AI Coding Live News

On October 30, Microsoft's Mage team released Mage-VL-Cowork on Hugging Face under Apache-2.0: a 4B multimodal computer-use agent in which a single model decides at every step whether to act through screenshots and GUI clicks (computer_use) or through bash and Python in a terminal, with no external orchestrator. Microsoft reports a two-run average of 66.0% on OSWorld-Verified (361 tasks, 50-step budget), above Qwen3.6-27B at 63.9% but below the 9B SCALECUA-Qwen3.5-9B at 68.7%.

Zoom

Katelyn Lesse, Anthropic's head of platform engineering, said on the Latent Space podcast (published Oct 27) that a Rust version of the Messages API fully rolled out the previous week. The old system was a CPU-hungry Python monolith, the team started with "not a single Rust developer", humans designed and verified the system, Claude wrote the implementation, and shadow traffic compared outputs between the old and new versions. Her ballpark figures are roughly 40-50% less CPU and 10-20% better time to first token. A clip posted by Somi (@somi_ai) drew 1,000+ likes and about 140K views on X and was quoted by swyx and others, with the debate centered on whether "never do the big rewrite" is now outdated advice. These are X discussion views and spoken estimates; Anthropic has not published a written engineering report.

Zoom

Moonshot AI's official Kimi account announced 3D Make at 03:14 UTC on Oct 30, saying Kimi connects to tools such as Blender and CAD software to create models, assemble scenes and develop games, available now on kimi.ai and Kimi Work. The companion 3D guide says K3.1 Pro was specifically trained to drive 3D software through Python scripts, so specialized tools without MCP support can join the workflow, while meshes such as people and animals are handed to diffusion services like Tripo. Plugins that need locally installed software work only in Kimi Work.

Zoom

On Oct 28 xAI announced on the official @grok account that all API customers can now add a guidelines array to text requests and set the nsfw, violence and profanity categories to decline, so Grok tightens that content while it writes rather than through after-the-fact filtering. The field works on the Responses API, Chat Completions and the xAI Python SDK; multi-agent models and deferred completions are not supported, and invalid values are rejected with 400 or 422 before the model runs.

Zoom

On October 21 the release pipeline of the popular LLM gateway LiteLLM was compromised. A malicious 1.107.0 was live on PyPI for about two hours (11:39 to 13:23 UTC), and the Docker tags v1.107.0, latest, main-latest and main-stable pointed to a poisoned image from 11:46 to 14:20 UTC. LiteLLM's incident report says the payload steals cloud, SSH, AI-tool and proxy keys on every Python start; the artifacts are pulled, OSS users should pin 1.106.2 and rotate secrets, and the private enterprise registry was not affected.

Zoom

Researchers introduced BlenderWorld (arXiv:2610.23986), the first comprehensive benchmark evaluating visual agents creating and editing 3D models from real-world references in Blender. Spanning 223 tasks across procedural geometry, Python scripting, material shaders, spatial layouts, and lighting, GPT-6 Astra leads the benchmark with a composite Score of 79.9 (and a 42.2% Perfect completion rate), followed by Opus-5 at 73.0. Open-weight flagship DeepSeek-V4.1-Flash claims 65.7, matching proprietary models while relying on active execution-and-inspection tool loops.

Zoom

On October 19 OpenAI said its latest models are much better at low-resource languages such as COBOL, Fortran, Visual Basic and OCaml, and open-sourced MultiLangBench, which asks a model to build a SQLite-compatible database engine from scratch in each of 20 languages. GPT-6 Astra averages an 87.4% test pass rate (GPT-5.6 Sol: 26.8%), above 83% in 19 of 20 languages, with COBOL hardest at 72.1%. On a separate COBOL migration eval requiring byte-for-byte output parity after porting to C++, Java, Kotlin, Python or Rust, GPT-6.1 Sol scores 86.6% at low effort (GPT-5.6 Sol: 5.4%) and 97.9% at higher effort. All figures are OpenAI's own.

Zoom

The vLLM team announced two major milestones: shipping precompiled Python bytecode via uv in v0.32.0 release images cuts cold-start container launch by 14–18% (~18s on NVIDIA H100) with zero runtime recompiles. Additionally, vLLM integrated the Decision 3.0 (D3) structured reasoning family (0.6B to 27B) into the /v1/systemone endpoint, ranking #1 on the Jev Decision Index and delivering 1.8x req/s on a single AMD MI325X under 64 concurrent clients.

Zoom

vLLM shipped v0.32.0 on Oct 18 with 814 commits from 363 contributors (121 new). Highlights: a default-served POST /v1/systemone structured-decision endpoint and a generic hf tool/reasoning parser; NVFP4 KV cache on SM8x/SM90/SM12x and FP8 KV by default for GLM-5.x on SM100; Model Runner V2 gains a GPU n-gram speculator and Elastic EP and becomes the ROCm default; three security advisories are fixed, default CORS is restricted, and Python 3.10 is dropped.

Zoom

On Oct 16 Tencent Hunyuan open-sourced Hy Memory 2.0 in three layers: the Apache-2.0 memory-writer model Hy-Memory-30B-A3B (~3B active, HF weights plus arXiv report), a Python SDK covering Chat, Working and Coding scenes (PyPI hy-memory 2.0.x), and local-first MemHub (CLI + macOS, preview). Per Tencent, swapping it in as the writer across Mem0, MemOS, Hy-Memory and held-out EverMemOS yields a 55.49 average vs 54.62 for Claude Opus 5, measured on fixed 20% subsamples; it still trails Opus 5 on several individual metrics.

Zoom

While AI coding agents and 'vibe coding' workflows synthesize an unprecedented volume of production software, code security remains highly fragile. Researchers from NUS and Monash University introduced the Last Secure Code Benchmark, evaluating 450 tasks derived from 150 real CVE vulnerabilities across 7 languages (Java, C, C++, JS, Python, PHP, Go) and 24 CWE categories (including 21 of the 2025 CWE Top 25 and 8 of the Top 10 KEVs). While frontier agents achieve 73.6% to 91.3% functional completion rates, even the strongest model (Claude Fable 5) produces code that is both functional and secure on only 25.1% of tasks, exposing acute supply-chain risks in autonomous vibe coding.

Zoom