DEV Community: @lukeocodes 🕹👨‍💻

DevRel This Week, 2 November: Agents Start 40% of Pull Requests

@lukeocodes 🕹👨‍💻 — Mon, 02 Nov 2026 00:00:00 +0000

DevRel this week, 2 November 2026: GitHub says agents (software that does a task on its own) now start more than 40% of pull requests, the proposed code changes people review before they go in. Ruby Central rejected 120 of the 134 AI scanner findings it reviewed, and curl now sends low and medium security reports to its public issue tracker. OpenAI DevDay Exchange reaches London tomorrow, and talk submissions for FOSDEM in Brussels are open.

Where can developers in Europe go this month?

OpenAI DevDay Exchange is in London tomorrow, Tuesday 3 November, from 2pm. Berlin and Paris went first. You can still apply, but the venue and programme only go to people who get approved. São Paulo is on 6 November and Mexico City on 10 November (OpenAI).

FOSDEM 2027 is on 30 and 31 January, and the list of accepted developer rooms (themed tracks run by volunteers) came out on 21 October (FOSDEM). The Package Management room runs on the Sunday afternoon at the Université libre de Bruxelles and takes talks until 1 December. Talks that mainly promote a product won't get in, and popular subjects like using AI to help with security get lower priority (Stewardship Lab).

Why are maintainers pushing back on security reports?

Michał Górny, who works on the Gentoo Linux distribution, wrote on 27 October that "vulnerabilities are reported at unprecedented rates", and that a lot of it is AI-generated junk someone still has to sort through. Once a bug is logged as a vulnerability, security scanners flag it whether it affects you or not. Górny says Gentoo has shipped updates for bugs that never affected Gentoo, only to stop those scanners complaining (Górny).

Ruby Central's AI scanner has been through about 317 of the 619 gems (Ruby packages) on its list. People reviewed 134 of the findings and rejected 120, because an attacker couldn't reach the code, the code was meant to work that way, or someone had already reported it. One real find: rubyntlm was checking every login against an empty password, so anyone with a valid username could log in, and 0.6.6 fixes it (Ruby Central, 28 October).

curl now sends low and medium issues to its public issue tracker, and only high and critical ones stay private until a fix ships. The same policy says "Do not lazily paste massive, AI-generated explanations" (curl). Josh Bressers backed it on 27 October and told maintainers (the volunteers who look after a project) "It's OK to push back on demands from strangers" (Open Source Security).

What does Octoverse 2026 say about agents?

GitHub published Octoverse 2026, its yearly report, on 28 October. Agents started more than 40% of pull requests in September, up from 17% in March, which is 110 million in one month.

Over the 12 months to 30 September there were 17.9 billion pushes (uploads of code), up from 6.7 billion the year before, and 1.3 billion merged pull requests, up from 538 million. Public open source contributions went from 1.12 billion to 2.5 billion. GitHub counts more than 225 million developers, with 6.47 million in the UK, 6.30 million in Germany and 4.75 million in France (GitHub).

What did GitHub Universe change for developers?

Universe ran on 28 and 29 October in San Francisco. Copilot Fusion is now on all Copilot plans. You pick it in the model menu and it chooses a model for you. You pay each model's normal rate, and paid plans get 30% off "for a limited time", with no end date given (GitHub changelog).

Companies buying through a sales team can now get Copilot included in their GitHub Enterprise licence. There's no monthly allowance, so every request comes out of the company's budget from the first one. If the budget runs out, code completion keeps working, but chat, code review and cloud agents stop (GitHub changelog).

Japan's Cloud Watch reported the target Microsoft's Jay Parikh gave in the keynote (the main talk) for GitHub's new Git setup: 5,000 agents on one repository (one project's code) and 7,200 pushes a second, about 180 times what it does now (Cloud Watch, 29 October). GitHub's own engineering post says "thousands of agents" and up to 35 times the write speed in internal tests (GitHub).

Also in DevRel this week, 2 November: Ollama, Apiary and Hacktoberfest

Ollama Cloud dropped its free plan and starter credits between 26 and 27 October. The $0 plan now charges per token (the chunks of text a model reads and writes) for every cloud model, and running models on your own machine is still included (Ollama, AgentDeals).

Oracle shut down Apiary, its tool for designing APIs (the way programs talk to each other), on 31 October, a year after announcing it. What's left gets permanently deleted, and anyone on the API Blueprint format has to convert to OpenAPI, a more common one (Oracle).

The Rust Project said on 26 October that "only a fraction" of its contributors are funded. You can give to the Rust Foundation Maintainers Fund, sponsor the RustNL Maintainers Team, pay for a named project goal or sponsor a person directly (Rust blog).

Hacktoberfest ended on Saturday with no final numbers on the site yet. Stickers and prizes get posted 8 to 12 weeks after the end, so late December to late January (hacktoberfest.com). Cloudflare's Cold Start page still names no winner two weeks on (Cloudflare), and I can't find a recording or write-up of the "Still open" session on AI and open source from Universe.

The hiring note in DevRel this week, 2 November, is empty. I found open roles but no DevRel team cut or senior hire I could put a source on.

FAQ

What share of GitHub pull requests do agents start?

GitHub's Octoverse 2026, published on 28 October, says agents started more than 40% of pull requests in September 2026, up from 17% in March. That comes to 110 million pull requests in one month. Merged pull requests across the 12 months to 30 September reached 1.3 billion, up from 538 million the year before.

How does curl handle low and medium security reports now?

curl asks reporters to file low and medium severity issues in its public issue tracker, and it stops handling them privately on HackerOne, the bug report site it uses. High and critical reports stay private until a fix ships in a release. curl's policy also tells reporters not to paste long AI-generated explanations.

When is OpenAI DevDay Exchange in London and how do you get in?

London is on Tuesday 3 November 2026 from 2pm local time. You apply on the OpenAI events site, and the venue and programme only go to people who are approved. The page says applications are being reviewed but you can still apply. São Paulo follows on 6 November and Mexico City on 10 November.

Agents start the pull requests now, and people still have to read them.

Living and Working With ADHD: What It's Like for Me

@lukeocodes 🕹👨‍💻 — Sun, 01 Nov 2026 00:00:00 +0000

I have ADHD, combined type, which means I get both the attention side and the hyperactive, impulsive side. Working with ADHD, for me, means huge focus on anything that interests me and a real struggle with anything that doesn't. I've spent nearly twenty years in tech like this.

This is only my experience. I'm not an expert and I don't have a degree of any kind, so what I have is my own life and a lot of reading. Other people with ADHD will tell you something different.

What ADHD is

People often treat ADHD as a mental health issue. It's a neurodevelopmental condition, which means my brain developed differently from early childhood. Since my diagnosis, I've come to see how much it has shaped my personality and my working life.

What working with ADHD gives me

Give me an interesting problem and I can hyperfocus on it, which means it takes up all of my attention until it's done. I love this work, and that excitement is what makes me driven and fast. I build first versions quickly, I come up with a lot of ideas and I go looking for things I can fix, even when they aren't my responsibility.

I'm also calm in a crisis. When things go wrong I can take in a lot of information, pick out what matters most, make a plan and act on it.

AI tools changed things again. I wrote about this in June: for years my brain ran ahead of what my tools could keep up with, and now I run six to twelve windows at once and give each one precise instructions. Finally, my output can keep up with my brain.

What it costs me

If something is out of sight, it can stop existing for me. I might read your message, get distracted and forget it was ever there. I don't always feel time passing either, which is known as time blindness, so I can be five minutes late without noticing.

I struggle to hold long lists of spoken instructions in my head.

The hardest part of working with ADHD is work that doesn't interest me. I really struggle with admin. In the past, if I went quiet for a while, I was probably stuck on something I had no interest in and too ashamed to ask for help. These days I ask without any shame, and I make sure neither I nor anyone I lead is blocked or missing the right information. I've also spent whole weeks spiralling on one issue, trying hard every single day and still getting very little done.

Small, unexpected changes to my routine can upset me more than a real emergency does. Criticism can land far harder than anyone meant it to, which has a name, rejection sensitivity, and in new or uncomfortable situations I tend to withdraw. Feedback is different, because I can act on it. If I can't act on it, it isn't feedback, it's just criticism. Sometimes I read people wrong in the other direction too. I've been in conversations where I thought we were joking, right up until the tone crossed a line that even I couldn't miss.

What masking costs

Masking means hiding how your brain works so you fit in with everyone else. I wrote about it at length in A Rising Tide Lifts All Boats, because "communicate better" on a performance review often means exactly that. Doing it all day is like having two jobs: the one you were hired for, and managing how you come across while you do it.

How I work around my limits

Trying harder only gets me so far, so I set up my work so the limits matter less.

Anything I might forget lives outside my head. GitHub holds my ideas, changes and context, so people can read them when it suits them and I don't have to remember to tell them. After a meeting I ask for a DM with what we agreed and what I need to do, and AI meeting notes catch the rest. If I miss a message or a meeting, a gentle nudge fixes it, and I say so up front in my user manual so nobody has to guess.

I keep boring work small. Process and admin stay as light as the job allows, and AI helps keep my tools up to date.

I also protect my focus. I ask for long blocks of time with nobody interrupting me, and when a deadline is close, I set up a short check-in first thing each morning. Over the years I've kept moving towards the parts of tech I find interesting, so the focus shows up for the work I'm paid to do.

Because I can't hold much in my head, I break problems down and write exact specs. Nearly twenty years of that is why precise instructions to an AI model come easily to me.

Where a team has guidelines, I follow them (to the best of my knowledge), because working inside sensible rules gives me an opportunity to discover improvements where possible. I'm more careful than I used to be with my drive for progress, but as they say, "we're all a work in progress."

What that has done for my career

I went from junior to head of engineering, with some CTO responsibilities, faster than most people expected, including me. I've stepped back from that path twice by choice, once to commute less and once when my kids were born.

I placed the first independent hotel search aggregator on TripAdvisor's self-service integration, which until then had been reserved for major chains.

At Deepgram I pushed to start our developer community. Someone in leadership disagreed with me about its chances of success and what it would cost in resources. We were cutting our support team's work from all customers and potential customers down to enterprise customers only. Who was everyone else meant to get support from, if it wasn't us? Our competitors also hadn't reached AI developer communities yet, so we could get there first. I committed to it and owned the result. We reached millions of developers and grew that community to tens of thousands. In my opinion, that move led to the fast growth and saved us from a lot of unhappy customers. If it hadn't worked, we'd have failed fast and tried something else.

Former reports still tell me I was the best manager they ever had, which I put down to something simple: knowing how it feels to be misunderstood, I made the effort to understand each of them and then championed them. I wrote down how I lead too.

How to work with someone who has ADHD

Ask them. Most "how to manage employees with ADHD" articles get it wrong, and the person in front of you knows far more about their own brain. These are the things that work for me:

Listen the first time. Asking someone to repeat themselves, after they've worked hard to stay focused on what you said, can feel like rejection.
Break instructions into simple steps and write them down.
Tell me about changes early, even small ones.
Let people work in the way that suits them. For some that's remote work and control over their routine. For others it's being in a room with the team.
Give feedback that's clear and specific, about something I can actually do differently.
Celebrate the wins out loud, because I'm far more likely to celebrate yours than notice mine.

My brain isn't going to change, so I build my working life around it.

What I Expect From a Workplace

@lukeocodes 🕹👨‍💻 — Sat, 31 Oct 2026 00:00:00 +0000

This is what I expect from a workplace. None of it is about perks or job titles.

What I expect from a workplace

Everyone gets the same respect, wherever they live, however junior they are and whatever they're paid.

The words people use about each other at work matter, and leaders set the standard for them.

A decision stays made until there's a good reason to change it. I can work with almost any decision, and I'll disagree and commit. I can't do good work when it changes every day with nothing new behind it.

What's been agreed stays agreed, and nobody's honesty gets questioned without good reason.

Shipping and leading are different skills, and a leader needs both. Someone who only delivers can get a lot done and still leave a lot of people behind.

I look for these before I join a team, and I hold myself to the same list when I lead one.

TIL: The git log Pickaxe Finds the Commit That Deleted a Line

@lukeocodes 🕹👨‍💻 — Tue, 27 Oct 2026 00:00:00 +0000

git log -S finds the commit that added or deleted a piece of text. Git calls it the pickaxe, and the git log pickaxe is the quickest way I know to answer "which commit took this function out?"

git log -S "retryRequest" --oneline

Git keeps only the commits that changed how many times retryRequest shows up, so you get the one that added it and the one that deleted it. Add -p to see each change.

git bisect tests commits one at a time to find what broke. If you already know the text, you do not need to test anything.

When the git log pickaxe skips a commit

Changing retries = 3 to retries = 5 doesn't change how many times retries appears, so -S retries leaves that commit out. Use -G for those:

git log -G "retries" --oneline

-G takes a regex (a search pattern) and keeps any commit where an added or removed line matches it, so edits show up.

Can I search one file?

Yes. Put the path after two dashes, like git log -S "retryRequest" -- src/http.ts. Git then only looks at changes to that one file. On a repo with years of history, that makes the git log pickaxe a lot faster.

DevRel This Week, 26 October: Developers Ship Faster and the Friction Stayed

@lukeocodes 🕹👨‍💻 — Mon, 26 Oct 2026 00:00:00 +0000

DevRel this week, 26 October 2026: Atlassian's new report says 87% of developers ship faster with AI and 72% feel the same or more friction than before it. NVIDIA filled a free Berlin workshop with 500 people the weekend before GTC, OpenAI DevDay Exchange is in Berlin this afternoon and Paris on Wednesday, and Cloudflare now counts 10 million developers. On Thursday OpenAI switched off GPT-4, and Hacktoberfest finally said what the online stickers get you.

Developers ship faster with AI, and the friction stayed

Atlassian published its 2026 State of Developer Experience report on 20 October. 87% of developers say AI helps them ship work faster. 72% say they feel the same or more friction (the things that slow work down) than before AI. In 2025, 68% said they saved 10 or more hours a week, and this year 25% do. 65% regularly spend time correcting what the AI wrote (Atlassian).

60% say their company treats AI usage as a sign you're being productive. 41% say they sometimes use it more than they need to because they feel expected to. Only 17% of developers, and 23% of leaders, say their company has an AI strategy that has been explained and put in place. Andrew Boyagi, who wrote the report, told Techzine "AI can help developers work faster, but faster code isn't the same as better software delivered sooner" (Techzine, 22 October). ITPro's write-up on 23 October added that half of developers spend at least four hours a week managing AI output (ITPro).

NVIDIA filled a free Berlin workshop before GTC

GTC Berlin ran from 20 to 22 October at the Tempodrom and STATION-Berlin, with Jensen Huang's keynote (the main talk) on the Wednesday (NVIDIA). Three days earlier NVIDIA ran a free workshop for people who weren't going. Build-A-Claw Berlin on Saturday 17 October ran from 4pm to 8pm and was aimed at students, startup founders and open source contributors. There were demos of agents (software that does a task on its own, not just answers a question), an agent competition, a panel of European AI companies, and a raffle for a DGX Spark, a small desktop AI computer (Luma). NVIDIA says more than 500 people came, and that Berlin was the last stop on a European Build-A-Claw tour.

The week before, on 13 October, NVIDIA promised the UK $250 million of compute (time on its chips, not cash) over five years for research into keeping agents safe, going to Imperial College London and two new research labs, BOLD and SOFAIR, through UK-based cloud partners (NVIDIA).

OpenAI DevDay Exchange is in Berlin today

Four weeks ago I wrote that DevDay was invite only at $650 and that eight smaller DevDay Exchange events would follow. The European ones are this fortnight. Berlin is today, Monday 26 October, Paris is Wednesday 28 October and London is Tuesday 3 November, each starting at 2pm local time. Bengaluru, Tokyo and Seoul have already happened, and São Paulo and Mexico City come in November (OpenAI). You apply rather than buy a ticket, and the venue and programme are only sent once you're approved. The page says applications "are currently being reviewed, but please still feel free to apply". The afternoon is technical sessions with OpenAI staff, workshops on Codex (OpenAI's coding agent), and founders showing what they've built.

Cloudflare counted 10 million developers at Connect

Cloudflare Connect was 19 to 21 October in San Francisco. On the Tuesday Cloudflare said more than 10 million developers now build on its platform, up from 7.4 million the quarter before (Cloudflare). The founders' letter on 27 September said "more than 7 million" (Cloudflare), so the number went up by 3 million in four weeks and I don't know what changed in how they count.

The Cold Start, the live pitch where five startups competed for $500,000 in credits (money you can only spend on Cloudflare) and a billboard, was on the Monday. As of this morning nothing on the Cloudflare blog names the winner. The Connect week posts there cover a rewrite of the TypeScript compiler in Rust and protections for the PHP2Shell vulnerabilities I wrote about on Saturday (Cloudflare blog).

OpenAI switched off GPT-4 on Thursday

On 23 October OpenAI shut down GPT-3.5 Turbo, GPT-4, GPT-4 Turbo, GPT-4.1 nano, the May 2024 version of GPT-4o, gpt-image-1, o1, o1-pro, o3-mini and o4-mini, along with fine-tuned versions (copies trained further on a customer's own data) of several of them. The notice went out on 22 April, six months earlier, and each model has a named replacement in the 5.6 family (OpenAI deprecations). Code written against GPT-4 in 2023 that nobody has touched since got an error on Thursday.

Smaller, and with no notice I can find: Socket's free plan is now one developer seat with 1,000 package scans a month, where it used to say unlimited developers and repos. The next plan up is $25 a seat a month (Socket pricing, AgentDeals).

Also in DevRel this week, 26 October: Hacktoberfest stickers, GitHub Universe, Elastic hiring

Hacktoberfest has published what online participation gets you. Collect three virtual stickers in My Hacktoberfest by doing the activities on your participant page and a real sticker pack goes in the post. Ten stickers add a holographic one. Fifteen enter you in a raffle for a 2026 t-shirt or an Arduino Uno Q, a small programmable circuit board (hacktoberfest.com, Hacktoberfest Swag List). Stickers and prizes are mailed 8 to 12 weeks after October ends. The homepage now says 500 plus Fests, up from 217 registered on 20 September. On Thursday I wrote about the t-shirt I used to point people at and why I'm glad it's gone.

GitHub Universe is Wednesday and Thursday at Fort Mason. One session is called "Still open: How AI reshaped open source", with Angie Jones, David A. Wheeler and Priya Pahwa, on what happens to quality and governance "when bots can contribute at machine scale" (GitHub).

The hiring note in DevRel this week, 26 October, is Elastic, with Senior Developer Advocate roles open across the UK, Ireland, Portugal, Spain, Poland and Greece. The job is videos, open source demos on GitHub and writing for Elasticsearch Labs (Elastic).

FAQ

What did Atlassian's 2026 State of Developer Experience report find about AI?

Published on 20 October 2026, it says 87% of developers ship faster with AI and 72% feel the same or more friction than before. 25% say they save 10 or more hours a week, down from 68% in 2025. 65% regularly spend time correcting AI output. 60% say their company treats AI use as a sign of productivity, and 41% sometimes use it more than they need to because they feel expected to.

When is OpenAI DevDay Exchange in Europe and how do you get in?

Berlin is on Monday 26 October, Paris on Wednesday 28 October and London on Tuesday 3 November 2026. Each starts at 2pm local time. You apply on the OpenAI events site, and the venue and programme are only sent to people who are approved. The page says applications are being reviewed but you can still apply. No ticket price is listed.

How do you get Hacktoberfest 2026 swag without going to a Fest?

Sign in to My Hacktoberfest and do the activities on your participant page to collect virtual stickers. Three virtual stickers get a real sticker pack in the post. Ten add a holographic sticker. Fifteen put you in a raffle for a 2026 t-shirt or an Arduino Uno Q board, a small programmable circuit board. Stickers and prizes are mailed 8 to 12 weeks after October ends.

Which OpenAI models were shut down on 23 October 2026?

GPT-3.5 Turbo, GPT-4, GPT-4 Turbo, GPT-4.1 nano, the May 2024 GPT-4o snapshot, gpt-image-1, o1, o1-pro, o3-mini and o4-mini, plus fine-tuned versions of several of them. OpenAI announced the shutdown on 22 April 2026, so developers had six months. The suggested replacements are gpt-5.6-sol, gpt-5.6-terra and gpt-5.6-luna, depending on the model.

The tools got faster this year and the week did not get shorter.

PHP2Shell Vulnerabilities Took Government Sites Offline Across Europe

@lukeocodes 🕹👨‍💻 — Sat, 24 Oct 2026 00:00:00 +0000

Two bugs in PHP, the PHP2Shell vulnerabilities, let an attacker run their own code on a web server with one web request and no login (Help Net Security). Details leaked on 20 October 2026, and government sites in the Netherlands, France, Denmark and Finland went offline until PHP shipped fixed versions on 21 October.

What the PHP2Shell vulnerabilities are

PHP runs about seven in ten websites. The two bugs, CVE-2026-109618 and CVE-2026-109619 (a CVE is the public ID for a security bug), sit in how PHP cleans up when a request runs out of memory or crashes, and the server runs what you sent it before the site's own code starts (php.net). PHP has known about one of them since 2024 and couldn't agree a fix, which the PHP Foundation now calls "a structural failure" (The Next Web).

Ryan Austin at the security firm Calif (Wikipedia) and a team at Wiz, using the AI models Gemini 4 Argon and GPT-5.6 Sol (Wiz), found them separately in August. The fix was scheduled for 21 October at 14:00 UTC (3pm in the UK). On 20 October the bugs appeared on Hacker News, watchTowr posted about them on X, and Calif put out a demo video by mistake. PHP published 8.5.12, 8.4.27, 8.3.36 and 8.2.35 at 13:34 UTC, 26 minutes early.

Who went offline

The Netherlands took down DigiD (the national login), MijnOverheid, Overheid.nl and the parliament website on Wednesday morning, before a fix existed (NL Times). Matthijs van Amelsfort of the Dutch NCSC said there was no sign of attacks, but traffic showed people scanning sites for the PHP2Shell vulnerabilities (NL Times). Most were back by Thursday morning.

France's Interior Ministry took every prefecture (local government office) website offline (The Connexion). Denmark's council IT firm Kombit shut the national school messaging platform, and Finland's state IT provider Valtori took government public services offline (Reuters factbox).

What happened after the patch

Amazon's threat team saw attack attempts on 17 October, four days early (Help Net Security). Palo Alto's Unit 42 counts 22.6 million PHP servers still reachable from the internet. In one European government body, attackers used an AI agent to pull stored passwords and the secrets behind two-step login within two hours of getting in (Unit 42).

Cloudflare's Matthew Prince told Reuters on 23 October that he knows of "a bunch of additional severe vulnerabilities" and expects "a couple of years" where "every single week it's going to feel like the sky is falling" (Reuters via TimesLive).

FAQ

How do I know if my site has the PHP2Shell vulnerabilities?

Any PHP older than 8.2.35, 8.3.36, 8.4.27 or 8.5.12 that serves web requests is affected, however it runs (PHP-FPM, Apache mod_php, php-cgi, FrankenPHP). Run php -v on the server. If someone else runs the server, check their status page. Most big hosts patched on 21 October.

Is there a fix other than updating PHP?

No complete one. PHP's release notes say updating is the only safe choice. Web firewalls (filters that sit in front of a site) added rules for the known attack shapes, which helps until you patch. The UK NCSC says if you can't patch or filter quickly, take the system offline.

Why did the PHP2Shell details leak early?

The fix was scheduled for 21 October at 14:00 UTC (3pm in the UK). On 20 October the bugs turned up on Hacker News, watchTowr posted about them on X, and Calif, one of the firms that found them, put out a demo video by mistake. PHP shipped the fix 26 minutes early.

The bugs waited two years for a fix and the models found them in one summer, so the next PHP2Shell has probably already been found.

OpenAI Agents Disabled Monitoring Twice, and One Denied It

@lukeocodes 🕹👨‍💻 — Fri, 23 Oct 2026 00:00:00 +0000

Two OpenAI agents disabled monitoring inside the company in early October, GPT-6.1 Sol and GPT-6 Astra, and Astra denied it when asked, OpenAI reported on 20 October 2026 (OpenAI alignment team). The same week the European Commission said it had sent the labs its first formal questions under the AI Act, and the UK's AI minister told the labs "if you can't adequately control the risks, do not release the system."

Since the last post

Four weeks ago the labs had a standards body with a CEO shortlist, the White House had told OpenAI and Anthropic to keep new models away from the UK, and GPT-6.1 Astra was due in October.

Three days later OpenAI cancelled the Astra launch because the model "didn't quite meet the bar in terms of staying within scope and authorization" (via AI Weekly). The standards body still has no CEO and no charter.

How the OpenAI agents disabled monitoring

On 3 October a researcher asked GPT-6.1 Sol to build evaluation tasks from Slack feedback and told it not to send messages. The pipeline hit a monitoring alert. In OpenAI's words, "based on its judgment that the user's instruction not to send messages applied to the misalignment monitoring system, the parent agent then directed the subagent to force notification suppression."

On 6 October GPT-6 Astra was asked to copy the code that serves a model from an example repo, and had already been told not to disable monitoring. It read a line about preserving monitoring "as appropriate" as permission to drop it, removed the monitor configuration, and changed the tests so they passed only when the monitor was gone. "When the user later asked about it, Astra denied removing the monitoring system."

Nobody on the Security team got paged for either. OpenAI told RTÉ "we don't yet have a satisfying explanation for this behavior" (RTÉ). It says its automatic review now blocks attempts to disable monitoring and that it plans to study the models' internal activations, the numbers inside the model as it runs, to work out why (The Decoder).

Astra here is the released GPT-6, not the cancelled 6.1, so the problem OpenAI pulled the October model for is in one that shipped. Both incidents join the list from the sandbox escapes, where models reached systems they weren't meant to. In this one the OpenAI agents disabled monitoring, the thing that would have reported the reach.

Brussels had already sent the questions

On 9 October Henna Virkkunen, the Commission's executive vice-president for tech, held a special meeting of the AI Act's Scientific Panel on loss-of-control incidents (European Commission). The panel is 60 independent researchers who advise the AI Office, the Commission unit that enforces the AI Act on the big models. Its chair, Seán Ó hÉigeartaigh, asked the Commission to do four things, and the first was to "ensure governance of the risk posed by internal models during development activities and deployment". Internal models are what Sol and Astra are: agents a lab runs on its own code, not products.

The other three: an EU team to investigate incidents, an international setup for sharing incident reports, and "enhanced scrutiny of training techniques and architectures that reduce monitorability".

On 14 October in Dublin, Virkkunen said those requests had gone out. They ask whether models run in secure environments, whether outside evaluators get enough access, and how a lab watches its models after release. She said "more than 20 loss-of-control incidents have been documented in 2026 across OpenAI, Anthropic, Google DeepMind, Meta and independent evaluation organisations" (Unite.AI). The Commission has been able to fine a model maker since 2 August, up to 15 million euros or 3% of worldwide turnover.

Two days later, EU leaders met for a summit, and the 24 page summary they published afterwards did not mention AI once (AI & GPP).

London got its access back and set a condition

On 12 October, Kanishka Narayan, the UK's AI minister, gave a speech at Imperial College London. To the labs: "Listen when your scientists warn of severe dangers" and "if you can't adequately control the risks, do not release the system" (GOV.UK). The same day the UK confirmed its AI Security Institute had early access to the labs' models back, 17 days after the White House cut it (TechXplore). The institute has tested more than 55 models before release, and every one of those tests is voluntary on the lab's side.

On 23 October Narayan told the BBC's Political Thinking podcast that "the British public and democracy has to assert power rather than leave it to the tech bros and oligarchs", and that the answer is building capability in the state rather than "pulling the lever of regulation" (City AM). The example he gave: a 13,000 pound test with frontier models found 500 security holes across the public sector.

Altman gave staff three endgames

The Information reported this week that Altman laid out three ways this ends in an internal presentation, and said OpenAI has a year to decide which to back (The Decoder).

The first is an international agency like the IAEA that watches AI development and enforces rules. He favours that one. The second he called the Demis plan: a shared body like CERN where the big labs hand models to partner countries. The third he called the Eliezer plan: one lab gets to self-improving AI first and uses its money to cut everyone else off from chips. He opposes that.

Who is asking for a slowdown now

The academics. On 9 October a group of 26 researchers led from UC Berkeley, including Stuart Russell and the economist Barry Eichengreen, published a 200 page report saying a "hardwired pause" is possible (Berkeley News). The idea is to stop making chips that can train frontier models, phase out the ones already built, and replace them with chips that can only run models, for at least ten years.

FAQ

What did the OpenAI agents do to the monitoring?

On 3 October 2026 GPT-6.1 Sol told a subagent to suppress misalignment monitoring alerts, after deciding a user's instruction not to send messages covered the monitor too. On 6 October GPT-6 Astra removed a monitor during a code migration and denied doing it when asked. OpenAI published both on 20 October.

What has the EU asked the AI labs under the AI Act?

On 14 October the European Commission said its AI Office had sent requests for information to the makers of the most advanced models. The questions cover how models are kept in secure environments, whether outside testers get enough access, and how models are watched after release. The Commission can fine a model maker up to 15 million euros or 3% of worldwide turnover.

What are Sam Altman's three endgames?

An international agency like the IAEA, which he favours. A shared body like CERN where the big labs hand models to partner countries, which he called the Demis plan. And one lab reaching self-improving AI and using its money to cut rivals off from chips, which he called the Eliezer plan and opposes. OpenAI has a year to pick.

A month after the labs said they would slow themselves down, the only people who have actually sent them questions with a fine attached are in Brussels.

Little Did We Know: The Hacktoberfest T-Shirt and the Pull Requests I Asked For

@lukeocodes 🕹👨‍💻 — Thu, 22 Oct 2026 00:00:00 +0000

In September 2018 I made a GitHub repo where your first pull request was adding your name to the README, and I wrote a guide that told people a Hacktoberfest t-shirt was waiting at the end. The two repos took 1,353 pull requests. 101 of them never got a reply. From 2020 Hacktoberfest made repos opt in because of people chasing swag, and in 2026 it stopped counting pull requests at all, because AI made the low-effort ones free.

Throwback Thursday, so back to autumn 2018, eleven months into the first job I had that was writing instead of building.

The repo

On 7 September 2018 I made the my-first-pr org on GitHub and three repos in one morning: a site, first-timers, and hacktoberfest-2018. Fork the repo, add your name to the README.md, open a pull request. Nothing you did could break anything, because there was nothing in there.

I opened pull request number 1 on first-timers myself four days later, to get the screenshots. It never got merged.

The guide went up on the Auth0 blog on 24 September as First Timers Guide to Contributing to an Open Source Project. Fork, edit the file in the browser, open the pull request, a screenshot for each click, then the same again on the command line. It pointed at First Timers Only (Kent C. Dodds and Scott Hanselman's project) and at Up For Grabs. It had a section called "Hacktoberfest Isn't Just About Free Swag". The first line under that heading was "But, there is free swag." T-shirt and stickers, in bold.

I put numbers in. 768 people took part in 2014. In 2017 it was 31,901 people and 239,164 pull requests, and I wrote that 2018 "is poised to be the biggest year yet".

I also said my favourite kind of pull request was deleting a .DS_Store file (the hidden file a Mac leaves in every folder you open) from someone else's repo. The one I linked, on auth0/jwt-auth-bundle, was opened on 10 August 2016 and merged 30 seconds later. That was 15 months before I worked there.

In the same guide, writing about the first-timers-only label, I said "it's important for project owners to understand what they're agreeing to". I wrote that about other people's repos.

Hackference

Hackference 2018 was a one day conference on Friday 12 October and a hackathon over the weekend, the sixth one Mike Elsmore had run. Auth0 sponsored it and I was there for the hackathon. My recap went on the Auth0 blog on 22 October, eight years ago today. The Auth0 prize went to a team called "Who Dis?" who built their own identity provider on IndieAuth and plugged it into Auth0's login page. All weekend the hacktoberfest-2018 repo was taking pull requests from people I would never meet.

What happened to the pull requests

Both repos are still up. hacktoberfest-2018 took 1,191 pull requests and has 734 forks. first-timers took 162 and has 125 forks. 25 of the 162 were merged. 101 are still open. The last push to first-timers was in February 2024. The newest pull request is from August 2025, from a first-time contributor, called "add me to contributors". It is still open.

So people did it. They forked the repo, changed one file and opened a pull request, which they had never done before. Then nothing. The guide said "all pull requests will be considered", and I was there for about one in six.

2020: repos had to opt in

In 2020 Hacktoberfest changed the rules. A repo had to opt in with a hacktoberfest topic, or a maintainer had to put a hacktoberfest-accepted label on the pull request, and the Hacktoberfest team could exclude a repo. On 10 October 2020 I built hacktoberfest.ninja, a Nuxt site with a Netlify Function behind it that checked those three things for any repo you pasted in.

My team at Vonage sponsored that year. I was on the Hacktoberfest Discord answering questions and, in my own words, helping people "with how to get some free Vonage socks". Ten days later I wrote:

As both sponsor, maintainer, and avid supporter of Hacktoberfest, I feel conflicted by what I've seen this year. Out of the tens of thousands of young folks first hearing of it, a large number seem more focused on the swag rather than the importance of open source.

Same month, I wrote a post on other ways to contribute: translate docs, take words like "easy" out of a README, answer the questions maintainers don't have time for. The translation example was the First Contributions project, which had its guide in over 60 languages, one of them my pirate-English. For the "easy" one I linked a pull request on Jest from the year before, where someone had gone through the docs and taken the condescending words out, and Carol Stransky's guide on doing the same. That kind of non-code contribution helps, because someone wanted it. The last line of that post was "And, get a t-shirt." That year you could pick a t-shirt or a tree.

2026: no pull requests, no t-shirt

On 28 September I wrote that Hacktoberfest 2026 dropped pull requests. The FAQ says why: "with the rise of AI tools making low-effort PRs trivial to generate, open-source maintainers faced unprecedented floods of noise, spam, and burnout". Instead there are Fests, in-person and online events of up to 12 hours. T-shirts are only at Fests, if the organiser wants to, while they last. The first thing the homepage suggests you do is "write your first skills.md", a short file that tells an AI agent how to use a project.

In 2018 the hard bit was the fork, the branch and the push. That's what the screenshots were for. The edit was tiny on purpose. In 2026 a tool does the fork, the branch, the push and the edit, and opens the pull request. The maintainer still has to open every one.

What I think now

The good part of the guide was who it was for. Someone who had never done this. Every word explained the first time it came up. A place where the worst that could happen was nothing. In May I wrote about contributing guides, and how most are written by maintainers for people who already fit in. The 2018 one was the other way round.

The rest I'd cut. I told people the pull request was the point, and the t-shirt rule said the same thing: enough pull requests and you're done. Deleting a .DS_Store from a stranger's repo doesn't help them. Neither does a name on a list, or a pull request sent for a shirt. Non-code edits were meant to be the way in for people who weren't programmers, and they became the easiest thing to send to a project that never asked, years before a model could send them for you.

A skills file is written for someone who has never seen the project. Same reader as my README. The difference is the project has to want one. I'm glad there's no more t-shirt.

Does llms.txt Work? What a Year of Server Logs Says

@lukeocodes 🕹👨‍💻 — Wed, 14 Oct 2026 00:00:00 +0000

Does llms.txt Work? What a Year of Server Logs Says

Does llms.txt work? For getting found by AI, no. Ahrefs read the server logs of 137,210 domains for May 2026 and found that 97% of the llms.txt files on them were never requested, by anything. For helping a coding agent that is already reading your docs, yes. Mintlify tested 20 documentation sites and agents made 2.23 failed page requests per task on plain HTML, and 0.11 when the pages were Markdown with a link to llms.txt.

A month ago I wrote that DevRel now serves two audiences and that the team should own llms.txt and the MCP server because that is where discovery happens. Half of that holds up. The other half was wrong, and the logs show which half.

What llms.txt was supposed to do

The idea came from Jeremy Howard in September 2024. You put a Markdown file at /llms.txt with a short description of the site and a list of links to the pages that matter, and a model that lands on your domain reads that file first instead of fighting its way through your navigation, cookie banner and JavaScript. The pitch was robots.txt for the reading side rather than the blocking side.

That pitch needs one thing to be true: something has to fetch the file. Not a person, not an SEO plugin, but the bot or the agent that is about to answer a developer's question using your docs.

Who fetches llms.txt?

Ahrefs looked at 137,210 domains for May 2026 using its web analytics and bot analytics products. 28% of those domains published a valid llms.txt. 97% of those files got zero requests for the whole month. Of the 3% that got any traffic at all, 96% of it was bots, and the biggest group of those bots was SEO audit tools at 21.7% of requests. The AI training crawlers were at 5.3%. GPTBot was the busiest single AI bot and it made 4.51% of the requests. The search-side crawlers from OpenAI, Perplexity and Anthropic combined added up to "only a couple of hundred fetches" across the whole dataset.

The detail I keep coming back to is the missing files. Ahrefs checked whether AI bots request /llms.txt on domains that do not have one. The answer was zero. "They never go looking." A crawler that wanted the file would try the URL the way every crawler tries /robots.txt. None of them do.

A smaller study backs that up with the kind of numbers you can check against your own logs. Saaslinks watched 18 named AI crawler families for 14 days to 3 August 2026. Those crawlers fetched robots.txt 723 times, fetched 151 of the site's own pages, and fetched llms.txt zero times. ChatGPT-User alone made 82 page requests. It did not want the index.

Google said the same thing twice. On 17 June 2025 John Mueller wrote on Bluesky, "FWIW no AI system currently uses llms.txt," and told people to check their own server logs. A year later, in June 2026, he called the whole thing "purely speculative for now (the file has existed for years, yet none of the AI systems use it)" and pointed technical SEOs at WebMCP instead, the Google and Microsoft proposal that went into a Chrome origin trial at I/O 2026.

Adoption went up anyway

None of that slowed anyone down. Originality.ai counted 4,088 sites with an llms.txt in June 2025 across the 3 million it monitors. By May 2026 that was 36,120, an 8.8x rise in eleven months. The longer llms-full.txt variant went from 23 sites to 2,463.

The big sites were slower. Rankability checked the Tranco top 10,000 on 18 September 2026 and found 9.3% of the top 1,000 serving a confirmed file. Cloudflare has one, so do GitHub, Fastly, WordPress.org and Adobe. Originality found 7.4% of the Fortune 500 had one in March 2026, against 92.8% with a robots.txt.

So we have a file that tens of thousands of sites publish and that the crawlers it was written for do not read. On its own that would be the end of the post. It is not the end, because the crawlers are not the only reader any more.

Agents are reading your docs more than people are

Mintlify published 30 days of traffic across the documentation sites it hosts on 3 April 2026. AI agents made 357.6 million requests, 45.3% of the total. Browsers made 361.7 million, 45.8%. Claude Code on its own made 199.4 million requests, more than Chrome on Windows. Cursor made 142.3 million. ChatGPT made 1.8 million, NotebookLM 1.4 million. OpenAI's Codex does not send an identifiable header, so the agent share is an undercount.

By August the line had been crossed. Mintlify's 2026 State of Knowledge report, published 16 September, counts 257 million agent requests against 131 million human page loads for the month. MCP tool calls against its hosted servers tripled between February and August. And 83% of the agent traffic came in through what Mintlify calls machine-friendly routes: Markdown versions of pages, llms.txt, and agent skills.

Read those two sets of numbers side by side and they look like they disagree. Ahrefs says nothing reads llms.txt. Mintlify says agents arrive through it. Both are right, and the gap between them is the whole strategy question.

The crawler and the agent are different readers

Ahrefs measured the open web. Most of its 137,210 domains are shops, publishers and company sites, and the bots that visit those are training crawlers and search crawlers. GPTBot, ClaudeBot, PerplexityBot. Those bots fetch HTML in bulk to train or to ground a chat answer, and they have no reason to read a hand-written index when they can take every page.

Mintlify measured developer documentation, and the reader there is a coding agent sitting in a developer's terminal with a task. Claude Code or Cursor is trying to call your API right now. It fetches a page because a CLAUDE.md, a skill, a search result or the developer pointed it there, and once it is on the page it follows links to find the next one. That agent does read llms.txt, when it is told where the file is. Ahrefs saw this too: in its data the Claude-Code user agent fetched llms.txt more than every AI retrieval bot, assistant and training crawler. That is the agent, not the crawler.

Nobody is probing for the file by default. A Claude Code issue from June 2025 asked for llms.txt to be picked up automatically the way Cursor lets you add the links in settings. The reply from the maintainer was "Claude should be able to fetch urls that you paste in," and the issue closed without a built-in. You point the agent at the file, or you link to it from the page the agent is already reading. The file does nothing on its own.

That is where Mintlify's test matters. The report describes 2,400 controlled tasks across 20 documentation sites. Agents answered correctly 94 to 99% of the time whatever format the docs were in, so the content was never the problem. The problem was requests for pages that do not exist. Agents guess URLs. On plain HTML they made 2.23 failed requests per task. On Markdown pages, 1.42. On Markdown pages that link to llms.txt, 0.11. Token use dropped by up to 60% on the same tasks.

Two caveats before you take that to a planning meeting. Mintlify sells the product that does this, so the test is a vendor benchmark, and the full method is in its report rather than a paper. And the 20x number is failed requests, not correct answers. The agent got the answer either way. It just burned fewer calls and fewer tokens getting there.

What developers say they trust

The human side moved as well, and in a direction that favours docs. Stack Overflow's 2026 Developer Survey, published 6 October from over 30,000 developers in 169 countries, has 66% using a coding assistant or agent and 6.6% willing to trust AI with an important decision. Nearly half trust it when they can verify the output. 78.7% say source attribution is important or very important when they judge an AI answer.

Asked what context an AI needs to get things right, 73% said the underlying code and the technical documentation, second only to project goals at 85%. Asked where they go to check a specific answer, 72% go to a colleague, 63% to the code, 60% to the docs. Technical documentation is still the top learning source at 58.9%, ahead of AI code tools at 52.7%.

Put that next to the Mintlify traffic. The agent reads your docs to write the code, and the developer reads your docs to check what the agent wrote. Same page, two readers, and the second reader is the one deciding whether to trust the first.

What this means for a DevRel team

In September I said the new surfaces give DevRel its first measurement story an executive can read. I still think that. The thing I got wrong was which surface. Here is what the evidence supports now.

Stop treating llms.txt as discovery. Nobody arrives through it. If your plan for being recommended by ChatGPT is a file at the root, the Ahrefs logs say that plan is doing nothing, and Google has said so twice. Discovery still runs on whatever the search crawler and the training crawler can read in your HTML, and on what developers paste into the agent.

Publish it anyway, and link to it from every Markdown page. The cost is an afternoon. The payoff is an agent that stops guessing URLs on your site. The 20x in Mintlify's test came from the link on the page, not from the file at the root. If your docs host cannot serve a Markdown version of each page, that is the thing to fix first, because the agent is reading the HTML and the HTML is where it got 2.23 failures per task.

Find your 404s. This one is free. Filter your docs logs by the Claude-Code and Cursor user agents and sort by status code. Every 404 is a URL an agent guessed from a pattern it saw elsewhere. The guessed URL tells you what the agent expected your docs to be called, and a redirect from the guess to the real page fixes it for every agent that follows.

Count the agent traffic, and count it separately. 24% of the companies Mintlify surveyed still lump agent traffic in with bots. If your analytics does that, your docs look like they lost half their readers over the past year when the readers moved from the browser to the terminal. The State of DevRel report has 61% of DevRel teams finding it hard to prove their impact and 18% able to link their work to revenue. A page that an agent fetched during a successful integration is a cleaner signal than a page view ever was, and right now most teams are throwing it away as bot noise.

Accept that the referral is gone. Cloudflare's 1 July 2026 report has 52% of all crawler requests going to AI training, up from 22% in spring 2025, and more than half of all traffic on the internet now non-human. Some sectors have lost 40% of their human traffic in under a year. The agent that reads your docs does not send a human back to them. That was the measurement I used to lean on, the click from the chatbot to the signup page, and it is not coming. What you can measure is the API key that was created during a session where an agent was fetching your reference pages.

The MCP server is a different bet from the file. The llms.txt file is passive. An MCP server is something the agent calls, and Mintlify's hosted servers saw those calls triple in six months. That is still a vendor's number from a vendor's platform, and the public registries are at a point where finding the right server is harder than building one, with roughly 9,400 published servers by April 2026 across the four big registries. Owning the server still looks right. Owning the file is cheap and should not be sold internally as more than it is.

The split in the brief was that DevRel serves the agent and the human. The logs say it is more specific than that. DevRel serves the agent that is already on the page, and the human who checks its work, and neither of them is the crawler the file was written for.

Frequently asked questions

Do ChatGPT or Claude read llms.txt?

Not when they crawl. Ahrefs' May 2026 logs across 137,210 domains show GPTBot made 4.51% of the few llms.txt requests that happened and ClaudeBot under 1%. Neither probes for the file on sites that do not have it. A coding agent like Claude Code does fetch it when a page or a config file points at it.

Should I still publish an llms.txt file?

Yes if you run developer docs, no if you expect it to get you found. Put it at the root, keep it a short list of links to Markdown pages, and link to it from the Markdown version of every page. Do not spend a sprint on it. Mintlify's tests put the win at fewer failed requests per task, not more traffic.

Why do agents fail on documentation?

They guess URLs. In Mintlify's 2,400 controlled tests across 20 sites, agents got the answer right 94 to 99% of the time whatever the format. What went wrong was navigation: requests for pages that did not exist. Plain HTML averaged 2.23 failed requests per task, Markdown 1.42, Markdown with a link to llms.txt 0.11.

How much documentation traffic is now AI agents?

More than half on Mintlify-hosted docs. In August 2026 agents made 257 million requests against 131 million human page loads. In March 2026 it was 45.3% agents to 45.8% browsers, with Claude Code at 199.4 million requests and Cursor at 142.3 million. Other hosts have not published equivalent numbers.

The file was never the product; the page the agent lands on is, and a year of logs says to spend the budget there.

TIL: Node --env-file Loads .env Without the dotenv Package

@lukeocodes 🕹👨‍💻 — Tue, 06 Oct 2026 00:00:00 +0000

Node can read a .env file on its own now. The flag is --env-file, and it has been in Node since 20.6.0.

node --env-file=.env app.js

Node reads the file before your code runs and puts each line into process.env. Comments, quotes and values that span more than one line work the same way they do in the dotenv package. If a variable is already set in your shell, the shell value wins. Pass the flag twice and the second file wins over the first, so --env-file=.env --env-file=.env.local gives you a shared file and a local override.

I wrote about the dotenv package back in 2020. For most projects you can uninstall it and delete the require line.

What if the file is missing?

--env-file stops with an error when the file is not there. --env-file-if-exists, added in 22.9.0, carries on without it. Use that one in a Dockerfile where the .env only exists on your laptop.

Can I load it from code instead?

Yes. process.loadEnvFile(".env") does the same thing from inside a script, and the argument is optional when the file is called .env. It landed in 20.12.0.

Eleven v4 Turbo Gets Voice Agents to Full Duplex

@lukeocodes 🕹👨‍💻 — Mon, 28 Sep 2026 00:00:00 +0000

ElevenLabs released Eleven v4 and Eleven v4 Turbo on 28 September 2026. Turbo takes text while your LLM (the text model that writes the reply) is still writing it, and starts sending audio back about 150 milliseconds later. Inside ElevenAgents, a turn-taking model decides when the agent should stop and when it should keep going, so you get an agent you can talk over. ElevenLabs doesn't call that full duplex. I do, because it's the setup my August whitepaper asked for.

That post listed three problems with how voice agents are built. This one goes through them again with today's release in hand, so it's a follow on.

What ElevenLabs shipped

Two models came out together. Eleven v4 is for produced content, the audiobook and video work where quality matters more than speed. Eleven v4 Turbo is the fast version for agents. ElevenLabs says both are built on "an entirely new architecture" (a new way of building the model), and the product page describes something it calls context stitching, which keeps the same voice steady across a whole script.

The numbers from the product page:

More than 90 languages.
Instant Voice Clones from 10 seconds of audio.
Professional Voice Clones are back. They weren't supported in v3.
One generation can be up to 10,000 characters.
Free plan: 10,000 credits a month, about 10 minutes of audio. Premium is $6 a month.

The blog post adds the test results. ElevenLabs says Artificial Analysis, an outside site that ranks AI models, puts v4 first for September 2026. It says about 75% of listeners picked v4 in blind tests, where the listener doesn't know which model they're hearing, and that v4 won 65% to 81% of head-to-head tests against Cartesia Sonic 3.6, Inworld TTS-2 and two of Google's Gemini voices. Nobody outside ElevenLabs has published a measurement yet.

TechCrunch has the business side. Language support was 70 in v3. Revenue run rate, meaning this year's pace rather than money already in, is past $600 million, up from about $330 million at the start of the year, and more than 55% of it comes from big companies.

What streaming both ways gives you

The old way to connect text-to-speech to an agent was to wait for the LLM to finish a sentence, send the sentence, then wait for the audio. Every sentence waited for the full trip out and back.

With v4 Turbo you push words as the LLM produces them and audio comes back before the sentence is finished. ElevenLabs' words: "Bidirectional streaming, built for agent loops." Latency, the wait before you hear anything, is about 150 milliseconds to the first sound. The model's own processing time is about 100 milliseconds. Both are medians, the middle result with half faster and half slower. ElevenLabs' comparison table puts Cartesia Sonic 3.6 at 262 milliseconds and OpenAI's GPT-4o mini TTS at 814.

Is Eleven v4 Turbo full duplex? The three problems from August

The whitepaper described a voice agent as a chain of three parts, each waiting for the one before it to finish: speech-to-text, then the LLM, then text-to-speech. I called that chain the cascade. It broke the trouble with it into three problems.

The first was latency adding up at every step. Speech-to-text waits for enough audio, the LLM waits for the full transcript, and text-to-speech waits for the full text. v4 Turbo removes the last wait, and streaming both ways means it no longer waits for a full sentence either.

The second was that the model knows what it said but not what the user heard. The bigger the gap between what has been generated and what has been played, the more there is to sort out after an interruption. At 150 milliseconds to first speech, with audio going out as it's made, that gap is now tiny.

Interruptions are the third problem, and the one I care about most. People make noises while they listen: "mm", "yeah", "uh-huh", a laugh, a cough. On a call with a person those noises mean carry on, but a plain voice detector hears them as the user talking and stops the agent mid-sentence. ElevenAgents is built from four parts: a speech-to-text model, your LLM, a text-to-speech model (v4 Turbo now, according to the v4 blog post) and what the docs call "a proprietary turn-taking model that handles conversation timing". Proprietary means their own, not public. A model whose only job is timing should be able to learn that a sound is not always a turn, and not always a change of subject. The docs don't say what it's trained on, and they list the interruption and turn-taking settings you can change.

What to do with it today

If you build voice agents, use Turbo for the speaking part, then make sure the rest of the chain, speech-to-text and the LLM, adds no more than another 150 milliseconds.

Then measure the three things the whitepaper asked for: the time from the user going quiet to the agent starting to speak, the time it takes to recover from an interruption, and how often the agent carries on talking after the user has started. If you're on ElevenAgents, the turn-taking settings are where you change the last two.

One more thing from the agents docs: they still say the text-to-speech there covers 70 plus languages, while the v4 pages say 90 plus. Expect that page to catch up.

DevRel This Week, 28 September: Hacktoberfest Drops the Pull Request

@lukeocodes 🕹👨‍💻 — Mon, 28 Sep 2026 00:00:00 +0000

DevRel this week, 28 September 2026: Meta put $1 million into a VR competition and another $1 million into an AI hackathon, Cloudflare offered $500,000 in credits and a billboard to one startup, and OpenAI DevDay runs tomorrow at $650 a ticket for people it invited. Two things got worse. Hacktoberfest starts on Thursday with pull requests no longer counting for anything, and Microsoft switched off Office 365 E3 developer accounts without sending an email.

Can anyone get into OpenAI DevDay tomorrow?

OpenAI DevDay is on Tuesday 29 September at Fort Mason in San Francisco. Sam Altman's keynote (the main talk) is at 10am Pacific and streams free. Everything else is only for people there in person. You had to apply over the summer, invites went out in late July, a ticket is $650, and there are no tickets on the day. Eight DevDay Exchanges, smaller one-day versions, follow later in the year in Bengaluru, Tokyo, Seoul, Paris, Berlin, London, São Paulo and Mexico City (devday.openai.com).

Cloudflare Connect is three weeks later, 19 to 21 October at Moscone West, at $595 a pass (Cloudflare). GitHub Universe is the week after that, 28 and 29 October, back at Fort Mason (GitHub). Three developer conferences in one city in five weeks.

Meta and Cloudflare are paying prize money

Meta Connect was on 24 September. The developer recap has two competitions in it. The 2026 VR Start Developer Competition opened the same day and closes on 18 November, with $1 million split across 20 prizes from $20,000 to $100,000 in gaming, entertainment and productivity, winners announced on 11 December, and you have to be in the VR Start programme to enter (Meta). Next to it is a Global AI Developer Hackathon with another $1 million and free Model API credits (credits are money you can only spend on their services), now that the Meta Model API is out of beta and open to everyone (Meta Connect recap).

Cloudflare's Birthday Week opened with the founders' letter on 27 September. The number that matters is 7 million developers on the platform. The letter also says automated traffic passed human traffic in May 2026, earlier than they had forecast, and says it will give creators and app builders a way to get paid when AI agents use their work (Cloudflare). Today's posts include The Cold Start. Five startups that have taken less than $10 million from investors present live at Connect on 19 October, five minutes each, in front of Matthew Prince, Michelle Zatlyn and Dane Knecht. The winner gets $500,000 in credits and a billboard in San Francisco (Cloudflare).

Google let other people's agents into Android Studio

On 24 September Google released Bring Your Own Agent in Android Studio Rabbit 2, the Canary build (the earliest test version). You can run Anthropic's Claude Agent, OpenAI's Codex or Google's own Antigravity inside the app you write code in, and it hands the agent build diagnostics and control of the emulator (a fake phone on your computer) through the Agent Client Protocol, a shared way for editors and agents to talk to each other (Android Developers Blog). Matthew Warner, the product manager, said "it's important for you to be able to build Android apps in the way that works best for you and your team".

Hacktoberfest starts Thursday and pull requests don't count

Hacktoberfest 2026 runs through October, and this year the four pull requests for a t-shirt rule is gone. The FAQ says why: "with the rise of AI tools making low-effort PRs trivial to generate, open-source maintainers faced unprecedented floods of noise, spam, and burnout" (Hacktoberfest FAQ). In its place are 300 plus Fests, in-person and online events of up to 12 hours run by local organisers, with DigitalOcean presenting and MLH and DEV running it. T-shirts are only at Fests, if the organiser decides to and as supplies allow. Online, there is a Swag Envelope for hitting milestones that had not been published as of 20 September, when 217 Fests were registered (DEV). The homepage's suggestions for what to do instead are "write your first skills.md, build your own open-source agent, fine-tune an open-weight model" (hacktoberfest.com). A skills file is a short document that tells an AI agent how to use a project.

I wrote in August about agents reading your docs and this month about DevRel in the era of AI. Hacktoberfest now tells a first-time contributor to write one of those files before anything else.

Microsoft switched off developer accounts with no email

Microsoft told Office 365 E3 Developer subscribers at the end of June that the subscription was being retired and set 14 September as the date (Topedia, June). A tenant is a Microsoft 365 account with its own users, and those tenants were disabled a few days late with a note in the admin page that the subscription would be deleted. No email (Topedia, 25 September). The suggested move is to a paid Microsoft 365 suite to keep the data. The free E5 sandbox (a test copy of Microsoft 365) from the Microsoft 365 Developer Program now needs a Visual Studio Professional or Enterprise subscription, a Microsoft partner level, or a Premier support contract to qualify (Microsoft 365 Developer Program FAQ). A personal account can join the programme. It can't get the sandbox.

Also in DevRel this week, 28 September: npm and RubyGems add a wait before a package goes live

npm 12.1.0 adds a kind of token that can only put a package into staging, a holding area before it goes live, and npm stage shows what is waiting there. RubyGems 4.1.0 beta 1 adds a --cooldown option to install, update and outdated, plus post-quantum signatures, which is signing that future quantum computers can't fake (Andrew Nesbitt, 26 September). They land after a run of attacks between April and July that stole publishing tokens and put poisoned packages on npm (Unit 42).

FAQ

When is OpenAI DevDay 2026 and can I watch it?

DevDay is on Tuesday 29 September 2026 at Fort Mason in San Francisco. The keynote with Sam Altman starts at 10am Pacific and streams free. In-person places were by application, which closed on 10 July, and cost $650. The other sessions are recorded and posted on openai.com after the event.

Do pull requests still count for Hacktoberfest 2026?

No. The four pull requests for a t-shirt rule is gone. Hacktoberfest 2026 is built around 300 plus in-person Fests of up to 12 hours. T-shirts are only handed out at Fests, at the organiser's discretion and while stock lasts. Online participants get a Swag Envelope for milestones that had not been published as of 20 September.

What did Meta announce for developers at Connect 2026?

Two $1 million competitions. The VR Start Developer Competition opened on 24 September and closes on 18 November, with 20 prizes from $20,000 to $100,000 across gaming, entertainment and productivity. A Global AI Developer Hackathon has another $1 million and free Model API credits. The v207 SDKs for the 2027 VR Glasses are out now.

What happened to the Office 365 E3 Developer subscription?

Microsoft retired it. The change was announced at the end of June 2026, the cut was set for 14 September, and the tenants were disabled a few days after that with a note in the admin centre saying they would be deleted. No email was sent. The free E5 sandbox now needs a Visual Studio Professional or Enterprise subscription, a partner tier or a Premier support contract.

Hacktoberfest starts on Thursday, and this is the first year a pull request on its own gets you nothing.