AI Coding Live News

Vercel Token Pass Credit Applies Automatically on AI Gateway via API Key, OIDC, or fx Login

On 2026-11-06 Vercel updated Token Pass so featured-model usage through AI Gateway draws credit automatically with a standard API key, OIDC token, or fx login. When credit runs out, those auth modes fall back to team AI Gateway credits; dedicated Token Pass keys still stop until the next billing period.

Vercel Token Pass Credit Applies Automatically on AI Gateway via API Key, OIDC, or fx Login

Key Takeaways

  • Official: Vercel changelog 2026-11-06 — Token Pass credit now applies automatically across AI Gateway
  • Behavior: standard API key, OIDC, or fx login can draw Token Pass credit; dedicated key optional
  • Fallback: when credit ends, standard key/OIDC use team AI Gateway credits; dedicated Token Pass keys still stop until next period
  • Product terms: ~$30/month for ~$80 featured open-weight credit on Pro; Token Pass path stays ZDR
  • Guidance: early Token Pass key users should switch to standard key/OIDC to enable fallback
Read full story

Nous Research Ships Hermes Agent v0.23.0 “The Hearth”: Browser Webapp Desktop, Unified Gateway Sessions, Plugin Catalog Past 1,050

On 2026-11-05 Nous Research released Hermes Agent v0.23.0 (The Hearth). Your gateway can serve the full Desktop in a browser; CLI/TUI/Desktop/editors/bots/cron share one session authority; the plugin catalog grew from ~600 to 1,050+; plus conversation rewind, inline terminal images, and paid-MCP spend limits. Official: ~1,950 merged PRs and 666 contributors.

Nous Research Ships Hermes Agent v0.23.0 “The Hearth”: Browser Webapp Desktop, Unified Gateway Sessions, Plugin Catalog Past 1,050

Key Takeaways

  • Official GitHub release: Hermes Agent v0.23.0 (2026-11-05), codename The Hearth
  • Webapp: gateway serves full Desktop in a browser (off by default; webapp.enabled)
  • Unified sessions: one gateway owns chats so surfaces stop double-writing
  • Plugin catalog ~600→1,050+ with a Verified tier; paid MCP tools can declare cost + chat spend caps
  • Since v0.22.0 (vendor): ~10,080 commits / ~1,950 PRs / 666 contributors
Read full story
Linked Models & Agents:

Nous Research opens the official Hermes Agent mobile beta: iOS via TestFlight, Android via Firebase, connecting your phone to your own gateway to approve tools and manage bots and routines

During NousCon 2026 in New York on Oct 30, Nous Research released an official mobile beta of Hermes Agent and put up a sign-up page at hermes-agent.nousresearch.com/mobile: iOS users join the "Hermes Agent - Mobile" beta through TestFlight, and Android users join through Firebase App Distribution. The TestFlight page says the app connects to your own Hermes gateway so you can chat with streaming, approve tool calls, and manage bots and routines from anywhere. Teknium, co-founder and lead engineer of Hermes Agent, confirmed on X that the iPhone and Android betas launched together. Nous has not announced a general release date or any benchmarks.

Key Takeaways

  • Entry point: the official page hermes-agent.nousresearch.com/mobile covers 2 platforms, iOS through TestFlight and Android through Firebase App Distribution
  • Positioning: the TestFlight description says the app connects to your own gateway for streaming chat, tool-call approval, and managing bots and routines; it is a client, not a separate agent running on the phone
  • Confirmation: Teknium, co-founder and lead engineer of Hermes Agent, confirmed in a reply on X that the iPhone and Android betas both launched on NousCon day
  • Watch for clones: several third-party Hermes phone clients already exist, so only use the links on the official page; Nous has not published a general release date or benchmarks
Read full story
A
Anthropic@AICoder·
👀106
🔥80

Claude Code 2.1.314 adds a block on writes outside working directories, IdP group routing for the apps gateway, and idle compaction in VS Code and Desktop

Anthropic published Claude Code v2.1.314 on GitHub at 01:06 UTC on Oct 30. The official CHANGELOG lists 119 entries, more than half of them fixes. The new features lean enterprise: permissions.blockWritesOutsideWorkingDirectories makes Write, Edit and NotebookEdit refuse paths outside the working directories in every permission mode; Claude apps gateway upstreams can be limited to IdP groups, and Bedrock upstreams can log which guardrail fired; idle compaction now also runs in VS Code and the Code tab of Claude Desktop. It also fixes sessions failing repeatedly when an admin caps effort, and claude -p exiting 0 with no output when startup failed.

Key Takeaways

  • Size: the official v2.1.314 CHANGELOG has 119 entries, more than half of them fixes; released at 01:06 UTC on Oct 30
  • Safety: the new permissions.blockWritesOutsideWorkingDirectories setting stops Write, Edit and NotebookEdit from writing outside the working directories in every permission mode
  • Enterprise gateway: upstreams take an optional groups list so only developers in those IdP groups are routed there, failover included; Bedrock upstreams gain guardrail_trace
  • Experience: idle compaction now runs in VS Code and the Claude Desktop Code tab, summarizing idle conversations above 200K tokens
  • Fixes: when an admin caps effort, Claude Code lowers it and retries; a failed claude -p startup now prints the error and exits 1
Read full story
Linked Models & Agents:
ADSponsored

Suhail launches Particle and its first model, Particle-1: a DeepSeek V4.1 Flash post-train that uses about 45% fewer tokens on coding tasks

On Oct 28, Mixpanel founder Suhail Doshi announced his new company Particle on X, with its first model, Particle-1, live now. Particle's blog says it is a reinforcement-learning post-train of DeepSeek V4.1 Flash that uses 28.4% to 52.2% fewer output tokens and costs 34.4% to 51.6% less per task across four coding and data engineering benchmarks, with pass rates inside the base model's confidence intervals. It is available through the Particle API, OpenRouter and Vercel AI Gateway; Particle's docs list $0.25 input and $1.00 output per million tokens with a 1,048,576-token context window.

Suhail launches Particle and its first model, Particle-1: a DeepSeek V4.1 Flash post-train that uses about 45% fewer tokens on coding tasks

Key Takeaways

  • Across four benchmarks (Terminal-Bench 2.1, ReactBench, ADE Bench, DeepSWE 1.1), 28.4% to 52.2% fewer output tokens and 34.4% to 51.6% lower cost per task (vendor-reported)
  • Particle's summary table: $0.2211 per task versus $0.3368 for DeepSeek V4.1 Flash and $0.6523 for GLM 5.3 Flash; 59,580 mean output tokens versus 83,246 and 98,155
  • Task pass rate 72.57% versus 71.15% for the base model and 66.82% for GLM 5.3 Flash; GPQA Diamond 90.40% (base 90.91%), MMLU 86.08% (base 85.98%)
  • Training: a rank-64 LoRA on the experts in all layers, about 1.25% of the model's parameters, trained with sequence-level GSPO in two RL stages
  • Pricing: Particle docs currently list $0.25 input, $0.03 cached input and $1.00 output per million tokens, a 1,048,576-token context and a 131,072-token output ceiling
Read full story

LiteLLM Gateway Compromised in v1.107.0 Supply-Chain Attack: Emergency Rollback to 1.106.2 and Credential Rotation Issued

LiteLLM, a widely deployed unified proxy gateway powering millions of LLM and autonomous agent pipelines worldwide (including LangChain and OpenHands), suffered a critical supply-chain compromise. Attackers breached its automated CI/CD release pipeline, pushing a poisoned v1.107.0 release to PyPI and Docker Hub tags ('latest' and 'main-stable') equipped with a credential-harvesting payload targeting system environment variables and cloud API keys. Coordinated with security firms including SlowMist, the maintainers quickly contained the incident, yanked v1.107.0, restored PyPI to 1.106.2, and urged all operators to pin dependency versions and rotate API credentials immediately.

LiteLLM Gateway Compromised in v1.107.0 Supply-Chain Attack: Emergency Rollback to 1.106.2 and Credential Rotation Issued

Key Takeaways

  • LiteLLM release pipeline compromised, publishing trojanized v1.107.0 packages across PyPI and Docker Hub tags
  • Payload secretly exfiltrated host environment variables, harvesting model API keys, database credentials, and cloud secrets
  • Maintainers yanked the malicious package within hours, rolling PyPI and official Docker containers back to stable 1.106.2
  • Urges all agent and LLM platform operators to verify pinned package versions and execute immediate credential rotation
Read full story

Walmart opens up to AI shopping agents: an MCP-based Agent Gateway enters developer beta, and Agent Profiles with spending limits such as $50, $100 or $200 arrive next month

On October 21 Walmart announced Agent Profiles, the Walmart Agent Gateway and terms for AI agents. The Gateway lets agents search and buy across Walmart and Sam's Club over MCP, starting with a beta for companies and developers. Agent Profiles, due next month, let shoppers authorize each agent separately, see its orders apart from their own, set a spending limit or approve every purchase, and revoke access at any time. Agents never receive payment-card data and are blocked if they break the terms. TechCrunch reports Amazon is moving the other way and blocking third-party shopping agents.

Walmart opens up to AI shopping agents: an MCP-based Agent Gateway enters developer beta, and Agent Profiles with spending limits such as $50, $100 or $200 arrive next month

Key Takeaways

  • Access: the Walmart Agent Gateway uses MCP (Model Context Protocol), opening first as a beta for companies and developers, instead of agents clicking through the website in a browser
  • Agent Profiles arrive next month: one profile per agent, orders listed separately, spending limits such as $50, $100 or $200 (Walmart's examples) or approval for every purchase
  • Terms: purchases need customer approval by default, agents never get payment-card data or change payment methods, see only the data the task needs, and are blocked if they break the rules
  • Pricing (vendor statement): agents see the same prices a person sees on Walmart.com; per Reuters no Walmart+ membership is required
  • Walmart already integrates with Muse, ChatGPT, Gemini and others for conversational shopping; TechCrunch reports Amazon is blocking third-party shopping agents
Read full story

LiteLLM 1.107.0 hit by a supply-chain compromise: PyPI wheels and Docker images shipped a credential stealer and backdoor; LiteLLM says it is contained and advises pinning 1.106.2

On October 21 the release pipeline of the popular LLM gateway LiteLLM was compromised. A malicious 1.107.0 was live on PyPI for about two hours (11:39 to 13:23 UTC), and the Docker tags v1.107.0, latest, main-latest and main-stable pointed to a poisoned image from 11:46 to 14:20 UTC. LiteLLM's incident report says the payload steals cloud, SSH, AI-tool and proxy keys on every Python start; the artifacts are pulled, OSS users should pin 1.106.2 and rotate secrets, and the private enterprise registry was not affected.

LiteLLM 1.107.0 hit by a supply-chain compromise: PyPI wheels and Docker images shipped a credential stealer and backdoor; LiteLLM says it is contained and advises pinning 1.106.2

Key Takeaways

  • Scope (vendor figures): all 7 PyPI wheels of litellm==1.107.0, live 11:39:51 to 13:23 UTC; 4 Docker Hub and GHCR tags poisoned from 11:46:56 UTC
  • Attack chain: the attacker held 3 sets of developer GitHub CLI credentials, one belonging to an org owner, used it to disable branch protection and force-push, then had the release workflow build and sign from the lookalike repo Berri-AI/litellm
  • Payload: cook.pth, cook.py and sitecustomize.py run on any Python start and survive uninstalling litellm; a second loader fetches remote code hourly
  • Fix: delete the 3 files and matching .pyc first, then pin litellm==1.106.2 or rebuild from scratch, and rotate every provider key in the proxy DB, the master key and the database password
  • This is LiteLLM's second supply-chain incident of 2026 (versions 1.82.7/1.82.8 in March); the GitHub source tag v1.107.0 itself is clean
Read full story
A
Anthropicgithub.com·
👀68
🔥82

Claude Code 2.1.304 adds guided /auto-mode-setup and warns Pro/Max users before resuming an inactive conversation would eat into the 5-hour usage limit

Claude Code v2.1.304 (Oct 19 UTC) adds /auto-mode-setup, a guided setup that reads your project and recent sessions to teach auto mode about your environment, now also on Bedrock, Vertex, Foundry, Claude apps gateway and telemetry-disabled sessions. It adds a read-only /claude-api managed-agents-secure check against Anthropic's security guide, warns Pro/Max users when resuming an inactive conversation would use a noticeable share of the 5-hour limit, and fixes 40+ issues including claude --worktree deleting a worktree and branch without asking, which could lose commits.

Key Takeaways

  • New /auto-mode-setup reads your project and recent sessions to teach auto mode your environment, now on Bedrock, Vertex, Foundry, Claude apps gateway and telemetry-disabled sessions
  • New read-only /claude-api managed-agents-secure compares a Managed Agents agent's settings with Anthropic's published security guide
  • Pro/Max plans get a warning when resuming an inactive conversation would use a noticeable share of the 5-hour usage limit
  • Mods gain decider: "person" and e.isReadOnly in tool.check, so only a human permission dialog can approve certain calls
  • 40+ fixes, incl. claude --worktree removing the worktree and branch without asking (could lose commits) and CLAUDE_CODE_AUTO_COMPACT_WINDOW=200k silently becoming 100K
Read full story

Inception launches Mercury 3 diffusion LLM: 1,068 tokens/s and 1M context, beating GPT-6 Luna and Haiku 5.5 on several benchmarks per the vendor

On October 19 Inception released Mercury 3, which it calls the most capable diffusion LLM (dLLM) to date. Per the vendor, it is more than 40x the size of Mercury 1, outputs 1,068 tokens/s, expands context from 260K (Mercury 2.5) to 1M tokens, and beats GPT-6 Luna and Claude Haiku 5.5 (both medium) on GPQA Diamond, IFBench, SWE-Bench Atlas and more. List price is $0.20/M input and $0.70/M output, 50% off at launch. It is live on the Inception API, OpenRouter, Baseten and Vercel AI Gateway with an OpenAI-compatible API. All scores are vendor-reported and not yet independently reproduced.

Inception launches Mercury 3 diffusion LLM: 1,068 tokens/s and 1M context, beating GPT-6 Luna and Haiku 5.5 on several benchmarks per the vendor

Key Takeaways

  • Speed: 1,068 tokens/s output; the vendor table lists GPT-6 Luna at ~130 and Haiku 5.5 at ~240 (vendor figures).
  • Scores: GPQA Diamond 89.23, IFBench 76.84, SWE-Bench Atlas 51.08, all above Luna and Haiku 5.5; but DeepSWE v1 at 46.31 trails Haiku 5.5 (51.62), and MRCR v2 also trails Haiku.
  • Scale and context: more than 40x the parameters of Mercury 1, with a 1M-token window (260K on Mercury 2.5).
  • Price: $0.20/M in and $0.70/M out list, 50% off at launch ($0.10/$0.35), cached input 90% off; new API keys get 100M free tokens.
  • Access: Inception API, OpenRouter, Baseten and Vercel AI Gateway, OpenAI-compatible as a drop-in replacement.
Read full story
ADSponsored

Perplexity Releases Open-Weight Multimodal Decision Models pplx-decider-v1.2 (27B) and Flash (4B) on OpenRouter and Vercel AI Gateway

Perplexity Developers (@perplexitydevs) announced the launch of pplx-decider-v1.2 (27B) and pplx-decider-flash-v1.2 (4B) across OpenRouter and Vercel AI Gateway. Taking both text and images as input, these open-weight multimodal decision models return typed answers with calibrated probabilities at just $0.02 per million input tokens for the 27B checkpoint and half the cost for the 4B Flash variant.

Perplexity Releases Open-Weight Multimodal Decision Models pplx-decider-v1.2 (27B) and Flash (4B) on OpenRouter and Vercel AI Gateway

Key Takeaways

  • Dual open-weight multimodal decision models: launches 27B pplx-decider-v1.2 and 4B pplx-decider-flash-v1.2 taking text or images and returning typed answers with probabilities
  • Ultra-low $0.02/1M token pricing: 27B checkpoint costs $0.02 per million input tokens, while 4B Flash runs faster at half the price
  • Live on OpenRouter and Vercel AI Gateway: provides drop-in rolling aliases for low-latency agent routing and multimodal classification
Read full story
Linked Models & Agents:

Liquid AI releases d1-ultra decision model: calibrated probabilities with zero generated tokens, #1 on Artificial Analysis Decision Index (65), $0.042 per M input tokens

Liquid AI released d1-ultra on Oct 15: a multimodal decision model that takes text and images and, in one forward pass, returns probabilities for yes/no, choice and score questions without generating tokens; billed on input only. Artificial Analysis ranks it #1 on Decision Index v1.0 at 65, at least 8 points ahead, with an 85% non-hallucination rate. Available on the Liquid API, Vercel AI Gateway and OpenRouter.

Liquid AI releases d1-ultra decision model: calibrated probabilities with zero generated tokens, #1 on Artificial Analysis Decision Index (65), $0.042 per M input tokens

Key Takeaways

  • Artificial Analysis Decision Index v1.0: 65, ranked #1 and at least 8 points ahead (independent)
  • AA-Omniscience-Decision non-hallucination 85% vs 40% for runner-up Microsoft-Decision-1; more abstention drops accuracy to 32% vs d1's 41%
  • $0.042 per M input tokens, output free; a 1024x1024 image counts as 1,536 tokens
  • 32,768-token context, 44 languages, leads all eight categories of Liquid's 112-eval suite (vendor)
  • Call via Liquid /decisions/v1/systemone with model d1-ultra, or liquid/d1-ultra on Vercel AI Gateway / OpenRouter
Read full story
Linked Models & Agents:

Hermes Agent v0.22.0: keyless guided onboarding, one-click local llama.cpp models, Gmail/Linear/Notion connectors and a 600-plugin catalog

Nous Research shipped Hermes Agent v0.22.0, "The Threshold Release", on Oct 14 (UTC). Fresh desktop installs open a guided setup chat on a free trial model (nous/welcome) with no API key, connectors reach Gmail, Linear and Notion through the Nous tool gateway, a one-click llama.cpp runtime runs local models, installs now follow tested SemVer stable releases, and desktop builds are signed (including the Microsoft Store). The source tree shrank from about 1.06M to 698K lines (−34%).

Hermes Agent v0.22.0: keyless guided onboarding, one-click local llama.cpp models, Gmail/Linear/Notion connectors and a 600-plugin catalog

Key Takeaways

  • Scale since v0.21.0: ~24,200 commits, ~6,080 merged PRs, ~7,180 issues closed, ~2,520 contributors, about 2.5x the v0.21.0 cycle
  • Leaner: source went from ~1.06M to 698K lines (−34%); gateway/run.py from 34,847 to 5,512 lines; ~19 rarely used tools now load on demand, roughly halving the desktop tool schema, and ~2.1k tokens came off the fixed prompt
  • Local models: installs llama.cpp b11370 for CPU/CUDA/Metal/Vulkan/ROCm, recommends only models that fit fully in GPU memory; catalog includes Qwen3.8 27B, Qwen3.6 35B-A3B, DeepSeek V4 Flash and any Hugging Face GGUF
  • 600-plugin catalog, each pinned to a reviewed commit; memory providers (Honcho, Mem0, Supermemory and others) moved out of core
  • Faster updates that rebuild only what changed: 16.5 s vs 32.5 s on macOS (vendor figure)
Read full story

Physical Intelligence opens the Pi API beta: upload robot data, fine-tune π models on managed compute, and run hosted inference

On Oct 13 Physical Intelligence opened a beta of the Pi API: teams upload robot demonstrations, fine-tune Pi's latest robot foundation model on Pi-managed compute, and serve the result to their robots through a hosted inference gateway. Showcased deployments range from an operator-less wheel loader to strawberry harvesting and server assembly; early-access customer Almond got a deburring policy for its Axol dual-arm robot after four days of iteration. Access is by application and pricing/API parameters are not published; self-hosters can still use the Apache-2.0 openpi repo (π0/π0.5 base checkpoints).

Physical Intelligence opens the Pi API beta: upload robot data, fine-tune π models on managed compute, and run hosted inference

Key Takeaways

  • Three-step loop: upload data → fine-tune a π model on Pi-managed compute → run it on your robot via hosted inference, using eval data to plan the next collection round
  • Early-access customer Almond iterated with the API for 4 days to get a policy that lets its Axol dual-arm robot deburr its own assembly parts
  • ~20 named partners/early users (Actor, Chef Robotics, Formic, Ultra, etc.) across Japan, Switzerland and the US; most ran cloud-hosted inference, and Pi flags network connectivity as a known issue
  • Self-host alternative: openpi (Apache-2.0, ~14k stars) ships π0 / π0-FAST / π0.5 base checkpoints pre-trained on 10k+ hours of robot data; inference needs >8 GB VRAM, LoRA fine-tuning >22.5 GB, full fine-tuning >70 GB
  • Beta access is by application; pricing, endpoints and parameters are not published
Read full story
Linked Models & Agents:
⚡ π0⚡ π0-FAST⚡ π0.5🌐 Physical Intelligence

ScaleDown ships Constrained Decoding Models: 1M-token task models for summarize, compress, extract and classify, with LangChain Deep Agents middleware

On Oct 13 ScaleDown launched Constrained Decoding Models (CDMs): each model is trained for a single task and only returns answers that task allows (a label or spans of the input) instead of free-form token-by-token generation. LangChain shipped a langchain-scaledown integration and LangSmith LLM Gateway support the same day, with middleware for history summarization, tool-result compression and structured extraction. ScaleDown claims 200x faster and 467x cheaper than frontier models on these narrow tasks; Extract and Summarize are on OpenRouter at $0.04 per million input tokens.

ScaleDown ships Constrained Decoding Models: 1M-token task models for summarize, compress, extract and classify, with LangChain Deep Agents middleware

Key Takeaways

  • Four single-task models (Summarize, Compress, Extract, Classify), each taking up to 1M input tokens; Extract, Summarize and Classify accept images and scanned PDFs
  • Vendor-reported: vs the average of GPT-5.5, GPT-5.4 Mini and GPT-5.4 Nano, Summarize is 41x cheaper and 2.7x faster, Compress 138x cheaper and 1.8x faster, both with higher accuracy
  • Classify vs Jev: Jev is text-only with 32K tokens of state per question; Classify takes 1M tokens plus images and adds a one-sentence reason per decision
  • LangChain's trace example compresses a docs page from 18,402 to 3,110 characters; if a ScaleDown call fails the middleware leaves history untouched and the agent keeps running
  • On OpenRouter, Extract and Summarize cost $0.04/M input tokens with 1M context; Summarize caps output at 4,000 tokens and neither supports tools or response_format
Read full story
Linked Models & Agents:
⚡ ScaleDown Classify-1⚡ ScaleDown Extract⚡ ScaleDown Summarize⚡ ScaleDown Compress🤖 LangChain Deep Agents🌐 ScaleDown🌐 LangChain🌐 OpenRouter