AI Coding Live News

Factory launches Droid 1.0: programmatic tool calling by default, hundreds of tool calls per model request, leads native harnesses on its own Terminal-Bench 4 runs

AI coding agent company Factory announced Droid 1.0 on X and its blog at 22:31 UTC on Oct 29, calling it the largest update yet to its agent harness. The key change makes programmatic tool calling (PTC) the default: the model writes a JavaScript program that runs up to hundreds of tool calls in a sandbox in one model request. In Factorys own Terminal-Bench 4 runs, Droid scored 57.6% with GPT-6.1 Sol ($0.79 per passed task) and 65.2% with Claude Opus 5.5 ($4.73), ahead of Codex, Claude Code, Cursor, OpenCode and Devin on the same models.

Factory launches Droid 1.0: programmatic tool calling by default, hundreds of tool calls per model request, leads native harnesses on its own Terminal-Bench 4 runs

Key Takeaways

  • Programmatic tool calling is now the default: the model writes JavaScript that runs in a sandbox with no file, network or system access of its own, making up to hundreds of tool calls per request, with independent calls run concurrently
  • Factory example: moving and verifying 151 Linear issues took 312 tool calls; direct calls needed about 36 requests and 3.1M input tokens, a Script needed 2 requests and 61K tokens
  • Terminal-Bench 4 (Factory runs, Oct 23-28, three trials per task): with GPT-6.1 Sol, Droid 57.6% vs Codex 54.0%, OpenCode 51.0%, Devin 45.0%; with Opus 5.5, Droid 65.2% vs Cursor and OpenCode 62.1%, Devin 59.6%, Claude Code 57.6%
  • The first request shrank from 20,887 to 13,055 tokens (-37%) and up-front tool definitions went from 11 to 2; newly loaded MCP tools are appended to keep the prompt cache intact, and a typical production request reads 98% of input from cache
  • Available now as a macOS and Windows desktop app, a terminal UI and the Droid SDK (@factory/droid-sdk); the benchmarks are vendor-run with no third-party reproduction yet
Read full story

X discussion: Zerodha CEO Nithin Kamath asks what traders are building with free Kite APIs and AI coding agents

On Oct 26, Zerodha founder and CEO Nithin Kamath asked on X how people are using Kite APIs with AI agents now that they are free, and what they have built. He said AI coding agents such as Claude Code and Codex have made it much easier for traders and investors to build their own tools without much coding experience, and that Zerodha is seeing more Kite API usage because of these agents. Within about 10 hours the post drew more than 2,200 likes, over 2,000 bookmarks and 200+ replies. This is an X discussion and the CEO's own view, not a new product launch.

X discussion: Zerodha CEO Nithin Kamath asks what traders are building with free Kite APIs and AI coding agents

Key Takeaways

  • Engagement (as of 2026-10-26 21:08 UTC, public X API metrics): about 183K views, 2,256 likes, 2,039 bookmarks, 219 replies and 113 reposts
  • Source of the view: an original post by Zerodha founder and CEO Nithin Kamath (@Nithin0dha), who says coding agents are driving more Kite API usage; Zerodha has not published how much
  • Pricing (per the official Zerodha API page): the Personal tier is free with orders, GTT, alerts, margin computation and portfolio management; the Connect tier costs ₹500/month and adds realtime WebSocket streaming and historical candles
  • Official SDKs cover 8 languages (Python, Java, Node.js, C#/.NET, Go, Rust, PHP and C++), so coding agents can generate client code directly
  • The debate: AI coding agents make it common for non-programmers to build their own trading tools, which also puts risk control and automated order placement in individual hands
Read full story

X discussion: engineer Arpit Bhayani says "no human will ever write code better than LLMs", drawing 7K+ likes, 240+ replies and a debate over AI coding ability

At 13:37 UTC on 2026-10-25, engineer Arpit Bhayani (@arpit_bhayani) posted: "No human will ever write code better than LLMs. Accept this fact, stop pretending, and move on." (post). When we pulled it, the post had about 7,193 likes, 496 reposts, 104 quotes, 241 replies, 529 bookmarks and 174K views, and it reached X's trending stories. Replies are split: some agree LLMs already write code faster and better, while others push back that LLMs often produce more code than a task needs and that production edge cases, architecture and final verification still depend on people. This is an X discussion presented as opinions, not a proven conclusion.

Key Takeaways

  • Main post: Arpit Bhayani's post, published 13:37 UTC on 10-25, with about 7,193 likes, 496 reposts, 104 quotes, 241 replies, 529 bookmarks and 174K views when we pulled it
  • The wording is "No human will ever write code better than LLMs. Accept this fact, stop pretending, and move on"; it is a personal opinion with no data or experiment attached
  • For: one reply says the author coded for years and LLMs now code better and faster than they do
  • Against: other replies say LLMs tend to generate far more code than a simple use case needs, and that browser quirks, accessibility and production edge cases still need human judgment
  • Common ground: many replies place human value in design, supervision and verification; layoff and hiring-ratio figures circulating online were not verified here, so we do not use them
Read full story
Linked Models & Agents:

Last Secure Code Benchmark: Vibe Coding Under Fire as Top Agents Produce Secure Code on Only 25.1% of Tasks

While AI coding agents and 'vibe coding' workflows synthesize an unprecedented volume of production software, code security remains highly fragile. Researchers from NUS and Monash University introduced the Last Secure Code Benchmark, evaluating 450 tasks derived from 150 real CVE vulnerabilities across 7 languages (Java, C, C++, JS, Python, PHP, Go) and 24 CWE categories (including 21 of the 2025 CWE Top 25 and 8 of the Top 10 KEVs). While frontier agents achieve 73.6% to 91.3% functional completion rates, even the strongest model (Claude Fable 5) produces code that is both functional and secure on only 25.1% of tasks, exposing acute supply-chain risks in autonomous vibe coding.

Last Secure Code Benchmark: Vibe Coding Under Fire as Top Agents Produce Secure Code on Only 25.1% of Tasks

Key Takeaways

  • First comprehensive vibe-coding security benchmark: 450 tasks based on 150 CVEs spanning 7 languages, covering 21 of the 2025 CWE Top 25 and 8 Top 10 KEVs
  • The functionality illusion: while agents pass functional specs at 73.6%–91.3%, dual functional-and-secure pass rates collapse to 16.4%–25.1%
  • Vulnerability defense crisis: across full-repository and file generation scenarios, top models resolve only 12% of vulnerability environments securely
Read full story
ADSponsored

Skill Constellations: The First Supply Chain Audit of 2.19M GitHub Agent Skills Reveals Vulnerability Propagation Patterns

Modern AI coding agents such as Claude Code, Codex, and terminal assistants routinely execute agent skills—instructions and executable scripts bundled in SKILL.md specifications—with full local user privileges. Developers share these skills primarily by copying files across repositories, inadvertently forging a shadow software supply chain without centralized registries, semver tagging, or provenance tracking. A seminal empirical audit by Fahd Seddik (arXiv:2610.11169) introduces Skill Constellations, constructing the first dated copy network of agent skills derived from git provenance across 2,193,119 skill adoptions on GitHub. The investigation demonstrates that a minuscule set of root repositories generates nearly all downstream copies, yet GitHub star counts correlate poorly with true lineage sources. Critically, downstream copies almost never adopt upstream security patches. By fitting a predictive copy network model, auditing just the top 100 identified root repositories halts 14.9% of subsequent high-risk skill adoptions (compared to a negligible 0.5% when inspecting the top 100 starred repos), proving the urgent necessity for decentralized package ecosystems to adopt versioned references over loose copies.

Key Takeaways

  • Skill Constellations delivers the first dated supply chain network of 2.19M agent skill adoptions across GitHub repositories
  • Reveals that a tiny cluster of progenitor repositories drives global adoption without correlating with GitHub star metrics
  • Auditing the top 100 root repositories prevents 14.9% of subsequent high-risk skill adoptions, outperforming star-based audits by 30x
Read full story
Linked Models & Agents:

GitHub stacked pull requests are generally available on all github.com plans: approvals survive rebases, whole stacks land via merge queue, and gh stack ships an AI-agent skill

On 2026-10-06 GitHub made stacked pull requests generally available on all github.com plans, with GitHub Enterprise Server support coming in a later release. Since the public preview, repos using stacks have merged 9% more code than their peers, and more than two-thirds of the top 1% of repos now use them, with a 5% faster time-to-merge. New in GA: approvals are kept for unchanged code after a rebase, replacement commits are signed automatically, a whole stack enters the merge queue as one merge group, stacks retarget automatically when their base branch is deleted, and stack auto-merge is rolling out over the coming weeks. The gh-stack CLI extension (v0.2.0) now supports Git worktrees, and gh skill install github/gh-stack teaches AI coding agents how to split large changes into stacked PRs.

GitHub stacked pull requests are generally available on all github.com plans: approvals survive rebases, whole stacks land via merge queue, and gh stack ships an AI-agent skill

Key Takeaways

  • Impact (changelog): repos using stacks merge 9% more code; over 2/3 of the top 1% of repos use them, with 5% faster time-to-merge
  • Approvals and signing: Rebase stack keeps approvals on unchanged code even when stale approvals are dismissed; replacement commits are signed and keep the original authorship
  • Merge queue: a stack lands as 1 merge group; with the merge-commit method, each PR gets its own merge commit; stack auto-merge rolls out over the next few weeks
  • Agents: gh-stack v0.2.0 (2026-10-02, 1.6k stars) supports worktrees and installs an agent skill via gh skill install github/gh-stack; the pull_request webhook gains a stacked action
  • Coverage: all github.com plans now, GHES in an upcoming release; requires gh v2.0+ and Git 2.36+
Read full story

Who Finishes the Job? First Empirical Study Reveals AI Coding Agent Merges Require 1.62x More Follow-Up Fixes

Researchers from Monash University and the University of Melbourne published the first large-scale empirical study tracking the post-merge lifecycle of AI coding agents across GitHub open-source repositories (arXiv:2609.26847). Analyzing 6,774 merged agent PRs (spanning Devin, Cursor, Claude Code, GitHub Copilot, and OpenAI Codex) against 5,044 contemporaneous human PRs across repos with 500+ stars, the study reveals that merged agent code requires verified follow-up bug fixes at 1.62 times the odds of human merges. However, 69.6% of verified fixes are authored by the same agent, and 76.4% of fix PR commits remain entirely agent-driven, debunking assumptions that human maintainers bear the full manual burden of cleanup.

Who Finishes the Job? First Empirical Study Reveals AI Coding Agent Merges Require 1.62x More Follow-Up Fixes

Key Takeaways

  • Empirical scale: analyzes 6,774 merged agent PRs and 5,044 contemporaneous human PRs across popular repos (500+ stars)
  • Higher bug odds: merged agent PRs attract verified follow-up fixes at 1.62x the odds of human PRs (OR = 1.62)
  • Self-fixing loop: 69.6% of verified fixes come from the original agent, with 76.4% of fix commits authored entirely by AI
  • High-agreement benchmark: evaluated via human annotators and LLM Judge (Kappa = 0.78 vs human-human Kappa = 0.77) with 90% direct-fix precision
  • Engineering takeaway: maintainers should introduce post-merge staging soak periods and harness agent self-repair workflows
Read full story

Goose v1.52.0: live voice in desktop plus Opus 5.5, GPT-6-sol and GPT-6-luna

Open-source agent Goose (aaif-goose/goose) shipped v1.52.0 on 2026-09-23 with live voice conversations in the desktop app, a Decisions provider (OpenRouter + Jev), Z.AI Coding Plan streaming tool calls, recipe parameter caps (32 / 200 / 128 KiB), and first-class Opus 5.5, GPT-6-sol, and GPT-6-luna support.

Goose v1.52.0: live voice in desktop plus Opus 5.5, GPT-6-sol and GPT-6-luna

Key Takeaways

Read full story

EmbodiedSWE Benchmark Released: First Code-Agent Evaluation Suite for Long-Horizon Dexterous Robotics

The SWE-bench initiative and robotics researchers (@SWEbench) unveiled EmbodiedSWE (arXiv: 2609.27308). Expanding benchmark standards beyond pure software repositories, EmbodiedSWE assesses AI coding agents on 250 challenging robotic manipulation tasks requiring physical reasoning, sensor calibration, and closed-loop motor control code generation.

EmbodiedSWE Benchmark Released: First Code-Agent Evaluation Suite for Long-Horizon Dexterous Robotics

Key Takeaways

  • Features 250 enterprise-grade robotics software engineering challenges across ROS2, Isaac Gym, and MuJoCo.
  • Implements closed-loop physics simulation verification where candidate code must successfully execute in simulator.
  • Reveals that leading frontier models resolve under 22% of tasks, underscoring the gap between software and physical control.
  • Complete benchmark dataset and dockerized evaluation harnesses are openly accessible on GitHub and Hugging Face.
Read full story

lpm open-sources a native macOS desktop workspace for services, terminals, and coding agents

@DanKornas shipped lpm (github.com/gug007/lpm): an MIT native macOS desktop app that keeps project services, terminals, and AI coding agents in one workspace—one-click start/stop with live terminal output, duplicate projects for parallel feature work, profiles for service subsets or one-off test/migrate/deploy actions, and native (no-Docker) service management beside Claude Code, Codex, and other agents.

Key Takeaways

  • Native macOS workspace for project services, terminals, and coding agents.
  • One-click start/stop, project duplication for parallel work, and profiles for tests/migrates/deploys.
  • MIT open source; native services without Docker; runs Claude Code/Codex alongside.
Read full story
Linked Models & Agents:
ADSponsored

brief open-sources a single-binary CLI that briefs AI coding agents on project toolchains

@DanKornas ships brief (github.com/git-pkgs/brief): an MIT single-binary CLI for contributors and AI coding agents that detects language, package manager, test/build/lint/formatter conventions; accepts local paths, Git URLs, and registry packages; can narrow reports to changed files; emits human or JSON output; and adds inspection commands for native artifacts, tooling gaps, and threat categories.

Key Takeaways

  • Single-binary CLI that orients humans and coding agents before edits.
  • Detects language, package manager, test/build/lint conventions; change-aware narrowing.
  • MIT open source; local path, Git URL, and registry inputs; human or JSON output.
Read full story
Linked Models & Agents:

Pulse open-sources a sidebar aggregating quotas across 19 AI coding tools

@Jolyne_AI highlighted Pulse, a lightweight edge sidebar that live-aggregates remaining quotas and rate-limit windows across 19 AI coding services including Claude Code, Codex, and Cursor, so you need not open each vendor page. Repo: https://github.com/qunqin24/Pulse.

Key Takeaways

  • Edge sidebar aggregates remaining quotas across AI coding services.
  • Covers about 19 tools including Claude Code, Codex, and Cursor, plus rate-limit windows.
  • Open-source at qunqin24/Pulse to avoid checking each vendor site.
Read full story

Grok Build adds /learn to mine reusable Skills from agent chats

@iml1s covered xAI coding tool Grok Build adding /learn: it analyzes your agent chats, proposes new or updated Skills from repeated instructions, and flags stale rules, rarely used Skills, plugins, and MCP. Choose report-only or step-through apply. This is workflow-rule curation, not chat memory—akin to Claude Code /insights.

Key Takeaways

  • /learn mines reusable Skills from chat so you stop retyping the same agent rules.
  • Flags stale rules and cold Skills/plugins/MCP; report-only or step-through apply.
  • Rule curation, not memory—Grok Build's take on Claude Code /insights.
Read full story

Critical Zero-Click RCE Vulnerability Disclosed Across Major AI Coding Agents

Cybersecurity researchers disclosed a critical zero-click remote code execution vulnerability impacting Claude Code, Codex, GitHub Copilot, and Gemini CLI. The flaw exploits weaponized repo metadata during autonomous indexing, spurring an industry-wide push for strict containerization.

Key Takeaways

  • Uncovers indirect prompt injection chain during autonomous repo ingestion
  • Requires zero user clicks, potentially compromising host developer environments
  • Accelerates emergency vendor patching and cements container isolation as mandatory
Read full story

Circle Launches Arc Studio: Autonomous AI Coding Agent for Web3 & Smart Contracts

Circle launched Arc Studio, an AI-powered coding agent built for full-stack onchain software. From single natural language prompts, it automatically writes frontend interfaces, backend services, unit tests, and audited smart contracts across Ethereum, Base, and Arbitrum.

Key Takeaways

  • End-to-end generation of Web3 full-stack dApps, backend glue, and smart contracts
  • Native interoperability across Ethereum, Base, and Arbitrum networks
  • Built-in formal verification engine prevents reentrancy bugs and access leaks
Read full story
Linked Models & Agents: