Issue No. 6

The Nov 3 edition

  • 19-minute read
  • 149 primary links
  • 9 sections
  • News19
  • Update3
  • Context4
  • Still open4

Snapshot#

  • News (research debate): "Weight-space programming" is the top AI story on HN (2,833 points). The author says GPT-6 Astra edited 0.016% of Qwen3.5-0.8B's weights and lifted MATH-500 from 7.9% to 48.1%. Two rebuttals followed within a day. Matthew Honnibal points out that the Qwen run used Python and practice-problem batches, not raw weights alone. Sean Goedecke argues the fix resembles normal research work. Read all three before you cite the headline.
  • News (agent latency): Claude message threads entered public beta on 11-02. Agents send only the new turns instead of the whole history. Anthropic reports about 35% lower median time to first token for Claude Code requests of 500k–1M tokens. Token usage and prices do not change.
  • News (models and price): Artificial Analysis scored Gemini 4 Carbon (Low) at 54 on Intelligence Index v5, priced at $4 / $20 per 1M tokens. AA re-ran the Coding Agent Index on 11-02 at 16:46 CST. The top row is now Claude Code + Opus 5.5 (Max) at 61.7, costing $11.42 per task.
  • News (Chinese model, API only): Meituan's LongCat-2.5 has 1.6T total parameters (about 48B active) and native vision. It is now on Vercel AI Gateway at $0.30 / $1.20 per 1M tokens with a 1M context window. It has no weights on Hugging Face yet, and every benchmark so far is Meituan's own.
  • News (hard eval): SemiAnalysis GDPx launched with 206 agent tasks across 11 domains. The best model, Opus 5.5, scores only 12.0%, at $51.41 per task. DeepSeek V4.1 Flash 1017 scores 5.4% at $0.94 per task.
  • Update (MCP security): a researcher write-up explains the MCP SDK OAuth advisories, which The Agentic Digest led with today. The fixes were released in September: Python mcp 1.30.0 / 2.2.0 and TypeScript @modelcontextprotocol/sdk 1.31.0.
  • Corrections to yesterday: Vercel's Ling 3.1 Flash 1019 changelog says billing begins on November 3, so the free window has closed rather than running through today. Kimi K3.1 Pro weights are still not on Hugging Face.
  • Do this today: check your lockfiles for mcp below 1.30.0 (or 2.x below 2.2.0) and @modelcontextprotocol/sdk below 1.31.0, and upgrade any you find. Then open GitHub Actions Insights to see which workflows would fail: GitHub starts blocking pull_request_target by default in public repos on 2026-12-02, and the first trial block ("brownout") runs 2026-11-09 from 10:00 to 12:00 CST.

Frontier and open-weight models#

News#

  • Gemini 4 Carbon (Low) (AA changelog, 11-02).
    • Scores 54 on AA Intelligence Index v5, which ranks it 10th of 60 models.
    • $4.00 in / $20.00 out per 1M tokens, with a 95% discount on cached input.
    • 1M context. Accepts text, image, speech and video input.
    • AA added the Medium setting on 11-01. Carbon is still #1 overall (AA article, 10-28). The Low setting is the cheaper way to use it.
  • LongCat-2.5 (Meituan; the blog is dated 11-01 China time).
    • 1.6T total parameters, about 48B active.
    • Images are converted into tokens and handled by the same model as text, rather than by a separate vision encoder.
    • Trained and served on domestic Chinese accelerators. Meituan says its 4-bit (W4A4) serving lifts prefill throughput 43.3% over an 8-bit (W8A8) baseline.
    • Meituan's table reports 38.5 on Terminal Bench v4.0 and 58.3 on SWE Atlas Codebase QnA. All figures are self-reported.
    • Access: API only, through Vercel AI Gateway as meituan/longcat-2.5, at $0.30 in / $1.20 out per 1M tokens and $0.006 per 1M cached input.
    • Not yet on OpenRouter. The meituan-longcat HF org has no 2.5 weights; the newest model there is LongCat-2.0.
  • GLM 5.3 FlashX Legal (Z.ai).
    • The only new model ID on OpenRouter in the window (created 11-02 07:29 CST).
    • A legal-domain variant of GLM-5.3-FlashX. Accepts text, image and video input with a 1,048,576-token context.
    • $0.37 in / $1.25 out per 1M tokens, $0.075 cached.
    • Already #4 in OpenRouter's new-and-trending list at 3.97B tokens.
  • Nanbeige4.3-33B (open weights, Apache-2.0).
    • A 33B reasoning model with 524k context.
    • AA scores it 20, #1 of 8 in its size class (class median 13).
    • AA flags it as very verbose: it used 160M output tokens to run the index, against a median of 78M.
    • #16 on HF trending with 1,017 likes. No hosted API price yet.

Update / Context#

  • GPT-Rosalind-6 (system card addendum).
    • Uses the same weights as GPT-6 Astra, tuned for biology research.
    • Offered only through trusted access to vetted scientists and organizations, so most builders cannot use it.
  • Hydrogen-1.0 (Deep Principle, uploaded 10-31; MarkTechPost covered it 11-02).
    • About 753B parameters per the HF safetensors metadata, tagged MIT.
    • Gated: you must request access. Built for scientific discovery rather than coding.

Still open#

  • Kimi K3.1 Pro: $2 / $10 per 1M on OpenRouter. The newest model on Moonshot's HF org is still Kimi-K3 (06-13). The "weights by Nov 4" date still comes only from The Agentic Digest, with no Moonshot primary. Check again tomorrow.
  • DeepSeek V4.1 Flash 1017:
    • $0.15 / $0.60 per 1M on OpenRouter. #2 on HF trending, behind LiquidAI's LFM3-1.7B.
    • Still the #1 model on OpenRouter rankings by weekly tokens: 50.4T, up 43%. DeepSeek holds a 29.8% request share.
  • Ling 3.1 Flash 1019 (correction):
    • The changelog says "On November 3, requests will begin charging at the published rate."
    • The gateway's model list still showed $0 for inclusionai/ling-3.1-flash-1019 this morning, but treat the free period as over.
    • The non-1019 inclusionai/ling-3.1-flash lists $0.30 / $0.90 per 1M on Vercel, while OpenRouter lists Ling 3.1 Flash at $0.075 / $0.225.

Pareto frontier#

AA Coding Agent Index (v2.0: FrontierCode v1.1 + Terminal-Bench 4.0 + SWE-Atlas-QnA).

  • AA re-ran the index on 2026-11-02 at 16:46 CST. Today's page lists 34 rows.
  • The Claude Code + Opus 5.5 and Sonnet 5.5 rows were missing from yesterday's payload, so I can't say whether they are new or just newly visible.
  • Rows shared with yesterday have the same numbers.
  • Cost is mean USD per task.
Harness + model Index $/task Note
Claude Code + Opus 5.5 (Max) 61.7 $11.42 Top row; 95.3% cache hit, ~14.5M tokens/task
Devin Fusion CLI + Opus 5.5 Max / GPT-6 Luna High 61.5 $8.00 Router
GitHub Copilot + Copilot Fusion (max) 59.9 $5.59 Best $/point near the top
Antigravity + Gemini 4 Carbon (High) 59.4 $7.74 Limited access
Claude Code + Sonnet 5.5 (Max) 59.3 $13.30 ~24.1M tokens/task
Codex + GPT-6 Astra (Max) 54.7 $7.04 ~3.2M tokens/task
Codex + GPT-6.1 Sol (Max) 54.1 $1.50 Mid-tier value
Opencode + GLM-5.3 (Max) 48.9 $5.23 Chinese open weights
Mistral Vibe + Mistral Large 4 (High) 48.3 $1.26 Western open weights
Codex + GPT-6.1 Terra (Xhigh) 48.2 $0.69
Codex + DeepSeek V4.1 Flash (Max) 47.3 $0.39 98.3% cache hit
DeepSeek Harness + V4.1 Flash 1017 (Max) 46.3 $0.30 Cheapest row above 45
Codex + GPT-6.1 Terra (High) 46.3 $0.54
Grok Build + Grok 4.7 (Xhigh) 46.6 $9.48 Expensive per point
Kimi Code CLI + Kimi K3 (Max) 41.4 $5.17
Codex + GPT-6 Luna (Max) 31.1 $0.16 Floor

How to read the table:

  • Frontier tier (≥59): the Claude Code + Opus 5.5 row leads Copilot Fusion by 1.8 points but costs about twice as much per task ($11.42 vs $5.59).
  • Value tier (~46–48): the value tier is unchanged. DeepSeek Harness at $0.30 and Codex + Terra High at $0.54 sit within about 2 points of Mistral Large 4 at $1.26.
  • Token volume vs. price: Claude Code rows use far more tokens per task than Codex rows (14.5M–24.1M vs 3.2M–3.9M on the Astra and Sol rows). Their high cache-hit rates are what keep the cost from being higher still.

GDPx (SemiAnalysis, News 11-02).

  • 206 tasks across 11 domains, with up to 8 hours per task.
  • Each model runs in its own native harness where one exists; otherwise it runs in OpenCode.
  • Scores are pass@1 averaged over 3 attempts.
  • The write-up says safety classifiers lowered some scores in the cyber, bio and alignment domains.
Model GDPx $/task
Claude Opus 5.5 12.0% $51.41
Gemini 4 Carbon 10.9% $16.29
GPT-6 Astra 9.6% $53.99
GPT 6.1 Sol 8.4% $9.80
Claude Sonnet 5.5 8.2% $45.27
DeepSeek 4.1 Flash 1017 5.4% $0.94
GPT-6 Luna 5.1% $0.92
GLM 5.3 2.7% $11.79

On this hard, long-horizon set, Gemini 4 Carbon gives about 90% of Opus's score at about a third of the cost per task. GPT 6.1 Sol is the cheapest model above 8%.

Self-hosting economics (Context, resurfaced today).

  • In a talk transcript from AI Engineer NYC (given 10-13; it went viral on X and HN today), Revolut's AI-ops lead says the company serves self-hosted GLM 5.3 to about 2,000 engineers on roughly 56 B200 GPUs.
  • He reports a blended cost of about 30 cents per 1M tokens and an invoice "one-tenth" of their earlier frontier-API spend.
  • His tuning advice: target under 3 s time to first token, cap context at 256k, run FP4 on Blackwell, consider TP8 to free KV cache, and check your cache-hit rate.
  • These are one company's numbers, not a portable price.

Usage signal. On OpenRouter rankings (data through 11-02):

  • GLM 5.3 Flash is at 15.3T weekly tokens, and MiniMax M3.1 Flash is up 340% week over week.
  • In the apps list, Hermes Agent leads at 1.92T tokens, ahead of Claude Code at 1.29T, pi at 544B and Codex at 310B. DeepSeek Harness is new on the list at 295B.

Coding CLIs, IDEs, harnesses#

  • News: Claude Code v2.1.317 (11-02 19:25 CST).
    • Safety: asks before a web or shell tool call would send your account email address to the network.
    • Agent SDK: new onFailure: "block" setting for hook callbacks, so a failed callback blocks the action instead of letting it run.
    • Cloud tasks: /schedule now warns when a new cloud scheduled task gets connectors you did not ask for.
    • Admins: a gateway cost report at GET /v1/organizations/analytics/cost, plus new plan and seat attributes in OpenTelemetry (OTel) metrics.
    • Fixes: project and local MCP servers no longer disconnect after the first turn in some desktop sessions. Auto mode no longer fails every turn behind an LLM gateway that returns 403 or 422.
  • News: llm 0.37 (11-02 17:49 CST; Simon Willison).
    • Adds gpt-6.1-sol and gpt-6.1-terra.
    • The default model is now GPT-6 Luna.
    • New llm openai endpoint add|list|remove|path commands for OpenAI-compatible servers.
    • Embedding models accept typed attachments, and llm chat -u shows token usage.
    • Python 3.10 support is dropped.
    • Bug fix: Response.reply() now respects before_call. Previously, a tool call rejected by that hook would still run.
  • Pre-releases only elsewhere:
  • News (testing agents): Momentic (Launch HN, 150 points). A hosted QA agent that explores your app from a prompt. Tests are kept in YAML in your repo, and it can be driven from a coding agent over MCP. It is a commercial product, so: Watch.

Usable tools and open projects#

Repo or tool What it is Stars / +24h Runnable today? Why a tinkerer should care
Niko1221/Strata One-click local inference for Qwen3.8-Flash-Next on Windows/Linux; OpenAI/Anthropic API on localhost 38,974 / n/a Runnable (v0.2.10, 11-02 17:52 CST, MIT) 8 GB cards now start at 128K context; author-measured 63–73 tok/s in an 8 GB-class test
vercel-labs/agent-desktop Computer-use CLI for agents via OS accessibility APIs 11,727 / +3,792 Runnable (v1.1.0, 11-02 22:13 CST) #1 on trending; v1.1.0 fixes Windows overlay crashes and adds type --interval-ms
thedotmack/claude-mem Persistent cross-session memory for coding agents 111,386 / +1,138 Runnable (v15.9.0, 11-02) Adds Devin CLI support, redacts more secret types before storage, and blocks writes from other localhost sites
anomalyco/hex Local voice dictation for Mac, Windows and Linux 4,269 / +1,134 Runnable (v3.3.0, 11-02 10:43 CST, MIT) Dictate prompts to agents locally; Linux gains a local API for starting and stopping dictation
NVIDIA/auto-ontology Builds a semantic/ontology layer from enterprise metadata and serves it over MCP, CLI and API 1,855 Watch (Apache-2.0; needs Postgres and NVIDIA NIM) Grounds text-to-SQL agents in certified metric definitions (HN, 163 points)
JustVugg/colibri Pure-C MoE engine that streams experts from disk 46,974 / +803 Runnable (Still open, v2.1.0) Run 700B–1T MoE GGUFs on one box
max-sixty/worktrunk Git worktree CLI for parallel agents 10,285 / +437 Runnable (Still open, v0.81.0) Pairs with the Docker worktree advice in section 6
spotify/portal-ai-plugins Spotify Portal plugins for Claude Code, Codex, Cursor and pi 2,931 / +94 Watch (Apache-2.0, no releases) Only useful if you run Spotify Portal
p-e-w/heretic Removes refusal behavior from models 38,509 / +699 Skip Not a builder tool for shipping products
mattpocock/skills Skill files +1,164 Skip Prompt pack with no runtime
Donchitos/Claude-Code-Game-Studios Multi-agent Claude Code game studio +1,181 Skip Prompt and workflow pack

Totals come from the GitHub API at about 08:00 CST. The +24h figures come from GitHub trending at about 07:40 CST. Strata was not on the trending page.

Keepers:

  • Strata 0.2.10: DFlash2 is now the default speculative-decoding drafter. On Linux, a split engine spreads one model across several GPUs.
    • On four Radeon AI PRO R9700 cards the project measured 158 tok/s for one user and 350 with 8 parallel requests.
    • On 8 GB cards it starts at 128K context and frees memory step by step (smaller KV window, drop the MTP layer, then move the output head to host memory) instead of cutting the context.
    • All figures are the project's own.
  • agent-desktop v1.1.0: this release is mostly Windows and macOS overlay fixes. It also adds a steady typing pace and re-identifies on-screen elements through their accessibility address, which makes repeated clicks more reliable.

Agent builder stack#

  • Update (security, MCP): official SDK OAuth advisories.
    • Python: GHSA-qx49-fqc8-xw99 (CVE-2026-115563, High 7.5, published 09-28). Affected versions are mcp >=1.9.1 <1.30.0 and >=2.0.0a1 <2.2.0; it is fixed in 1.30.0 and 2.2.0. Client-credentials and private-key-JWT providers must now be given issuer=.
    • TypeScript: GHSA-6qxp-vccf-f47h (CVE-2026-104850, published 09-30). Fixed in @modelcontextprotocol/sdk 1.31.0 and @modelcontextprotocol/client / core 2.2.0. Bundled providers need expectedIssuer.
    • What's new today: the researcher's write-up (11-02) and The Agentic Digest lead story.
    • Builder take: upgrade, set the issuer, and clear credentials that were saved without one. If a client may have connected to an untrusted server, rotate its secrets, as both advisories recommend.
  • News (protocols, latency): Claude message threads (public beta, docs).
    • The first request sends the full conversation. Later requests send only the new messages plus a thread reference to the previous response.
    • A thread expires 5 minutes after its last request, and then your client must resend everything.
    • Claude still reads the whole conversation each turn, so token bills are the same; only the upload shrinks.
    • Available on the Claude Platform and through AWS, Microsoft Foundry and Google Cloud.
    • Builder take: add it to long tool loops and screenshot-heavy computer-use agents. Keep the full-resend path for when a thread expires.
  • News (sandboxes): Docker on where agent code should live (11-02). The post compares three setups for sbx:
    • a shared checkout, for close pairing;
    • one Git worktree per sandbox, for parallel tasks;
    • a clone mode that mounts the host source read-only and gives the agent its own clone.
    • It warns that mounting only a linked worktree leaves that worktree's Git metadata outside the sandbox, and that dependencies with native binaries built in a shared checkout can break on the host.
  • News (CI): pull_request_target blocked by default from 2026-12-02 (11-02).
    • Applies to public repos on GitHub Free, Team and Enterprise Cloud. Private and internal repos are not affected.
    • Brownouts on 11-09 and 11-16, from 10:00 to 12:00 CST.
    • If an agent bot or PR-triage workflow uses that trigger, allow it explicitly in an Actions event policy, or move it to a safer trigger.
  • News (security, keys): Google Threat Intelligence on "LLMJacking" (11-02).
    • Mandiant reports stolen LLM API keys and cloud access running up more than $100,000 in a single day, with cumulative charges reaching $1 million at some organizations.
    • Builder take: set hard budget alerts on every provider key. Keep keys out of repos. Do not leave self-hosted model endpoints open to the internet.
  • News (papers with code, computer-use agents) from HF Daily Papers:
    • CoworkOS (code, MIT, 78 votes). A harness for long-horizon work: the model decides actions and delegation, while the runtime keeps state, shared workspaces and memory. In the authors' case study, a GLM-5.3-driven post-training loop raised Qwen3.6-35B-A3B's 8-benchmark average from 33.19 to 42.95.
    • CUA-Master (code, 57 votes). Its 27B computer-use model scores 80.2 on OSWorld Verified, as reported by the authors.
    • NorthCUA (code, Apache-2.0). An open desktop/web agent harness with Nano, Mini and Pro models.
    • ReTrace / "Lost in Recovery" (code). A benchmark for how computer-use agents recover after mistakes.
  • News (coding-agent evals): CrossSWE has 171 tasks that each require coordinated changes across several repositories (165 repos in total).
    • The best model tested, GPT-6.1 Sol, reaches 58.48% Pass@1.
    • Inconsistency between repositories is the most common failure, at 44.2%.
    • No code has been released yet.
  • News (agent safety research): Agentic Backdoors via Pretraining Poisoning.
    • Reports that poisoning 0.1% of pretraining data planted a backdoor in a 4B CLI agent, which then ran an attacker's command in about 92% of triggered cases while behaving normally otherwise.
    • Take it as a reason to sandbox agents even when they run on trusted open weights.
  • Context (agent safety research): Red-teaming Codex Auto-review (LessWrong, posted 10-30).
    • Reports 11 ways an agent could defeat the Codex sandbox and its Auto-review approval monitor. OpenAI has fixed several.
    • The recommendations are generic: do not trust broad code loaders, close gaps in what the agent can reach, and label agent-written text so the monitor can tell it from trusted input.
  • Context (research artifact): the weight-space programming post ships patched weights, full logs and a demo Space. Per Honnibal, the "raw weights only" condition applies only to the small-network experiments (17K–172K weights). In those, a Breakout policy beat PPO but Seaquest and Asterix did not.

Infrastructure dash#

  • News: Anthropic FlashProve (11-02; code, Apache-2.0, labeled a research prototype that is not maintained).
    • zkSNARK proofs that a specific committed model produced a given response.
    • For Llama 4 Maverick (400B MoE, 4-bit), one H100 generates proofs at about 110 tokens/s, with about 19 MB of proof per 1,024-token request.
    • That costs 70–95x the GPU time of serving the model on vLLM.
    • Relevant if you route through third parties and want proof that you got the model you paid for.
  • News: Transformers Model Integration Contracts (HF, 11-03).
    • Hugging Face now runs "fast integration tests" on small models built from each real checkpoint's configuration.
    • These would have caught a UMT5 decoder bug (introduced when SDPA attention was enabled) that let the decoder attend to future tokens during training. It sat in main for almost two months.
    • If you fine-tune T5-family models on recent Transformers, check which version you trained on.
  • Claude message threads: about 35% lower median time to first token on 500k–1M-token Claude Code requests (section 6).
  • Strata 0.2.10 and colibri (Still open) remain the two consumer-hardware MoE engines worth testing (section 5).
  • Revolut's serving notes: the most concrete self-hosting tuning list of the week (section 3).
  • Engine blogs: nothing from vLLM, SGLang or TRT-LLM was nominated today.

Builder actions#

  1. Run pip show mcp and npm ls @modelcontextprotocol/sdk in each agent project. Upgrade to mcp>=1.30.0 (or >=2.2.0) and @modelcontextprotocol/sdk>=1.31.0, and pass issuer= / expectedIssuer to bundled OAuth providers (Python advisory, TS advisory).
  2. In each public repo, search .github/workflows for pull_request_target, then check Actions Insights before the 11-09 10:00 CST brownout (GitHub changelog).
  3. If you build on the Claude API, add the thread parameter to one long-running agent loop and compare time to first token before and after (docs).
  4. Try LongCat-2.5 cheaply: run vercel setup, then point an OpenAI-compatible client at meituan/longcat-2.5 on AI Gateway. Run your own coding eval before you trust the vendor table.
  5. Upgrade the llm CLI with pip install -U llm (or uv tool upgrade llm) to 0.37. Use llm openai endpoint add to register a local Strata or vLLM server.
  6. Set a daily spend alert on every LLM provider key you own, and scan your repos for committed keys (GTIG report).
  7. Before citing "LLMs can edit weights," read the original post together with Honnibal's rebuttal. The logs repo lets you check the claims yourself.

Checkmarks stay in your browser only.

Source log#

Show the full source logEvery source checked for this issue.

Primary discovery

Source Result Note
Artificial Analysis + articles Hit Newest article still 10-28. Home changelog: Gemini 4 Carbon (Low) and Nanbeige4.3-33B (11-02). Coding Agent Index re-run 11-02 16:46 CST, 34 rows
OpenRouter models API + rankings Hit One new ID (GLM 5.3 FlashX Legal). Cost-per-session data loads client-side and was not captured
HF trending models Hit LFM3-1.7B #1, DeepSeek V4.1 Flash 1017 #2, Nanbeige4.3-33B #16
HF Daily Papers Hit CoworkOS, CUA-Master, NorthCUA, ReTrace, CrossSWE kept; SWE-Trail has no code, dropped
HN front page + Algolia 24h + inference slice Hit Weight-space post + rebuttals, auto-ontology, Revolut, Momentic, LongCat-2.5, FlashProve, GitHub changelog, GTIG. The inference slice had only small Show HNs
GitHub trending Hit agent-desktop #1; hex, claude-mem, colibri, worktrunk, auto-ontology
Price Per Token news + agents/coding/open-source/model-releases slices Hit Model releases: none in last 24h besides GLM 5.3 FlashX Legal; HF MIC blog; OpenAI "Scaling Git" (Pando) not printed
LearnPrompt AI News Radar Miss (live) / Hit (fallback) Live site and Pages fallback rendered empty. The repo's latest-24h.json (generated 06:47 CST) was used for nominations
RadarAI Hit Mostly commentary. VeriCUA had no primary found, dropped
The Agentic Digest Hit MCP SDK OAuth, message threads, Docker sandboxes; Circle K and Legora case studies not printed
Simon Willison 2026-11-02 Hit llm 0.37 kept
X (narrow) Not checked

Ranked dailies (in order)

Rank Daily Result Note
1 Latent Space AINews Partial Index only; 11-03 issue headline on weight-space programming (covered via primary)
2 AlphaSignal Partial Headlines only: message threads, Pando, LifeVal, Exa Monitors, tiny corp; message threads confirmed, rest not printed
3 Code4U AI Digest Hit LongCat-2.5 and GDPx nominated → both confirmed
4 TLDR AI archives Hit 11-02 issue: GPT-Rosalind-6, Auto-review red-team, pretraining-poisoning paper confirmed; Mythos 5.5 rumor dropped
5 TLDR flagship Not needed TLDR AI loaded
6 The Neuron Hit 11-02 and 11-03 issues; nothing printable
7 AI Daily Brief Hit 11-02 episode "How to Deslopify Your AI"; nothing printable

Confirm opens

  • Weight-space programming: HN → confirmed (post, artifacts) plus two rebuttals
  • Message threads: Agentic Digest / AlphaSignal → confirmed (Claude); AlphaSignal's request-size figures not printed (not on the primary)
  • MCP SDK OAuth: Agentic Digest → confirmed (both GitHub advisories)
  • LongCat-2.5: HN / Code4U / LearnPrompt → confirmed (blog, Vercel); weights not published on HF
  • GDPx: Code4U → confirmed (gdpx.semianalysis.com)
  • Revolut self-hosted GLM: HN (X post) → confirmed via the AI Engineer transcript
  • LLMJacking: HN → the HN URL returned 404 (truncated) → confirmed at the full GTIG URL
  • Strata 0.2.10: LearnPrompt (AIbase) → confirmed (GitHub release)
  • Hydrogen-1.0: LearnPrompt (MarkTechPost) → confirmed (HF, gated)
  • LifeVal: LearnPrompt / AlphaSignal → confirmed (OpenAI, via a second fetch after curl got 403). OpenAI-only internal eval with no public task set; scored below 5, not printed
  • Carryovers re-checked: Ling 3.1 Flash 1019 free window → ended per the changelog; Kimi K3.1 Pro weights → still not published
  • "Open models can do 90% of agentic work" (The Register, via HN): link returned 404 → dropped
  • DeepSeek Harness Creator Mode (Mashable), SenseNova 6.8 Flash, Tencent Hyra 2.0, Android Studio Rabbit 2, Claude Enterprise smart reports, WebMCP post, VeriCUA, OpenAI bug-bounty change: nominated, not confirmed or below threshold, dropped
  • Vercel changelog (opened for the Ling re-check) also listed a Sandbox Drives speed-up, MCP Client ID Metadata Document support and npm install-time blocking. These were not nominated by any aggregator, so they are not printed
  • Coding CLI releases checked: claude-code, codex, gemini-cli, opencode, pi, aider, llm (GitHub releases API and release pages)
  • Engine blogs: not nominated
  • Blocked: none. The GitHub API rate limit was hit once, so github.com release pages were used instead