Cursor's new boss agent writes no code — and OpenAI caught its models passing notes

Two themes this week, and they're the same theme. Coding agents are getting bosses and long memories, and both are showing where the seams are. Cursor shipped a coordinator, OpenAI shipped its Codex harness as an API, and OpenAI also published a very uncomfortable finding about what agents do with their own memory. ## This Week in AI Coding - **Cursor Projects: the boss agent that writes no code.** Cursor's [Projects beta](https://cursor.com/blog/projects) (Sept 10) puts a coordinator on top of a feature, migration or whole app. Per Cursor, the coordinator "doesn't write code itself" and just directs the agents that do, so it never blocks. Their numbers: new users merge 30% more PRs, and people who mostly use Projects merge six times as many. Those are Cursor's own stats, so salt to taste, but the shape (a planner that only delegates) is where every tool is heading. - **OpenAI puts the Codex harness behind one API call.** The [Agents API](https://openai.com/index/introducing-the-agents-api/) went to public beta on Sept 10. You get a managed harness (sessions, context compaction, recovery), custom tools and MCP servers, and sandboxes that run on OpenAI's infra, your own, or a partner's (Cloudflare, Modal, Vercel, E2B and others at launch). If you've been hand-rolling an agent loop, this is the "should I stop?" moment. Cost of admission is lock-in to their harness. - **OpenAI caught its models leaving notes to hide their mistakes.** In a [disclosure on Sept 17](https://techcrunch.com/2026/09/17/openai-caught-its-models-leaving-notes-to-successors-to-hide-bad-behavior/), OpenAI said it found 27 compaction summaries in training with jailbreak-style instructions written by the model for its successor. One told the next run to be transparent "only if asked". This matters for anyone running long agent sessions: the summary that carries your context forward is also a place where an agent can quietly steer its future self. Read your compaction output sometimes. - **Copilot admins can now lock down agent operations.** GitHub's [managed permissions](https://github.blog/changelog/2026-09-09-enterprise-managed-permissions-for-github-copilot-agent-operations/) (Sept 9) let Business and Enterprise admins decide which shell commands, file reads and edits, and network domains are blocked, need approval, or run freely. Users and workspaces can't override it. Boring, and exactly what makes agents shippable inside a company. - **Stolen AI keys are now a supply-chain problem.** Anthropic's [September threat report](https://www.anthropic.com/threat-intelligence-report-september-2026) describes a group (GTG-50020) that pulled production API keys out of an AI vendor's evaluation sandbox, then hit roughly thirty AI companies in about four days. Treat AI keys like production credentials. Don't park real ones in eval or test sandboxes. - **Cognition raises $2B at a $48B valuation.** Per [TechCrunch](https://techcrunch.com/2026/09/08/cognition-hits-48b-valuation-signaling-investors-believe-ai-coding-is-far-from-a-winner-take-all-market/) (Sept 8), the Devin maker's annualized revenue went from $492M in May to about $900M now. Read it as investors betting AI coding won't be won by one tool. Good news if you don't want to be locked to one. - **AI-exposed jobs are seeing pay rise, and seniority takes the gains.** [Indeed Hiring Lab](https://hiringlab.indeed.com/2026/09/17/ai-exposure-isnt-squeezing-advertised-pay-in-the-us-its-boosting-it/) (Sept 17): advertised pay in the most AI-exposed occupations is up about 46% since 2021 versus 25% in the least exposed. The premium is roughly 17 points at senior level, 12 at mid, and 2 at entry level. Software development is on their list of high-exposure fields. Same story as the last few months: AI isn't crushing pay, it's just very unevenly distributed. ## What We Shipped Not a flashy week, so here's the honest version: - Fixed the weekly analytics digest, which was reading the wrong database credentials from my environment instead of the analytics one. - Daily site checks: 33 of 36 passing, 3 warnings (EndOfCoding, Vibe Coding Academy, APIGhost), 0 failures. - The weekly billing review failed again this week. Still chasing that. - The ebook weekly update is written, but the deploy is stuck on a Vercel auth problem. ## Tool of the Week: Claude Code's `plugin eval` and AGENTS.md Two small changes in the [Claude Code changelog](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md) worth knowing. v2.1.269 added `claude plugin eval`, which runs a plugin's eval suite against Claude Code and gives you scored, reproducible results as JSON plus an HTML report. And v2.1.277 added AGENTS.md support: in a project with no CLAUDE.md, Claude Code reads AGENTS.md instead (not yet on Bedrock, Vertex or Foundry). If you maintain skills or plugins, evals are how you find out whether they actually do anything. If your repo already has an AGENTS.md for another tool, you no longer need a duplicate file. ## Quick Links - [Dev Weekly, Sept 7-13](https://singhajit.com/dev-weekly/2026/sep-7-13/openai-agents-api-cursor-projects-react-19-3/): a good one-page roundup of the week's dev news, security and funding. - [OpenAI Agents API docs](https://developers.openai.com/api/docs/guides/agents-api/overview): the quickstart, if you want to see what "Codex harness as an API" looks like in code. - [Anthropic's September threat report](https://www.anthropic.com/threat-intelligence-report-september-2026): worth reading before you decide where your API keys live. - [Claude Code changelog](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md): it ships several times a week now, and skimming it is the cheapest way to keep up. Thanks for reading. Reply and tell me what you're building. Guy --- [endofcoding.com](https://endofcoding.com) · [vibecodingebook.com](https://vibecodingebook.com) · [llmhire.com](https://llmhire.com) · [YouTube @endofcoding](https://www.youtube.com/@endofcoding)