AI Coding Live News

Wiz "Black October" report: at least nine AI developer platforms breached in October, with stolen API keys feeding an LLMjacking resale market

Cloud security firm Wiz published research on October 30 saying at least nine AI developer platforms disclosed incidents this month: Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode and Northflank. Attackers hunted stored environment variables, especially keys for paid AI models; Wiz traced two stolen enterprise keys to roughly 800,000 and 1.7 million Amazon Bedrock calls, which it estimates likely ran over $100k at list price in those two cases alone.

Wiz "Black October" report: at least nine AI developer platforms breached in October, with stolen API keys feeding an LLMjacking resale market

Key Takeaways

  • Scale: between October 6 and 30, at least nine AI developer platforms disclosed incidents, and Zeabur is shutting down as a result (Wiz blog)
  • Methods: Fireworks, OpenCode and Warp reported signs of an "agent swarm" attack, and OpenCode and CommandCode attributed theirs to "distillation" attempts; the common thread is hunting stored environment variables that grant AI access
  • Case A: one stolen key drove about 800k Bedrock calls over 30 hours, about 90% successful, with Opus models making up three quarters (Wiz figures)
  • Case B: a single address made about 1.7 million calls in 13 hours, over a million successful; the two cases together likely exceeded $100k at list price
  • Resale chain: Wiz identified two sites selling discounted frontier-model access and saw both test the stolen keys
Read full story

Meta open-sources Muse Spark Open: 816B-total / 42B-active MoE with 1M context, billed as the most capable US open-weight model to date

On 2026-10-15 Meta released weights for Muse Spark Open, a natively multimodal MoE (~816B total / ~42B active per token, 1M context) aimed at long-horizon coding and agents. Weights are on Hugging Face and peers; hosted APIs include Together, Fireworks, Groq and OpenRouter. Reported figures include DeepSWE 60%, MCP-Atlas 89.2% and JobBench 61.8% (see Meta’s evaluation methodology).

Meta open-sources Muse Spark Open: 816B-total / 42B-active MoE with 1M context, billed as the most capable US open-weight model to date

Key Takeaways

  • Scale: ~816B total / ~42B active per token; 256 experts/layer with top-8 routing; 62 layers, hidden 8192; context up to 1,048,576 (HF blog)
  • Coding/agents (Meta scorecard / AA, xhigh): DeepSWE 60.0%; SWE-Atlas Codebase QnA 58.0%; MCP-Atlas 89.2%; JobBench 61.8%; Toolathlon-Verified 72.8% (eval methodology)
  • Throughput (NVIDIA tech blog, agentic on GB300 NVL72): up to ~50K tok/s/GPU and ~600 tok/s/user; NVFP4 checkpoints published (NVIDIA blog)
  • Deploy: Muse Model License with limited commercial terms; SGLang / vLLM / TensorRT-LLM / MLX / llama.cpp; Meta demos two Apple M5 Ultra Mac Studios for on-desk local run
  • Third-party index: Artificial Analysis Intelligence Index ~38.9–39 (xhigh, as of 2026-10-07)—behind closed frontier, but a key open-weight reference (AA)
Read full story
Linked Models & Agents:
⚡ Muse Spark Open⚡ Muse Spark Open 816B-A42B🤖 Muse Code🌐 Meta🌐 NVIDIA🌐 Hugging Face🌐 Apple

Meta open-sources Muse Spark Open: 816B/42B natively multimodal US open-weight flagship, runs on two M5 Ultra Mac Studios

On 2026-10-15 Meta released Muse Spark Open open weights: an 816B-total / 42B-active MoE with a Perception Encoder, natively multimodal (text/image/video/audio in → text out), 1M context, aimed at coding and long-horizon agents. Weights are on Hugging Face (BF16/NVFP4), SageMaker, Model Garden and Foundry; APIs include OpenRouter, Together, Fireworks and Groq. Meta calls it the most capable US open-weight model to date and, with Apple, optimized it to run locally across two M5 Ultra Mac Studios via MLX.

Meta open-sources Muse Spark Open: 816B/42B natively multimodal US open-weight flagship, runs on two M5 Ultra Mac Studios

Key Takeaways

  • Specs: MoE 816B total / 42B active (256 experts, top-8), 62 layers, 1M context; text+image+video+audio in → text out (model card)
  • Local: NVFP4 needs ≥~700GB VRAM, BF16 ~2TB; or two Apple M5 Ultra Mac Studios via MLX (Meta blog)
  • Agentic benches (xhigh, official table): MCP-Atlas 89.2, JobBench 61.8, OSWorld Verified 80.4, Terminal-Bench 2.1 76.4, DeepSWE 1.1 60, AA Intelligence Index 39
  • Serve with SGLang / vLLM / TensorRT-LLM / Transformers / llama.cpp / Unsloth / MLX; Helion kernels claim 1.03–3.95× kernel speedups on NVIDIA/AMD
  • License: Muse Model License (display “Built with Muse Spark Open”; MaaS over $20M/yr needs a separate deal); OpenRouter ~$1.25/M in, $4.25/M out
Read full story
Linked Models & Agents:

Bolt Forge launches on bolt.new: open-weight coding agent free with up to 50x usage until Oct 14

bolt.new introduced Bolt Forge, an open-weight coding agent now live in the bolt.new model picker. Free until Oct 14 with up to ~50x usage and zero usage charges; lineup includes GLM 5.3 / GLM 5.3 Flash, Kimi K3, and DeepSeek v4 Pro. Opt-in builds help train a trillion-parameter-class model with Arcee; also announced $9/mo Bolt Lite (Forge included; join by Oct 14 to lock $9). Partners include Arcee, Microsoft, Vercel, Fireworks, and DigitalOcean.

Key Takeaways

  • Bolt Forge is live in bolt.new’s model picker as an open-weight coding agent.
  • Free through Oct 14 with up to ~50x usage and zero usage charges; GLM 5.3, Kimi, DeepSeek included.
  • Also ships $9/mo Bolt Lite with Forge; opt-in builds train a trillion-param model with Arcee.
Read full story
ADSponsored

Fireworks: LangChain fine-tunes Qwen judges at up to 100x lower cost

Fireworks said partner LangChain generates billions of agent-trace tokens a day, making frontier closed judges too costly. Fine-tuning a Qwen base on Fireworks matched GPT-5.5 / Opus-level judging at up to about 100x lower cost, and Fireworks is pushing its Training API for similar workflows.

Key Takeaways

  • LangChain produces billions of agent-trace tokens daily; frontier closed judges are too expensive.
  • Qwen fine-tuned on Fireworks matched GPT-5.5 / Opus-level judging at up to ~100x lower cost.
  • Training API is positioned for builders to train similar low-cost judge/agent models.
Read full story
Linked Models & Agents:

Fireworks ships DeepSeek V4 Flash with native vision at $0.22/$0.66 per 1M tokens

Fireworks said DeepSeek V4 Flash now includes native vision on serverless and priority tiers. It reports better benchmarks than the text-only 0731 checkpoint at the same $0.22 input / $0.66 output per 1M tokens. The model page lists a 305B MoE with about 1040K context, function calling, image input, and a speculative-decoding module.

Key Takeaways

  • DeepSeek-V4-Flash-Vision-Exp is live on Fireworks serverless and priority tiers with native image input.
  • Same price as text-only 0731: $0.22 input / $0.66 output per 1M tokens (cached input $0.007).
  • 305B MoE, ~1040K context, function calling, and speculative decoding for screenshot-aware coding agents.
Read full story

Fireworks opens Training API and Fireworks Lab for serverless or dedicated RL at scale

Fireworks announced general availability of its Training API and Fireworks Lab, aiming to make model specialization accessible beyond labs that already own training clusters. The API lets teams connect a custom Python training loop to Fireworks-managed distributed training and rollout infrastructure, keeping control of loss, reward, data, and environment. Compute is split into Serverless mode for fast experiments and Dedicated mode when scale, control, and GPU economics matter. The stack is built for reinforcement learning as a single train-sample-serve-retrain loop, with three hard requirements: rollout throughput, weight sync so fresh weights land on the rollout deployment every step, and correctness so trainer and inference engine agree on the same model. Fireworks Lab additionally embeds forward-deployed researchers and engineers to co-design or build a model. Named customers include Cursor, Harvey, Figma, Vercel, Cognition, Factory, and Heidi.

Key Takeaways

  • The Training API attaches a custom Python loop to managed distributed training and rollout, with Serverless and Dedicated compute.
  • The RL loop is optimized for rollout throughput, per-step weight sync, and trainer-inference model agreement.
  • Fireworks Lab embeds researchers with customers including Cursor, Harvey, Figma, Vercel, Cognition, and Factory.
Read full story

Factory fine-tunes open Qwen on Fireworks, catching ~20% more secrets than GPT-5.5

Fireworks spotlighted Factory's Droid Shield as a Training API customer story. Factory's droids write and commit code faster than human reviewers can keep up, so secret detection has to catch real leaks without flooding the team with false alarms. Using the Fireworks Training API, Factory fine-tuned an open Qwen model that caught almost 20 percent more real secrets than GPT-5.5, at lower cost and latency. The result is a specialized scanner sitting in the commit path rather than a generic frontier chat model asked to grep for keys. For coding-agent vendors, it is a concrete example that a domain-fine-tuned open-weight model can beat a larger closed model on a verifiable production task, then ship at a cost that matches high-frequency agent traffic. It also shows why training and inference on one platform matters: the specialized weights have to stay cheap enough to run on every commit.

Key Takeaways

  • Factory fine-tuned an open Qwen model on Fireworks that caught about 20% more real secrets than GPT-5.5.
  • Droid Shield is built for high-frequency droid commits, prioritizing true positives and low-friction review.
  • A specialized open-weight scanner can beat a general frontier model on a verifiable security task at lower cost.
Read full story

GitHub Copilot generally available with Gemini 3.7 Flash, MAI-Code-1.1-Flash, and Kimi K3

GitHub said Gemini 3.7 Flash, Microsoft MAI-Code-1.1-Flash, and the Fireworks-hosted open-weight Kimi K3 model are generally available in the GitHub Copilot app, Copilot CLI, VS Code, and related surfaces. Developers can switch among Google's low-cost coding model, Microsoft's in-house code model, and an open-weight option without leaving the Copilot workflow. The same Copilot weekly thread also promoted a Customize tab that gathers MCP servers, plugins, skills, and canvases, plus Slack and Microsoft Teams integrations that let teams mention GitHub to plan changes, investigate problems, and hand off coding tasks from chat. For organizations standardizing on GitHub as the agent control plane, the release is less about a single SOTA model and more about routing: pick Gemini 3.7 Flash for cheap iteration, MAI-Code for Microsoft-stack tasks, or Kimi K3 when open weights and Fireworks hosting matter.

Key Takeaways

  • Gemini 3.7 Flash, MAI-Code-1.1-Flash, and Kimi K3 are GA in Copilot app, CLI, and VS Code.
  • Kimi K3 lands as a Fireworks-hosted open-weight option inside Copilot.
  • Teams can route tasks across closed-source efficiency models and open weights, including from Slack and Teams.
Read full story

GitHub Copilot generally available with Gemini 3.7 Flash, MAI-Code-1.1-Flash, and Kimi K3 across app, CLI, and VS Code

GitHub said Gemini 3.7 Flash, Microsoft MAI-Code-1.1-Flash, and the Fireworks-hosted open-weight Kimi K3 model are generally available in the GitHub Copilot app, Copilot CLI, VS Code, and related surfaces. Developers can switch among Google's low-cost coding model, Microsoft's in-house code model, and an open-weight option without leaving the Copilot workflow.

Key Takeaways

  • Gemini 3.7 Flash, MAI-Code-1.1-Flash, and Kimi K3 are GA in Copilot app, CLI, and VS Code.
  • Kimi K3 lands as a Fireworks-hosted open-weight option inside Copilot.
  • Teams can route tasks across closed-source efficiency models and open weights in one assistant.
Read full story
ADSponsored

Fireworks AI Delivers Day-Zero US-Hosted Serverless Inference for GLM-5.3

Fireworks AI launched day-zero US-hosted serverless inference for GLM-5.3, highlighting a 50% improvement on Code Bench and state-of-the-art results in open-weight cyber defense and long-horizon agents.

Key Takeaways

  • Instant day-zero serverless API access for teams without dedicated multi-GPU infrastructure for 744B MoEs;
  • Optimized specifically for complex code refactoring, cyber security benchmarks, and long-horizon tasks;
  • Proprietary inference stack delivers sustained high tokens-per-second streaming performance.
Read full story
Linked Models & Agents:

Fireworks AI Powers Harvey's Tenet Legal Agent: Post-Trained via Async RL with Doubled Contract Pass Rate

Fireworks AI detailed Harvey's proprietary model Tenet, post-trained from Kimi K3 using async RL on Fireworks Training API, doubling LAB Contract all-pass rates from 10.8% to 19.7% at matched cost.

Key Takeaways

  • Achieves SOTA 19.7% on Harvey's LAB Contracts benchmark for long-horizon legal drafting and analysis;
  • Trained via Fireworks Training API async RL pipeline, doubling accuracy without increasing inference cost;
  • Demonstrates the production blueprint for vertical AI leaders building specialized agents on open bases.
Read full story
Linked Models & Agents: