Cursor wants to host the code, run the agent, and sit inside the review loop. That’s a lot of trust concentrated in one workspace. Quick context before today’s update: Novee Security showed how default coding-agent harnesses around Claude Code, Gemini CLI, and Codex could be abused through low-privilege GitHub issue input. A later Claude Code repro put hook-governance semantics back in focus, and Claude Code v2.1.233 added path-validation and execution-environment fixes, including a fix for an NTLM credential-leak vector. This is AI Coding Daily. Today: a model catalog that quietly shrinks your working memory, an API setting that can blow up your cache bill, and Cursor moving closer to the repo’s control plane. This one's from GitHub:
After the recent long-context rollout, the server-delivered Codex model catalog still gives GPT-5.6 Sol a smaller context profile than Terra and Luna on the same ChatGPT account. A fresh /models fetch returned the same ETag for all three models: gpt-5.6-sol: max_context_window = 272000 gpt-5.6-terra: max_context_window = 872000 gpt-5.6-luna: max_context_window = 872000
Same fresh /models response, same ETag: Sol gets 272K, while Terra and Luna get 872K. If your router picked Sol expecting long-diff capacity, it just silently cut your working budget by roughly two-thirds. The report isolates it pretty cleanly: edit models_cache.json, and Codex honors the larger window; let the TTL refresh, and Sol falls back to about 258.4K effective context. That points straight to server-delivered catalog metadata or entitlement logic. Great. The catalog says all three models are on the same account, but one gets demoted mid-workflow. A 50-file refactor does not care whether that was rollout plumbing or a product decision. Treat context-window claims as runtime configuration. Log the delivered limit per run. The difference between 272K and 872K changes truncation, retrieval, latency, and the bill. This one's from Cursor:
Cursor can now host your code. Origin begins rolling out today in early beta on all paid plans. We're starting with the essentials, designed for agent scale: repos, pull requests, code browsing, and GitHub sync. Agent-native features ship soon.
Cursor Origin is early beta, but it already puts repos, PR review, GitHub sync, and Buildkite checks in one workspace. For a feature called a Codebase tab, that’s an impressively large egress surface. GitHub remains the source of truth for synced repos, which is the sensible part. But Cursor says comments, replies, and PR activity sync within seconds, so teams need to know exactly what code and review text leave, along with any agent context. The agent can answer questions, change code, update the PR, or push a branch from that same surface. Sounds like a great workflow—until a regulated team has to explain which integration saw the diff, the CI logs, and the branch credentials. Here's one from Hacker News:
I do wonder if calling this "Origin" is going to result in semantic misinterpretations by LLMs. Ie saying, > "hey can you push to origin main?" now has two separate meanings. A LLM may inadvertently push your code to a new provider without you knowing. It's walking a thin line between genius-growth-move and domain typosquatting.
“Push to origin main” already means something very specific in developer muscle memory. If Cursor’s Origin becomes another destination, CLI and agent confirmations need to put the remote URL right in front of you. Yep. One ambiguous remote name plus an eager agent is how somebody discovers their private branch has had a very productive afternoon. Hacker News, weighing in:
"Legacy Privacy Mode disables code storage, so you can't set up a Codebase. Switch to a different privacy mode below to continue." The only other privacy mode is to share data for Cursor to do training. All your codebases are belong to us.
If Legacy Privacy Mode blocks Codebases because code storage is disabled, make that trade-off unmistakable before anyone connects a repo. Source-code hosting needs a clear, upfront warning. From Hacker News:
Cursor is allegedly worth $60B. That is a higher market cap than Mercedes Benz group, which is profitable and has $144B revenue. But the website uses 100% CPU. And this is a beta for paid plans, not a GitHub alternative.
A paid beta does not need to dethrone GitHub on day one. It does need a web app that can browse a large monorepo without turning a developer laptop into a space heater. The test is boring: diff rendering, search, PR timelines, and real-time sync under load. Those are the features Origin is asking teams to trust with the review path. GitHub writes:
Security: remote file reads, session restore, CLAUDE.md includes, workflow scripts and file uploads now reject Windows NT-namespace ( \??\ ) paths, hardening the remaining pre-approval file accesses against the NTLM credential-leak vector Fixed auto mode in very long sessions repeatedly re-checking and denying sandboxed commands' network access after the conversation had been compacted
Claude Code 2.1.234 closes the Windows NT-namespace path hole across remote reads, session restore, CLAUDE.md includes, workflow scripts, and uploads. That is an impressively long list of places a pre-approval read could have gone sideways. Back on the Claude Code harness-security thread: 2.1.234 extends the NTLM path hardening to more pre-approval file accesses. On Windows, a manipulated path could coax the machine into handing network credentials to an attacker-controlled server. That coverage matters. Also, the long-session fixes deserve attention: after compaction, auto mode was repeatedly denying network access to sandboxed commands; session-scoped permission answers could also vanish for background subagents. Permissions that change personality after a long conversation are a great way to make an incident report weird. The patch is concrete, which I appreciate. But teams still need to test permission state after compaction and subagent handoffs, not only the first clean tool call in a fresh session. Here's kduffie at OpenAI:
But, it appears, that tool_choice is rendered into the input context. And therefore if you change the tool_choice on the last cycle, you are effectively losing the entire cacheable prefix and we have pay write tokens for the entire size of the last cycle. That’s very expensive.
OpenAI’s Responses API appears to render tool_choice into the cached input. So if a team runs required while it gathers evidence, then switches to none for the final answer, it blows away the whole cacheable prefix on that last cycle. Which means a policy switch becomes a billing event. You didn’t add a giant document; you changed one field, and suddenly you’re paying write-token prices again for the accumulated tool trail. And auto isn’t a clean escape hatch: the report says GPT-5.6 will occasionally decide it doesn’t need to call a tool at all. So developers get to choose between unreliable evidence collection and an invisible cache miss. Excellent set of options. It’s the same issue as that 272K-versus-872K catalog split. Context budgeting falls apart when operational details are treated as implementation trivia. Here's Divyansh Rai at DEV Community:
You pin a golden set of expected tool calls as a contract, re-run them against the live model, and get pass / fail / inconclusive with a diff showing what changed. It is not an eval framework. promptfoo, DeepEval and the rest score whether an output is good — semantic quality, usually judged by another model. toolcontract asks a narrower, cheaper question: is the tool call structurally the same as the one I pinned?
toolcontract’s v0.1 pitch is gloriously boring: pin the tool-call trajectory, rerun it, fail the build when city quietly becomes location. That’s the kind of breakage that makes it through a polished demo and detonates in a parser. And it draws the boundary correctly. promptfoo and DeepEval can tell you an answer looks good; toolcontract checks whether the interface stayed stable—whether the tool name and argument shape held up, and calls came in the same sequence. Those are different tests, and teams need both. I especially like INCONCLUSIVE as a first-class result. If the comparator can’t tell whether a model changed behavior, it shouldn’t wave the PR through with a little green checkmark. And that ties back to the tool_choice caching failure we just covered. A field can change provider-side rendering and blow up a cacheable prefix. A structural fixture around emitted calls lets you catch that behavior moving before the token bill does. If you’re enjoying AI Coding Daily, subscribe and leave us a review wherever you’re listening. Your feedback helps more people discover the show, and we’re grateful you’re here.
You’ll find links to every story in the show notes if you want to dig deeper into anything we covered. Thanks for listening, and we’ll be back tomorrow. That’s it for AI Coding Daily today. This is a Lantern Podcast.