AI discovery: 2026/03
01.03.2026 – 31.03.2026
Product
- OpenAI releases GPT-5.4 on March 5 with native computer use in Codex and the API, 75% on OSWorld-Verified (GPT-5.2: 47.3%) and a 1M-token API context window
- Claude Code adds auto mode (a classifier approves safe actions and blocks risky ones, research preview), computer use in the desktop app and PR auto-fix on Claude Code on the web
- Cursor ships Composer 2 on March 19, priced at $0.50 input and $2.50 output per million tokens (Fast variant: $1.50 and $7.50)
- On March 13 Anthropic makes the 1M-token context window generally available for Opus 4.6 and Sonnet 4.6 at standard per-token pricing, with up to 600 images or PDF pages per request
- OpenAI announces Codex Security, an agent that scans for vulnerabilities and proposes and applies fixes, as a research preview for ChatGPT Pro, Enterprise, Business and Edu customers
UX/UI
- Google Labs rebuilds Stitch as an AI-native design canvas with a design agent, voice input and a DESIGN.md file for moving design rules between tools
- Figma opens its canvas to coding agents: the
use_figmaMCP tool can write to the canvas, free during the open beta, with markdown skills to teach agents a team’s conventions - GitHub shows coding agent sessions (Copilot, Claude, Codex) under the assignee in Issues and in Projects table and board views
- GitHub puts a redesigned pull requests dashboard at github.com/pulls into public preview, with an inbox, saved views and AND/OR search
Engineering
- OpenAI releases GPT-5.4 mini and nano on March 17, with mini scoring 54.4% on SWE-Bench Pro (GPT-5.4: 57.7%) and usable as a subagent in Codex
- Anthropic launches Code Review for Claude Code: parallel agents review each pull request and a verification step filters false positives, at about $15 to $25 per review
- GitHub’s Copilot coding agent can resolve merge conflicts on a pull request when you mention
@copilot, then checks build and tests before pushing - Cursor admits it should have disclosed that Composer 2 is built on Moonshot’s open-source Kimi K2.5, saying about a quarter of the pretraining came from the base model
DevOps
- Cloudflare puts Dynamic Workers into open beta: V8 isolate sandboxes for AI-generated code that start in milliseconds, with outbound network access that can be blocked
- Datadog’s MCP server is generally available, giving Claude Code, Cursor, Codex and Copilot access to live logs, metrics and traces
- Custom images for GitHub-hosted runners are generally available, so you can bake tools, dependencies and certificates into your own runner image
- GitHub Actions run summaries now show the markdown config of an agentic workflow as it was when the run executed
Infosec
- Trend Micro analyzes the compromised axios npm releases 1.14.1 and 0.30.4 (March 31), which pulled in a hidden dependency that installed a cross-platform remote access trojan
- Aqua Security’s advisory (March 21) covers the malicious Trivy v0.69.4 release of March 19 and force-pushed
trivy-actionandsetup-trivytags that ran malicious commits - LiteLLM confirms that PyPI releases 1.82.7 and 1.82.8 on March 24 contained a credential stealer, removed them from PyPI and links the incident to the Trivy compromise
- Claude Code 2.1.88 ships a source map to npm on March 31, exposing about 512,000 lines of TypeScript; Anthropic calls it a packaging error, not a breach
- A CMS misconfiguration exposes about 3,000 unpublished Anthropic assets, and Anthropic confirms it is testing a new model, Claude Mythos, with early-access customers
- GitHub will train on Copilot Free, Pro and Pro+ interaction data from April 24 unless you opt out in settings; Business and Enterprise are exempt
Tricks & Tips
- A GitHub engineer walks through a Copilot CLI workflow: plan with
/plan, implement with/autopilot, loop on Copilot code review, then finish with a human review - GitHub’s Squad post shows how to set up a team of Copilot agents in a repository that share decisions through versioned files
- Claude Code 2.1.85 (March 26) lets hooks declare an
iffield in permission rule syntax, such asBash(git *), so a hook only runs for matching tool calls - Anthropic’s harness design write-up: a separate, skeptical evaluator agent works better than self-review, but costs more (a 6-hour run at $200 versus 20 minutes at $9)
Reddit & Twitter
- On Hacker News, the thread on the Claude Code source map leak reaches 2,095 points
- On Hacker News, the thread on the malicious
litellm_init.pthin LiteLLM 1.82.8 collects 739 points before moderators move the discussion to an earlier thread - On Hacker News, a 1,274-point thread about OpenCode’s homepage collects complaints about defaults and stability and suggestions to try Codex or Claude Code
OSS
- Mistral releases Small 4 under Apache 2.0 on March 16: 119B parameters (6B active) and 256k context, with reasoning, vision and coding in one model
- NVIDIA releases the open Nemotron 3 Super: 120B parameters (12B active), 1M-token context, available on Hugging Face and OpenRouter
- OpenAI announces on March 19 that it will acquire Astral, the maker of uv, Ruff and ty, and says it plans to keep supporting the open source tools