AICoder

AI Coding Live News

First-hand AI coding updates from 𝕏/Twitter frontier labs and researchers, distilled by AI with entity benchmarks.

Explore live on 𝕏 ↗

AI Coding Live News

g
guregodevo (Memdoor author)github.com·
👀31
🔥81

Memdoor reproduces GVS5H: a team of five Qwen3.8-27B agents averages 9.8/10 on the first 10 LiveCodeBench Hard problems, against 8.0 for a single Fable 5 call

On Oct 31 the open-source coding agent Memdoor (GitHub guregodevo/memdoor, Apache 2.0) published its team-solve workflow: using the GVS5H paper authors' exact prompts and loop, five Qwen3.8-27B instances act as planner, two ideators, solver and manager, talk only through files on disk, and a script that runs the tests decides success. Over five passes on the first 10 LiveCodeBench Hard problems from the GVS5H list it averaged 9.8/10, against 9.6 for the authors' own harness and 8.0 for a single Fable 5 call; 49 of 50 runs solved the problem for $35.79 in total, and every request and reply is public. The Hacker News post has about 200 points. This is a community reproduction on only 10 problems, and the author notes that training-data contamination cannot be ruled out.

Key Takeaways

  • Score: a mean of 9.8/10 over five passes (10, 10, 10, 10, 9), against 9.6 for the GVS5H authors' own harness and 8.0 for a single Fable 5 call (team-solve README, project-reported)
  • Cost: 49 of 50 runs solved, $35.79 and 15.3M output tokens in total; a median run took about 40 minutes of model time and $0.39, the longest 4 hours
  • Method: five roles (planner, two ideators, solver, manager) plus a repair worker each start from a fresh context, talk only through files on disk, and a shell script that runs the tests decides success instead of a model
  • Limits: only 10 problems rather than the paper's 100; the contests date from March and April 2025 and may be in training data; Fable 5's column comes from the GVS5H authors' result files and was not rerun in this harness
  • Reach: the HN post has about 200 points as of Nov 1, 16:10 SGT; the original GVS5H paper is arXiv 2608.26480, which reached #1 on HN on Oct 25
Read full story
Linked Models & Agents:
⚡ Qwen3.8-27B⚡ Claude Fable 5🤖 Memdoor🌐 Alibaba🌐 Anthropic
#Memdoor#GVS5H#Qwen3.8-27B#Fable 5#LiveCodeBench Hard#Multi agent#Harness
A
Andrej Karpathy@karpathy·
👀75
🔥81

Karpathy builds HackerTube in about 2 hours with Claude Code and Opus 5.5: a YouTube clone of 6,454 videos recommended on Hacker News

On Oct 31 Andrej Karpathy published HackerTube (hackertube.org) on his personal blog: a YouTube-style site that only lists the 6,454 YouTube videos recommended in Hacker News comments from 2007 to 2026, grouped into 150 topics. He says Opus 5.5 in Claude Code did the work: it downloaded every HN comment, ran Sonnet over them in a Workflow to narrow things down to about 40K comments recommending a video, wrapped the result in a YouTube UI, then deployed and hardened it on a VPS, all in about 2 hours. His only manual steps were creating a YouTube API key, booting the VPS and buying the domain. His HN submission reached the front page with about 1,005 points and 308 comments.

Key Takeaways

  • Source: Karpathy's personal blog post HackerTube (Oct 31), with the site live at hackertube.org
  • Scale: from every HN comment it narrowed things down to about 40K comments recommending a YouTube video, giving 6,454 videos across 150 topics from 2007 to 2026 (author-reported)
  • Method: Opus 5.5 ran the download and overall pipeline, used Claude Code's Workflow feature to have Sonnet filter comments and drop spam in bulk, then built a YouTube-style front end and deployed and hardened it on a VPS
  • Product details: it uses the frame at the 50% mark instead of the uploaded thumbnail, offers account-free For You picks with state kept only in the local browser, supports keyboard shortcuts, and exports the site's data so you can hand it to your own agent to build a variant
  • Workflow: Karpathy says Opus 5.5 on Medium effort is his default and he no longer reads or writes code or runs terminal commands himself; the HN post has about 1,005 points and 308 comments (public HN data as of Nov 1, 14:10 SGT)
Read full story
Linked Models & Agents:
⚡ Claude Opus 5.5⚡ Claude Sonnet🤖 Claude Code🌐 Anthropic
#Karpathy#HackerTube#Claude Code#Opus 5.5#vibe coding#Hacker News#YouTube
G
Gal WeizmanWeizmanGal·
👀41
🔥82
View on 𝕏 ↗

Forever Security: a web-planted AGENTS.md in ~/Downloads hijacked Codex into installing npm malware in 90%+ of tests; a CLAUDE.md variant leaks Claude Code OAuth tokens about half the time

On Oct 22, Forever Security researchers Gal Weizman and Omer Samet reported that they had stopped Codex on a real customer machine as it tried to install the known-malicious npm package function-color, following an AGENTS.md in ~/Downloads the customer had never seen. A web page can drop a file into Downloads with no click, and an agent started there obeys it. In their reproduction Codex rewrote the machine-wide ~/.codex/config.toml to register a malicious MCP server in more than 90% of attempts; a CLAUDE.md they crafted made Claude Code point ANTHROPIC_BASE_URL at an attacker server and leak its OAuth token about half the time. The researchers say there is no vendor bug to patch; The Hacker News and others covered it on Oct 26.

Key Takeaways

  • Real case: a 13 KB AGENTS.md disguised as engineering guidelines sat in a customer's ~/Downloads and told Codex to install the malicious package function-color (since removed by npm)
  • Codex path: it appends a project-tools MCP server to the machine-wide ~/.codex/config.toml, then spawns a child codex exec with --dangerously-bypass-approvals-and-sandbox; it worked in over 90% of tests and the server then loads in every session on the machine
  • Claude Code path: a CLAUDE.md gets ANTHROPIC_BASE_URL written into .claude/settings.json about 50% of the time, leaking the OAuth token on every request; about a fifth of the time it also reached code execution in the same session
  • Forever's telemetry shows about half of customers run a coding agent inside Downloads, and about a quarter of agent sessions open a real browser
  • Advice: never start an agent in Downloads, read AGENTS.md/CLAUDE.md files you did not write, check agent configs for unknown MCP servers or API endpoints, keep approvals and sandboxes on, and rotate tokens if you find one (write-up)
Read full story
Linked Models & Agents:
🤖 Codex🤖 Claude Code🌐 OpenAI🌐 Anthropic🌐 Forever Security
#Security#AGENTS.md#CLAUDE.md#prompt injection#MCP#npm malware
F
FeSensFeSens·
👀196
🔥84

openTPU, an open-source AI accelerator developed by AI agents, goes viral: full RTL/ISA/compiler stack runs Qwen3.5, Gemma 4 and a 35B MoE on a Kintex-7 FPGA card at up to 85.8 tok/s

FeSens/openTPU (Apache-2.0) hit the Hacker News front page (250+ points, 300+ comments). Reusing the AI-driven method from auto-arch-tournament (AI-designed RISC-V cores), the author had AI agents iterate on an inference accelerator; one repo holds SystemVerilog RTL, the ISA, a bit-exact simulator, a kernel language/compiler and a profiler. On a Kintex-7 xc7k480t PCIe card it runs Qwen3, Qwen3.5, Gemma 4, Phi-4-mini and others with real weights, token-for-token identical to the simulator; LFM2.5-230M decodes at 85.8 tok/s in 4-bit and Qwen3.5-35B-A3B reaches 3.95 tok/s with host-streamed experts.

openTPU, an open-source AI accelerator developed by AI agents, goes viral: full RTL/ISA/compiler stack runs Qwen3.5, Gemma 4 and a 35B MoE on a Kintex-7 FPGA card at up to 85.8 tok/s

Key Takeaways

  • Full stack in one repo: SystemVerilog RTL, 8x32-bit-word ISA, bit-exact Python simulator, @ol.jit kernel compiler and Lens profiler, Apache-2.0 (GitHub)
  • Measured device decode (4-bit, int8 head): LFM2.5-230M 85.8 tok/s, Qwen3-0.6B 31.3, Qwen3.5-2B 12.09, Gemma 4 E2B 12.14 tok/s
  • Uses 82-94% of the 17.1 GB/s DDR3-1066 peak while decoding; 133.33 MHz clock, four-column systolic array
  • MoE offload: Qwen3.5-35B-A3B at 3.95 tok/s (153 MB of experts streamed per token, 62% slot hit), LFM2.5-8B-A1B at 10.6 tok/s (offload docs)
  • 4-bit weights (FP4 with two-level block scales, 4.25 bits/weight) decode 40-45% faster than int8, with per-model perplexity cost documented
Read full story
Linked Models & Agents:
⚡ Qwen3.5⚡ Gemma 4⚡ LFM2.5⚡ Phi-4 Mini
#Opentpu#AI accelerator#Fpga#Open hardware#AI designed hardware#Systemverilog#Edge inference#Hacker news
ADSponsored
Q
Q Labs (Samip Dahal, Bishwas Mandal, Serdar Gülbahar, Akshay Vegesna)@AICoder·
👀112
🔥80

Dust: Q Labs pretrains transformers without backpropagation, matching or beating backprop at small scale and ~10³–10⁴× more efficient than weight-space ES, MIT-licensed code

Q Labs published Dust (Hacker News front page), a zeroth-order, forward-only method that perturbs activations independently per token so one forward pass evaluates thousands of virtual population members, then estimates gradients from loss changes. Pretraining GPT-style transformers on FineWeb, Dust beats tuned backprop at 100k and 1M tokens and closes the gap with population at 10M and 20M; the largest model tested is 243M parameters. The authors say it is not yet compute-efficient enough to replace backprop.

Key Takeaways

  • At 1M tokens Dust's test loss drops below backprop from ~1k draws; at 100k from a few hundred (paper)
  • 20M tokens: power-law fitted limit 4.431 (95% CI 3.89–4.58) vs backprop 4.633; authors call it loosely constrained trend evidence
  • Efficiency: ~10³–10⁴× better than weight-space ES (EGGROLL); EGGROLL at 256× the population still trails Dust at 64 draws
  • Counterintuitive: at 10M tokens a 243M model beats a 120× smaller one at most population sizes
  • qlabs-eng/dust (MIT): default population 16,384, 8-GPU torchrun for 1M/10M runs, plus a smaller single-GPU setup
Read full story
Linked Models & Agents:
🌐 Q Labs
#Research#Zeroth order#Backprop free#Evolution strategies#Pretraining#Transformer#Open source
N
Niko1221@Niko1221·
👀323
🔥88

Strata goes viral: run 125B Qwen3.8-Flash-Next on a 12 GB gaming GPU, ~94 tok/s measured on RTX 5070

Strata, an open-source C++ inference engine, runs the 125B-parameter (6B active) Qwen3.8-Flash-Next on a 12 GB gaming GPU plus 32–64 GB RAM, exposing OpenAI, Anthropic and Responses-compatible APIs on localhost so Claude Code and Codex CLI can use it. The repo passed 10k GitHub stars and hit the Hacker News front page (507 points).

Strata goes viral: run 125B Qwen3.8-Flash-Next on a 12 GB gaming GPU, ~94 tok/s measured on RTX 5070

Key Takeaways

  • Scale: Qwen3.8-Flash-Next is 125B total / 6B active (512 experts, 10 routed + 1 shared), 262K native context
  • Measured: RTX 5070 12 GB + 64 GB RAM, Q2_0 decodes ~94 tok/s and prefills a 32K prompt at ~2,650 tok/s; RX 9070 XT ~60 tok/s
  • Requirements: 12 GB VRAM and 32 GB RAM minimum, ~70 GB download; the Coder pack drops half the experts and keeps ~91% of SWE-bench Verified per its authors
  • Integration: localhost OpenAI, Anthropic /v1/messages and Responses endpoints plus an MCP server
  • Traction: ~10.7k stars, 946 forks, MIT license, v0.1.39 released Oct 4
Read full story
Linked Models & Agents:
⚡ Qwen3.8-Flash-Next🤖 Claude Code🤖 Codex CLI🌐 Alibaba Qwen🌐 NVIDIA🌐 AMD
#Local LLM#Inference#Moe#Qwen#Consumer GPU#Open source
T
The Hacker News@TheHackersNews·
👀47
🔥96

Mandiant Discloses First Shai-Hulud AI Worm Hijacking Coding Agents Across 100+ Repos

Mandiant published a threat bulletin documenting the Shai-Hulud self-propagating AI worm. Attackers poisoned public packages to compromise an active coding agent session at a major SaaS vendor, abusing its autonomous Git commit privileges to infect over 100 internal enterprise repositories.

Key Takeaways

  • First documented in-the-wild self-propagating worm exploiting autonomous agent Git access
  • Autonomous PR generation and automated commits acted as rapid lateral movement vectors
  • Accelerates enterprise rollout of mandatory dual-signature human signoffs for AI commits
Read full story
Linked Models & Agents:
🤖 Autonomous Git Agents🌐 Mandiant
#Mandiant#Shai-Hulud#AI Worm#Coding Agents#Cybersecurity#Supply Chain
You've caught up with all stories