A single daily edition of announcements from the AI coding tools you use, read from a curated source list, summarised, and linked back to the original. No infinite feed, no account, no advertising.
Compiling a Rust project was enough to leak your browser credentials.
A compromised maintainer account published arrayref 0.3.10, internment 0.8.7 and append-only-vec 0.1.9, each carrying a new dependency on proc-macro1, a typosquat of proc-macro2 whose build script fetched and ran an architecture-matched payload during compilation. The crates were pulled within roughly 90 minutes, but arrayref alone has 245 million lifetime downloads, and researchers say the payload exfiltrated host information and browser login databases, so anyone who built against the bad versions is advised to rotate accessible credentials, CI tokens and signing keys.
Codex on Bedrock has been paying for a prompt cache it never reads.
A report on the Codex repository describes cache writes being billed while the read/write ratio stayed below five percent, producing charges around ten times what the workload should cost. Commenters point to setting web_search to disabled as the change that stops it, and several report unrelated usage burning faster than expected; neither OpenAI nor AWS has publicly confirmed a cause.
A free million-token coding model is serving agent traffic under a codename.
Ox Alpha is a stealth reasoning model on OpenRouter priced at zero for both prompt and completion tokens, with a 1,048,576-token context window and a 131,072-token maximum output, accepting text, images and video and supporting tool calls and JSON output. OpenRouter describes it as built for long-horizon software engineering and lists Claude Code and Hermes Agent among the apps sending it the most traffic, while stating it is not the model's developer, owner or provider.
Claude Code stopped holding onto subagent output for the whole session.
Version 2.1.238 releases subagent tool results once they leave the recent display window, which was the source of unbounded memory growth in long interactive sessions. The same release lets plugin marketplaces mint short-lived HTTP headers through a headersHelper command, adds proxy-authorization and deferred-shutdown options for self-hosted runners, and stops stdio MCP servers being asked to discover tools before they are initialized.
A stalled stream now gets cancelled instead of hanging a Kiro turn.
CLI v2.19.0 adds an idle watchdog that warns after 60 seconds of silence and cancels at 300, while throttling, 5xx errors and dropped connections are retried automatically with backoff. Streaming responses also get a 60-minute default timeout so long answers are no longer cut off, and all three limits are tunable through the streamIdleSoftTimeout, streamIdleHardTimeout and timeout settings.
Bun 1.4 can drive a browser tab, so your agent's scraper drops Playwright.
Simon Willison built a roughly 150-line TypeScript service on Bun 1.4's experimental Bun.WebView that exposes JavaScript evaluation and PNG, JPEG and WebP screenshots over three JSON endpoints, opening one tab per request so calls run concurrently. He measured about 64 milliseconds for a JavaScript request against 308 for a heavy screenshot, with memory ranging from 56 MB for evaluation-only work to 104 MB once Chromium's headless shell is loaded.
One experimental editor keeps your intent in pseudocode and regenerates the code.
Huzzah has you write human-readable pseudocode in .hz files and generates the real code from it, then captures your later diffs and uses them as prompts to regenerate the affected sections. The pitch is a move away from prompts that are longform, imperative and transient toward ones that are declarative and persistent, and the author is open that scaling, existing codebases and cross-file dependencies remain unsolved.
