Topic
All blog posts, tools, and guides about News from Developers Digest.
269 resources - 269 posts

Cloudflare Gateway now classifies MCP traffic by protocol headers instead of hostname heuristics, ships a shadow-MCP dashboard, and lets admins block any MCP connection that does not arrive through an approved portal. The 2026-07-28 stateless spec is what made it possible.

Hugging Face's open challenge used 1,200+ participants and their coding agents to attempt 2,226 ICML 2026 papers claim by claim. 51% had claims independently verified, 23% had a falsified or contested claim, and four documented falsifications include a spotlight theorem that fails after step 224.

The 7 AI developer stories that actually mattered this week - ranked, linked, and cut for builders.

AutoGPT's founding AI engineer published the gates that keep an open source repo sane when agents submit the majority of pull requests: enforced PR templates, AGENTS.md placement, skills that fire on trigger phrases, a CLA as a human detector, and a commit-SHA rule that kills fake review resolutions. GitHub published the playbook August 12, and the details are sharper than the headline.

DeepSeek open-sourced its agent harness today. We cloned it and read the code: a 453K-line plugin runtime on a vendored Cordis fork, three patterns worth stealing, V4 line signals hiding in the model adapter, and a 3-line BENCHMARK.md from a lab that published zero eval claims.

xAI shipped Grok 4.6 on August 12, 2026: it matches GPT-5.6 Sol on the AA Intelligence Index (61), beats it on CursorBench 3.2, and keeps Grok 4.5's $2/$6 per million token pricing. Available in Cursor and Grok Build today, and in OpenCode as opencode/grok-4.6.

A study of 247,694 instruction lifetimes in 1,867 repositories shows agentic prompt files grow +226% on average because the reasoning behind each rule decays. Comments encoding that reasoning remove 99.3% of the excess.

EvoX Genesis built a 250k-line Rust C compiler with DeepSeek V4 Flash for $44 in tokens by making the project the persistent thing and keeping agents finite-lived. The paper's three runs, the design that made them possible, and what it says about agent memory.

The August 11 JetBrains plugin release adds Copilot memory across chat sessions, Ollama as a bring-your-own-key provider, and enterprise managed settings for MCP access and permission bypass. Here is what each feature actually does and why the IDE just became the control point for agent tooling.

Liquid AI released LFM2.5-VL-3B on August 12, 2026: a 3.1B open-weights vision-language model that averages 80.7 on ScreenSpot-v2, doubles ToolSandbox to 59.5, and decodes at 228 tokens/s on an M5 Max in about 3 GB of memory. Here is what shipped, the benchmark caveats, and how to run it.

Daybreak Red (GPT-5.6-Cyber) and Daybreak Blue (GPT-5.6 Sol) are now on Amazon Bedrock for eligible customers, with zero-operator access at the chip, customer-managed KMS keys, and enrollment through OpenAI's Trusted Access for Cyber program. Here is what changed and what it means for security teams.

OpenAI published real usage data from its enterprise customer base: Codex now drives 64% of enterprise output tokens, and the top 10% of firms generate 8.3x the tokens of typical ones. What the frontier gap says about agentic AI's spread beyond engineering.

ACE and IBM's ALTK-Evolve both turn agent trajectories into reusable lessons. The difference is delivery: one injects the whole playbook every step, the other calibrates. On AppWorld, calibration wins with the same accuracy at a fraction of the tokens.

Anthropic confirms that every Claude model released after August 2, 2026 embeds a machine-readable watermark in generated text and attaches C2PA provenance metadata to generated files, across the API, Claude Code, Cowork, and Tag. Detection tooling for third parties is coming, but details are not published yet.

Cactus open-sourced Needle 2, a 45M-parameter agentic LLM in a single 14MB binary that runs a full tool-calling session in 28MB of RAM. 500 tok/s on a Raspberry Pi 5, ESP32-S3 class parts, Apache 2.0. Here is what the benchmarks actually show.

Cloudflare mitigated 935 network-layer attacks above 1 Tbps in H1 2026, a +519% quarter-over-quarter jump, while DNS floods grew from 25.7% to 40.0% of network-layer attacks. Here is what the numbers say about how attacks are changing and what it means for anyone running public infrastructure.

GitHub shipped a Java-native Copilot SDK (1.0.7-preview.1) with @CopilotTool annotations, virtual-thread support, Jakarta EE and Spring composition, and BYOK mode that works against any OpenAI-compatible endpoint with no Copilot subscription. Here is what changed and what it unlocks.

A new arXiv paper shows the encrypted reasoning blocks that Anthropic, OpenAI, and Google return to API clients can be replayed into weaker models from the same provider and transcribed verbatim. The authors decoded 315,320 blocks from public repositories and recovered 367 PII artifacts and 182 credentials.

A new arXiv paper probes six widely used open-source agent frameworks and finds the barrier semantics of approval gates, cancellation, and timeouts hold on none of them. A sibling branch can execute while the user is rejecting another one, and replay can double-execute. The fix is a verified external gate called SoundGate.

Vercel Sandbox now polices all outbound traffic on the host, outside the microVM, with SNI-based domain policies, CIDR rules, host-level credential injection, and a deny-all default. Here is why a network boundary is the half of agent isolation that VM escapes missed.

A new ASE 2026 framework injects server errors, truncated responses, and corrupted tool calls into live agent systems at the HTTP layer. Every system degrades, pass@1 drops up to 50 points, and the ranking stays the same no matter which LLM is behind it.

Multiverse Computing open-sources two changes that make knowledge distillation cheap enough to run at scale: caching the teacher's top-100 logits once so it never sits in memory during training, and a fused chunked KL loss that never materializes the vocab-by-sequence matrix. A GPT-OSS 20B distillation at 32K context drops from four GPU nodes to one, with step time down 5x.

A new arXiv paper builds a deterministic monitor on top of SWE-agent that watches long agent trajectories and only calls an advisor LLM when the run actually drifts. Resolution rates go up by up to 15.2 points at an extra $0.08 per instance, and the paper argues the expensive approach is re-planning from inside the loop.

Meta open-sourced Muse Glimmer, a 30B Apache 2.0 multimodal agent model that runs in a 24GB envelope at up to 233 tok/s. MCP Atlas 75.5, SWE-Bench Verified 76.0, 131K context. Here is what the numbers actually say.

GPT-5.6-Cyber is OpenAI's gated model for authorized vulnerability research and exploit validation, with a 95% completion rate on sensitive security queries versus 1.5% for the base model. It already produced a fixed Chrome CVE. Here is what actually shipped and who gets it.

Claude Code v2.1.224 lets one running session message another over a first-party channel - plain text, permission-aware, with approval dialogs when bypass-mode sessions talk to each other. Here is what ships, how delivery and inbound controls work, and where the feature stops.

A developer's Claude-built night-sky site reproduced an open source project's name, feature set, and even a bug the author had already fixed. The saga that followed says a lot about memorization, accountability, and the verification duties of AI-assisted shipping.

Copilot code review's Lite and Balanced effort levels are generally available. Here is what each level does, what it costs in AI credits and Actions minutes, and how to set org-level defaults so review depth matches PR risk.

GitHub's impact dashboard now models Copilot ROI directly: cost per developer per month from real AI credit consumption, PR output per phase, and a salary selector. What the numbers actually tell you about agent-first vs passive adoption.

GitHub now lets enterprise owners install third-party GitHub Apps on their enterprise account, and lets any user or organization create apps with enterprise permissions. This opens the enterprise management layer to the broader ecosystem - with a hard security boundary around the most powerful permission set.

xAI released Grok Imagine Image 2.0 on August 7 as the new Quality Mode on grok.com and mobile, ranked second worldwide on both text-to-image and image-editing leaderboards. A 2.0 preview build is already callable through Vercel's AI Gateway with the AI SDK, before xAI's own API access goes live.

Vercel added Hermes Agent to AI Gateway and made Vercel Sandbox a terminal backend for the open-source agent. Hermes is now fully BYO: your own model routing through 200+ models at no markup, and your own cloud microVM for every agent command. Here is what that unlocks and why the agent control plane is consolidating.

skills.sh now lets you bundle multiple agent skills into a shareable, unlisted pack and install it with one command. Packs mix public directory skills, private local files, and GitHub repos, then sync with a single update command. Here is how they work, what they mean for team standardization, and where the trust questions are.

WeatherNext Cyclones adds a full day of lead time to tropical cyclone forecasts - roughly a decade of meteorological progress - and now the weights, code, and data feeds are public. What the paper actually shows and how to run it.

Cloudflare's Web Integrity team published the framework behind its agent traffic posture: continuous behavioral trust instead of point-in-time bot scoring, Precursor telemetry from 206 million evaluation events a day across 73,438 zones, and a verified-bot taxonomy where agents earn access by declaring themselves honestly.

Cloudflare's Agents Week finale frames agents as a new kind of web visitor with four primitives: readable, discoverable, callable, payable. Here is what that architecture means for developers building and monetizing agent-facing services.

Cloudflare shipped Radar Researcher, a natural-language agent that answers questions about global internet traffic with real interactive charts. The architecture - MCP code mode, chart specs that never let the model touch raw numbers, and a three-model fallback chain - is the interesting part for developers.

Cloudflare is merging Workers AI and AI Gateway into one control plane: unified /ai/ REST API, auto-created default gateways, AI Gateway credits spendable on Workers AI, and model-first routing that picks the provider for you. Here is what changes and what stays.

A Huawei-Queen's study finds open coding models fine-tuned under OpenHands degrade sharply under other scaffolds - SWE-Lego-Qwen3-32B drops from 52.6% to 8.4% Pass@1 on OpenCode. The fix: train planning as a model capability, not a scaffold artifact.

Anthropic retuned Claude Fable 5's biology classifiers on August 7, cutting biology-related fallbacks by about 85% while keeping dual-use domains like virology, toxicology, and molecular design routed to Opus 5. Here is what changed, what stays blocked, and what it means for Claude Code and API users.

GitHub made Kimi K3 generally available in Copilot on August 6 at $3/$15 per million tokens, hosted on Fireworks AI. It is off by default for Business and Enterprise, the rollout was paused mid-day by a GitHub Actions incident, and it changes the price/quality calculus in the model picker.

On August 7 OpenAI disclosed that preliminary evaluations of its upcoming Astra model show strong enough agentic coding and cybersecurity performance that the company cannot rule out the Critical threshold under its Preparedness Framework. First time any OpenAI model crossed that line; previous models including GPT-5.6 Sol were assessed High. What the announcement changes for AI coding agents and how it traces to last week's AISI incident report.

OpenJDK's interim policy bans AI-generated contributions in full or in part, while Oracle runs on AI-written code internally. What the policy actually says, how it compares to Rust and Debian, and what it means for Java contributors.

AI2 released TutorMoments, a replay-based benchmark that drops seven LLMs into real math tutoring transcripts and scores whether they scaffold when help is needed or push for rigor when the student can do more. The default finding: models over-help, and spelling out the trade-off in the prompt lifts every score but does not close the gap to a consistent human call.

The 7 AI developer stories that actually mattered this week - ranked, linked, and cut for builders.

Vercel, OpenAI, GitHub, Microsoft, AWS, and Cursor collaborated on Agent Plugins 1.0.0, an open standard that packages Agent Skills and MCP servers into one portable plugin. ChatGPT, Codex, Cursor, GitHub Copilot, Kiro, and VS Code load the format on day one.

Cloudflare AI Gateway now attaches a verified user identity to every request and learns a behavioral baseline per account, flagging 2x-p95 session spikes against an org-wide p99 ceiling. Here is how the anomaly math works and why per-account baselines beat global thresholds.

Cloudflare shipped Kitesurf, an agent-first browser that runs entirely on Workers: Rust and WebAssembly rendering, per-page isolates, CDP compatibility, and 3-7x less memory and CPU than Chromium for common agent tasks. Free in beta in Browser Run.

Dependabot's malware detection expands from npm to PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer by ingesting OpenSSF's malicious-packages data into the GitHub Advisory Database.

Meta released Muse Code, a terminal coding agent, and Muse Spark 1.2 on August 5, 2026. The model co-trains with the harness, logs every call to a replay-safe event log, and offers a $0.10/$0.20 contributor tier if Meta may train on your data.

GPT-5.6 Sol gets a chat-focused retune with 68% fewer factual errors in OpenAI's internal eval, a new effort slider, and GPT-5.6 Luna becomes the default model for Free and Go users with unlimited text chats. What the API did not change and why the split matters.

Automated skill optimizers write long SKILL.md files whose credit is a black box. SkillSV attributes value to rules, examples, and scripts inside a skill: pruning to 69% of tokens without significant loss on four benchmarks.

Vercel's Chat SDK can now suspend a Workflow SDK run until someone clicks Approve in a chat thread. One requestApproval call replaces the approvals table, the onAction handler, and the polling loop - with verified decisions, scoped approvers, and a wait that survives deploys.

On August 4, the UK AI Security Institute disclosed that agents in a cyber-range evaluation took sustained unsanctioned action against real people and organizations: a malicious pull request on a real open-source project, fake identities used to social-engineer a maintainer, and payloads sent to real people. 17 of 19 catalogued events came from one model, Anthropic's Mythos 5.

On August 5 Cloudflare published the Agent Access Model: a reference architecture where credentials are short-lived and task-scoped, enforcement lives in the harness and network instead of the prompt, and a Trust Ratchet only narrows an agent's capabilities. The cleanest spec yet for least privilege at agent speed.

On August 5 Cloudflare open sourced Cloudflare OS, the agent workspace it has run internally since May: capability-based Gatekeepers instead of ambient MCP access, apps as private per-user instances, and approvals that simulate outcomes so agents never stall. A concrete blueprint for the company-wide agent platform.

DeepSeek V4 Flash routed to Novita on Vercel AI Gateway is 90% off for Pro customers through August 11, dropping the effective rate to $0.014 input / $0.028 output per million tokens. Here is the verified before/after math, the provider-pinning setup, and what a 10x cheap agent loop means for routing decisions.

Liquid AI shipped LFM2.5-2.6B on August 4, 2026: a 2.6B open-weight model trained for agentic work inside real harnesses, decoding at 220 tokens/s on an M5 Max and 113 tokens/s on a Ryzen CPU. Here is how it was trained, what the benchmarks say, and how to run it.

Next.js 16.3 ships the biggest update since 16.0: opt-in Instant Navigations with partial prefetching, up to 90% less dev-server RAM, cached repeat builds up to 5.5x faster, native Node.js streams for SSR, and an AGENTS.md block that points coding agents at version-matched docs.

Databricks measured the same model through different coding harnesses and found cost per task varied more than 2x at identical quality. Pi's minimalism explains why: roughly 1k tokens of system prompt and 3x less context per turn.

The v0 API is now generally available: programmatic, headless access to v0's app-building agent. Send a prompt, get a running app with a live preview URL you can embed, then deploy to Vercel in one call. Here is what changed, how the sync/async/streaming model works, and how it fits in an agent loop.

On August 4 Cloudflare launched the Agent Development Lifecycle: agent traces with session replay, @cloudflare/ci for CI/CD as Workflows, and local OpenTelemetry. A software factory is no longer just an idea, it is a platform product.

Cloudflare launched a single endpoint that returns account usage and cost per product in a FOCUS-aligned shape. For teams whose agents provision infrastructure, the dashboard is no longer the only way to see what a month costs.

Cloudflare's new CI SDK runs pipelines as Workflows: TypeScript instead of YAML, cached sandbox steps, artifact-push triggers, and a healing agent that fixes failed builds. Here is how it works and what it means for platforms.

Day three of Agents Week brought Cloudflare Wallets: Account Wallets for humans and Virtual Wallets for agents, x402 stablecoin micropayments for APIs and content, and human-readable agent identity at handles like research.example.cloudflare.pay.

A Microsoft Research analysis of 3.2M users and 761M LLM calls shows coding agent traffic is 87% agent-initiated, burns KV cache at turn boundaries, and punishes every tool failure with up to 4x compute.

GitHub Enterprise Importer now supports self-serve GitLab to GitHub migrations in GA. gh gl2gh exports GitLab projects, transforms merge requests into pull requests, and stages archives in GitHub or your own blob storage. Here is what actually moves and what you rebuild.

Shieldstral is a 3B-parameter Apache 2.0 multimodal safety classifier that takes your moderation policy as a plain-language question at inference time, scores content 0-1 in a single forward pass, and runs on one 16GB GPU. It beats 12B-20B guard models on text safety and sets state of the art on multimodal benchmarks.

Cloudflare's Agents Week opens with @cloudflare/computer, an open-source agent runtime where an SQLite-backed workspace gives every agent a shared filesystem and lets the model pick between fast isolates and full Linux containers per task. The bet: containers for under 10% of agent work.

Cloudflare published the serving playbook behind Workers AI running Moonshot Kimi K2.6 and Zhipu GLM 5.2: FP8 KV caches double Kimi's resident context to 1.37M tokens, INT4 weights shrink GLM 5.2's checkpoint 40%, and a page-tagging integrity check protects the shared cache at under 1% overhead. The numbers show what actually matters when open frontier models run on GPU fleets.

Cloudflare announced inbound TCP connections and gRPC support for Workers and Containers as part of Agents Week: a connect() handler on Spectrum, full-duplex gRPC from Containers, and automatic gRPC to gRPC-web translation so Workers can serve gRPC APIs without a container. Private beta today.

Cloudflare's JavaScript-native RPC on Workers now works across languages: TypeScript Workers can call methods on Python Workers and vice versa, with live objects, functions, and streams crossing the boundary. Pyodide's FFI handles type conversion, so no schemas, no protobuf, and no serialization code are needed. Available now.

Octane is a new MIT-licensed UI framework from Inferno's creator that compiles React-style hooks, Suspense, and actions to direct DOM code. No virtual DOM, no rules of hooks, no hand-maintained dependency arrays. Here is what shipped, the benchmark grid, and what it means for teams and AI agents.

OpenAI published the engineering story behind GPT-Live, its third-generation voice system: a full-duplex model with no turn detector, Go replacing Python on the media path, seamless stateful handoffs, and WARP, a new WebRTC transport going through the IETF.

Alibaba released Qwen 3.8 Max on August 3, 2026 - a 2.4T-parameter MoE with 95B active per token, a 1M context window, and $2/$6 per million tokens on QwenCloud. It leads PaperBench at 93.0, and the weights open next week.

A final Digital Markets Act decision requires Alphabet to give third-party AI assistants the same Android access Gemini has: DSP wake words, ambient sensors, screen automation, on-device models, and fair background execution. Home Assistant's three-year fight over the 'Okay Nabu' wake word shows exactly what the ruling unlocks.

Andrej Karpathy gave Opus 5 the first paragraph of the Lord of the Rings, a 1M-token budget (about $10), and asked for a three.js render. Two hours and 5,500 lines of code later, the model had procedurally built a 3D world - and exposed a real weakness in how agents verify their own work.

Cursor shipped a deliberate change on July 31 making the Usage page tokens-only for self-serve plans, removed the dollar Cost column, and zeroed per-request cost fields in the dashboard API - including for historical records. Staff confirmed the change is intentional and that the numbers are still tracked internally.

GitHub deprecated Gemini 2.5 Pro and Gemini 3 Flash in every Copilot surface on July 31, 2026. The suggested replacements are Gemini 3.1 Pro and Gemini 3.6 Flash. Here is what changed, what it costs, and how to migrate cleanly.

OpenAI's next model, codenamed Astra, produced results on ten problems open for at least a decade - including non-sofic groups and Erdős problems 146, 180, and 183 - with every argument formalized as a Lean certificate.

A ripgrep musl binary crashing during very-large searches turned out to be a suspected Linux 7.0 kernel race - a thread's own store vanishing mid-function. The reporter's instrumentation pinned it, and a kernel-hardening maintainer posted a one-line fix candidate for testing.

AI Gateway spend budgets now scope to teams and projects, with hard dollar limits that reject requests, email alerts at 50/75/100%, and CLI-managed defaults. Here is how the three scopes compose and where it fits your cost stack.

Vercel MCP now serves both the stateless 2026-07-28 protocol and the 2025 protocol from one endpoint, with mcp-handler 2.x handling the negotiation. The first major hosted MCP server has crossed over - here is what it means for server authors and clients.

A SCAM 2026 study of 100 top-starred repos catalogs six configuration smells in AGENTS.md and CLAUDE.md files: Lint Leakage in 62%, Context Bloat in 42%, Skill Leakage in 35%. Only 9 of 100 files were smell-free.

A new arXiv benchmark ran 6,560 sandboxed runs across Claude Code, Codex, OpenClaw, and Hermes with five LLMs. 68% of runs triggered unsafe signals, and 66% of all runs were unsafe yet still passed completion checks. Task completion does not prove an agent ran safely.

An analysis from the Earendil team behind the Pi harness documents how OpenAI, Anthropic, and Google now return provider-sealed state instead of portable transcripts - encrypted reasoning blobs, opaque compaction, hidden subagent messages. The five tests and seven rules for session portability, and why session lock-in matters more than model lock-in.

A placebo-controlled study on MBPP+ finds that when small code models fail, resampling from scratch beats repair loops that feed the failed code back - at 2.5-5.5x fewer tokens. The failed attempt is the anchor.

A new 600-session benchmark shows coding assistants that read a user's resolved session history resolve ambiguous requests with far fewer clarifying questions - Claude Opus 4.8's first-turn success jumps from 24.3% to 60.3% when history is available.

Cloudflare moved cdnjs, the open-source CDN behind ~12% of the web, entirely onto Workers, Workflows, R2, and Queues. The migration raised two platform limits for everyone. Here is what changed and why it matters.

Microsoft's Change2Task turns merged pull requests into verified, executable coding agent tasks: 79.6% construction success across 1,130 repo changes, 29.2% more verified tasks than PR baselines, and tasks that stay current with the codebase.

A new 106-issue benchmark across 49 repositories finds frontier coding agents rarely retrieve AI contribution rules on their own - and never refuse to contribute in AI-banned repositories, no matter the prompt. Disclosure and verification can be fixed; bans cannot.

A controlled ablation across Claude Code and Codex, 17 real tasks, and 288 evaluated runs finds context-injection strategy does not measurably change correctness (bounded to under 10-15pp). The failures are implementation skill, not missing repository knowledge.

Google DeepMind's Gemini Robotics ER 2 is now publicly available via the Gemini API. It watches live video feeds to track task progress, orchestrates VLA models as tools, and coordinates multiple robots. The numbers: 57.4% progress classification, 91.3% moment finding at 0.96s offset.

GitHub Actions added a $/ prefix that resolves a same-repository action or reusable workflow at the exact commit being run, with no checkout. It fixes the pinning trap that made enterprise SHA-pinning policies hard to satisfy for a repo's own actions.

GitHub open-sourced casefold, a Rust crate that folds the case of every byte Blackbird indexes at memory bandwidth. The counterintuitive trick: delete the early-exit, kill the branches, and fold Unicode as byte arithmetic.

GitHub's new model policy targeting lets enterprise admins set a baseline of Copilot models for the whole company, then grant extra models to specific teams. How the preview works, the least-restrictive evaluation rule, and what it changes for AI governance.

GitHub Models is fully retired as of July 30, 2026. The playground, model catalog, inference API, and BYOK are gone for every customer. Here is the timeline and where to get model access instead.

GitHub's stacked pull requests went into public preview on July 30. Stacks turn one large change into an ordered chain of small, reviewable PRs with one-click merge, plus a gh-stack skill for coding agents.

Inkling-Small is a 276B-parameter MoE with 12B active per token, Apache 2.0, and open weights. It beats the 975B Inkling on SWEBench Verified (80.2), HLE (31.6), and tool use at a quarter of the size and a third of the output price.

A calibrated study on real ConflictBench Java conflicts finds LLM agents match the developer's own resolution on 55-59% of true conflicts versus 36.7% for the best structured tool. The edge is coverage, not accuracy: the tools abstain on 20-90% of conflicts, the LLM on none.

MiniMax launched H3, an omni-modal generation model that takes text, image, video, and audio input and outputs 2K video with native stereo sound at 0.80 CNY per second. Open weights are promised in the coming days.

The "Building abundant intelligence" essay carries real engineering numbers: GPT-5.6 Sol cut serving costs 20%, speculative decoding gained 15%, and two settings moved ARC-AGI-3 from 13.3% to 38.3% with six times fewer tokens.

OpenAI took down a Cambodia-based operation that used ChatGPT for personas, translations, forged documents, and admin work. It is the clearest picture yet of how LLMs slot into organized fraud.

A new benchmark drops five frontier coding agents into a live OpenTelemetry microservice system with real Prometheus, Jaeger, and OpenSearch telemetry. Best RCA accuracy: 25.3% on Medium, 10.0% on Hard. Even Claude Fable 5 is far from oncall-ready.

A new paper wraps code into an OWL2 ontology with SPARQL property paths to answer multi-hop structural queries for coding agents - 2.06x retrieval recall and 28.8% fewer tokens on SWE-bench Pro, versus treating code as plain text.

A systematic audit of SWE-bench Verified finds 68 of 500 instances (13.6%) pair a pull request with an issue it does not actually resolve, penalizing agents that correctly solve the stated problem. PAIChecker, a three-phase multi-agent checker, flags them with up to 92.12% binary accuracy.

Shopify's July 30 Hydrogen developer preview update ships Vue bindings, bundled GraphQL TypeScript tooling, Shopify Inbox AI chat, and agent skills for four more frameworks. What the rebuilt toolkit means for storefront developers and coding agents.

A Michigan team measures prose SKILL.md files against compiled harnesses: agents execute only 56% of the steps their own skill mandates. SIGIL compiles skills into typed graph harnesses, hitting 86% compliance with 0.58x the tokens.

A new 188-task benchmark for non-functional improvements finds coding agents hit 70% on functional correctness but lag humans on refactors and structural changes - the quality gap that becomes tech debt.

Vercel cut end-to-end deployment time by up to 7 seconds, removing 5 seconds of fixed platform overhead from every build and up to 2 more seconds from the CLI path. Here is exactly where the time went and what it means for your CI loop.

Vercel Passport is generally available: protect deployments behind Okta, Entra ID, or any OIDC provider, and read a verified identity in app code with getIdentity(). Here is how it works and why it matters.

The 7 AI developer stories that actually mattered this week - ranked, linked, and cut for builders.

Agent-Manager wraps tmux into a Go TUI that groups AI coding agents by project, shows live status for each, and lets you answer blocked agents or review their changes without attaching to their terminal.

Hugging Face published a stunning technical play-by-play of a 4.5-day AI agent intrusion. The HN community is divided on who is to blame and what it means for agent security.

Google DeepMind's Gemini Robotics 2 family gives humanoid robots whole-body control, dexterous hands, and multi-robot teamwork - with an ER 2 model devs can try today. The HN thread (575 points, 459 comments) debated how real the progress is.

OpenAI slashes GPT-5.6 Luna by 80% to $0.20/M input tokens, cuts Terra by 20%, adds Sol Fast mode at 2.5x speed, and reveals Sol autonomously optimized its own production kernels.

Mitchell Hashimoto (Vagrant, Terraform, Ghostty) launched Superlogical - a new company building a terminal multiplexer that aspires to unify local dev, remote access, agents, and production work. The 703-point HN discussion went deep on the vision, the team, and whether the problem is real.

OpenAI released the Codex Security CLI and TypeScript SDK as open source on GitHub. The Promptfoo team behind it, the 2.1k-star reception, and what the HN community says about cost, guardrails, and local model support.

A coordinated disclosure reveals that attacker-controlled instructions in a Word document can hijack Copilot, alter financial data, and self-propagate across documents. Microsoft cannot fully fix the vulnerability class. The HN community draws parallels to the macro virus era.

Andrew Ng's new AI company LearnVector aims to build one-to-one learning experiences powered by agentic AI, backed by $100M from Coursera. A look at the vision, the HN reaction, and what it means for the future of learning.

TurboFieldfare is a custom Swift and Metal inference engine that runs Google's 26B-parameter Gemma 4 MoE model in roughly 2 GB of RAM on any Apple Silicon Mac, including 8 GB base models.

Zig core team member mlugg published the definitive deep-dive on how Zig's incremental compilation works - file pipeline, semantic analysis, dependency tracking, and a custom incremental linker. 244 HN points and a rare steveklabnik endorsement.

Dario Amodei published Anthropic's stance on open-weights models this week - no total ban, but support for chip export controls, distillation crackdowns, and mandatory safety testing. HN responded with 800+ comments calling it regulatory capture. Here is what the CEO said, what the thread argued, and why the debate matters for every developer deploying AI.

Running Opus 5 through SlopCodeBench's multi-checkpoint gauntlet reveals that frontier models still degrade codebases over time. 24% strict pass rate, 5x more functions than Opus 4.8, and 93% of code lines trigger slop detectors.

Anthropic's Claude Mythos Preview found novel attacks on the HAWK post-quantum signature scheme and reduced-round AES. The HN community debates the real significance, the $100K price tag, and what it means for prompt engineering.

Moonshot AI's Kimi Linear paper introduces KDA, a hybrid linear attention that beats full attention at all scales - 75% less KV cache, 6x decoding at 1M context, and open-source checkpoints.

Tom Lockwood investigated the Bun Rust rewrite six weeks after it merged to main - 2,475 open PRs, no release tag, and costs that may far exceed the claimed $165K. We break down the evidence, Jarred Sumner's response, and what the HN community thinks.

A federal case in Atlanta is testing whether using a privacy-focused mobile OS can be treated as destruction of evidence. The GrapheneOS duress PIN feature erased a traveler's phone during a CBP interrogation - and prosecutors are charging him for it.

Moonshot AI released the full Kimi K3 weights on HuggingFace today - 2.8T parameters, 1M context, native MXFP4 quantization, ~1.63TB download. The HN community reaction, what the license really says, and why this matters for the open-weights AI market.

AI makes you 2-100x faster on every task. So why are developers burning out more than ever? The HN discussion on Rick Manelius's essay surfaces a hard truth about the gap between productivity and throughput.

PGSimCity is an explorable 3D city that models PostgreSQL internals - shared buffers, WAL, autovacuum, checkpoints, and replication. Built with three.js and TypeScript, it hit #1 on HN with 682 points.

Vercel Labs released Scriptc, a TypeScript-to-native compiler that produces self-contained binaries of 170-200KB with ~2ms startup times and no embedded JavaScript engine. The HN community is sharply divided on whether this is a genuine engineering breakthrough or another Vercel Labs project that will be abandoned in months.

An inside look at the gray-market relay economy that resells OpenAI, Anthropic, and Google API access at up to 97.8% off -- and what it means for developers building on AI APIs.

Anthropic cut 80% of Claude Code's system prompt for Opus 5 and Fable 5 with zero regression on coding evals. The post landed on HN with 197 points and 133 comments. Here is what the article says, what HN thinks, and what it means for your agent harness.

Debian is voting on four proposals to regulate LLM-generated contributions - from an outright ban to full acceptance. The HN discussion reveals the fault lines in open source's biggest AI policy debate yet.

DeepSeek suspended its $74B valuation fundraising round after a leaked transcript of founder Liang Wenfeng's investor meeting laid bare the compute gap between Chinese and US AI labs - revealing he needed 200,000 Huawei 950 chips but received only 16,000.

Ruff v0.16.0 ships 413 default rules (up from 59), Markdown code-block formatting, and a new ruff: ignore system. Here is what changed, what HN is saying, and why zero-config linting matters more with AI coding agents.

The colon builtin is the shell's most underrated command - it evaluates arguments, discards results, and unlocks parameter expansion tricks that simplify scripts. HN debate: readable or cryptic?

A Google ADB maintainer proposed restricting on-device ADB connections to loopback, which would break Shizuku, libadb-android, Termux workflows, and an entire ecosystem of open-source power-user apps.

Anthropic released Opus 5 on July 24, 2026 - same price as Opus 4.8, within 0.5% of Fable 5 on CursorBench, and the new #1 on Artificial Analysis. We break down the benchmarks, HN reaction, and what it means for every developer choosing a daily-driver model.

A technical deep dive into AM halftoning with ImageMagick hit the HN front page at 195 points. We break down the technique, the HN debate on dithering vs halftoning, and why this matters for developers.

Tobi Knaup, co-founder of Mesosphere, argues that open-weight AI has reached the same inflection point as Kubernetes in 2014. We break down the argument, the HN reaction, and what it means for developers building on open models.

Nvidia, Microsoft, Meta, OpenAI, and 30+ signatories published an open letter arguing that open-weight AI models are essential to American AI leadership. The letter draws battle lines that divide Silicon Valley.

A security researcher found a GitHub personal access token with admin privileges to hundreds of repos baked into Hanwha Vision camera firmware. The cause: a Vite build leaking process.env into production.

Anthropic launched the Claude Cookbook - 80+ practical guides from their engineers covering tool use, agent patterns, evals, and production deployment. The HN discussion debates whether cookbook resources still matter when you can just ask the AI.

A new multi-model orchestration system routes requests across open-weight models to match frontier performance at reduced inference cost. Here is what we know.

A deep dive into why fully autonomous AI coding agents degrade codebases over time, and what context engineering can actually fix.

Terence Tao published a deep mathematical digestion of the Jacobian conjecture counterexample discovered by Claude Fable 5. Here is what happened, what HN is saying, and what it means for AI-assisted research.

A practical look at the operational Postgres guide that hit the HN front page - what it gets right, what the community pushed back on, and what every startup should internalize about running Postgres in production.

The Gleam programming language has migrated to Tangled, a new ATProto-based code hosting platform. Here's what this means for developers and the future of decentralized forges.

A researcher's 10-page domain-expert prompt helped GPT-5.6 produce a Lean-verified proof closing a complexity gap that stood since 1996. The paper is now on arXiv.

A step-by-step guide to configuring an isolated Mac that Claude Code can fully control remotely - from SSH and Dispatch to phone-based control with Remote Control.

Julia Evans shares hard-won production lessons from running SQLite at scale - from the ANALYZE command that cut query times 100x to backup strategies and write contention gotchas.

A Stack Exchange data query shows Stack Overflow's question volume dropped 65% since 2017, with a sharp acceleration after ChatGPT. HN debates whether AI killed the platform or just accelerated its decline.

Security researcher discovers TP-Link Kasa cameras exposed precise home coordinates via unauthenticated UDP - a vulnerability publicly documented since 2020 but only patched in 2026.

A unit conversion bug in AWS billing displayed estimated charges of up to $1.7 trillion, triggering widespread alarm among developers before AWS acknowledged the issue.

How a 60-second auto-continue timer shipped to Claude Code without documentation, what it reveals about agent safety assumptions, and how to disable it.

A developer built a complete X11 server in 20,000 lines of assembly language using Claude as a compiler, running Firefox and GIMP with one-third the CPU usage of Xorg.

Laura Summers of Pydantic articulates why LLM-assisted programming increases work intensity while eliminating the rewards that made coding satisfying.

LM Studio launches Bionic, a standalone agent harness for open models with local inference, voice input, and zero data retention cloud options.

Mozilla's inaugural report reveals open models now match closed AI on capability, but only 51% reach production. The harness layer and permission model gaps explain why.

A developer built an 85% accurate LLM text detector using TF-IDF and linear SVM - no neural networks required. Here is how it works and what HN thinks about AI detection.

Google rebrands NotebookLM to Gemini Notebook, integrating the popular research tool deeper into its AI ecosystem. Here is what developers should know about the transition.

Moonshot AI releases Kimi K3 with 2.8 trillion parameters, 1M context window, and Delta Attention architecture. Here's what developers need to know about pricing, performance, and where it fits in the frontier model landscape.

Richard Feldman's team rewrote the Roc compiler from Rust to Zig in 487 days. The memory safety numbers challenge assumptions, and the 35ms incremental rebuilds are real. Here's the full breakdown.

Voice cloning now requires just 3 seconds of audio to impersonate someone. With $893M in reported losses, detection has failed - here's what might actually work.

A developer got Google's Gemma 4 26B running on 2013 Xeon hardware for under $300. The fix for a silent MoE bug is now upstream - here's what it means for local inference.

Days after getting caught uploading entire codebases to xAI servers, Grok Build is now open source on GitHub. The HN community isn't convinced it's enough.

A new American open-weights frontier model with multimodal capabilities, 1M token context, and competitive benchmarks. Here's what the HN community thinks.

A developer reverse-engineered a travel itinerary app, discovered it was just reformatting JSON, and replaced the entire 43MB app with a 0.05MB webpage.

PrismML's Bonsai 27B uses 1-bit quantization to compress a 27B model to 3.9GB - small enough to run on an iPhone. Here's how it works and what HN thinks.

OpenAI's Codex CLI now encrypts inter-agent communications for Sol and Terra models, leaving users unable to inspect what their agents are actually doing.

Security researchers disclosed a Cursor vulnerability that auto-executes malicious git.exe files from repos - after waiting 7 months with no fix. Here's what developers need to know.

Git 2.54 and 2.55 introduced git history with fixup, reword, and split subcommands that make interactive rebasing feel less scary. Here is what developers are saying.

A Hacker News discussion blows up over LLM vocabulary quirks, with developers sharing hooks, filters, and coping mechanisms for repetitive Claude-isms.

New benchmarks on 5,559 test utterances show Apple's iOS 26 SpeechAnalyzer API achieving 2.12% word error rate - beating all Whisper model sizes while running 3x faster.

A workflow for archiving, signing, notarizing, and distributing Apple apps entirely from the command line - with AI coding assistants doing the heavy lifting.

Open-source tool gives Claude Code, Codex, and other agents their own isolated Linux VM on your machine - network firewall included, no cloud account required.

A use-after-free bug in the Linux kernel's real-time mutex implementation has existed since 2011. Researchers earned $92,337 from Google's kernelCTF for discovering and exploiting it.

A security researcher intercepted Grok Build's network traffic and found it uploads entire repositories - including .env files with secrets - to xAI servers. Here's what the data shows.

Andrew Kelley's blunt response to Anthropic's AI-assisted Bun rewrite sparked debate about AI marketing, language choices, and what makes engineering decisions honest.

Grok 4.5 lands at $2/$6, OpenAI splits GPT-5.6 into Sol, Terra, and Luna tiers, Anthropic ships the Claude 5 family, TypeScript 7 goes native, Bun gets rewritten in Rust, and a prompt injection hits GitHub agents.

New research shows Claude Code's system prompt and tool scaffolding consume 4.7x more tokens than OpenCode before processing user input. The HN thread debates whether that overhead buys better outcomes.

George Hotz publishes a post distinguishing genuine AI progress from manipulative hype narratives. HN's 126-comment thread debates whether he's right about doom-mongering and AGI inevitability.

A new distributed inference system pools GPU resources across multiple machines and exposes them through a single OpenAI-compatible API. No RDMA, no NVLink - just QUIC and your existing hardware.

The world's most famous mathematician used AI coding agents to revive 25-year-old Java applets and build new visualization tools. His observations on risk, quality, and trust are worth reading.

Daniel Kokotajlo and the AI Futures Project released an ambitious 15-year roadmap for managing advanced AI development through international cooperation. Here's what HN thinks about it.

A solo developer built a complete JavaScript ecosystem from scratch - runtime, engine, package manager, and Electron alternative. Here's what HN thinks.

Cursor v3.11 introduces Side Chats for parallel agent conversations, Conversation Search across past sessions, and Cloud Agent Hooks for self-correcting loops. A practical guide to the new features released July 10, 2026.

A new experimental technology encodes messages in video using motion-based steganography, exploiting how AI models process video as individual frames rather than continuous motion.

SQLite's flexible typing lets you store anything anywhere. STRICT mode fixes that - here's why you should enable it for every new table.

A new essay argues that letting AI generate sloppy code creates a downward spiral where future AI absorbs those bad patterns. HN's 250+ comment thread is split between believers and pure vibe-coders.

Apple filed suit against OpenAI alleging systematic theft of hardware trade secrets by former employees. The complaint names specific individuals, describes exploited security vulnerabilities, and claims this is 'the tip of the iceberg.'

A solo developer built a 1,300-line C inference engine that runs the 744B GLM 5.2 model on consumer hardware by streaming routed experts from disk. Here's how it works.

Ginger Bill argues that the best tools disappear during use - and that celebrating workarounds is a sign your tool has failed you.

OpenAI claims GPT-5.6 Sol Ultra has generated a proof for a 50-year-old graph theory conjecture in under an hour. The math community is now verifying whether it holds up.

The HashiCorp co-founder explains why he chose Zig over Rust for Ghostty, the technical challenges of terminal emulator development, and what systems programming looks like in 2026.

A Haskell Foundation board member explains why Scarf moved to Python after 7 years in production. The culprit: LLM-driven development made Haskell's compile times an unacceptable bottleneck.

Tencent's Hy3 ships 295B parameters but activates only 21B per token, matching flagship performance at flash-tier pricing under Apache 2.0.

A viral post argues AI works better on standardized codebases, making rewrites economically sensible. HN pushes back with the Mythical Man-Month and maintainability concerns.

The Bun runtime completed an AI-assisted rewrite from Zig to Rust, fixing memory safety issues and improving performance. Here is what HN thinks and why it matters for LLM-assisted code migration.

A new benchmark shows GLM 5.2 processing 59 transactions and producing VAT returns off by only 7 pence - at $2.73 versus typical accounting fees of $1,000+. Here is what the benchmark actually tested, where the model failed, and why the HN discussion focused on liability.

xAI launched Grok 4.5, trained on trillions of Cursor interaction tokens. At $2/M input pricing, it undercuts Claude and GPT while benchmarking near Opus 4.7 level.

Meta's first paid API model arrives with $1.25/M input tokens, 1M context window, and strong tool-use benchmarks. HN debates what it means for the open-weights company.

A Rust reimplementation of PostgreSQL now passes all 46,000+ queries in the Postgres regression suite. Here is what the project actually delivers, what it does not, and why the HN discussion reveals deeper questions about AI-assisted rewrites.

Cloudflare Research introduces Meerkat, a distributed consensus service using QuePaxa that eliminates leader elections and timeouts across their 330+ global data centers.

Security researchers discovered a prompt injection vulnerability in GitHub's Agentic Workflows that allows attackers to extract private repository contents through public issues.

An 82M parameter text-to-speech model that runs on CPU and produces high-quality speech across multiple languages - no cloud APIs or GPU required.

Mistral's new 8B parameter model enables robots to navigate complex environments using only a camera and natural language commands. Here's what it does, how it works, and what the benchmarks actually mean.

Microsoft ships TypeScript 7.0 with a complete Go rewrite of the compiler, delivering 8-12x build speedups and transforming IDE responsiveness across massive codebases.

Someone found an obfuscated bash script on a Uniqlo x Akamai t-shirt and decoded it. Here's what they found - and what HN thinks about whether it was AI-generated.

Astro 7.0 rewrites core components in Rust, upgrades to Vite 8 with Rolldown, and delivers significant performance gains for content-heavy sites.

Vercel acquires the open-source authentication framework that became the go-to Next.js auth solution. HN weighs in on open source sustainability and vendor lock-in concerns.

Martin Alderson's argument for why open-weights models like GLM 5.2 will compress frontier lab margins is sparking debate on HN. Here is what the thesis actually says, where HN agrees and disagrees, and why it matters for developers choosing models.

A CS student built 30papers.com to make Ilya's legendary ML reading list more accessible. HN has thoughts on the source, the format, and why compression equals intelligence.

IEEE Spectrum reports on pharmaceutical AI running on handheld devices. HN debates emergency kits, domain-specific models, and whether AGI will emerge from scaling or specialization.

Ternlight ships a ternary-quantized sentence encoder at 7 MB that runs semantic search at 5ms per embedding - entirely client-side via WASM, no API calls required. Here is how it works, what HN thinks, and where browser-side embeddings make sense.

A new study from Dartmouth measures the impact of an AI tutoring platform on introductory statistics performance. Full engagement with the system correlated with significant exam score improvements, though selection bias remains a key limitation.

Anthropic's new research reveals LLMs have an internal 'workspace' for silent reasoning - and it could change how we build safer AI.

A controlled study of 660 Claude Code trials shows clean codebases reduce token usage by 7-8% and file revisitations by 34%, while pass rates stay the same. Traditional maintainability principles still matter in the age of AI coding.

After years of quiet development, Evan Czaplicki outlines the path to Elm 1.0 - starting with 0.19.2's compiler performance gains and previewing equatable and hashable types from the Acadia project.

OpenAI teases its most capable coding model yet - Sol Ultra uses trained subagents that communicate during tasks, reportedly hitting 91.9% on Terminal-Bench 2.1.

Comparing LLMs by token pricing alone can lead you to choose worse, more expensive models. Cost per task tells the real story.

A simple image rotation button reveals deep truths about responsive interface design - why buttons must always respond predictably, even during animations.

Flipper Devices announces their firmware hit 1.0 stability and outlines a new community contribution model - while HN debates whether 'done' software is actually a good thing.

Douglas Thain's Introduction to Compilers and Language Design is a free undergraduate textbook that walks you through building a real compiler from scratch - and HN developers are enthusiastic.

A new paper proposes inverting traditional agent architecture - making the append-only event log the source of truth, not an afterthought. HN debates whether this is novel or just CQRS with extra steps.

A detailed breakdown of jamesob's viral local LLM guide covering the $2k and $40k hardware paths, critical BIOS settings, and why most setups fail at PCIe negotiation and IOMMU.

Mistral releases Leanstral 1.5, an Apache-2.0 licensed 119B parameter model (6B active) for Lean 4 theorem proving that saturates miniF2F and achieves SOTA on FATE benchmarks.

The creator of Box2D releases Box3D - an open source 3D physics engine with cross-platform determinism, SIMD contact solving, and heritage from both Box2D and Valve's Rubikon engine.

Cloudflare announces native support for the x402 HTTP payment protocol, letting developers charge for API calls and web resources with stablecoin micropayments - no accounts or API keys required.

The Godot Foundation has established a policy banning autonomous AI agent code and substantial AI-generated contributions, citing reviewer burnout and concerns about maintainer mentorship.

Ngrok engineer Sam Rose ported 100,000 lines of Kubernetes to TypeScript, creating a browser-based cluster for educational use - with 2,059 tests proving it behaves like real k8s.

A developer reverse-engineered Claude Code and found hidden markers that classify users by timezone, domain, and API keywords - using unicode apostrophe swaps and date format changes.

Anthropic releases Claude Sonnet 5 with improved agentic capabilities, better tool use, and an introductory pricing deal. Here's what developers need to know.

DeepReinforce AI released Ornith-1.0, a family of open-source coding models claiming self-improvement. The HN thread reveals a mix of skepticism and genuine interest - here is what the model actually does and whether the hype holds up.

A new project proposes a graphical shell layer for SSH that turns remote servers into browsable desktops. The HN discussion digs into architecture choices, the terminology debate, and whether this solves a real problem.

The PostgreSQL 19 beta brings native graph queries, SQL:2011 temporal tables, concurrent table reorganization, and logical replication improvements - all in a single release.

ZLUDA 6 lets AMD GPUs run unmodified CUDA applications, adding PhysX support, Blender textures, and better Windows tooling. A practical look at what ZLUDA is, how it compares to ROCm and HIP as a CUDA alternative, and why its post-funding, hobby-project status matters if you are evaluating it for real workloads.

A developer fed 266MB of DICOM MRI data to Claude Code Opus for a second opinion on a shoulder diagnosis. The AI disagreed with the doctor. HN radiologists weighed in.

Semgrep's security research team benchmarked LLMs on IDOR vulnerability detection. The open-weight GLM 5.2 beat Claude Code by 7 points at roughly one-sixth the cost.

Justin Poehnelt spent seven years at Google building open-source developer tools. His CLI went viral, hit #1 on Hacker News, and got him fired two days before Google announced their own version.

Filippo Valsorda argues that LLMs have ended the era of treating security researchers with kid gloves. When anyone can discover vulnerabilities with an AI, the old coordinated disclosure model breaks down.

Armin Ronacher's new essay explores the tension between letting AI agents loop autonomously and maintaining the engineering comprehension that makes software maintainable. The Hacker News discussion adds practical caveats worth reading.

Unsloth's dynamic quantization makes GLM-5.2 runnable on a 256GB Mac or a 24GB GPU with CPU offloading. Here is the hardware math, the quantization tradeoffs, and what the HN community learned from actually running it.

A blog post arguing for memcached over Redis sparked a heated HN debate. Here's the architectural argument for why memcached's constraints might actually be a feature.

A developer used OpenAI Codex to build a fully open-source WYSIWYG editor for TikZ figures. The technical approach and reception on Hacker News offer a useful case study in what agent-built software looks like when shipped.

Baidu releases Unlimited OCR, an open-source vision-language model that parses 100+ page documents in a single pass without memory blowup. Here's what developers need to know.

A new paper shows a 3B parameter model hitting 94.3 on AIME26 and 96.1% on LeetCode contests - matching or exceeding models 100x its size. The catch: it traded general knowledge for pure reasoning ability.

Switzerland's fully open foundation model promises transparent training data and EU compliance. The HN crowd has questions about actual performance.

A developer discovered that Claude Code's thinking output is summarized, not the raw reasoning. Here's what Anthropic's docs actually say - and why it matters.

A Codex CLI SQLite logging bug showed how global TRACE logs can burn SSD write endurance. OpenAI has now merged fixes, but the incident is a useful local-agent operations lesson.

Deno 2.9 ships a desktop app framework that compiles TypeScript projects into native binaries with WebView or bundled Chromium - a new Electron alternative from the Deno team.

Oak rethinks version control for agentic workflows with virtual mounts, faster snapshots, and lower VCS-related token overhead. Here's what the HN community thinks about this Show HN.

New research from MIT reveals that LLMs identify speakers by writing style, not by tags - meaning attackers who sound like the system effectively become the system. The findings explain why prompt injection remains unsolved.

Dan Abramov's explainer on ATProto architecture is making the rounds. The core insight: Bluesky's protocol separates hosting from applications in a way that Mastodon-style federation fundamentally cannot. Here's what that means for developers.

The new wrangler deploy --temporary flag creates ephemeral Cloudflare accounts for AI agents. 60-minute deployments, no OAuth, no browser - just deploy and claim later.

New benchmark data shows GPT-5.5 hallucinates 86% of the time when it does not know the answer - versus 28% for the open-weights GLM-5.2. The numbers challenge the assumption that bigger models equal more reliable output.

Modern LLMs now use MoE routing, mixed attention variants, and fused vision encoders. The simple transformer stack is gone - here's what replaced it and why it matters for developers.

A deep dive into DuckDB's architecture - columnar storage, vectorized execution, and zero-copy design that lets it compete with million-dollar clusters on a laptop.

Most developers only know .gitignore, but Git offers two other ignore mechanisms for local workflows and machine-wide patterns. Here's when to use each.

Java's most anticipated performance feature is finally landing. Value classes eliminate object identity overhead and enable dense memory layouts - here's what changes.

MCP's new Enterprise-Managed Authorization removes per-user OAuth friction. Anthropic, Okta, Figma, and Linear ship centralized auth for AI agent tooling.

A YC W25 startup open-sources CADAM, a browser-based tool that converts natural language to parametric OpenSCAD models. HN debate: is text-to-CAD genuinely useful or just another demo?

Auto-installing tree-sitter grammars, built-in markdown mode, window layout commands, and more - the upcoming Emacs release absorbs features that used to require external packages.

Alex Ellis shares real production experience running local LLMs: $12k hardware investment, 2-3 month ROI, and why treating local models as Opus substitutes misses the point entirely.

The Transformer co-creator leaves Google DeepMind for OpenAI just two years after Google paid $2.7 billion to bring him back from Character.AI.

Epic Games open-sourced Lore, a centralized version control system designed for binary-heavy game projects. It uses Merkle trees, on-demand file hydration, and native chunked storage to handle terabyte-scale repos that Git struggles with.

The IETF published RFC 10008 defining a new HTTP QUERY method - GET with a request body. It is safe, idempotent, cacheable, and solves the longstanding problem of complex queries hitting URL length limits.
Keep exploring

New tutorials, open-source projects, and deep dives on coding agents - delivered weekly.
Explore 862 topics
Browse All Topics