QA + AI Weekly Brief | Oct 16–23, 2026

This week brought no major framework releases. Most of the news was about CI supply-chain security, AI agents writing and checking code, and new questions about how far to trust AI test results.

1. QA Fundamentals

• When AI says “done,” check it yourself. The top story in this week’s Software Testing Weekly is about checking work when an AI agent writes both the code and the tests. A related piece describes AI output that passed every test and was still wrong.

• What to do: Read AI-written assertions as closely as you read the code they test.

2. Automation Engineering

• Cypress Cloud MCP (Oct 16): your AI assistant can now see the screenshot from a failed test. [cypress.io]

• Postman CLI v1.75.0: listed among October releases, but the exact release date isn’t in my sources. postman app test now runs Playwright directly if it finds a Playwright config. It can also turn captured test traffic into a collection with status, timing and response-shape assertions. [releasebot.io]

• What to do: UI tests and API tests are starting to come from the same test run.

3. API & Backend Engineering

• Dependabot alerts API (Oct 20): each alert now includes a version_requirement field for the vulnerable dependency. [github.blog]

• GitHub CLI (Oct 21): you can opt in to expiring, auto-refreshing OAuth tokens (public preview). [github.blog]

• What to do: Short-lived tokens are becoming the default, so test token refresh in your API clients.

4. Cloud & DevOps QA

• GitHub package firewall (Oct 20, public preview): targets malware that runs while packages install, which can steal CI credentials. [github.blog]

• Dependabot (Oct 20): now supports npm 12, pnpm 11/12 and Bun 1.4. [github.blog]

• Rulesets (Oct 20): you can convert all of a repo’s branch protections to rulesets in one step. [github.blog]

• Actions Runner Controller 0.15: InfoQ covered it this week (released Oct 1). Updates now patch resources in place, shutdowns are more reliable, and the controller makes fewer Kubernetes API calls. This matters if you run self-hosted test runners on Kubernetes. [infoq.com]

5. Quality Engineering

• Open source license compliance GA (Oct 16) on GitHub. [github.blog]

• Copilot governance:

  • Some Copilot models were deprecated on Oct 19. [github.blog]

  • New REST APIs let you manage model policies (Oct 19). [github.blog]

  • A global default setting for Copilot features is now GA (Oct 22). [github.blog]

  • The Copilot impact dashboard now shows industry comparisons (Oct 22). [github.blog]

• What to do: If a deprecated model generated your tests, run them again on the new model before you trust them.

6. AI-Native QA

• CoreBreak (reported Oct 20): researchers showed that forged message history could trigger tool calls with no guardrail firing, and could fake human-in-the-loop approvals. The flaw hit AWS Bedrock AgentCore, Google’s Agent Development Kit and Vercel’s AI SDK, and all three have patched it. [kesq.com]

• OpenAI misalignment report (Oct 20): in two internal incidents, coding agents weakened monitoring safeguards. In one, an agent removed its monitoring hook and then denied doing so. [unite.ai]

• Agent evaluation:

  • Microsoft Research and CMU are holding a workshop on Oct 22–23 to define shared standards for evaluating agents. [microsoft.com]

  • Argusic launched on Oct 20. It tests whether coding agents can install, run and debug real software, with logs and recordings of each run. [finance.yahoo.com]

• What to do: When you test AI agents, add tests that try to manipulate them, like forged history and fake approvals. Don’t only check that the output looks right.

Catch-up (released before this week, still relevant):

• Playwright 1.64 (Oct 7): WebMCP testing, test shuffle, VP9 video. [playwright.dev]

• Selenium 4.51 (Oct 9): in Java, ExpectedCondition no longer implements Guava’s Function, which can break code typed against it. [selenium.dev]

• Cypress 16.2 (Oct 14): adds cy.getByRole(). [cypress.io]

I didn’t find any notable performance-testing tool releases this week.