SI Agent News

• An opinion piece in The Tech Edvocate argues that one thing about OpenAI's lawsuits could change everything for AI's future, and it frames the case as a question of AI ethics.
• Junegunn's page on using fzf with AI coding agents is a practical tip for anyone who already lives in the terminal.
• 36Kr reports that OpenAI has poached a core sales head from xAI.
• A post on OpenAI's community forum introduces custom avatars to ChatGPT.
• A write-up on Note tests Codex Security Cloud against OWASP WebGoat to see how the AI interprets vulnerabilities.
• A dev.to guide covers how to add payments to an app you built with AI without it breaking.
• A LessWrong post looks at how to make capability evaluations scale.

Custom avatars. A post on OpenAI's community forum introduces custom avatars for ChatGPT (the chatbot app). The post itself says little, so what avatars do, who gets them and the price are not confirmed. Wait for an official announcement before planning around it.

What this means for you: Small business owner: don't redesign customer chat around it yet. Job seeker or student: nothing to do; skim the official post when it lands. Creator: sketch what a consistent on-screen character could look like, then wait.

Codex security test. A hands-on write-up ran a one-time scan with Codex Security Cloud (a code-security scanner) on WebGoat, a deliberately vulnerable OWASP practice app, to see what it flags and how it explains each issue. Takeaway: judge an AI reviewer by its explanations, not its finding count, and test on practice code first.

A security hire. OpenAI hired Graham Seamans, previously go-to-market head at xAI, to lead sales for its cybersecurity business, 36Kr reported for October 16. Why it matters: a dedicated security sales lead suggests a business line, not just a feature. Takeaway: if you buy security tools, ask what OpenAI offers.

Payments in AI-built apps. A dev.to guide warns that typing 'add payments' into a coding agent such as Claude Code, Cursor or Codex can produce a checkout that works at first but breaks later. Takeaway: treat payment code as high-risk, and review the agent's first draft before you charge anyone.

Defining what not to do. A Japanese daily-digest note highlights an agent-safety idea: protect AI agents by defining what they must not do, rather than only what they may. Takeaway: before granting an agent access, write three explicit don'ts, for example no deleting files and no spending money.

Scalable evaluations. LASR Labs research from summer 2026, supervised by Justin Olive of Generality Labs and Magda Dubois of the UK AI Security Institute, looks at scalable capability evaluations, meaning ways to test what models can do. It is niche. Takeaway: when a vendor cites a capability test, ask who ran it.

fzf with agents. fzf's author published a tip page on using the fuzzy finder (a command-line search tool) with AI coding agents. It drew just 2 points on Hacker News, so it is low-stakes. Takeaway: if you live in the terminal, skim it for a smoother agent workflow.

Lawsuits. The Tech Edvocate runs an opinion piece on OpenAI's lawsuits and AI ethics under a 'could change everything' headline. The summary shows little concrete detail, so read it as commentary, not a ruling. Takeaway: follow court filings, not headlines, if legal risk touches your tools.

Semgrep (a code-scanning tool) is good for fast, rule-based scans you can run yourself, a useful second opinion beside an AI review. Limits: it only finds what its rules cover, and it can raise false alarms. Alternative from a different company: Snyk Code (a security scanner).

Safe to use? Check their privacy page.

Worth it if... you ship code and want a second check beside AI review.

Models: today's stories name no new ChatGPT models, so check the model picker at the top of a chat for what your plan offers.

Codex Security Cloud: the test above was a one-time scan of a public repository. To try the same, point it at one repo and read the explanation for each finding, not just the count.

Custom avatars: introduced in an OpenAI community post; details unconfirmed.

Pricing: not stated in today's stories. Check the current price on OpenAI's pricing page.

That's the report. Tomorrow we're watching for official word on custom avatars. The Agent Signal is independent and self-funded: one person built it, with no investors and no ads, and every share keeps it going.