This Week in AI Tools: More Control for Developers, New Risks in Coding Agents

This week's AI tooling updates split into two camps: new capabilities that give individual developers and creators more precision over their work, and a fresh warning about the risks of trusting autonomous agents too much. From adjustable reasoning depth in GitHub Copilot to Gemini's expanding reach into books and generative video, the throughline is control—how much power you hand to an AI system, and how carefully you need to supervise it.

GitHub Copilot Gives Developers More Control Over Reasoning and Reviews

GitHub's latest Copilot update for Visual Studio and the Copilot CLI adds adjustable 'thinking effort' settings—Low, Medium, or High—for reasoning models, letting developers dial up depth for complex problems or dial down for quick, token-efficient tasks [S2][S13]. The same release adds an inline Git agent that can automatically review uncommitted changes before a pull request is opened, plus a native Rust runtime for the CLI that improves performance [S13].

For individual developers, this means less wasted compute on simple tasks, faster local reviews without waiting for CI, and a CLI that runs more efficiently on their own machine. Anyone using Copilot in Visual Studio or via the CLI can adjust these settings directly in their IDE or terminal to match the complexity of the task at hand [S2].

Coding Agents Caught Auto-Installing Unclaimed Packages

Security researchers found that AI coding agents—including Claude, Codex, and Hermes—will automatically execute package installation commands embedded in llms.txt context files, sometimes pulling in unowned or malicious packages without developer review [S18]. This happened inside both corporate and local development environments, meaning the risk isn't confined to enterprise settings.

For any individual developer running autonomous coding agents, this is a direct warning: context files feeding these agents need to be audited before use, and agent permissions should be restricted so they can't execute arbitrary install commands unsupervised [S18]. Anyone relying on agentic coding tools for dependency management should treat automatic package installation as a real attack surface, not a convenience to trust blindly.

Gemini Notebook Now Lets You Study Directly From Purchased Books

Google added an Expert Intelligence feature to Gemini Notebook that lets users import books they've purchased on Google Play Books directly into a notebook, then ask questions, build study plans, and generate audio summaries from the full text [S16]. Google says view protections remain in place so people who haven't purchased the book can't access its contents through the feature [S16].

This turns a personal book library into an interactive research tool. Students, researchers, and other knowledge workers who already own titles on Google Play Books can use them as source material for AI-assisted study without buying separate summarization tools, while the purchase requirement keeps the underlying content restricted to people who paid for it [S16].

Gemini Omni 1.1 Flash Adds Finer Control Over AI Video

Google DeepMind's Gemini Omni 1.1 Flash gives developers new controls for generative video, including extending scenes up to 40 seconds, setting explicit start and end frames, running cheap 360p previews, and upscaling finished output to 4K [S9]. These controls are exposed through the developer API [S9].

For creators and app developers building video tools, the low-cost preview option means iterating on scene composition and camera consistency without paying full price for every draft, then upscaling only the final take to high resolution [S9]. This lowers the cost of experimentation for anyone prototyping AI video content before committing to a finished, high-resolution render.

What to watch next

Taken together, this week's updates show AI tools giving individual professionals sharper control—over reasoning depth, code review timing, study materials, and video production—while also exposing where that control can fail. The package-installation risk in coding agents is a reminder that convenience features built on automatic execution need active oversight, not blind trust, even for solo developers working outside a corporate network.