Pondero’s Friday and Saturday briefs this week are not thought leadership. They are version numbers. Upgrade anything below Claude Code 2.1.179 or Codex 0.146.0. SHA pinning for plugins is deprecated, which is a problem because SHA pinning is the control a lot of internal plugin reviews actually used. GitHub Copilot and Gemini CLI still leave marketplace plugins from repos you do not own in a gray zone until a fix lands.
The same brief says Safari 27.0, out September 17, ships an MCP server on safaridriver. An agent can drive a real Safari window without an extension. Two toggles, one command. That is a browser becoming a tool the same week the coding agents learned to fan out.
We already did Claude Code as pair programming and a generic multi-agent roundup. This week is narrower. A patch, a deprecation, a cloud-only Projects mode, and a testing vendor trying to bolt eyes onto the agents that now write UI 10x faster.
The version pin is the story, not the demo
Pondero’s Saturday note is the one to print on a sticky: 2.1.179 and 0.146.0. If your laptop is older, you are running the hole. If your CI image is older, every pull request is running the hole. “We reviewed the plugin” is not a sentence you get to keep if the review assumed SHA pinning and the pin no longer means what the review thought it meant.
Internal plugin allowlists are how companies pretended marketplace code was tame. You freeze a hash, you write a ticket, you tell security the agent can load that plugin. Deprecate the pin and the ticket is a souvenir. Pondero’s line is mean and correct: the teams doing this by the book are the ones who thought they were covered.
Copilot and Gemini CLI are called out separately. Treat every marketplace plugin from a repo you do not own as unreviewed until a patch exists. That is not a vibe. That is how you talk to an auditor when the agent has file system access. If you also have to prove which agent versions engineers run, Pondero mentions Comp AI as an evidence trail for SOC 2 and ISO 27001. I am not selling Comp AI. I am noting that “which binary did they run” is now an audit question, not a curiosity.
If you cannot inventory agent versions, you cannot claim you upgraded. Ask for a claude --version in the engineering wiki. Ask for the Codex number. Put both in the same place you put the Node version, or you will learn the number from a brief after the fact.
Parallel agents are a scheduler problem
The Saturday headline is that Claude Code fans out parallel agents. The Friday brief says Projects goes multi-agent, cloud-only for now. Local Projects that were a folder and a prompt are not the same object as a cloud fan-out. If your company banned cloud agents last quarter, Friday’s feature is not for you yet. If your company already put Cursor cloud agents in a sandbox, you already had this argument. We covered Cursor moving into Cloudflare sandboxes. Same shape, different logo: the agent that used to live in a terminal now lives in someone else’s region.
Force-tool-call shows up in the Friday brief as a toggle that makes a flaky small-model agent predictable, and it ships off by default. Off by default means demos look flexible and production looks like a coin flip. Turn it on for the jobs where “the model decided not to call the linter” is not an aesthetic choice.
Queue mode means worker processes exist somewhere. Pondero name-drops Cloudways and Make as places people already park jobs. You do not need those brands. You need to know whether the parallel agents share a working tree, a branch, or a set of pull requests. Four agents on one dirty checkout is how you get a commit that no human can read. Four agents on four worktrees is how you get four bills.
Token cost is the unprinted line. Fan-out is a multiplier. If one agent was already expensive, four agents doing speculative refactors are a finance meeting. Set a cap before you set a demo. The patch notes will not do that for you.
Safari 27 is an MCP server with a GUI
Safari 27.0 on September 17 adding MCP on safaridriver is the kind of platform detail that looks small and then eats a sprint. No extension. Real window. Enable the advanced features toggle, run the command, and an agent has a browser that is not headless Chrome in a container.
That is good for tests that fail in WebKit. It is bad for the assumption that browser automation is a CI concern. Now the same laptop that runs Claude Code can drive the employee’s actual Safari, with the employee’s cookies, unless you separate profiles. Separate them. Do not let an agent click through a password manager prompt in the same session you use for mail.
MCP servers are spreading faster than review processes. Power Apps, in the same Friday brief, put a canvas authoring agent at GA and opened an MCP server in public preview. The agent creates, inspects, and updates canvas apps in a live session while the maker decides what to hand off. A model app-builder skill also hit GA and runs through GitHub Copilot CLI or Claude Code. Microsoft is not waiting for your plugin policy.
If your shop is Microsoft-heavy, that GA is the news. If your shop is not, it is still a reminder that “the IDE agent” and “the business-app agent” are converging on the same protocol. The protocol does not know your allowlist.
Applitools is selling eyes because the agents are blind
Applitools put out a paid GlobeNewswire release about Eyes Visual AI MCP Tools. Connect deterministic visual AI to Claude Code, Cursor, Copilot, and Cline. Agents get visual diffs and page structure snapshots so a layout shift can be tied to source. The pitch: agents can accept or reject baseline changes and mask dynamic data, cutting test maintenance overhead by up to 95 percent from the IDE.
Treat 95 percent as a vendor number. Treat the problem statement as real. Faros AI telemetry in the same release says median PR review times are up 5x and production incident risk more than tripled as teams let agents author UI faster. Vision-language models inspecting code cannot see how a page renders across browsers, devices, and OS. Applitools calls that a “Probabilistic Validation Gap.” The phrase is branded. The gap is not.
If your agents ship CSS, you need a check that is not another model squinting at a screenshot. Deterministic visual baselines are one answer. Screenshot tests you already have are another. “The agent said it looked fine” is not an answer. Review time going to 5x is how a 10x coding speedup becomes a 0.5x release speed. The bottleneck moved from typing to staring.
I would not buy a tool from a press release. I would add a visual check to the definition of done for agent-written UI this week, even if the check is an existing Playwright suite. Safari’s MCP server and Applitools’s MCP tools are the same week because agents that write interfaces now expect to operate interfaces. Give them a sandbox, not production credentials.
What to do on Monday morning
Print the versions. Claude Code 2.1.179. Codex 0.146.0. Anything below those two gets upgraded before the next agent session, including CI images.
Inventory plugins. If the review rested on SHA pins, reopen the review. If Copilot or Gemini CLI pulled a marketplace plugin from a public repo you do not own, disable it until the vendor says the hole is closed.
Keep parallel agents off shared dirty trees. One worktree per agent, or do not fan out. Turn force-tool-call on for jobs that must call a test runner.
Do not point Safari MCP at a profile that holds your bank, your mail, or your SSO. Make a clean browser profile for agents. If you cannot, wait.
For UI, pick a visual check that is not a chatbot. If Applitools is already in the company, try the MCP path on one app. If it is not, run the suite you have on agent branches before review. Faros’s 5x review time is the cost of skipping that.
Cloud-only Projects stay in the cloud. If that violates your data policy, you do not have the feature. You have a landing page. Local Claude Code remains the pair-programmer we already wrote about. The new work is the fan-out, the pin that vanished, and the browser that grew a socket.
Write the policy in one page, not in Slack. Name the minimum versions. Name the plugin rule: no marketplace install from a repo the company does not fork. Name whether Safari MCP is allowed, and on which macOS profile. Name whether Claude Code Projects cloud is allowed, and for which data classes. If legal has not seen MCP yet, they will see it after the first agent opens a customer staging site in a real browser.
Microsoft’s Power Apps canvas authoring agent being GA is the business-side copy of the same week. Makers hand work to an agent in a live canvas session. The MCP server is in public preview. Copilot CLI and Claude Code can run the app-builder skill. If your company already locked down engineering agents and left Power Platform as a free-for-all, the lock is a side door. Put the same version and plugin questions on the Power Platform team. They will not enjoy the question. That is the point.
Applitools saying agents can maintain baselines from the IDE, including accept, reject, and dynamic data masking, is a permission model. Accepting a visual baseline is a production decision. If an agent can accept, it can bless a broken header on mobile Safari. Keep accept in human hands even if you let the agent file the diff. Faros’s incident risk more than tripling is what happens when speed is unblocked and judgment is not.
Queue mode needs an owner. If workers run on a laptop, the laptop is a server. If they run on Cloudways or Make, those accounts need the same SSO and logging as CI. Parallel agents without a queue owner are four processes you will kill with Activity Monitor at 6 p.m. and never reproduce.
The week is not “agents got smarter.” The week is “the bookkeeping caught up.” Versions, pins, browsers, and screenshots. Unsexy on purpose. Sexy is how you skip 2.1.179 and let a plugin from a stranger’s repo run next to your checkout.