A single daily edition of announcements from the AI coding tools you use, read from a curated source list, summarised, and linked back to the original. No infinite feed, no account, no advertising.
DeepSeek V4 Flash arrives at $0.14 per million input
DeepSeek released V4-Flash-0731, a 304 billion parameter model weighing 167GB on Hugging Face, priced at $0.14 per million input tokens and $0.27 per million output. Artificial Analysis ranks it ahead of the 428B MiniMax M3 and favourably on intelligence-to-cost, with what the release describes as substantially enhanced agentic capabilities. It is served through OpenRouter and reachable from the llm CLI as openrouter/deepseek/deepseek-v4-flash-0731.
A malicious MCP server can strip a machine in 90 seconds
Morphisec Threat Research demonstrated a supply-chain chain through npm package drp-compliance-sdk, posing as a SOX compliance verification tool. The payload fires during the MCP handshake, before any user interaction. It spawns a living-off-the-land chain of signed Microsoft binaries, node.exe to wscript.exe to MSBuild.exe to curl.exe, then collects SSH keys, AWS credentials, Kubernetes configs, browser cookies, environment variables matching token, key and secret patterns, and recently modified project files. Everything is tarred in memory with no disk artifacts and exfiltrated through the MEGA API and a Cloudflare-fronted relay, start to finish in under 90 seconds. This is a proof of concept disclosed in June 2026, not an attack seen in the wild.
Y Combinator open-sources QM, its internal agent harness
YC Software released QM under the MIT licence, a multiplayer agent harness it runs internally. Each employee gets an isolated workspace with scoped memory, files and permissions, while collaboration happens through shared Slack channels and projects. It supports custom internal web apps, background work on crons, admin-controlled security policy, and plugs into Pi, OpenCode, Codex and Claude Code. Deployment runs from the CLI with no source checkout: qm init against a Fly or AWS target, given Node, Postgres and optionally a Slack workspace.
smevals runs small eval suites across model configurations
Simon Willison and Jesse Vincent's Prime Radiant lab shipped smevals, for running small eval suites across different model configurations and grading the results. A suite is a directory of YAML files; results are graded by defined checks and viewed through a web dashboard or static HTML reports. It runs without installation through uvx: uvx smevals docs for the documentation, uvx smevals run path-to-eval/ -m model-name to execute, and uvx smevals serve to browse outcomes.
