SailPoint announced conditional just-in-time access, agent discovery and an agent kill switch at its Navigate conference in Austin. Futurum's analyst calls the bet well positioned but flags runtime authorization and agent coverage as open.
Perspective Coverage
3 publishers
- Builder
- Builder 25%
- Operator
- Operator 53%
- Investor
- Investor 22%
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+20
- Incentives55
- Confidence62
Google Cloud's Gemini agent works inside Workspace, Microsoft 365, Slack and the command line, keeping one set of memories across all of them. For whoever rolls it out, the work becomes wiring in the systems of record and access controls it depends on.
Perspective Coverage
25 publishers
- Builder
- Builder 26%
- Operator
- Operator 45%
- Investor
- Investor 29%
Reality
- Evidence60
- Adoption15
- Hype gap+40
- Incentives72
- Confidence58
ServiceNow adds its Slack-and-Teams service desk Flow to AI-SKU contracts at no extra cost
ServiceNow launched Flow, a Slack and Teams service desk it says deploys in one day, at no additional cost for existing AI-SKU customers on consumption terms. Futurum calls it a land-and-expand defence against AI-native rivals in SMB and mid-market accounts.
Publishers:futurumgroup.com
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap+35
- Incentives
- Not scored
- Confidence40
AI vulnerability scanners flag 41% to 99% of safe code in AWS's Deception Benchmark
AWS's Deception Benchmark found AI vulnerability scanners catch up to 95% of real bugs but flag 41% to 99% of safe code. Its samples were built to fool models, so teams still need their own false-alarm count before sizing the triage work.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+20
- Incentives
- Not scored
- Confidence40
IBM says a single core will run z/OS and Arm-native Linux at once. The part has no name and no ship date, which puts in-flight migration programs back into argument.
Perspective Coverage
3 publishers
- Builder
- Builder 35%
- Operator
- Operator 43%
- Investor
- Investor 22%
Reality
- Evidence50
- Adoption3
- Hype gap+35
- Incentives70
- Confidence60
GitHub lets enterprise owners export every token that can reach their code
Enterprise Cloud owners can now pull owner, scope, expiry and last-use data for SSH keys, PATs and app tokens as a CSV. The export stops at credentials GitHub issued, so secrets pasted into repositories stay out of scope.
Reality
- Evidence58
- Adoption20
- Hype gap+5
- Incentives70
- Confidence62
AWS claims its pre-assembled agent harness cuts costs 28% on the same Claude and GPT models
The new Strands harness ships the tools, memory and context handling most teams assemble themselves, and AWS attributes its 28% saving to offloading bulky tool output to files and reusable caches across six unnamed benchmarks.
Reality
- Evidence29
- Adoption
- Not scored
- Hype gap+34
- Incentives71
- Confidence37
Cycode blocks freshly published packages at the developer's workstation
Cycode's Workstation Protection, now in early access, screens installs against a threat intelligence feed and holds back packages updated too recently to vet. It ships inside the device management module Cycode already installs.
Reality
- Evidence28
- Adoption10
- Hype gap+34
- Incentives78
- Confidence38
Z.ai's ZCode uploaded whole developer workspaces to Alibaba's cloud by default
Z.ai has disabled the feature, deleted the cloud data and commissioned two outside assessments. For teams buying coding assistants, the test this leaves behind is measuring what the process sends before approving it.
Reality
- Evidence55
- Adoption35
- Hype gap+10
- Incentives72
- Confidence52
Claude Code's new AGENTS.md fallback leaves the symlink as the only audit trail
Version 2.1.277 reads a shared AGENTS.md when no CLAUDE.md is in scope. The documented exceptions cover first sessions, telemetry-disabled runs, Bedrock, Vertex and Foundry, and the hooks governance tooling watches.
Reality
- Evidence68
- Adoption58
- Hype gap+12
- Incentives62
- Confidence64
GitHub will restrict pull_request_target by default on affected public repos on November 2, 2026
GitHub's workflow execution protections went generally available on September 17, and the evaluate mode that shows what a rule would block before enforcement is documented as an Enterprise Cloud capability.
Reality
- Evidence58
- Adoption25
- Hype gap+12
- Incentives58
- Confidence54
Splunk open-sources a tool that prices AI coding sessions from local trace files
Token Meter reads the trace files Claude Code, Codex and Cursor already leave on a developer's disk and prices them against published model rates. The budget alert it fires goes to whoever ran the session.
Reality
- Evidence38
- Adoption10
- Hype gap+18
- Incentives75
- Confidence45
StackHawk's Wingman asks the coding agent to patch the vulnerability it just wrote
The tool boots the running app once an agent finishes a feature, sends findings to Claude Code or Copilot, and rescans to confirm the fix. It costs $10 a seat a month and meters that loop at 50 scans.
Reality
- Evidence32
- Adoption18
- Hype gap+30
- Incentives75
- Confidence38
Nearly half of scanned Artifactory servers still ran unpatched two weeks after JFrog's fix
Wiz reports multiple threat actors independently exploiting three patched JFrog Artifactory flaws, and its telemetry puts 49% to 62% of scanned instances still missing the fixes weeks after release. Two of the three chain into admin.
Reality
- Evidence55
- Adoption70
- Hype gap+12
- Incentives65
- Confidence55
VS Code moves agent sessions out of the editor and publishes the protocol under MIT
Version 1.133 runs agents in a standalone host that survives window closes and can be reached over SSH, and the session protocol is now an MIT-licensed spec.
Reality
- Evidence52
- Adoption20
- Hype gap+18
- Incentives58
- Confidence55
Chinese models clear 75% of enterprise engineering tasks at a fifth of the US cost
American agencies say six Chinese labs bought bulk subscriptions to US models and trained on the outputs since 2024. Enterprise buyers are meanwhile paying a fifth as much for models that clear most of their engineering work.
Reality
- Evidence45
- Adoption55
- Hype gap+25
- Incentives70
- Confidence45
GitHub triples the license ceiling for self-serve Advanced Security trials
Mid-size engineering teams can now run GitHub Advanced Security against their own repositories for 30 days without a sales call, and then they have to decide what a good result looks like. Mitch Ashley of The Futurum Group says the bottleneck was procurement.
Reality
- Evidence44
- Adoption
- Not scored
- Hype gap+12
- Incentives56
- Confidence48
Rust Survey: Most Developers Favor println! as Debuggers Struggle to Show Values Like HashMap and Vec
The Rust compiler team's first debugging survey found that 46% of respondents use a debugger, and the reasons given are about legibility rather than taste, with 74% reporting poor value rendering and 55% unable to reliably inspect a variable.
Reality
- Evidence55
- Adoption55
- Hype gap+10
- Incentives45
- Confidence58
GitHub moves Copilot's sandbox lock into the JetBrains plugin itself
Admins can now set filesystem, network, proxy, developer-tool and Keychain limits for Copilot sessions from inside the plugin rather than through a device-management request, and a new diagnostics tool tells them whether the policy reached the laptop.
Reality
- Evidence42
- Adoption
- Not scored
- Hype gap+12
- Incentives58
- Confidence48
Faros telemetry shows pull requests nearly quadrupling across 22,000 developers in two years
Two years of compounding growth in pull request size lands on the same reviewers, while Futurum's adoption figures put AI at 40.2% in code generation against 6.2% in deployment decisions. That gap is where the queue forms.
Reality
- Evidence44
- Adoption58
- Hype gap+18
- Incentives66
- Confidence49