AI Coding Live News

On Nov 2, semiconductor and AI research firm SemiAnalysis released GDPx, a benchmark of agentic capability across 11 domains: chip design, cybersecurity, biology, finance, legal, quant trading, recursive self-improvement (RSI), hardware design, materials science, alignment and software engineering. Its 206 tasks were built by 14 specialist data partners, with SemiAnalysis doing final QA. On the official leaderboard Claude Opus 5.5 leads at 12.0%, followed by Gemini 4 Carbon at 10.9% and GPT-6 Astra at 9.6%; nearly every model scores 0 on finance and legal. SemiAnalysis says safety classifiers drag down Opus 5.5 and GPT-6 Astra, and plans a new version every 3–6 months. All scores are as reported by SemiAnalysis.

Zoom

Security firm Parameter published an exploit chain in which an attacker publishes a malicious conversation through ChatGPT's normal sharing feature; when a signed-in victim opens the /share/ link, the payload runs as chatgpt.com in their session, lists conversations, reads a private chat that was never shared, and sends data out. Parameter reported it through OpenAI's bug bounty on October 18; OpenAI raised it from P2 to P1, fixed it on October 26 and paid a $5,000 bounty. Parameter reports no real-world use, and users do not need to do anything.

Zoom

Cloud security firm Wiz published research on October 30 saying at least nine AI developer platforms disclosed incidents this month: Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode and Northflank. Attackers hunted stored environment variables, especially keys for paid AI models; Wiz traced two stolen enterprise keys to roughly 800,000 and 1.7 million Amazon Bedrock calls, which it estimates likely ran over $100k at list price in those two cases alone.

Zoom

Microsoft Research, Microsoft Security and UC Berkeley open-sourced TokenEconomizer on GitHub (Apache 2.0, v0.1.0 released October 26), a plugin for Claude Code, Codex, GitHub Copilot CLI and Pi, with experimental opencode support. It learns from earlier sessions in the same repository: micro-skills remember repo facts, tool pruning drops tool definitions that go unused, and a loop guard nudges an agent that is stuck. The paper reports 18.4–30.9% lower mean cost across five agent and model combinations on 277 SWE-Bench tasks (paper figures).

Zoom

Epoch AI reported on Oct 29 that, in a deliberately basic setup emulating an unsophisticated attacker, Z.ai's open-weight GLM 5.3 read security fixes that were public but not yet shipped and autonomously built exploit chains for all six Firefox releases from Sep 17 to Oct 26, letting a single webpage visit read local files. Marginal cost was about $1,000 per version and the fastest run took 12 hours. Mozilla patched a previously undisclosed bug the model also used in Firefox 159.0 on Oct 27.

Zoom

Cognition, the company behind Devin, announced on Oct 29 via its official @cognition account that it is acquiring Corridor. In a post on Cognition's official blog dated 2026.10.28, Corridor co-founders Jack Cable and Ashwin Ramaswami said the team is joining Cognition to take Devin Security to the next level. Corridor, founded almost two years ago, positions itself as the security layer for AI-native teams. Deal terms were not disclosed.

Zoom

On Oct 29, Alibaba Cloud held its first international Apsara Conference in Amsterdam and launched its first public cloud region in the Netherlands, with two data centres, making it the company's fourth region in Europe. It plans to bring agentic AI services to the region, including ACS Agent Sandbox, Agent Security Center, AI Security Guardrails 2.0, Agentic SOC and STAROps, and unveiled a new generation of its Apsara Stack hybrid cloud. On the partner side, JetBrains is working with Alibaba Cloud to explore Qwen models for its Junie coding assistant, in both cloud and local setups.

Zoom

On Oct 28, GitLab CEO Bill Staples announced in a blog post and on X that new and existing customers can request free credits to run a security sprint with Claude Mythos alongside GitLab Orbit, Secrets Manager and Duo Agent Platform. The core capability is the Business Logic Security Analyzer, the first GitLab feature to support Anthropic's Claude Mythos 5.1. It reads the whole repository, infers what each endpoint should enforce, and flags authorization and mass-assignment flaws that pattern-based SAST misses. The analyzer has been in early access for a small group of GitLab.com Ultimate customers since Oct 20.

Zoom

Google DeepMind announced Gemini 4 Carbon on Oct 28, calling it its strongest model, just two weeks after Gemini 4 Argon. The official blog says it ranks first on v5.0 of the Artificial Analysis Intelligence Index at 59 and leads three cybersecurity evaluations: 88.2% on SEC-bench Pro for finding vulnerabilities, 54.8% on ExploitGym for exploitation and 71.0% on CWE-bench for patching; it also gains 89 points to rank fourth on WebDev Arena at 1769. Access starts this week for a subset of cyber defenders in the Fairwind program, with developers, businesses and consumers to follow. Introductory pricing matches Argon at $2 per million input tokens and $10 per million output tokens, rising to $4 and $20 afterwards.

Zoom

Cognition, the maker of Devin, released FrontierCode 2.0 on Oct 27. It keeps the method of maintainer-written tasks graded on whether the code is actually mergeable, but draws tasks from more repositories, adds security patches and performance work, uses deliberately underspecified prompts and adds many thoroughness criteria. In Cognition's results Claude Opus 5.5 leads at 45.5%, GPT-6 Astra follows at 42.8%, and Grok 4.7 and Gemini 4 Argon drop into the 20s, leaving the benchmark far from saturated.

Zoom

In an Oct 26 post on Replit's blog, "The Rise of the Self-Driving Company," CEO Amjad Masad introduced Replit for Business. Its central idea is an Agent Habitat: a company-controlled environment where agents use the company's knowledge and systems and coordinate with people and other agents, while the company decides what they can access, when human approval is required, and how far mistakes can spread. The enterprise page lists SSO, SCIM, role-based access, bring-your-own-cloud, audit logs, isolated execution, security scanning, model controls and 510+ connectors. Masad says Replit engineers nearly tripled code output in the first half of 2026 while review times, reversions and incidents stayed flat (vendor figures).

Zoom