AI Coding Live News

BoxWorks 2026: Box and NVIDIA Unveil Box Context Retrieval, Permission-Aware Retrieval for Enterprise Agents Built on Nemotron Retriever, Plus Box Architect and Box Mount

At BoxWorks 2026 on November 5, Box announced an expanded NVIDIA collaboration: Box Context Retrieval, a new engine built on NVIDIA Nemotron Retriever embedding models, combines keyword and semantic search to return the most relevant passages to AI agents while honoring existing file permissions, with general availability for Enterprise Advanced customers planned for early next year. Box's press release claims 20% better search accuracy (Recall@5), 90% fewer tokens and 4x faster answers. Open-weight Nemotron models, starting with Nemotron 3 Ultra, are available in Box AI now. Box also unveiled Box Architect, which designs workflows from a stated goal; Box Mount, which mounts Box folders inside agent sandboxes and works with NVIDIA OpenShell; and agent security controls including MCP Guardrails.

BoxWorks 2026: Box and NVIDIA Unveil Box Context Retrieval, Permission-Aware Retrieval for Enterprise Agents Built on Nemotron Retriever, Plus Box Architect and Box Mount

Key Takeaways

  • Box Context Retrieval uses NVIDIA Nemotron Retriever with hybrid keyword and semantic search, honoring existing file permissions
  • Vendor claims: +20% Recall@5 accuracy, 90% fewer tokens, 4x faster answers; GA for Enterprise Advanced early next year
  • Open-weight Nemotron models, starting with Nemotron 3 Ultra, are available in Box AI now
  • Box Mount puts Box folders inside agent sandboxes and works with the NVIDIA OpenShell secure runtime
  • New agent security controls include MCP Guardrails, classification-based access policies and audit trails
Read full story
Linked Models & Agents:
⚡ Nemotron 3 Ultra⚡ Nemotron Retriever🌐 box🌐 Nvidia (NIM)

Claude Code Background Subagent Status Lines Now Written by Haiku 5.5: About 99% Cheaper per Update, About 6% More Prompts per Limit

On November 4 ClaudeDevs, Anthropic's official developer account, said the status line that a background subagent in Claude Code refreshes every 30 seconds used to re-read its whole conversation each time, and is now written by Haiku 5.5 from short notes, so each update costs about 99% less. Anthropic says sessions with background subagents used about 5% less of the limit, giving about 6% more prompts on the same limit. It is live for most Pro, Max and Ultra users and everyone on Team and Enterprise, on v2.1.316 or later.

Key Takeaways

  • A background subagent refreshes its status line every 30 seconds, and each refresh used to re-read the subagent's whole conversation
  • Haiku 5.5 now writes the status line from short notes, which Anthropic says makes each update about 99% cheaper
  • The subagent itself keeps its own model; only the status line is written by Haiku 5.5
  • Anthropic says sessions with background subagents used about 5% less of the limit, so the same limit gives about 6% more prompts
  • It is live for most Pro, Max and Ultra users and everyone on Team and Enterprise; update to v2.1.316 or later
Read full story

Vercel Security Review Enters Public Beta: Vulnerability Review on Every GitHub Push, One-Click Fixes with Vercel Agent

On November 3 (US Pacific time), Vercel launched Security Review in public beta. It is a new Vercel Agent capability alongside Code Review and Investigation: once enabled, every push to connected GitHub repositories triggers a diff-only vulnerability review that finishes in seconds. Findings land in the Security dashboard, PR comments and the CLI, and can be fixed with one click by Vercel Agent or pulled into your own coding agent via vercel security vulnerabilities. It is available to Pro and Enterprise teams, and reviews are free until November 10.

Vercel Security Review Enters Public Beta: Vulnerability Review on Every GitHub Push, One-Click Fixes with Vercel Agent

Key Takeaways

  • Trigger: every GitHub push (including direct pushes to production) is reviewed automatically; only the diff is scanned, which Vercel says finishes in seconds, so it can run on every preview and production deployment
  • Beyond pattern matching: the agent traces how changed code is reached, checks existing protections and rechecks each finding, which Vercel says catches logic flaws such as missing authorization checks
  • Teams can write security policies in plain language, scoped to projects or the whole team, and manage them with vercel security policy
  • Pricing: Vercel Agent rate, model tokens at provider cost with no markup, plus $0.25 per million tokens; reviews are free until November 10, 2026, while Agent fixes are billed
  • Availability: public beta for Pro and Enterprise teams; Vercel has not published detection-rate or false-positive benchmarks
Read full story

Menlo Ventures 2026 State of Enterprise AI: Enterprise AI Spend Hits $176.8B, Up 5.4x, as Anthropic Takes 55% of Enterprise API Spend

On November 3, Menlo Ventures released its fourth annual enterprise AI report. It estimates enterprise spending on using AI reached $176.8B by September 2026, up 5.4x from $33B in 2025. In enterprise LLM API spend, Anthropic rose from 40% to 55%, OpenAI from 27% to 31%, and Google fell from 21% to 9%. Coding is the largest app category at $34.0B. Figures come from a survey of about 400 US enterprise AI decision-makers plus third-party data, so they are estimates; Menlo is an Anthropic investor.

Menlo Ventures 2026 State of Enterprise AI: Enterprise AI Spend Hits $176.8B, Up 5.4x, as Anthropic Takes 55% of Enterprise API Spend

Key Takeaways

  • Enterprise AI deployment spend: $1.7B (2023) to $8.5B (2024) to $33B (2025) to $176.8B by Sep 2026, up 5.4x vs 3.9x last year (Menlo estimate)
  • Enterprise LLM API spend share: Anthropic 55% (from 40%), OpenAI 31% (from 27%), Google 9% (from 21%); open-source models are about 19% of usage but only 4% of spend
  • App-layer spend is about $77.3B: coding $34.0B and chatbots/productivity $25.0B make up 76%; Claude Code and Codex account for $24.0B (70%) of coding spend
  • On OpenRouter, agents generate 80% of tokens (about 130.9T per week), roughly 7x human usage, and have grown 37x since overtaking human traffic in February
  • 55% of incremental AI spend comes from net-new budgets and 22% from existing software budgets; the share of enterprises paying for AI rose only from 55% to 65%
Read full story
ADSponsored

CrowdStrike Agrees to Acquire Fiddler and Dreadnode and Ships an AI Kill Switch, Bringing Agent Observability, Pre-Deployment AI Security Testing and Agent Termination Into Falcon

At Fal.Con Europe in Barcelona on November 3, CrowdStrike said it signed definitive agreements to acquire AI agent observability company Fiddler AI and automated AI security testing company Dreadnode, and launched an AI Kill Switch in Falcon Guardian that can terminate a misbehaving agent, block it from relaunching and cut its enterprise network access. Both deals are expected to close in CrowdStrike's fiscal Q4 FY27, with the products generally available that quarter. CrowdStrike did not disclose prices; CyberScoop, citing the Wall Street Journal, put Fiddler at about $400 million and Dreadnode at about $95 million.

CrowdStrike Agrees to Acquire Fiddler and Dreadnode and Ships an AI Kill Switch, Bringing Agent Observability, Pre-Deployment AI Security Testing and Agent Termination Into Falcon

Key Takeaways

  • Both acquisitions were announced the same day and are expected to close in CrowdStrike's fiscal Q4 FY27, paid mostly in cash plus some stock subject to vesting conditions.
  • CyberScoop, citing the Wall Street Journal, puts Fiddler at about $400 million and Dreadnode at about $95 million, roughly $495 million combined; CrowdStrike did not disclose the amounts.
  • Fiddler will be sold as Falcon Observe: pre-deployment evaluation, tracing of decisions and tool calls across the agent hierarchy, drift and hallucination detection, and evaluation costs cut by up to 98% using purpose-built models.
  • Dreadnode runs more than 100 known AI attack strategies (jailbreaks, prompt injection, multi-turn and agent-specific attacks) against models, agent reasoning loops, applications and MCP servers, mapping findings to OWASP LLM Top 10, OWASP Agentic ASI01-ASI10, MITRE ATLAS and NIST AI RMF.
  • The AI Kill Switch is available today: an authorized admin triggers it, the agent is stopped first at the Gateway (endpoint enforcement coming soon), blocked from relaunching and cut off from the network, with every action logged.
Read full story

Sarvam Releases Prism, an Open-Weight Decision Model Built on Sarvam 105B That Returns Calibrated Option Probabilities in About 44 ms, Apache 2.0

Indian AI company Sarvam released Sarvam Prism on November 3, a "System One" decision model for enterprise workflows: given a context and questions with fixed answer options, it returns a probability for every option in a single forward pass instead of generating text. Sarvam says that across the 25 decision models it tested, Prism averages 71.8 over three indices with a median response time of 44 ms on one B200, the highest score under 100 ms, and scores 82.5 on its Indian-language benchmark. Weights are on Hugging Face under Apache 2.0, with a hosted API as well. All scores are Sarvam's own measurements.

Sarvam Releases Prism, an Open-Weight Decision Model Built on Sarvam 105B That Returns Calibrated Option Probabilities in About 44 ms, Apache 2.0

Key Takeaways

  • Trained on the Sarvam 105B (105B-10B MoE) base; it only outputs option probabilities, so the answer is always one of the given options.
  • Vendor-reported indices: Jev Decision Index 67.0, Sarvam's recreation of the Artificial Analysis decision index 65.9, internal Indian-language benchmark 82.5, average 71.8; Perplexity Decider v1.2 averages 68.0 at about 117 ms.
  • Calibration: on English answers at 90%+ confidence it expects 3.3% errors and makes 2.2%; in Indian languages 5.4% expected vs 4.4% actual, while rivals underestimate errors by 1.5x to 4.8x.
  • By sorting options into a fixed order before scoring, it changed 0 of 2,000 answers across four shuffled option orders.
  • On 700 recorded agent runs it judges correctly 78.5% of the time overall, vs 70.7% for Claude Haiku 5.5.
  • Self-hosting needs one FP8-capable GPU with about 120 GB free memory (such as B200 or H200) and about 106 GB of disk for weights.
Read full story
Linked Models & Agents:
⚡ Sarvam Prism⚡ Sarvam 105B⚡ Perplexity Decider v1.2⚡ Jev 1.14⚡ Microsoft-Decision-1⚡ Claude Haiku 5.5🌐 Sarvam

Marvell to Acquire Lumentum in $115 Billion All-Stock Deal, Betting on Optical Connectivity for AI Data Centers

Marvell and Lumentum announced on November 2 a definitive agreement for Marvell to acquire Lumentum in an all-stock deal: 4.5 Marvell shares per Lumentum share, an implied enterprise value of $115 billion (about $1,132 per share, a roughly 23.9% premium). Marvell holders will own about 67% of the combined company. The companies say AI clusters are shifting from copper to optics, and the combination will cover connectivity from data center interconnect down to in-package links, targeting a $550 billion market. Closing is expected in the first half of 2028.

Marvell to Acquire Lumentum in $115 Billion All-Stock Deal, Betting on Optical Connectivity for AI Data Centers

Key Takeaways

  • Fixed exchange ratio of 4.5 to 1 implies a $115 billion enterprise value for Lumentum, a roughly 23.9% premium to the unaffected October 28 close.
  • Marvell holders will own about 67% and Lumentum holders about 33%; Matt Murphy stays chairman and CEO, and three Lumentum directors including CEO Michael Hurlston join the board.
  • The deal combines Marvell electrical and optical interconnect, switching and custom XPU silicon with Lumentum lasers, optical transceivers, optical circuit switching (OCS) and indium phosphide (InP) manufacturing.
  • The companies cite more than $1 billion in run-rate cost synergies and year-one non-GAAP EPS accretion; shareholder and regulatory approvals are required, with closing expected in the first half of 2028.
Read full story

X discussion: Pieter Levels posts a 13-minute video on "what is left when AI can build everything", saying his businesses are shrinking, the sense of achievement is gone, and moats shift to community and content

Indie developer Pieter Levels (@levelsio) posted a roughly 13.5-minute walk-and-talk video on X on November 1, following up his October 11 "software is dead" post. He says AI has finally hit programmers themselves, and the identity and sense of achievement that came from building paid products is fading; his own businesses and many friends' are flat or shrinking, and competition has exploded because anyone can now ship a landing page or app. He sees the remaining moats as community, audience, content and slower-moving enterprise B2B, and has already made Nomad List free as nomads.com. The post had about 2,478 likes and 205K views. These are personal views, not industry data.

X discussion: Pieter Levels posts a 13-minute video on "what is left when AI can build everything", saying his businesses are shrinking, the sense of achievement is gone, and moats shift to community and content

Key Takeaways

  • Original post: @levelsio video, Nov 1, 10:44 UTC, about 2,478 likes, 2,441 bookmarks, 204 replies and 205K views at fetch time
  • It quotes his October 11 "Software is dead" post (about 5,747 likes, 1.94M views); the video expands on what is left to do when AI can build everything
  • His GTA cheat-code analogy: every new model makes building faster and easier, but "where's the achievement?"; he says he is not pessimistic, just looking for a new source of achievement
  • His own observations: his and many friends' businesses are flat or shrinking, the ones still growing often rely on AI or VC sponsorships, and big labs building legal and medical products will absorb many small businesses
  • Nomad List is now free as nomads.com; he says sign-ups went from about 200 when paid to about 3,000 (period not stated), with revenue now from sponsorship and a $1 anti-spam membership
Read full story

Wiz "Black October" report: at least nine AI developer platforms breached in October, with stolen API keys feeding an LLMjacking resale market

Cloud security firm Wiz published research on October 30 saying at least nine AI developer platforms disclosed incidents this month: Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode and Northflank. Attackers hunted stored environment variables, especially keys for paid AI models; Wiz traced two stolen enterprise keys to roughly 800,000 and 1.7 million Amazon Bedrock calls, which it estimates likely ran over $100k at list price in those two cases alone.

Wiz "Black October" report: at least nine AI developer platforms breached in October, with stolen API keys feeding an LLMjacking resale market

Key Takeaways

  • Scale: between October 6 and 30, at least nine AI developer platforms disclosed incidents, and Zeabur is shutting down as a result (Wiz blog)
  • Methods: Fireworks, OpenCode and Warp reported signs of an "agent swarm" attack, and OpenCode and CommandCode attributed theirs to "distillation" attempts; the common thread is hunting stored environment variables that grant AI access
  • Case A: one stolen key drove about 800k Bedrock calls over 30 hours, about 90% successful, with Opus models making up three quarters (Wiz figures)
  • Case B: a single address made about 1.7 million calls in 13 hours, over a million successful; the two cases together likely exceeded $100k at list price
  • Resale chain: Wiz identified two sites selling discounted frontier-model access and saw both test the stolen keys
Read full story

Kaggle and IBM Research launch the ScarfBench Java migration leaderboard: Gemini 4 Argon with Antigravity leads at 75.2%, and about 72% of failures happen at runtime

Kaggle announced ScarfBench with IBM Research, a 204-task benchmark that tests whether coding agents can migrate enterprise Java apps between Jakarta EE, Quarkus and Spring without changing behavior. IBM's October 27 technical note shows Gemini 4 Argon with Antigravity first on the smoke score at 75.2%, Claude Opus 5.5 with Claude Code highest on all-tests-pass at 72.1%, and GPT-6.1 Sol with Codex cheapest at $1.25 per solved task.

Kaggle and IBM Research launch the ScarfBench Java migration leaderboard: Gemini 4 Argon with Antigravity leads at 75.2%, and about 72% of failures happen at runtime

Key Takeaways

  • 204 migration tasks and 10 model-plus-harness configurations; top smoke scores are Gemini 4 Argon + Antigravity 75.2%, Claude Opus 5.5 + Claude Code 70.5% and Claude Opus 5 + Claude Code 69.8% (IBM figures)
  • Claude Opus 5.5 + Claude Code has the highest all-tests-pass rate at 72.1%, just ahead of Gemini 4 Argon at 71.1%
  • Compiling is mostly solved: 8 of 10 configurations compiled at least 97% of solvable tasks, yet smoke scores spanned more than 50 points
  • 535 of 745 classified failing runs (about 72%) were runtime behavioral failures, including 210 lost-route/404 failures
  • Cost per solved task: $1.25 for GPT-6.1 Sol + Codex, $1.59 for Gemini 3.8 Flash + mini-swe and $10.10 for Claude Opus 5.5 + Claude Code; public submissions are not open yet
Read full story
ADSponsored

OpenAI rolls out GPT-6 Rosalind Research, a GPT-6 generation life sciences model for approved research orgs in Work, Codex and the API at $15/$75 per million tokens

In its October 30 ChatGPT Business release notes, OpenAI said GPT-6 Rosalind Research is rolling out to a limited set of customers with Research approval. It shows up in the model picker in ChatGPT Work and Codex, not in the Chat tab, and separately approved organizations can call it through the API as gpt-6-rosalind. OpenAI's token-based Enterprise rate card lists it at $15 per million input tokens, $1.50 cached input and $75 output, three times the price of GPT-5.5 Rosalind Research.

Key Takeaways

  • Approved orgs only: both the organization and the user need Rosalind Research approval, and Discovery approval does not include it
  • Where to use it: the model picker in ChatGPT Work and Codex, not the Chat tab; in Codex it pairs with the Life Sciences Research plugin
  • API model name gpt-6-rosalind needs separate approval and is limited to internal research tools, not customer-facing products
  • Priced at $15 input, $1.50 cached input and $75 output per million tokens, versus $5/$0.50/$25 for GPT-5.5 Rosalind Research
  • Enterprise workspaces start with a two-week Admin Preview that is off by default until an admin enables it for approved users
Read full story
Linked Models & Agents:
⚡ GPT-6 Rosalind Research⚡ GPT-5.5 Rosalind Research⚡ GPT-6 Astra🤖 Codex🤖 ChatGPT Work🌐 OpenAI

OpenAI launches Private Intelligence for enterprises: Zero Data Retention, Private Inference preview and agent approval controls

On Oct 30 OpenAI introduced Private Intelligence, a business privacy offering that bundles Zero Data Retention, a Private Inference confidential-computing preview for the API, agent access and approval controls, encryption and compliance certifications across ChatGPT, Codex and the API, built with some of its largest customers.

OpenAI launches Private Intelligence for enterprises: Zero Data Retention, Private Inference preview and agent approval controls

Key Takeaways

  • Covers three product lines, ChatGPT, Codex and the API, with per-product controls documented by OpenAI
  • Private Inference ships as an API preview that OpenAI describes as confidential computing with strict, verifiable controls
  • Businesses set agent data access, available tools, permitted actions and required approvals before agents act
  • OpenAI lists SOC 2 Type 2, ISO certifications, HIPAA BAAs and FedRAMP support; no benchmarks or pricing were published
Read full story

Cartesia launches Managed Agents voice agent platform: #1 of 30 on Speech Agent Arena, $0.03 per minute at launch

Voice model company Cartesia launched Managed Agents on Oct 29, an end-to-end voice agent platform for enterprise phone calls that tunes its own speech-to-text and text-to-speech models together with the agent harness, and bundles telephony, knowledge bases, tool calls and outbound batches. Cartesia says it ranks #1 on Artificial Analysis's Speech Agent Arena with a 1115 Elo and scores 87.4% accuracy and 90.7% experience on ServiceNow's EVA-Bench (vendor-reported, with GPT-5.5 as the reasoning model). Launch pricing is 50% off at $0.03 per minute.

Cartesia launches Managed Agents voice agent platform: #1 of 30 on Speech Agent Arena, $0.03 per minute at launch

Key Takeaways

  • On Artificial Analysis's Speech Agent Arena blind preference test, Managed Agents ranks #1 of 30 agents with a 1115 Elo, ahead of Gemini 3.1 Flash Live Minimal (1099), Grok Voice 3.0 (1064) and GPT-Live-1 (1041) (Cartesia blog, as cited by the vendor)
  • First-attempt results on ServiceNow EVA-Bench across 200+ customer service, IT service and HR scenarios: 87.4% accuracy and 90.7% experience, versus 73.7%/71.2% for Grok Voice 3.0 and 59.0%/61.6% for GPT Realtime 2.1 (EVA-Bench)
  • All these benchmark runs use GPT-5.5 as the reasoning model; Cartesia's internal evaluation says 85% of calls had no turn-taking issues, versus 67% for other agents
  • Launch pricing is 50% off at $0.03 per minute; Cartesia says the platform has already handled tens of millions of conversations in finance, retail, hospitality and healthcare
  • It supports 44 languages; English, Spanish, Hindi, French and Japanese can switch mid-call today, with the rest coming soon
Read full story
A
Anthropic@AICoder·
👀101
🔥80

Claude Code 2.1.314 adds a block on writes outside working directories, IdP group routing for the apps gateway, and idle compaction in VS Code and Desktop

Anthropic published Claude Code v2.1.314 on GitHub at 01:06 UTC on Oct 30. The official CHANGELOG lists 119 entries, more than half of them fixes. The new features lean enterprise: permissions.blockWritesOutsideWorkingDirectories makes Write, Edit and NotebookEdit refuse paths outside the working directories in every permission mode; Claude apps gateway upstreams can be limited to IdP groups, and Bedrock upstreams can log which guardrail fired; idle compaction now also runs in VS Code and the Code tab of Claude Desktop. It also fixes sessions failing repeatedly when an admin caps effort, and claude -p exiting 0 with no output when startup failed.

Key Takeaways

  • Size: the official v2.1.314 CHANGELOG has 119 entries, more than half of them fixes; released at 01:06 UTC on Oct 30
  • Safety: the new permissions.blockWritesOutsideWorkingDirectories setting stops Write, Edit and NotebookEdit from writing outside the working directories in every permission mode
  • Enterprise gateway: upstreams take an optional groups list so only developers in those IdP groups are routed there, failover included; Bedrock upstreams gain guardrail_trace
  • Experience: idle compaction now runs in VS Code and the Claude Desktop Code tab, summarizing idle conversations above 200K tokens
  • Fixes: when an admin caps effort, Claude Code lowers it and retries; a failed claude -p startup now prints the error and exits 1
Read full story
Linked Models & Agents:

Android Studio Rabbit 2 goes stable with Bring Your Own Agent: 40+ coding agents including Claude Agent, Codex and Antigravity via the open ACP

On Oct 28, the day of Android Dev Summit, Google shipped Android Studio Rabbit 2 (2026.2.2) to the stable channel. The headline change is that Bring Your Own Agent (BYOA) moves from its September Canary preview to a stable feature: developers can plug any Agent Client Protocol (ACP) compatible coding agent into the IDE agent window. Google says more than 40 are available, including Anthropic Claude Agent, OpenAI Codex, JetBrains Junie and Google Antigravity, and users can sign in with personal or enterprise plans. The release also adds an agent skills manager, AI Change Review and agent-assisted LeakCanary fixes.

Android Studio Rabbit 2 goes stable with Bring Your Own Agent: 40+ coding agents including Claude Agent, Codex and Antigravity via the open ACP

Key Takeaways

  • Version 2026.2.2 reached the Stable channel on Oct 28; BYOA first appeared in preview with the Rabbit 2 Canary in September
  • Google says 40+ ACP-compatible agents are available; Claude Agent, Codex and Antigravity are the defaults, and others install from the registry under Settings > Tools > AI > Agents
  • Agents get IDE tools: the project graph and build diagnostics, Android SDK tools, terminal execution, emulator control, Logcat and Compose Preview
  • Sign in with personal API keys or consumer and enterprise subscriptions; the built-in Android Studio agent stays free
  • Also new: a skills manager preloaded with Android and Firebase skills, AI Change Review from three entry points, and agent-assisted LeakCanary fixes; Google's Mishaal Rahman said Android CLI users grew 10x
Read full story