2cmq-rv52-5rf6. VS Code (Copilot Chat / MCP) advisory.
ChatGPT Desktop gets working form and URL elicitation
Desktop 26.901: form and URL elicitation both verified working over remote HTTP.
Claude Sonnet 5 keeps its $2 / $10 API price
The increase to $3 / $15 scheduled for Sep 1, 2026 did not take effect; the introductory price is now standard.
August 2026
Copilot CLI adds the new protocol and CIMD OAuth
1.0.81 adds the 2026-07-28 protocol; 1.0.83 adds CIMD for OAuth.
MCP Java SDK: Unbounded reads when parsing Server-Sent Events in HTTP client transports
Medium (CVSS 6.5). Status: patched. GHSA-5q7x-232h-f834. MCP Java SDK advisory.
MCP Java SDK: Unbounded request-body reads in mcp-core HTTP server transports allow remote denial of service (CWE-770)
High (CVSS 7.5). Status: patched. CVE-2026-108395 · GHSA-4x8c-5vv7-973f. MCP Java SDK advisory.
VS Code (Copilot Chat / MCP): Agent network filter bypass via IPv4-mapped IPv6 literals
High (CVSS 8.2). Status: patched. CVE-2026-69306 · GHSA-6xp2-9cj3-f488. VS Code (Copilot Chat / MCP) advisory.
VS Code (Copilot Chat / MCP): Copilot Custom Agent Hook Remote Code Execution Vulnerability
High (CVSS 7.8). Status: patched. CVE-2026-70335 · GHSA-w79w-rj9h-vg4f. VS Code (Copilot Chat / MCP) advisory.
VS Code (Copilot Chat / MCP): Copilot Chat Security Feature Bypass Vulnerability
High (CVSS 7.1). Status: patched. CVE-2026-65675 · GHSA-3hjg-cwxj-qfc6. VS Code (Copilot Chat / MCP) advisory.
MCP Registry (V.A.P.E entry): Shai-Hulud worm payload delivered through an official MCP Registry entry
Not Rated. Status: research. OX Security reports a registry-listed MCP server shipping a payload that wrote malicious .vscode/settings.json and .claude/settings.json files.
July 2026
OpenAI API: Priority processing renamed Fast mode
OpenAI's pricing page notes Priority processing was renamed Fast mode on Jul 30, 2026.
MCP 2026-07-28 ships: stateless, with sampling and roots deprecated
MCP 2026-07-28 released: stateless (no initialize), sampling and roots deprecated.
June 2026
Gemini Code Assist for individuals stops serving; users move to Antigravity
Google says consumer Gemini Code Assist tiers ended on June 18, 2026; Standard and Enterprise editions remain on Google Cloud pricing.
Windsurf becomes Devin Desktop
Cognition renamed Windsurf to Devin Desktop and made the Agent Command Center the main view. The Windsurf JetBrains plugin is in maintenance mode, and Cognition recommends Devin over ACP instead.
February 2026
Cursor opens a reviewed plugin marketplace
Cursor launched its Marketplace with manually reviewed plugins that bundle rules, skills, MCP servers and hooks. Amplitude, AWS, Figma, Linear and Stripe were launch partners.
January 2026
Codex arrives inside JetBrains IDEs
OpenAI Codex is now selectable in the JetBrains AI Chat agent picker (2025.3+). JetBrains users get a second frontier agent without leaving the IDE.
Weekly, free
What changed in AI integrations
One short email when MCP clients, plugin ecosystems, IDE integrations, AI plan prices or security advisories change. Every item is sourced.