AICoder

AI Coding Live News

First-hand AI coding updates from 𝕏/Twitter frontier labs and researchers, distilled by AI with entity benchmarks.

Explore live on 𝕏 ↗

AI Coding Live News

A
Andrej Karpathy@karpathy·
👀44
🔥81

Karpathy builds HackerTube in about 2 hours with Claude Code and Opus 5.5: a YouTube clone of 6,454 videos recommended on Hacker News

On Oct 31 Andrej Karpathy published HackerTube (hackertube.org) on his personal blog: a YouTube-style site that only lists the 6,454 YouTube videos recommended in Hacker News comments from 2007 to 2026, grouped into 150 topics. He says Opus 5.5 in Claude Code did the work: it downloaded every HN comment, ran Sonnet over them in a Workflow to narrow things down to about 40K comments recommending a video, wrapped the result in a YouTube UI, then deployed and hardened it on a VPS, all in about 2 hours. His only manual steps were creating a YouTube API key, booting the VPS and buying the domain. His HN submission reached the front page with about 1,005 points and 308 comments.

Key Takeaways

  • Source: Karpathy's personal blog post HackerTube (Oct 31), with the site live at hackertube.org
  • Scale: from every HN comment it narrowed things down to about 40K comments recommending a YouTube video, giving 6,454 videos across 150 topics from 2007 to 2026 (author-reported)
  • Method: Opus 5.5 ran the download and overall pipeline, used Claude Code's Workflow feature to have Sonnet filter comments and drop spam in bulk, then built a YouTube-style front end and deployed and hardened it on a VPS
  • Product details: it uses the frame at the 50% mark instead of the uploaded thumbnail, offers account-free For You picks with state kept only in the local browser, supports keyboard shortcuts, and exports the site's data so you can hand it to your own agent to build a variant
  • Workflow: Karpathy says Opus 5.5 on Medium effort is his default and he no longer reads or writes code or runs terminal commands himself; the HN post has about 1,005 points and 308 comments (public HN data as of Nov 1, 14:10 SGT)
Read full story
Linked Models & Agents:
⚡ Claude Opus 5.5⚡ Claude Sonnet🤖 Claude Code🌐 Anthropic
#Karpathy#HackerTube#Claude Code#Opus 5.5#vibe coding#Hacker News#YouTube
W
Wiz@wiz_io·
👀38
🔥82

Wiz "Black October" report: at least nine AI developer platforms breached in October, with stolen API keys feeding an LLMjacking resale market

Cloud security firm Wiz published research on October 30 saying at least nine AI developer platforms disclosed incidents this month: Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode and Northflank. Attackers hunted stored environment variables, especially keys for paid AI models; Wiz traced two stolen enterprise keys to roughly 800,000 and 1.7 million Amazon Bedrock calls, which it estimates likely ran over $100k at list price in those two cases alone.

Wiz "Black October" report: at least nine AI developer platforms breached in October, with stolen API keys feeding an LLMjacking resale market

Key Takeaways

  • Scale: between October 6 and 30, at least nine AI developer platforms disclosed incidents, and Zeabur is shutting down as a result (Wiz blog)
  • Methods: Fireworks, OpenCode and Warp reported signs of an "agent swarm" attack, and OpenCode and CommandCode attributed theirs to "distillation" attempts; the common thread is hunting stored environment variables that grant AI access
  • Case A: one stolen key drove about 800k Bedrock calls over 30 hours, about 90% successful, with Opus models making up three quarters (Wiz figures)
  • Case B: a single address made about 1.7 million calls in 13 hours, over a million successful; the two cases together likely exceeded $100k at list price
  • Resale chain: Wiz identified two sites selling discounted frontier-model access and saw both test the stolen keys
Read full story
Linked Models & Agents:
⚡ Claude Opus 5.5⚡ Claude Opus 5🤖 opencode🤖 warp🌐 Wiz🌐 Amazon Bedrock🌐 Fireworks AI🌐 Railway🌐 Warp🌐 OpenCode🌐 Northflank
#Wiz#Black October#LLMjacking#Security#API keys#Amazon Bedrock#supply chain#OpenCode
C
Claude Docsclaudeai·
👀10
🔥80

Claude API launches the Usage and Cost Analytics API in beta and raises the request size limit to 128 MB

Per the official Claude API release notes, on Oct 29 Anthropic launched the Usage and Cost Analytics API in beta, with two endpoints, /v1/organizations/analytics/usage and /analytics/cost, that filter and group token usage and cost by model, workspace, API key, and the user or service account behind each request, with 1-minute, 1-hour, or 1-day buckets. The older Usage and Cost API is now legacy but still supported. On Oct 28 the maximum request size for the Messages and Token Counting APIs on the first-party Claude API rose from 32 MB to 128 MB.

Key Takeaways

  • The new API needs the analytics-usage-cost-2026-08-24 beta header; one endpoint returns token and request counts, the other cost in USD (per the official docs)
  • group_by takes up to 5 dimensions, time buckets can be 1m, 1h, or 1d, and each filter accepts up to 100 values
  • Claude Console and Claude Enterprise organizations share the same endpoints and fields; it also works on Claude Platform on AWS and Claude Models on Google Cloud (Anthropic managed)
  • The old Usage and Cost API and four Enterprise Analytics usage and cost report endpoints are now legacy but still supported, with migration guides
  • Since Oct 28 the Messages and Token Counting APIs accept requests up to 128 MB instead of 32 MB (4x), on the first-party Claude API only
Read full story
Linked Models & Agents:
🤖 Claude Managed Agents🌐 Anthropic
#Claude API#usage analytics#cost tracking#Admin API#request size#Anthropic
d
dax@thdxr·
👀93
🔥82
View on 𝕏 ↗

OpenCode 2.2.3 adds a built-in Claude Agent provider that runs Claude models through your own Claude Code login, subscriptions included

OpenCode, the open-source coding agent, shipped v2.2.3 at 09:55 UTC on Oct 30 with a built-in "Claude Agent" provider. After installing Claude Code and running claude auth login, users pick Claude Agent in /connect and can call Claude models through their own Claude Code login, whether that is a subscription, an API key or a cloud account. It runs the user's local claude program through Anthropic's public Claude Agent SDK, but turns off Claude Code's built-in tools and uses OpenCode's own tools and permission system instead. Hours earlier, OpenCode team member dax (@thdxr) teased on X "what if you could use your claude subscription in opencode", drawing about 2,300 likes.

Key Takeaways

  • v2.2.3 shipped at 09:55 UTC on Oct 30; its first highlight is "Use Claude Code in OpenCode", from PR #58782 (release notes)
  • Setup is three steps: install Claude Code, run claude auth login, and pick Claude Agent in /connect; OPENCODE_CLAUDE_PATH overrides the claude binary
  • The design spec says it uses only the public SDK, never reads Claude Code's saved login and never intercepts or changes its requests; subscription, API key and cloud logins all work (spec)
  • Claude Code's built-in tools, CLAUDE.md, hooks, MCP servers, skills, auto compaction and auto memory are all off; OpenCode's tools, permissions and compaction apply, with one claude process per session that stops after 5 idle minutes
  • dax's (@thdxr) teaser post drew about 2,300 likes and 280 replies (post); no performance comparison has been published
Read full story
Linked Models & Agents:
⚡ Claude🤖 OpenCode🤖 Claude Code🌐 Anomaly🌐 Anthropic
#OpenCode#Claude Code#Claude Agent SDK#Claude subscription#coding agent#Provider
ADSponsored
S
SlowMist@SlowMist_Team·
👀53
🔥98
View on 𝕏 ↗

LiteLLM Gateway Compromised in v1.107.0 Supply-Chain Attack: Emergency Rollback to 1.106.2 and Credential Rotation Issued

LiteLLM, a widely deployed unified proxy gateway powering millions of LLM and autonomous agent pipelines worldwide (including LangChain and OpenHands), suffered a critical supply-chain compromise. Attackers breached its automated CI/CD release pipeline, pushing a poisoned v1.107.0 release to PyPI and Docker Hub tags ('latest' and 'main-stable') equipped with a credential-harvesting payload targeting system environment variables and cloud API keys. Coordinated with security firms including SlowMist, the maintainers quickly contained the incident, yanked v1.107.0, restored PyPI to 1.106.2, and urged all operators to pin dependency versions and rotate API credentials immediately.

LiteLLM Gateway Compromised in v1.107.0 Supply-Chain Attack: Emergency Rollback to 1.106.2 and Credential Rotation Issued

Key Takeaways

  • LiteLLM release pipeline compromised, publishing trojanized v1.107.0 packages across PyPI and Docker Hub tags
  • Payload secretly exfiltrated host environment variables, harvesting model API keys, database credentials, and cloud secrets
  • Maintainers yanked the malicious package within hours, rolling PyPI and official Docker containers back to stable 1.106.2
  • Urges all agent and LLM platform operators to verify pinned package versions and execute immediate credential rotation
Read full story
Linked Models & Agents:
🤖 LiteLLM🤖 OpenHands🤖 LangChain🌐 BerriAI🌐 SlowMist
#LiteLLM#Security#Supply Chain Attack#Cybersecurity#API Key#DevOps
G
Google Research@GoogleResearch·
👀111
🔥86
View on 𝕏 ↗

Google Research launches Deep Review publicly: a four-stage agentic document verifier, piloted on 16,000+ conference papers, now on Gemini 4 Argon with an API

Google Research publicly released Deep Review on 2026-10-14. It grew out of the experimental Paper Assistant Tool (PAT), which gave opt-in pre-submission feedback on 16,000+ manuscripts at STOC 2026, ICML 2026, NeurIPS 2026 and ICLR 2027, and now covers design docs, presentations, and legal and financial documents. Users get two free reviews a week, can connect a Gemini API key for higher limits and the Deep Review API, and the system now supports Gemini 4 Argon.

Google Research launches Deep Review publicly: a four-stage agentic document verifier, piloted on 16,000+ conference papers, now on Gemini 4 Argon with an API

Key Takeaways

  • Pilot scale: 16,000+ opt-in manuscripts across STOC, ICML, NeurIPS and ICLR (Google Research blog)
  • Review load: over 74,000 submissions to ICLR, NeurIPS and ICML this year vs ~45,000 in 2025, 32,000 in 2024 and 23,000 in 2023 (Google-reported)
  • Two free reviews per user per week; a Gemini API key unlocks higher limits and the Deep Review API; PDF and plain text at launch, multi-file coming (Deep Review)
  • Uploaded documents are never used to train or fine-tune Google models and are stored one year for display only
  • Antigravity adds a Teamwork Deep Document Review pattern via /teamwork-preview; methodology in arXiv 2606.28277
Read full story
Linked Models & Agents:
⚡ Gemini 4 Argon🤖 Google Antigravity (AGY)🌐 Google DeepMind
#Google Research#Deep Review#Gemini 4 Argon#Antigravity
N
Nous Research@NousResearch·
👀176
🔥88

Hermes Agent v0.22.0: keyless guided onboarding, one-click local llama.cpp models, Gmail/Linear/Notion connectors and a 600-plugin catalog

Nous Research shipped Hermes Agent v0.22.0, "The Threshold Release", on Oct 14 (UTC). Fresh desktop installs open a guided setup chat on a free trial model (nous/welcome) with no API key, connectors reach Gmail, Linear and Notion through the Nous tool gateway, a one-click llama.cpp runtime runs local models, installs now follow tested SemVer stable releases, and desktop builds are signed (including the Microsoft Store). The source tree shrank from about 1.06M to 698K lines (−34%).

Hermes Agent v0.22.0: keyless guided onboarding, one-click local llama.cpp models, Gmail/Linear/Notion connectors and a 600-plugin catalog

Key Takeaways

  • Scale since v0.21.0: ~24,200 commits, ~6,080 merged PRs, ~7,180 issues closed, ~2,520 contributors, about 2.5x the v0.21.0 cycle
  • Leaner: source went from ~1.06M to 698K lines (−34%); gateway/run.py from 34,847 to 5,512 lines; ~19 rarely used tools now load on demand, roughly halving the desktop tool schema, and ~2.1k tokens came off the fixed prompt
  • Local models: installs llama.cpp b11370 for CPU/CUDA/Metal/Vulkan/ROCm, recommends only models that fit fully in GPU memory; catalog includes Qwen3.8 27B, Qwen3.6 35B-A3B, DeepSeek V4 Flash and any Hugging Face GGUF
  • 600-plugin catalog, each pinned to a reviewed commit; memory providers (Honcho, Mem0, Supermemory and others) moved out of core
  • Faster updates that rebuild only what changed: 16.5 s vs 32.5 s on macOS (vendor figure)
Read full story
Linked Models & Agents:
⚡ Qwen3.8-27B⚡ DeepSeek-V4-Flash⚡ Gemini 4 Argon⚡ GPT-6🤖 Hermes Agent🌐 Nous Research
#Hermes Agent#Nous Research#open source#Agent#llama.cpp#local models#Connectors#Plugins
A
Anvishaanvisha·
👀103
🔥86
View on 𝕏 ↗

Voyager launches: a desktop agent harness that drives Blender, DaVinci Resolve, After Effects and Ableton — 'the Codex for creative work'

Nullframe (the Moda team, YC F26) shipped Voyager, a local desktop agent harness that drives creative apps through their own scripting APIs, ships free Design/Video/DAW engines, and works with your own Claude/Codex sign-in or API keys. The launch post passed 1.48M impressions.

Voyager launches: a desktop agent harness that drives Blender, DaVinci Resolve, After Effects and Ableton — 'the Codex for creative work'

Key Takeaways

  • Launch post: ~1.48M impressions, 3,074 bookmarks, 2,457 likes on X
  • Drives Photoshop, Illustrator, After Effects, Premiere Pro, DaVinci Resolve, Final Cut Pro, Blender, Unity and Ableton Live; skills also cover Cinema 4D, Houdini, Remotion, Manim
  • ~40 built-in skills, MCP server support, and reuse of skills installed for Claude Code / Codex / Cursor
  • Free app with BYO agent/keys; paid plans from $19/mo, generation billed at provider cost with no markup
  • Apple Silicon + macOS 15 required; Windows 11 / Linux in alpha; desktop v0.1.84 shipped Oct 8
Read full story
Linked Models & Agents:
⚡ Claude Opus 5.5⚡ DeepSeek⚡ Seedance 2.5⚡ Veo 3.1🤖 Voyager🤖 Claude Code🤖 Codex🌐 Nullframe🌐 Moda
#Agent#Creative#Desktop agent#MCP#Blender#Davinci resolve#Yc
D
Dan Kornas@DanKornas·
👀49
🔥93
View on 𝕏 ↗

Clampdown open-sources a hardened container sandbox for Claude Code, Codex, and more

@DanKornas highlighted Clampdown (github.com/89luca89/clampdown), a hardened container sandbox for coding agents: Landlock filesystem rules before the binary starts, deny-by-default egress with an allowlist, real API keys held in a separate auth proxy while the agent gets a dummy key, OCI hooks for nested containers, plus launch helpers for Claude Code, Codex, OpenCode, and pi (GPL-3.0-only).

Key Takeaways

  • Landlock filesystem rules bind the agent to the project directory before start.
  • Real keys stay in an auth proxy; the agent gets a dummy key and deny-by-default egress.
  • Launch helpers for Claude Code, Codex, OpenCode, and pi; GPL-3.0-only.
Read full story
Linked Models & Agents:
🤖 Claude Code (Anthropic)🤖 codex
#Clampdown#Sandbox#Container#Landlock#Claude Code#Codex#Security#open source
R
RowTrail@hxlee418·
👀51
🔥88
View on 𝕏 ↗

RowTrail open-sources a Rust CLI/MCP so agents can query CSV/Parquet without stuffing tables into context

@hxlee418 shipped RowTrail (github.com/adam2go/rowtrail), an Apache-2.0 early-alpha local data tool: read-only SQL over CSV/TSV/Parquet, exact results saved on disk, bounded observations via CLI or MCP, and zero internal model calls with no API key. v0.1.0-alpha.2 publishes native packages for macOS arm64 and Linux x86_64.

Key Takeaways

  • Agents explore local tables with read-only SQL and bounded observations instead of loading whole tables into context.
  • Native Rust binaries with zero internal model calls; no Python, Node, or Docker required.
  • Apache-2.0 early alpha with CLI, persistent NDJSON sessions, and stdio MCP.
Read full story
Linked Models & Agents:
#RowTrail#MCP#CLI#CSV#Parquet#Rust#open source
ADSponsored
s
sora19ai@sora19ai·
👀59
🔥89
View on 𝕏 ↗

jev-mcp open-sources nine TypeSafe Jev judgment tools for Cursor and Codex

@sora19ai highlighted burnigtm/jev-mcp, a local stdio MCP that exposes TypeSafe Jev structured judgments to Cursor, Codex, and other MCP clients while the host still edits files and runs commands. Nine tools include jev_step, jev_review, jev_verify, and jev_rank for patch review, claim checks, and ranking; a TypeSafe API key is required, with mock mode for demos. MIT-licensed with about 13 GitHub stars at verification.

Key Takeaways

  • Local MCP that puts Jev judgments on Cursor/Codex loops while the host still executes tools.
  • Nine tools cover step routing, patch review, claim verification, screening, and ranking.
  • Needs a TypeSafe API key; burnigtm/jev-mcp under MIT with about 13 stars at verification.
Read full story
Linked Models & Agents:
🤖 Claude Code (Anthropic)🤖 Cursor Composer (Agent Mode)🤖 Aider🌐 typesafe
#Jev MCP#TypeSafe Jev#MCP#Cursor#Codex#patch review#open source
Ά
Άντιpacman🪽@doth4580·
👀49
🔥88
View on 𝕏 ↗

mcp-typesafe: Rust MCP server exposing TypeSafe Jev System One tools to any agent

Community release mcp-typesafe (github.com/sf-stav/mcp_typesafe): an unofficial Rust MCP server that exposes TypeSafe System One / Jev structured judgments (choice/score) plus higher-level filter/rank/classify/choose-one and stability tools to any MCP client. It targets bulk triage without burning LLM context and calibrated probabilities instead of prose confidence; most calls are ~100ms. stdio and SSE transports, TypeSafe API key required, single static binary.

Key Takeaways

  • Unofficial Rust MCP exposing Jev/System One structured judgments to any agent.
  • Bulk filter/rank/classify/choose-one plus stability sampling; most calls ~100ms.
  • stdio + SSE; TypeSafe API key required; single static binary.
Read full story
Linked Models & Agents:
⚡ jev🌐 typesafe
#MCP typesafe#MCP#Jev#TypeSafe#System One#Rust#decision model
C
Cline@cline·
👀45
🔥90
View on 𝕏 ↗

Cline ships jev-browser plugin: give TypeSafe Jev a background Chrome in Desktop

Cline released a Marketplace plugin named jev-browser that gives TypeSafe Jev a background Chrome inside Cline Desktop. After installing and saving a Vercel AI Gateway API key, browser tasks can launch Chrome in the background; the team says results have been striking.

Key Takeaways

  • Install jev-browser from Cline Desktop Marketplace under Customize > Plugins.
  • Save a Vercel AI Gateway API key to ~/.cline/plugins/cline-jev-browser.config.json and restart.
  • Browser tasks launch Chrome in the background, pairing Jev decisions with real web actions.
Read full story
Linked Models & Agents:
⚡ jev🤖 Cline (VS Code Agent)🌐 cline🌐 typesafe-ai🌐 vercel
#Cline#Jev#Browser#Plugin#Desktop#AI Gateway#Chrome
R
Replit@Replit·
👀45
🔥89
View on 𝕏 ↗

Replit Custom Connectors enter beta for governed REST API integrations

Replit announced Custom Connectors are in beta, letting workspace administrators connect supported publicly accessible HTTPS REST APIs with API-key authentication without waiting for first-party connectors. The governed integration path expands the systems Replit AI coding workspaces can use while keeping configuration under admin control.

Key Takeaways

  • Workspace administrators can configure supported publicly accessible HTTPS REST APIs with API-key authentication.
  • Custom Connectors let teams connect internal tools and specialized services without waiting for first-party integrations.
  • The governed workspace model provides a practical path for connecting enterprise systems to Replit AI coding workflows.
Read full story
Linked Models & Agents:
#Replit#Custom Connectors#REST API#API Key#AI coding#workspace integrations
R
Replit@Replit·
👀42
🔥88
View on 𝕏 ↗

Replit Custom Connectors Enter Beta: Admins Wire HTTPS REST APIs With API-Key Auth

Replit put Custom Connectors into beta. Workspace admins can configure supported HTTPS REST APIs with API-key authentication so teams can connect specialized systems beyond first-party connectors and expand what agents can call.

Key Takeaways

  • Beta: workspace admins configure supported HTTPS REST APIs with API-key auth
  • Value: go beyond first-party connectors to specialized internal or third-party systems for agents
  • Start now via Replit docs Integrations / Custom Connectors
Read full story
Linked Models & Agents:
🤖 Replit Agent🌐 replit
#Replit#Custom Connectors#Integrations#REST#API key#Agents#Beta