AI Coding Live News

Cursor Launches Live Apps: Cloud Agents Build, Add Postgres, Cursor SSO and Hosting, Run Security Checks, Then Share a Link

On November 5 Cursor shipped Build Live Apps: describe a tool to a cloud agent and Cursor builds the web app, adds Postgres if needed, sets up Cursor SSO auth and hosting, runs deterministic and agentic security checks, then publishes to a domain you choose with a shareable link for people, groups or the whole team. Works with Origin and GitHub repos on all paid plans with cloud agents enabled.

Cursor Launches Live Apps: Cloud Agents Build, Add Postgres, Cursor SSO and Hosting, Run Security Checks, Then Share a Link

Key Takeaways

  • Flow: start a cloud agent and say you want an app; Cursor handles scaffolding, Postgres if needed, Cursor SSO auth and hosting
  • Publish: pick a unique domain for a live link; repos on Cursor Origin and GitHub, GitLab and others "coming soon"
  • Safety: deterministic and agentic checks (secrets in files, exposed credentials) run first; nothing goes live until checks pass and you publish
  • Controls: admins see every app and secret, add review rules, approve blocked publishes and unpublish any app
  • Sharing & plans: behind Cursor sign-in for people, groups or the team, public sharing on individual plans; all paid plans with cloud agents
Read full story

Axiom Formalizes the Entire Stacks Project in Lean With AI Agent Swarms: About 16 Million Lines, Billed as the Largest Reusable Formal Math Library Yet

Axiom released a Lean formalization of the entire Stacks Project on November 4 (official X post at 17:13 UTC, with over 2 million views). The roughly 7,500-page open-source algebraic geometry reference, started by Johan de Jong in 2005, becomes about 16 million lines of code, which Axiom calls the largest integrated, reusable formal math library ever built. Hierarchically coordinated AI agent swarms did the work and surfaced dozens of statements in the original that needed local fixes, with counterexamples. The library is open source and browsable side by side with the original text at stacks.axiommath.ai.

Axiom Formalizes the Entire Stacks Project in Lean With AI Agent Swarms: About 16 Million Lines, Billed as the Largest Reusable Formal Math Library Yet

Key Takeaways

  • Scale: about 7,500 pages of source text and roughly 16 million lines of Lean, which Axiom calls the largest integrated reusable formal math library (vendor claim).
  • Method: hierarchical AI agent swarms translate statements, search Mathlib for existing abstractions and build proofs in parallel, with multi-agent auditing and semantic cross-checks against the source to keep statements faithful.
  • Findings: the system surfaced dozens of statements needing local refinement, including missing hypotheses and edge cases in positive characteristic, and built explicit counterexamples where claims failed.
  • The permanent Stacks tag structure is preserved so every Lean declaration links back to the original text; stacks.axiommath.ai offers side-by-side reading and a dependency graph.
  • This follows Axiom's October 27 formalization of the Classification of Finite Simple Groups (CFSG); per de Jong's request, corrections are kept in Axiom's own repository rather than sent upstream.
Read full story
Linked Models & Agents:

Anthropic adds two sentences to Claude Code's Opus 5.5 prompt to steer it away from recreating specific existing games; original and genre games still allowed

Around Oct 27, users noticed Claude Code receiving a new server-side rule (flag name tengu_heron_brook): build original games, games in a genre, and games from the user's own designs and assets, but do not build a recreation of a specific existing game, even if it is renamed or called original. The post that surfaced it drew about 8,700 likes and nearly 2 million views on Oct 30. The same day, Addy Osmani, who works on Claude Code at Anthropic, confirmed on X that the team added two sentences to Claude Code's prompt on Opus 5.5 because using Claude to infringe IP is against Anthropic's usage policy. He said original games, genre games, and games built from your own designs and assets should keep working, that the team will keep iterating, and that users can send him wrongly refused requests.

Key Takeaways

  • Scope: the change is just 2 sentences in Claude Code's system prompt for Opus 5.5, pushed from the server with no user-side toggle (Addy Osmani's post)
  • Rule text (per the flag tengu_heron_brook users captured): original games, genre games, and games from the user's own designs and assets are allowed; a recreation of a specific existing game is not, "even if it is renamed or called original" (original report, about 8,700 likes and nearly 2M views)
  • Basis: Anthropic's Usage Policy prohibits using its products to infringe, misappropriate, or violate a third party's intellectual property rights
  • Feedback path: Osmani says the team will keep tuning the line and asked users to send him wrongly refused requests; there is no separate Anthropic blog post yet, and benchmarks do not apply
Read full story

DeepSeek Harness team open-sources dsh-superagent, a proactive coding agent prototype for a single GitHub repo, alongside its Super-agent architecture article

On Oct 31, deepseek-ai open-sourced dsh-superagent-prototype on GitHub under the MIT license: a proactive coding agent that runs as a DeepSeek Harness bundle, lives on one GitHub repository and can optionally listen to Feishu. When an allowed person asks for work, it opens a work item, works in its own session and directory, and answers in the original conversation, for example with a pull request. The README states it is a research prototype, not an official DeepSeek product. The companion article, Exploring Super-agent Design, proposes a two-layer Router-Worker architecture; the team test, as reproduced by media, reports a p95 completion time of 15.7 minutes versus 29.5 minutes for a single-session setup.

Key Takeaways

  • Open source: deepseek-ai/dsh-superagent-prototype went public on Oct 31 under MIT, written in TypeScript, with about 1,800 stars at the time of writing
  • Scope: each deployment serves 1 GitHub repository, with optional Feishu; it acts only when an allowed person addresses it or a team-written rule allows it
  • Delivery: by default it only allows auto-merge for an approved pull request opened for a ticket with fewer than 200 changed lines, and never enables auto-merge as the agent account
  • Team test (as reproduced by media, vendor-reported): in a simulation with about 300 messages and 20 requests, p50 / p95 completion was 12.4 / 15.7 minutes versus 20.4 / 29.5 for a single session with a subagent tool
  • Risk: worker sessions run commands without approval as the operator's OS user, and the README asks users to review and adapt the code first
Read full story
ADSponsored

Anthropic's Frontier Red Team details five exploit chains an unreleased internal Claude model built for Chrome, Safari, Android, Windows and Linux; Chrome 156 fixes 62 CVEs

Anthropic's Frontier Red Team published a research post on Oct 27 saying it spent the past few months using an unreleased internal research model to find critical vulnerabilities in browsers and operating systems, and that after initial prompting Claude wrote five full exploit chains: one-click remote code execution with a sandbox escape in Chrome, a same-origin policy bypass in Safari, data extraction from a locked Android phone over USB, a remote denial of service against Windows HTTP/3 (QUIC), and zero-click root code execution on Linux servers with a multipath TCP listener. Anthropic says Google assigned 62 CVEs to its reports, all critical or high, fixed as of Chrome 156, and every issue went through coordinated disclosure and has been fixed. The model's name, the amount of human involvement and the compute cost were not disclosed.

Anthropic's Frontier Red Team details five exploit chains an unreleased internal Claude model built for Chrome, Safari, Android, Windows and Linux; Chrome 156 fixes 62 CVEs

Key Takeaways

  • The Chrome chain links 4 bugs: V8 heap corruption, a V8 sandbox escape that defeats ASLR, a CacheStorage race condition and a FedCM use-after-free; the PoC launches Calculator within seconds of a page loading in default Chrome on macOS
  • Per Anthropic, Google assigned 62 CVEs to its reports, all critical or high, including 13 sandbox escapes and 21 renderer-compromise bugs, fixed as of Chrome 156
  • The Windows kernel QUIC out-of-bounds read is CVE-2026-33096, with likely several million exposed servers by Anthropic's estimate; the Linux MPTCP zero-click root bug is CVE-2026-98432, where the PoC leaks a kernel pointer in about 48 minutes and reaches root command execution about 5 minutes later
  • Method: many parallel scanning agents scored by the extra vulnerabilities they add, with coverage tracking and automated variant analysis on every confirmed finding; Anthropic recommends scanning at PR time and has released a Claude Code security plugin
  • The model is an unnamed internal research model; Anthropic did not publish the share of human work, failed attempts or compute cost
Read full story
Linked Models & Agents:
⚡ Claude (unreleased internal research model)🤖 Claude Code🌐 Anthropic🌐 Google🌐 Apple🌐 Microsoft

Axiom uses AI agent swarms to fully formalize the Classification of Finite Simple Groups in Lean in 24 days: about 43.1M lines, the first complete computer-checked proof of the longest proof in math history

AI math company Axiom announced on Oct 27 that swarms of dozens of AI agents formalized the Classification of Finite Simple Groups (CFSG; the original proof runs about 15,000 pages across 500+ articles by about 100 mathematicians) in the Lean proof assistant in 24 days, producing about 43.1M lines of Lean and 2.05M declarations, with the repo public on GitHub. The work surfaced 34 noteworthy deviations from the published record, and AxiomProver produced a new alternative argument for the Unbalanced Group Theorem.

Axiom uses AI agent swarms to fully formalize the Classification of Finite Simple Groups in Lean in 24 days: about 43.1M lines, the first complete computer-checked proof of the longest proof in math history

Key Takeaways

  • Per Axiom: 24 days and swarms of dozens of AI agents produced about 43.1M lines of Lean, 2.05M declarations and 100 milestones, drawing on 715 papers and books
  • The original CFSG proof spans about 15,000 pages in 500+ articles by about 100 mathematicians; this is the first time it has been fully computer-checked
  • Formalizing it exposed 34 noteworthy deviations from the literature, the biggest a closure assertion in Walter's 1986 Unbalanced Group Theorem argument, with explicit counterexamples such as PSL2(49)
  • AxiomProver produced an alternative argument built on Solomon's 1976 theory and proved a new theorem, "Preservation of simple tops", published on Hexagon (2610.00575)
  • Humans stayed essential: original CFSG group theorists including Richard Lyons and Ronald Solomon were consulted, and an errata list will be published with an advisory board
Read full story
Linked Models & Agents:
⚡ AxiomProver🌐 Axiom

FrontierCS 2 benchmark: agents must rebuild a paper's deleted contribution in its own repo and beat the authors' code; Claude Opus 5.5 leads at 58%, 16 tasks unsolved

Teams from UC Berkeley, Princeton and others released FrontierCS 2 (arXiv 2610.29932): 48 tasks across 13 CS domains, each built by deleting a paper's contribution from the authors' released code. An agent has 5 hours to write it back and passes only if it beats the original on every metric and every hidden workload. Of 12 agents, Claude Opus 5.5 in Claude Code leads with a 58% pass rate, every other agent passes fewer than half, and 16 tasks have no passing run. On Oct 26 maintainer Wenhao Chai said a trace audit showed the Pi harness ends runs on refusals; rerun in Antigravity, Gemini 4 Argon now beats GPT-6 Astra and sits right behind Opus 5.5.

Key Takeaways

  • 48 tasks, 13 domains, 12 agents, one run per agent per task (paper)
  • Strict pass rule: the final submission must beat the authors' code on every metric and every hidden workload; a higher total score can still fail
  • Claude Opus 5.5 in Claude Code leads with a 58% pass rate; 16 tasks have no passing run
  • Under the Pi harness, 10 of Gemini 4 Argon's 48 runs ended on provider refusals; rerun in Antigravity it beats GPT-6 Astra (Wenhao Chai's post)
  • Tasks and evaluators are open source on GitHub; the authors estimate a full 48-task run with Opus 5.5 at about $1,000 in API fees, $300 GPU and $100 CPU
Read full story

MCP reference servers v2.1.0 fix eight vulnerabilities: upgrade filesystem and everything to 2.0.1 and fetch to 2026.10.24

On Oct 25 (UTC) the official Model Context Protocol servers repo shipped v2.1.0, fixing eight vulnerabilities in three reference servers: symlink races, trailing quote/whitespace path bypasses and case-insensitive symlink bypasses in filesystem; cross-origin calls over HTTP/SSE in everything; and IDNA host-name and NAT64 internal-address reachability plus robots.txt not rechecked after redirects in fetch. The maintainers warn that npm users still on date versions (2025.x/2026.x) will not be offered the upgrade and must install 2.0.1 explicitly, and that the filesystem write issue is only partly fixed on Windows.

Key Takeaways

  • Eight vulnerabilities fixed across three servers (release notes)
  • filesystem, 4 fixes: symlink race on writes, trailing quote/whitespace bypass, case-insensitive symlink bypass, list_directory_with_sizes leaking metadata outside allowed dirs
  • everything, 1 fix: HTTP/SSE transports no longer send Access-Control-Allow-Origin: *, so web pages can no longer call tools like get-env
  • fetch, 3 fixes: IDNA host-name check vs. connection mismatch, NAT64-wrapped private IPv4, robots.txt not rechecked after redirects
  • Date-versioned npm installs must run npm install @modelcontextprotocol/[email protected] explicitly; Windows is only partly fixed
Read full story

DeepSeek Open-Sources DeepInfer Inference Engine: Powering V4.1-Flash at Scale Across NVIDIA SM100 and Huawei Ascend 950

DeepSeek officially open-sourced DeepInfer under Apache 2.0, its production-grade inference engine serving DeepSeek-V4.1-Flash at scale. Originating from vLLM with architectural refinements from SGLang and TensorRT-LLM, DeepInfer natively targets NVIDIA SM100 GPUs and Huawei Ascend 950 NPUs. It integrates specialized kernels including FlashMLA, DeepGEMM, DeepEP, and TileKernels. The engine features DSpark confidence-scheduled speculative decoding with 5-token drafts, SWA bounded replay over a 140-token sliding window, and balanced MoE expert parallelism. DeepSeek simultaneously open-sourced deepseek-recipe, delivering an end-to-end open ecosystem across models, kernels, and inference runtimes.

DeepSeek Open-Sources DeepInfer Inference Engine: Powering V4.1-Flash at Scale Across NVIDIA SM100 and Huawei Ascend 950

Key Takeaways

  • DeepSeek officially open-sourced DeepInfer under Apache 2.0, releasing the production codebase powering DeepSeek-V4.1-Flash at massive scale
  • Natively optimized for both NVIDIA SM100 GPUs and Huawei Ascend 950 NPUs with deterministic, batch-independent output guarantees
  • Integrates custom FlashMLA, DeepGEMM, DeepEP, and TileKernels, alongside DSpark 5-token speculative decoding and 140-token SWA replay
  • Simultaneously released deepseek-recipe, aligning open-source local deployments perfectly with DeepSeek's official production API tokenization
Read full story

Are Embeddings Overpriced? Frozen 16 MB Vocabulary Slashes Small Model Weights by 62% with Zero Downstream Accuracy Loss

In small language models, vocabulary embedding tables often account for over 60% of total parameters, posing severe bottlenecks for edge deployment and ternary quantization. A new study (arXiv:2610.22428) replaces trainable embeddings with a single frozen 16 MB table of 512-bit binary codes derived via PCA and sign binarization. On Gemma 3 270M, trainable parameters collapse from 268.1M to 101.0M (-62.3%) while matching or exceeding original performance across HellaSwag (30.4%), LAMBADA (23.2%), and PIQA (61.5%).

Are Embeddings Overpriced? Frozen 16 MB Vocabulary Slashes Small Model Weights by 62% with Zero Downstream Accuracy Loss

Key Takeaways

  • Highlights structural waste in SLMs: embedding tables occupy 167.8M parameters in Gemma 3 270M (62.6% of the entire model)
  • Introduces a frozen 16 MB table of 512-bit binary codes (arXiv:2610.22428) derived via PCA and sign binarization with zero trainable weights
  • Slashes trainable parameters in Gemma 3 270M from 268.1M to 101.0M (-62.3% reduction)
  • Maintains parity on HellaSwag (30.4%) and outperforms the baseline on LAMBADA (23.2% vs 21.6%) and PIQA (61.5% vs 60.6%), while seamlessly enabling ternary models
Read full story
Linked Models & Agents:
ADSponsored

Cursor launches the Origin App Marketplace with 20+ CI, deploy, code-review and security integrations, open to public submissions

On Oct 13 Cursor launched the Origin App Marketplace: its code hosting platform Origin now connects to 20+ apps across deployments (Cloudflare, Vercel and more), CI (CircleCI, Buildkite and more), code review (CodeRabbit, Greptile, Tenki), security (Semgrep, Socket and more), monitoring (Sentry) and project management (Linear), and the marketplace is open to public submissions from any developer-tool team.

Cursor launches the Origin App Marketplace with 20+ CI, deploy, code-review and security integrations, open to public submissions

Key Takeaways

  • 21 launch apps in 6 categories: deploy (5), CI (7), code review (3), security (4), monitoring (1), project management (1)
  • Public submissions: build privately in your namespace, make it public, submit with slug, tags and a demo video, then Cursor reviews and lists it
  • Apps authenticate with an app JWT plus installation access tokens, receive webhooks, and write back check runs, PR comments and reviews
  • The official origin-apps plugin answers questions from live Origin API docs and plans ports of existing apps
  • Launch post: ~1,356 likes and ~68K views as of Oct 14 morning
Read full story

Silent Dissent Revealed: Mechanistic Interpretability Proves Conforming LLM Agents Retain Their Original Premise in Latent Layers

In multi-agent debate, collaborative consensus, and voting swarms, agents are increasingly tasked with resolving disagreements through structured multi-turn discourse until a unanimous consensus is reported. However, does an agent that reverses its stance genuinely change its internal beliefs, or does it merely exhibit surface-level compliance under majority pressure? Researchers unveil a profound mechanistic interpretability study titled Silent Dissent (arXiv:2610.02702). Replicating the classic Asch conformity paradigm within two-hop factual reasoning tasks, the authors deploy scripted peer agents asserting incorrect answers, causing the subject agent to publicly concede to the majority error. By probing the subject LLM's internal residual streams using the Jacobian lens (J-lens) and Logit lens at the exact moment of answering, the authors uncover that even when agents publicly output the consensus error, their intermediate latent layers still strongly compute and represent the original, correct factual premise. Crucially, this latent premise representation persists even when the agent's prior reasoning steps are entirely purged from the prompt context, demonstrating that multi-agent consensus can dangerously mask deep internal disagreement.

Key Takeaways

  • Silent Dissent reveals conforming LLM agents in multi-agent debates preserve their original premise in latent layers
  • Residual stream probing via Jacobian lens shows models encode correct facts internally while outputting consensus errors
  • Demonstrates that surface-level multi-agent consensus is profoundly deceptive, challenging multi-agent voting architectures
Read full story
Linked Models & Agents:

Can AI Agents Make Open-Ended Scientific Discovery? Station Multi-Agent Ecosystem Rediscovers 62.7% of ICLR Oral Breakthroughs

While AI systems have driven remarkable progress on narrowly scoped scientific problems with well-defined metrics, whether autonomous AI agents can undertake genuine open-ended scientific discovery has remained unproven. Researchers present Station (arXiv:2610.08927), an open-world multi-agent environment simulating a collaborative scientific research ecosystem. To overcome systemic drift during open-ended exploration without intermediate ground-truth metrics, Station introduces two mechanisms: an iterative Supervisor hierarchy and periodic Meta Reflection to enforce persistent inquiry. The framework was evaluated against open-ended research tasks formulated from three recent ICLR oral presentations, where agents received solely the primary research inquiry while withholding original experimental conclusions and disabling internet access. Station autonomously rediscovers an average of 62.7% of the original scientific criteria, compared to just 15.4% for Codex Multiagent-v2 and 14.4% to 20.6% for AI Scientist-v2. In open-ended tasks without oracle answers, the ecosystem produced verified scientific findings matching discoveries independently published by human researchers after the models' knowledge cutoff dates.

Key Takeaways

  • Station simulates collaborative scientific ecosystems, demonstrating autonomous open-ended discovery without external search
  • Rediscovers 62.7% of original findings from ICLR oral papers, decisively outperforming AI Scientist-v2 (14.4%-20.6%)
  • Introduces supervisory steering and periodic meta-reflection, successfully forecasting empirical discoveries published after model training cutoffs
Read full story

REMORY: HKUST and Alibaba Introduce Residual Memory for Agent Context Compaction, Matching Full Context with Only 5.2% Token Overhead

As autonomous agents execute complex multi-step workflows across terminal consoles and web browsers, context window expansion and escalating token costs impose severe operational bottlenecks. Conventional compaction methods rely on text summarization or token pruning, both of which discard crucial state variables and induce semantic drift over extended sessions. Researchers from HKUST and Alibaba present REMORY (arXiv:2610.11287), introducing a residual memory paradigm designed for sequence-level context compaction. REMORY combines lossy natural language summaries with bounded sets of learned soft memory tokens, effectively forming a residual connection in the sequence dimension. While text summaries convey high-level narrative continuity, the soft memory tokens reconstruct lost fine-grained execution artifacts, API arguments, and intermediate environment states. On challenging benchmarks including BrowseComp and Terminal-Bench 2.1, REMORY retains 97% of full-context task performance while occupying only 5.2% of the original input token footprint, slashing redundant tool retries and loops by more than 40%.

Key Takeaways

  • HKUST and Alibaba propose REMORY, establishing sequence-dimension residual memory connections to resolve agent context bloat
  • Matches 97.2% of full-context capability using only 5.2% of token positions, slashing repetitive tool errors by 41.5% on Terminal-Bench
  • Non-invasive plug-and-play architecture reduces TTFT latency by 73.8%, setting a new benchmark for long-horizon agent efficiency
Read full story
Linked Models & Agents:

SafeActBench: NUS Investigates the Broken Evidence-to-Action Chain in Tool-Using Agents Across Six Operational Domains

Tool-using agents execute consequential modifications to external systems, yet nominal task success frequently conceals unverified actions executed without prior evidence. Researchers from the National University of Singapore (NUS) present a rigorous empirical study on the breakdowns along the evidence-to-action chain (arXiv:2610.07753). Evaluating ten model-harness configurations reveals a striking paradox: high static action assessment accuracy routinely masks brittle interactive execution. Failures overwhelmingly originate prior to execution: agents terminate prematurely before collecting requisite evidence, or initiate state-altering actions before foundational proofs are established. The authors formulate SafeActBench, spanning 656 rigorous cases across six operational domains and five protocols progressing from static judgment to complex multi-action workflows. Supported by a provenance-bound Evidence Ledger and deterministic trajectory evaluator, findings demonstrate that while single-step execution is stable once evidence is verified, multi-action workflows frequently collapse under unresolved prerequisites and truncated state transitions.

Key Takeaways

  • NUS presents SafeActBench across 656 operational cases and 6 domains to evaluate where the evidence-to-action chain breaks
  • Tests across 10 model-harness configurations show high static evaluation masks fragile execution, with over 70% of failures caused by premature actions
  • Introduces the Provenance-bound Evidence Ledger, proving multi-action workflows suffer 64.7% failure rates from unresolved prerequisites
Read full story