Daily AI Zine · No. 071

Today's Big Thing

The one thing that matters

Test it

Copilot’s weekly release makes containment part of everyday coding

The important move is local sandboxing, not just more model choice.

GitHub’s latest Copilot weekly release adds new models, local sandboxing in the Copilot app, and updates across Slack, Microsoft Teams, JetBrains, and VS Code. Local sandboxing means agent work can be run inside a constrained environment on the machine, reducing the chance that a coding agent touches files or systems it should not. For daily product work, this matters because model choice, chat surfaces, and safety boundaries are now arriving together. Treat this as a controlled trial, not a blanket upgrade: pick one active repo, run the same issue through the old workflow and the sandboxed Copilot path, then compare speed, review burden, and mistakes before widening use.

T1GitHub Changelog09/25

My AI Ecosystem

Your actual stack

Use it

Copilot admins get 28 days before new defaults settle in

GitHub is introducing a new global default policy for generally available Copilot features and supported client capabilities in Copilot Business and Enterprise settings. Admins have 28 days to review it. This is governance work, not feature shopping: check which features become available by default, decide what should stay blocked, and record the policy before agents spread across repos and editors.

T1GitHub Changelog09/25

Test it

Copilot Memory becomes part of security autofix

GitHub says agentic autofix now reviews Copilot Memory when customers have enabled it, using stored context to help resolve security alerts. That makes repo memory operationally sensitive. The immediate move is to keep memories specific, current, and reviewable, because stale architecture notes can now influence automated security fixes.

T1GitHub Changelog09/25

Test it

Cloudflare lets coding agents fix incomplete Turnstile setups

Cloudflare says Turnstile Spin uses a preferred AI coding agent to wire up server-side verification when Turnstile has been misconfigured. The useful point is narrow and practical: form protection often fails because backend validation is skipped. This is a good candidate for a one-site test on a low-risk form before trusting it on lead capture or checkout paths.

T1Cloudflare Blog09/25

Watch it

Hot signal: Runway pushes toward steerable real-time video worlds

Runway’s WorldPrompt report describes GWM Worlds 2 using persistent context and timed actions to steer video and audio in real time. Pair that with Runway’s Gen-4.5 positioning around motion quality, prompt adherence, and visual fidelity, and the signal is clear: video tools are moving from clip generation toward controllable world direction. For production, watch this as previsualization, not final delivery yet.

T2Latent Space09/25 T1Runway Research

CoWork Corner

Claude CoWork, day to day

CoWork has no new move, so refresh the memory boundary

Claude CoWork is the workspace Adrian uses for persistent projects, operational records, and AI-assisted workflows. No meaningful CoWork product change was found in today’s candidates. The useful revisit is context engineering, meaning the practice of deciding what the AI should see, remember, and ignore before it works. Open one active project and add a short boundary note: what files are canonical, what decisions are settled, what sources are not trusted, and which tools should not be used without explicit approval.

Tier 4 · quiet day, honest fallback

T1Anthropic Engineering Blog

GPT Desk

OpenAI, ChatGPT, Codex

Test it

Give the Agents API one bounded Grey Group OS job

OpenAI’s Agents API is a managed service for cloud agents, powered by the Codex harness for orchestration, long-running sessions, and tool use. Adrian should care because Grey Group OS already has repeatable tasks that are too structured for chat and too annoying for manual handoff. Today’s experiment: create one agent brief for proposal QA, with permission to read a draft, check missing sections, and return a source-linked punch list, but not edit the source file.

T1OpenAI News09/10

Test it

Use OpenAI security triage as a pattern, not a platform bet

Cloudflare describes using production traffic and security signals with OpenAI Daybreak models to prioritize vulnerabilities, prepare edge mitigations when safe, and propose code patches. Adrian should care because Goodsense, SET, and client-facing builds need cheap first-pass risk triage before a human review. Today’s action: pick one Netlify or GitHub project and ask Codex to produce a vulnerability-review checklist that ranks findings by business exposure, not only technical severity.

T1Cloudflare Blog09/03

Small Money Systems

Small, repeatable, real

Use it

Small system: GitHub security-cleanup pack

System: build a fixed-scope repo cleanup pack that checks Copilot Memory, agentic autofix output, and form-protection gaps. Customer: small agencies, local businesses, or production vendors with neglected GitHub repos. Offer: a short security-readiness report plus one implemented low-risk fix. Price: ¥55,000. Existing assets: Grey Group OS, GitHub experience, Netlify habits, and Adrian’s production-client trust. AI workflow: Claude Code or Codex reviews the repo, GitHub agentic autofix handles eligible alerts, and Turnstile Spin is tested where form validation is incomplete. First action: choose one internal repo and write the before-and-after checklist. Repeatability: the same checklist becomes a paid intake template. Effort: half day. Expected value: a repeatable cleanup offer and a credible reason to revive old web-maintenance leads.

T1GitHub Changelog09/25 T1Cloudflare Blog09/25

Test it

Small system: real-time world previsualization pack

System: package AI video-world tests into a paid previsualization service. Customer: brands, event teams, and location owners that need to see an activation concept before approving spend. Offer: three short moving moodboards with a written director note and usage caveats. Price: ¥75,000. Existing assets: Goodsense, Street Attack Japan concepts, Adrian’s commercial production taste, and existing decks. AI workflow: ChatGPT or Claude drafts timed scene prompts, Runway generates the visual tests, and Codex or Claude Code stores outputs and notes in a reusable project folder. First action: convert one existing concept into three timed prompt variants. Repeatability: each accepted style becomes a reusable pitch template. Effort: one hour. Expected value: faster paid concept validation and stronger upsell material for production proposals.

T2Latent Space09/25 T1Runway Research

Build Next

Deployable now

Use it

Build a Copilot policy review page before defaults drift

What to build: a one-page internal Copilot policy register that records enabled features, blocked features, owner, review date, and reason. Why now: GitHub has introduced a new default policy for Copilot Business and Enterprise, with 28 days to review settings. Effort: one hour. Expected impact: fewer surprise agent capabilities inside repos and faster admin decisions later. Dependencies: access to the organization’s Copilot settings and one GitHub repo where Claude Code or Codex can generate the markdown or small dashboard.

T1GitHub Changelog09/25

Test it

Build a Turnstile validation fixer for one form

What to build: a small Netlify Function pattern that verifies Turnstile server-side before accepting a form submission. Why now: Cloudflare says Turnstile Spin can use an AI coding agent to repair incomplete Turnstile setups. Effort: half day. Expected impact: lower bot risk on lead forms and a reusable security snippet for future sites. Dependencies: a Cloudflare Turnstile setup, one test form, and a repo where Codex or Claude Code can make and review the change.

T1Cloudflare Blog09/25

Try This Today

One action, right now

Open the Copilot admin settings for one organization or repo-adjacent workspace. Write down which generally available features are enabled, which should stay blocked, and who owns the next review. Do this before the 28-day review window becomes background noise.