AI Coding Live News

Frontier language models generate incorrect conclusions with fluent, authoritative explanations, creating severe safety risks in autonomous systems where knowing when to defer to human review is essential. Traditional uncertainty quantification (UQ) methods rely either on compute-heavy repeated rollouts (e.g., semantic entropy across 10 to 20 samples) or supervised probes prone to confounding output length with true epistemic uncertainty. Researchers from TU Darmstadt and collaborating institutions introduce U-Space (arXiv:2610.09087), a mechanistic interpretability framework that uncovers evolving internal uncertainty within low-dimensional representations. By identifying semantic anchors of doubt and certainty in the unembedding matrix, U-Space constructs an orthogonal basis within the residual stream. The accompanying U-Lens projects intermediate token activations onto this basis, providing an interpretable, token-level uncertainty trajectory alongside an aggregated confidence score. Requiring zero training, zero labels, and zero repeated generations, U-Space outperforms established baselines under standard and length-controlled settings, with code fully open-sourced.

On Oct 8 Anthropic launched the Cyber Mission: (1) free opt-in OSS Scanner for critical open-source projects using strongest models including Claude Mythos, with PoC/explanation/candidate patches and >90% expected true-positive rate, no human triage; (2) Critical Infrastructure Defense Program with 11 founding partners including CrowdStrike, Palo Alto, Dragos, and Rockwell. Project Glasswing has surfaced 29,000+ candidate vulns. Oct 19 update: first scans have reported 77 critical and 803 high model-rated findings to maintainers; curl 8.23.0's high-severity HTTP/2 use-after-free CVE-2026-92392 was found by an early version.

Google's Open Source Software Vulnerability Reward Program stopped accepting product-vulnerability reports on October 1, 2026, citing a significant rise in automated submissions that are mostly invalid. Commit f8bf23ad8 in google/bughunters (Sept 30) replaced the product-vulnerability reward bands ($500–$7,500 for flagship projects, $101–$3,133.7 for important ones) with dashes, while supply-chain compromise rewards stay at up to $31,337. Reports filed before Oct 1 are unaffected, some Google Cloud repos can route via Cloud VRP, and Google promises an update in Q1 2027.

@DanKornas shipped lpm (github.com/gug007/lpm): an MIT native macOS desktop app that keeps project services, terminals, and AI coding agents in one workspace—one-click start/stop with live terminal output, duplicate projects for parallel feature work, profiles for service subsets or one-off test/migrate/deploy actions, and native (no-Docker) service management beside Claude Code, Codex, and other agents.

Amp Code CEO @sqs announced Amp can push and deploy to Vercel projects without a paid seat for the Amp committer—now exempt like Cursor and Claude Code.

Cursor introduced Projects, replacing per-task chats with a coordinator agent in one persistent thread. The agent stays on, proactively manages work with subagents, and can set reminders, run scheduled tasks, follow PRs to fix CI, and watch Slack for bugs. Agents in a project share memory and artifacts such as plans and demos, synced across your device and agent machines. Available in beta and rolling out starting September 10.

@DanKornas introduced Hypernovum, a desktop-only Obsidian plugin that maps project notes into a live 3D city using frontmatter, Git signals, and vault links. From one view you can launch Claude Code, Codex, Antigravity CLI, or a custom command, and inspect branch, commit velocity, dirty trees, stale projects, and merge conflicts. It is open source under AGPL-3.0.

@sunsetsyntax highlighted 8treenet/goraven (v0.5.5), a self-hosted team AI harness where each person gets an isolated workspace and agents can read/write files, run shell, call MCP tools and internal APIs, with shared projects and skill libraries. One Docker command to start; data stays on your box. Apache-2.0 with about 728 GitHub stars at verification.

Replit's weekly update announced Custom Connectors for Agent, allowing connections to APIs outside its integration library. Enterprise customers also get 65+ additional audit-log events across projects, deployments, security, SSO/SCIM, connectors, secrets, and Agent activity, improving both extensibility and governance.

Developer Daniel Hernandez launched open-source CodeBarAI, a macOS menu-bar utility that tracks Claude Code, Codex, and Cursor usage and repository changes, while generating commit messages with Apple's built-in models, opening projects, and starting dev servers. It provides a lightweight control surface for daily coding-agent work.