Issue 26

27 June 2026

Hi there,

A flaw in Amazon Q Developer showed how an untrusted repository can start a privileged tool process. GitHub tightened Actions cache permissions, while npm laid out its next major release’s dependency restrictions.

Artificial Intelligence

1. Google’s Interactions API becomes its primary Gemini interface

Google announced GA on 22 June for an API covering models and agents with server-side state, background execution and tool combination. GA means a stable schema, not a guarantee that every preview capability mentioned in the post is generally available. Teams with agent orchestration glued to earlier endpoints have a migration question, not necessarily an emergency.

2. Gemini 3.5 Flash gains built-in computer use

Google’s 24 June announcement integrates computer-use capability into its Flash model rather than a separate specialised model. It describes browser, mobile and desktop interactions. As with any computer-using agent, decide what it may see and click before benchmarking whether it can finish a task.

3. OpenAI gives trusted partners an early GPT-5.6 preview

In its 26 June note, OpenAI said Sol, Terra and Luna were entering a limited preview rather than general availability. OpenAI attributed the restricted initial rollout to a US government request; broad access was described as a future plan. Keep the distinction between a preview and a model already available to customers.

Microsoft

4. Copilot CLI’s redesigned terminal interface reaches GA

GitHub announced general availability on 23 June: tabs expose issues, pull requests and gists inside an interactive session and tool configuration is available in the terminal. The practical question is whether a faster route from an issue to an agent action also makes the permission boundary visible.

Development

5. npm describes v12 dependency restrictions before release

GitHub’s 9 June announcement describes approval requirements for install scripts and restrictions on Git and remote URL dependencies in the next major release. Version 12 was estimated for July, not yet released. npm 11.16.0 already emits warnings to help teams audit their dependency trees before upgrading.

6. Actions can run steps concurrently within one job

A 25 June GitHub changelog introduced a background capability for steps, with separate logs instead of shell backgrounding’s interleaved output. Useful for independent setup work; steps with shared mutable files or an implicit dependency still require deliberate ordering.

Information Security

7. A repository config could launch an Amazon Q MCP process

The 26 June disclosure describes CVE-2026-12957: a malicious .amazonq/mcp.json in an opened workspace could cause Amazon Q Developer’s VS Code extension to launch an MCP server process with the developer’s environment. Amazon had patched the issue. This is a demonstrated route to credential theft, not evidence of universal compromise. The boundary is between untrusted repository configuration and a privileged process.

8. GitHub makes Actions cache read-only for untrusted triggers

The 26 June GitHub notice limits cache writes from untrusted workflow triggers. A trusted push workflow can still populate the cache for a later read-only run. Cache poisoning is a different route across the same trust boundary as the MCP config: user-controlled input should not gain the privileges of a trusted build.

Coming up

July (estimated): npm v12 is expected to restrict install scripts and Git and remote URL dependencies by default; the release date remains an estimate.

Let me know if anything here is worth digging into.

Happy Friday, Julian

How this is made

Throughout the week I stumble across a mildly unreasonable number of interesting things, and I forward them instantly to the friend or colleague I think might care – sometimes to their delight, sometimes to their annoyance, and often with no context at all. Heartbeat is the attempt to do that a little better.

Every Friday a small agent I built, Honoka, looks through the places where those links tend to leak out: my private email, work email, Matrix, Mastodon, WhatsApp, Apple Messages, Signal, and the faint imprints on the platen of my Olympia typewriter (still not an API, tragically). It sorts, filters, groups and summarises the week, then hands me a draft.

Honoka is guided by a private corpus of things I have written over the last fifteen years, so it can get closer to how I sound in more-or-less official emails and public notes. I still take a pass by hand: remove things, change sentences, check links, argue with the judgement. Whether that is enough is, frankly, the experiment. Every issue has one item written entirely by hand. If you can reliably spot it, hit reply and judge.