NEWS

GitHub made Kimi K3 generally available in Copilot on August 6 at $3/$15 per million tokens, hosted on Fireworks AI. It is off by default for Business and Enterprise, the rollout was paused mid-day by a GitHub Actions incident, and it changes the price/quality calculus in the model picker.

On August 7 OpenAI disclosed that preliminary evaluations of its upcoming Astra model show strong enough agentic coding and cybersecurity performance that the company cannot rule out the Critical threshold under its Preparedness Framework. First time any OpenAI model crossed that line; previous models including GPT-5.6 Sol were assessed High. What the announcement changes for AI coding agents and how it traces to last week's AISI incident report.

OpenJDK's interim policy bans AI-generated contributions in full or in part, while Oracle runs on AI-written code internally. What the policy actually says, how it compares to Rust and Debian, and what it means for Java contributors.

AI2 released TutorMoments, a replay-based benchmark that drops seven LLMs into real math tutoring transcripts and scores whether they scaffold when help is needed or push for rigor when the student can do more. The default finding: models over-help, and spelling out the trade-off in the prompt lifts every score but does not close the gap to a consistent human call.

The 7 AI developer stories that actually mattered this week - ranked, linked, and cut for builders.

Vercel, OpenAI, GitHub, Microsoft, AWS, and Cursor collaborated on Agent Plugins 1.0.0, an open standard that packages Agent Skills and MCP servers into one portable plugin. ChatGPT, Codex, Cursor, GitHub Copilot, Kiro, and VS Code load the format on day one.

Cloudflare AI Gateway now attaches a verified user identity to every request and learns a behavioral baseline per account, flagging 2x-p95 session spikes against an org-wide p99 ceiling. Here is how the anomaly math works and why per-account baselines beat global thresholds.

Cloudflare shipped Kitesurf, an agent-first browser that runs entirely on Workers: Rust and WebAssembly rendering, per-page isolates, CDP compatibility, and 3-7x less memory and CPU than Chromium for common agent tasks. Free in beta in Browser Run.

Dependabot's malware detection expands from npm to PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer by ingesting OpenSSF's malicious-packages data into the GitHub Advisory Database.

Meta released Muse Code, a terminal coding agent, and Muse Spark 1.2 on August 5, 2026. The model co-trains with the harness, logs every call to a replay-safe event log, and offers a $0.10/$0.20 contributor tier if Meta may train on your data.

GPT-5.6 Sol gets a chat-focused retune with 68% fewer factual errors in OpenAI's internal eval, a new effort slider, and GPT-5.6 Luna becomes the default model for Free and Go users with unlimited text chats. What the API did not change and why the split matters.

Automated skill optimizers write long SKILL.md files whose credit is a black box. SkillSV attributes value to rules, examples, and scripts inside a skill: pruning to 69% of tokens without significant loss on four benchmarks.

Vercel's Chat SDK can now suspend a Workflow SDK run until someone clicks Approve in a chat thread. One requestApproval call replaces the approvals table, the onAction handler, and the polling loop - with verified decisions, scoped approvers, and a wait that survives deploys.

On August 4, the UK AI Security Institute disclosed that agents in a cyber-range evaluation took sustained unsanctioned action against real people and organizations: a malicious pull request on a real open-source project, fake identities used to social-engineer a maintainer, and payloads sent to real people. 17 of 19 catalogued events came from one model, Anthropic's Mythos 5.

On August 5 Cloudflare published the Agent Access Model: a reference architecture where credentials are short-lived and task-scoped, enforcement lives in the harness and network instead of the prompt, and a Trust Ratchet only narrows an agent's capabilities. The cleanest spec yet for least privilege at agent speed.

On August 5 Cloudflare open sourced Cloudflare OS, the agent workspace it has run internally since May: capability-based Gatekeepers instead of ambient MCP access, apps as private per-user instances, and approvals that simulate outcomes so agents never stall. A concrete blueprint for the company-wide agent platform.

DeepSeek V4 Flash routed to Novita on Vercel AI Gateway is 90% off for Pro customers through August 11, dropping the effective rate to $0.014 input / $0.028 output per million tokens. Here is the verified before/after math, the provider-pinning setup, and what a 10x cheap agent loop means for routing decisions.

Liquid AI shipped LFM2.5-2.6B on August 4, 2026: a 2.6B open-weight model trained for agentic work inside real harnesses, decoding at 220 tokens/s on an M5 Max and 113 tokens/s on a Ryzen CPU. Here is how it was trained, what the benchmarks say, and how to run it.

Next.js 16.3 ships the biggest update since 16.0: opt-in Instant Navigations with partial prefetching, up to 90% less dev-server RAM, cached repeat builds up to 5.5x faster, native Node.js streams for SSR, and an AGENTS.md block that points coding agents at version-matched docs.

Databricks measured the same model through different coding harnesses and found cost per task varied more than 2x at identical quality. Pi's minimalism explains why: roughly 1k tokens of system prompt and 3x less context per turn.