Yesterday's Top Launches: 5 Tools from September 23, 2026
This roundup covers five developer tool launches from September 23, split between code security and workflow automation, and suggests starting with Arcjet and Hyrax AI.
Five launches landed on September 23, and they split neatly between two camps: tools that help engineers ship safer code, and tools that quietly take work off your desk. If you track new developer tools for a living, Arcjet and Hyrax AI are the two worth reading first. The rest are worth knowing about.
Arcjet
Most agent security products want you to put something in front of your application. A gateway, a proxy, a control plane. Arcjet goes the other direction and ships inside the code you already deploy, exposing checks you call in the same code path that takes the action.
The reasoning is sound. Identity tells you who is asking, but not what happens next. That question has to be answered at every step, not at the door. Arcjet’s own illustration is a support agent that reads an email, looks up a customer record, and replies to an address that was cc’d on the way in. Every individual step looks fine. The sequence ends with bank details in someone’s inbox.
The runtime covers prompt injection detection, agent tool controls, DLP, and token budgets, alongside the older web security staples like WAF, bot detection and rate limiting. Everything returns a decision object your code branches on, so on a denial the action never runs. Overhead is quoted under 1ms locally and 20-30ms when the cloud API is involved. The honest caveat: a policy layer inside your own repo means someone on your team owns those rules. Arcjet splits rules in code from remote policies to soften that, which is a reasonable compromise.
SDKs cover JavaScript, Python and Go, with integrations reaching from LangChain and CrewAI to Claude Agent SDK and Vercel AI SDK. Worth a dry run on one route before you trust it.
Hyrax AI
Code review tools tell you what’s wrong with the pull request in front of you. Hyrax points at the whole repository instead. It maps modules, entry points, ownership and dependencies, then runs six specialized agents across security, correctness, maintainability, performance, architecture and operations.
The part that stands out is what happens after the finding. Hyrax writes the fix and runs it through a 13-step verification gate: isolated worktree execution, before and after tests, your build, lint and formatting, a diff size limit, a second review by an independent agent, a re-scan confirming the original issue is gone, and CI. Fail a required check and the work never becomes a pull request.
In the demo it unearths a hardcoded secret, a PCI DSS problem where a raw PAN routes through the backend, and a session token sitting in localStorage. Each finding carries an ID, a severity and an exact file and line. Approved architecture rules live in a HYRAX.md file with the repo, which keeps the decision where it belongs.
Free tier covers the full product with up to 100 PR reviews a month. Paid is $30 per user monthly. Hyrax never merges on its own, and inference runs in their Bedrock account rather than on your code.
Sai
Sai is a robosecretary from Simular AI that commands a fleet of autonomous computers. The mechanic is deliberately unglamorous: each computer reads the screen, clicks the button, types in the form.
That’s the whole trick, and it solves a real gap. Automation depends on an API, and the software buried deepest in daily operations — legacy desktop apps, internal portals, anything behind a login — rarely has one. Sai works through the interface instead, so the API requirement disappears. It runs on Windows, macOS and Linux and scores 73% on OSWorld, a benchmark for computer-use tasks.
No pricing is published yet, which is a gap if you’re evaluating it for a team. But for anyone with a backlog of repetitive screen work and no integration path, the premise holds up.
AI Creative Insights by Decode
Entropik’s predictive creative testing platform lets you upload an ad, banner, OOH unit or video and predict attention, emotion and conversion impact before media spend goes live. Four capabilities carry the weight: predictive attention scoring, second-by-second emotion simulation, visual hierarchy heatmaps, and prescriptive AI suggestions. Synthetic audiences let you compare predictions persona by persona.
The claims are strong — 95% predictive attention accuracy, 4X faster research timelines, 40% CTR improvement — and quoted secondhand they should be treated with some skepticism until your own numbers show up. Still, for teams tired of settling layout debates by opinion, the heatmaps and emotion mapping are the practical entry point.
Turfs
Turfs is a native macOS desktop organizer, and it exists because the Mac desktop never grew the way Windows did. Fences has done this on PC since 2009. Apple’s Stacks group by file type, which matches how almost nobody thinks.
You carve the desktop into labeled areas with three backing behaviors. A folder turf moves files into a real folder. A tag turf applies a Finder tag and surfaces every matching file without moving anything. A collection turf is purely visual, so nothing on disk changes. You mix them freely.
It replaces Finder’s desktop icon layer, which means wallpaper still shows, Mission Control still works, and Quick Look, Cmd-I and Cmd-Delete behave normally. It can’t be sandboxed, so it’s a direct download, notarized by Apple. Local-first, one JSON file, no accounts, no tracking. One-time $29 with a 10-day trial and no subscription.