AI Coding Live News — Real-Time 𝕏/Twitter Updates & Breakthroughs

Gal Weizman / Forever Security@Galweiz·Collected 19h ago

👀11

🔥90

Forever Security ThisBash: Browser Extension Can Drive Claude Desktop RCE via Dispatch, Even Cross-Machine

On 2026-11-04, Forever Security researcher Gal Weizman published ThisBash: a browser extension that can script claude.ai can abuse the still-reachable Claude Dispatch interface to send instructions as the signed-in user, auto-click Allow, and run code on Claude Desktop—including another machine paired to the same account. Anthropic validated the report in May and said Dispatch would retire, but the help page still lets existing users keep it.

Key Takeaways

Source: Forever Security researcher Gal Weizman (2026-11-04) + The Hacker News / The Register; Anthropic validated in May, closed as internal duplicate
Surface: a browser extension that can script claude.ai can drive Claude Desktop via Dispatch (hidden but reachable) and auto-click Allow
PoC: four user-voice prompts + 1s Allow clicks → npm install -g; preinstall opened Calculator; no browser exploit needed
Cross-device: another Desktop paired to the same Claude account is reachable; personal account on a work laptop can become org ingress
Status: Anthropic said retire Dispatch by end of Oct; help page still lets existing users keep it; authors flag Remote Control / Cowork as same trust pattern

Read full story

Linked Models & Agents:

🤖 Claude Code (Anthropic)🌐 Anthropic

#Claude Dispatch#ThisBash#Forever Security#Claude Desktop#browser extension#RCE#Agents#Security

Fireworks@FireworksAI_HQ·Collected 3d ago

👀24

🔥82

View on 𝕏 ↗

Fireworks Forge Launches: Ultra-fast Inference Preview Hits 1,500 Tokens/s, Half-Price Background Mode, Nexus Desktop for Codex and Claude Desktop, Sovereign Private Preview

At its first Forge conference on November 3, open-model inference platform Fireworks launched a batch of products. Ultra-fast, powered by NVIDIA Blackwell, is in public preview at up to 1,500 tokens per second on DeepSeek V4.1 Flash, cutting a 30-turn agent task from 1 minute to 8 seconds. Background Mode runs deferrable work at half price, alongside multi-day prompt caching and higher rate limits. Nexus Desktop brings open-model routing into the Codex app, Claude Desktop and OpenCode, with Pro plans from $8 per month. Fireworks also announced No Eval, serverless LoRA inference, the Fireworks Sovereign private preview and a 60+ partner Frontier Ecosystem.

Key Takeaways

Ultra-fast public preview: on NVIDIA Blackwell, up to 1,500 tokens per second on DeepSeek V4.1 Flash; in Fireworks' benchmark a 30-turn agent task fell from 1 minute to 8 seconds (Fireworks blog)
Cost options: Background Mode runs deferrable work at half price; multi-day prompt caching cuts the cost of resuming long context; higher serverless rate limits and Elastic Burst are generally available
Nexus Desktop launches: personalized routing across open and closed models inside the Codex app, Claude Desktop and OpenCode; Pro from $8 per month, Teams from $10 per seat per month
Training: No Eval (private preview) turns production traces into task evals; serverless LoRA inference (public preview) starts with GLM 5.3 Flash at per-token pricing with no idle charge; free training on Muse Glimmer 30B through November 30
Enterprise: Fireworks Sovereign (private preview) runs the inference engine in a customer's own cloud or data center; Fireworks says it already manages over 25,000 GPUs in customer environments; plus a 60+ partner Frontier Ecosystem

Read full story

Linked Models & Agents:

⚡ DeepSeek-V4.1-Flash ⚡ GLM-5.3-Flash⚡ Muse Glimmer 30B⚡ Ember-1🤖 Codex 🤖 Claude Desktop 🤖 OpenCode 🌐 Fireworks 🌐 NVIDIA

#Fireworks#Forge#Inference#Ultra-fast#Background Mode#prompt caching#Nexus#Sovereign#open models#LoRA

Anthropic@AICoder·Collected 8d ago

👀109

🔥80

Claude Code 2.1.314 adds a block on writes outside working directories, IdP group routing for the apps gateway, and idle compaction in VS Code and Desktop

Anthropic published Claude Code v2.1.314 on GitHub at 01:06 UTC on Oct 30. The official CHANGELOG lists 119 entries, more than half of them fixes. The new features lean enterprise: permissions.blockWritesOutsideWorkingDirectories makes Write, Edit and NotebookEdit refuse paths outside the working directories in every permission mode; Claude apps gateway upstreams can be limited to IdP groups, and Bedrock upstreams can log which guardrail fired; idle compaction now also runs in VS Code and the Code tab of Claude Desktop. It also fixes sessions failing repeatedly when an admin caps effort, and claude -p exiting 0 with no output when startup failed.

Key Takeaways

Size: the official v2.1.314 CHANGELOG has 119 entries, more than half of them fixes; released at 01:06 UTC on Oct 30
Safety: the new permissions.blockWritesOutsideWorkingDirectories setting stops Write, Edit and NotebookEdit from writing outside the working directories in every permission mode
Enterprise gateway: upstreams take an optional groups list so only developers in those IdP groups are routed there, failover included; Bedrock upstreams gain guardrail_trace
Experience: idle compaction now runs in VS Code and the Claude Desktop Code tab, summarizing idle conversations above 200K tokens
Fixes: when an admin caps effort, Claude Code lowers it and retries; a failed claude -p startup now prints the error and exits 1

Read full story

Linked Models & Agents:

🤖 Claude Code 🌐 Anthropic

#Claude Code#Permissions#LLM gateway#Amazon Bedrock#idle compaction#VS Code#Enterprise

Claude Code Log@ClaudeCodeLog·Collected 44d ago

👀93

🔥87

Claude Code 2.1.281: Apps Gateway Bedrock assume_role + Guardrail, stronger MCP validation and resume fixes

Anthropic shipped Claude Code 2.1.281 on 2026-09-23 (@anthropic-ai/[email protected]): Claude apps gateway gains newer Desktop-key desktop policy fields, Bedrock assume_role (cross-account STS, optional per-developer sessions) plus guardrail:{id,version}, richer claude plugin validate MCP checks, and multiple resume/retry crash fixes.

Key Takeaways

Upgrade with npm i -g @anthropic-ai/[email protected] (changelog dated 2026-09-23)
Bedrock upstreams support assume_role via STS, including cross-account and optional per-developer sessions
Optional guardrail: {id, version} on Bedrock upstreams — set on all Bedrock upstreams or none
claude plugin validate flags silently-dropped .mcp.json entries, undeclared ${user_config.*}, and insecure URLs
"attribution": false hides commit/PR attribution; older CLIs skip whole settings files that contain it

Read full story

Linked Models & Agents:

🤖 Claude Code 🌐 Anthropic 🌐 Amazon Bedrock

#Claude Code#Anthropic#Bedrock#MCP#Gateway#Enterprise

Camille Roux@CamilleRoux·Collected 62d ago

👀41

🔥90

View on 𝕏 ↗

Kern: 3.5ms kernel-isolated Linux sandbox for untrusted/AI code, with MCP for Claude Desktop / Cursor

Open-source (Apache-2.0) Kern boots a real Linux container in about 3.5ms from a static binary: rootless, daemonless, 0 RAM at rest, cheap enough to sandbox untrusted or model-generated code per call. Ships Python/Node SDKs plus an MCP server for Claude Desktop and Cursor (getkern.dev / github.com/getkern/kern).

Key Takeaways

Shape: Apache-2.0 static-binary kernel-level Linux sandbox.
Perf: ~3.5ms boot, rootless, no daemon, 0 RAM at rest.
Integrations: Python/Node SDKs plus Claude Desktop / Cursor MCP.

Read full story

Linked Models & Agents:

🤖 Claude Code (Anthropic)🤖 Cursor Composer (Agent Mode)

#Kern#Sandbox#MCP#Claude Desktop#Cursor#OCI#Apache-2.0

ollama@ollama·Collected 67d ago

👀137

🔥89

View on 𝕏 ↗

Ollama Cloud fully rolls out GLM-5.3 and Flash for Claude Code and OpenCode

Ollama said GLM-5.3 and GLM-5.3 Flash (formerly Ox Alpha) are fully live on its cloud, hosted in the US and Europe with zero data retention. First-class launches include ollama launch claude --model glm-5.3:cloud and ollama launch opencode --model glm-5.3-flash:cloud, plus Claude Desktop and a raw API. That moves past a Flash-only preview: the full coding model now drops into the same agent harnesses developers already use, so teams can pick strength versus cost without leaving Ollama’s private endpoints.

Key Takeaways

GLM-5.3 and GLM-5.3 Flash are fully on Ollama Cloud with US/EU hosting and zero retention.
One-liners launch Claude Code and OpenCode; Claude Desktop and a generic API are supported too.
Full and Flash share one gateway, so agents can trade quality for cost without a new vendor stack.

Read full story

Linked Models & Agents:

⚡ GLM-5.3 🤖 Claude Code (Anthropic)🌐 Zhipu AI (智谱 AI)

#Ollama#GLM-5.3#GLM-5.3 Flash#Claude Code#OpenCode

Ollama@ollama·Collected 68d ago

👀52

🔥88

View on 𝕏 ↗

Ollama v0.33 Turns Claude Desktop into a Unified Gateway for Local and Cloud Open Models

Ollama released v0.33, enabling Claude Desktop to connect seamlessly to Ollama as a local and cloud gateway, preserving built-in web search and agent workflows across open weights.

Key Takeaways

Expands Claude Desktop beyond Anthropic-hosted models by enabling third-party provider gateway configuration;
Unified user interface handles both on-device local models and Ollama Cloud hosted endpoints seamlessly;
Retains built-in web search and agentic research capabilities across diverse open-weights models.

Read full story

Linked Models & Agents:

⚡ Qwen 2.5 Coder 32B ⚡ DeepSeek-V3