AI Coding Live News

BoxWorks 2026: Box and NVIDIA Unveil Box Context Retrieval, Permission-Aware Retrieval for Enterprise Agents Built on Nemotron Retriever, Plus Box Architect and Box Mount

At BoxWorks 2026 on November 5, Box announced an expanded NVIDIA collaboration: Box Context Retrieval, a new engine built on NVIDIA Nemotron Retriever embedding models, combines keyword and semantic search to return the most relevant passages to AI agents while honoring existing file permissions, with general availability for Enterprise Advanced customers planned for early next year. Box's press release claims 20% better search accuracy (Recall@5), 90% fewer tokens and 4x faster answers. Open-weight Nemotron models, starting with Nemotron 3 Ultra, are available in Box AI now. Box also unveiled Box Architect, which designs workflows from a stated goal; Box Mount, which mounts Box folders inside agent sandboxes and works with NVIDIA OpenShell; and agent security controls including MCP Guardrails.

BoxWorks 2026: Box and NVIDIA Unveil Box Context Retrieval, Permission-Aware Retrieval for Enterprise Agents Built on Nemotron Retriever, Plus Box Architect and Box Mount

Key Takeaways

  • Box Context Retrieval uses NVIDIA Nemotron Retriever with hybrid keyword and semantic search, honoring existing file permissions
  • Vendor claims: +20% Recall@5 accuracy, 90% fewer tokens, 4x faster answers; GA for Enterprise Advanced early next year
  • Open-weight Nemotron models, starting with Nemotron 3 Ultra, are available in Box AI now
  • Box Mount puts Box folders inside agent sandboxes and works with the NVIDIA OpenShell secure runtime
  • New agent security controls include MCP Guardrails, classification-based access policies and audit trails
Read full story
Linked Models & Agents:
⚡ Nemotron 3 Ultra⚡ Nemotron Retriever🌐 box🌐 Nvidia (NIM)

Notion: MCP Shared Brain Lets ChatGPT, Claude, Muse and Bot Share Memories and Skills, With Official Agent Setup Prompts

On November 4 NotionHQ announced that via Notion MCP, ChatGPT, Claude, Muse and Bot can read and write the same Memories and Skills—one shared brain across agents. Official setup prompts (v0.0.6, Oct 30), help docs and a Nov 3 MCP use-cases blog corroborate the product push.

Notion: MCP Shared Brain Lets ChatGPT, Claude, Muse and Bot Share Memories and Skills, With Official Agent Setup Prompts

Key Takeaways

  • NotionHQ post (Nov 4, 19:14 UTC) had about 3,271 likes, 225 reposts, 4,560 bookmarks and ~589K views when fetched
  • Product claim: ChatGPT / Claude / Muse / Bot share Memories and Skills in Notion so switching agents does not reset context
  • Official setup prompt v0.0.6 (2026-10-30): walks agents through an Agent Operating Guide and custom-instruction paste for ChatGPT / Claude
  • Help center: Notion MCP works with Claude, Cursor, ChatGPT Pro and more; Enterprise can approve a whitelist and govern connections
  • Vendor blog (Nov 3): five team stories of MCP workflows as reusable SOPs; Skills via MCP are listed as coming soon
Read full story

Kling 4.0 Flash Is Fully Available With an API: 3-20 Second 720P Videos via Text, Image and Omni Reference Generation

Kling AI announced on November 4 that Kling 4.0 Flash is open to all users on the website and via API, and is also reachable through MCP, CLI and AI plugins, including Photoshop, Premiere Pro and After Effects. The official API changelog says the Flash API generates 3 to 20 second videos at 720P, supports text-to-video, image-to-video and Omni reference-to-video, accepts up to 15 inputs per task and bills by total duration.

Kling 4.0 Flash Is Fully Available With an API: 3-20 Second 720P Videos via Text, Image and Omni Reference Generation

Key Takeaways

  • Flash had been in early access for Ultra yearly subscribers since September 28; it is now open to all users and the API.
  • The API paths are kling-4.0-flash under /text-to-video, /image-to-video and /omni-video; image-to-video takes a single first-frame image.
  • Prompts can be up to 26,000 English characters, with up to 10 reference images and 5 reference videos, plus 21:9 and adaptive aspect ratios.
  • Billing is by the total duration of input and output video; unit prices are on the official pricing page and were not stated in the announcement.
Read full story
Linked Models & Agents:
⚡ Kling 4.0 Flash⚡ Kling 4.0🌐 Kling AI🌐 Kuaishou🌐 Adobe

Epic Says Unreal Engine 6 Will Remove Blueprints, Actors and the C++ Gameplay Framework, Going All-In on Verse With MCP and Python for AI-Assisted Development

At the Unreal Fest Tokyo 2026 keynote on November 3, Epic CEO Tim Sweeney said Unreal Engine 6 (Early Access targeted around 2027) will remove Actors, Blueprints and the C++ Gameplay Framework outright. Gameplay moves to Verse with Scene Graph entities and components, AI integration runs through MCP and Python for any major model, Epic will not build or sell models, and AI-assisted tools will help convert Blueprints and C++ gameplay code to Verse. On X, Sweeney added that after UE6 Preview 1, UE5 will only get critical security and platform compatibility fixes.

Key Takeaways

  • UE6 Early Access targets roughly 2027; keynote slides marked Actors, Blueprints and the C++ Gameplay Framework as "Remove", not deprecated
  • Gameplay moves to Verse with Scene Graph entities and components; C++ stays only in engine internals such as rendering and physics
  • Four AI principles: open, developer-controlled, any major model via MCP and Python, and Epic neither builds nor sells models
  • Epic says AI already makes its teams 1.5x to 4x more productive in programming, debugging and level design (vendor claim); Fortnite is moving thousands of Blueprints to Verse
  • Sweeney on X: after UE6 Preview 1, UE5 gets only critical security and platform fixes; leading models saw little Verse in training, which "will change by January"
Read full story
Linked Models & Agents:
ADSponsored

Epic Confirms Unreal Engine 5.9: Preview Next Week With Improved AI Workflows and Web Back as a Target Platform

On November 3, the official Unreal Engine account said UE 5.9 is happening, with a Preview build next week that includes improved AI workflows, web as a target platform, and rendering and animation updates; changes are already landing in the 5.9 branch on GitHub, with more details to come. This reverses Epic's June State of Unreal stance that 5.8 was the last planned major UE5 release, with 5.9 kept only as an option. UE 5.8 shipped the Experimental Unreal MCP plugin, which lets MCP clients such as Claude Code and Cursor drive the editor; the 5.9 AI workflow changes likely build on it, but Epic has not published a feature list yet.

Key Takeaways

  • Timing: the official post went out at 13:05 UTC on November 3 and says the 5.9 Preview arrives next week; the exact date and the final release date are not announced
  • Scope (per Epic): improved AI workflows, web as a target platform, and rendering and animation updates; changes are already landing in the 5.9 branch on GitHub
  • Context: in June, State of Unreal called 5.8 the last planned major UE5 release; UE6 targets Early Access at the end of 2027, with the full release 12 to 18 months later
  • AI groundwork: the Experimental Unreal MCP plugin in 5.8 embeds an MCP server in the editor at http://127.0.0.1:8000/mcp by default, loopback only and with no authentication
  • Reach: about 2,552 likes, 251 reposts, 114 quotes and 215K views at fetch time
Read full story

Meituan ships LongCat-2.5, a 1.6T-parameter (about 48B active) native multimodal agentic model, with API pricing of $0.30/$1.20 per 1M tokens

On Nov 2 Meituan's LongCat team listed LongCat-2.5 in its API platform change log as the full release of September 25's LongCat-2.5-Preview. The official technical blog says it has 1.6 trillion total parameters with about 48 billion activated per token, builds on LongCat-2.0 with stronger native visual understanding and agentic coding, and was trained and served with W4A4 inference on domestic AI accelerators. Vendor-reported scores include 88.4 on Terminal Bench v2.1, 38.5 on Terminal Bench v4.0, 91.9 on BrowseComp and 83.1 on MCP Atlas. The API speaks both OpenAI and Anthropic formats with a 1M-token context and up to 128K output tokens, at a limited-time price of $0.30 per 1M uncached input tokens, $0.006 cached input and $1.20 output.

Meituan ships LongCat-2.5, a 1.6T-parameter (about 48B active) native multimodal agentic model, with API pricing of $0.30/$1.20 per 1M tokens

Key Takeaways

  • Scale: a 1.6-trillion-parameter MoE with about 48B active per token, a 1M-token context and up to 128K output tokens (official blog, API docs)
  • Code agents (vendor-reported): Terminal Bench v2.1 88.4 (Claude Opus 5 89.1, GPT-5.6-Sol 88.8), Terminal Bench v4.0 38.5 (GPT-5.6-Sol 37.3, Claude Opus 5 53.9), DeepSWE v1.1 64.6
  • General agents (vendor-reported): BrowseComp 91.9, MCP Atlas 83.1, AutomationBench v1.0.6 51.8, HLE with tools 63.1; AutomationBench jumps from 15.8 on LongCat-2.0
  • Pricing: limited-time $0.30 per 1M uncached input tokens, $0.006 cached input and $1.20 output (pricing page)
  • Engineering: W4A4 inference raises prefill throughput 43.3% and decode throughput 42.77% over a W8A8 baseline; FSDP gives 86% higher per-device throughput than DDP in long-sequence SFT
Read full story

Krea launches Ad Studio, its first Krea 3 Expert model, turning a website URL into on-brand ads

On Oct 29 Krea released Ad Studio, the first Krea 3 Expert, a version of Krea 3 specialized for one job. Paste a brand URL and it builds an editable brand kit and product catalog, then generates up to 12 ads per batch for chosen placements; it also works in Claude through the Krea MCP server.

Krea launches Ad Studio, its first Krea 3 Expert model, turning a website URL into on-brand ads

Key Takeaways

  • Ad Studio is the first Krea 3 Expert, and Krea says more Experts are on the way
  • From a URL it extracts logo, colors, fonts, tone, selling points and products (Shopify catalogs supported), with up to 20 products per kit
  • Outputs 4:5, 1:1, 9:16 and 16:9 placements, up to 12 ads per batch, with conversational edits through Krea Agent
  • Krea's own timed run: brand kit in 49 seconds and six Story ads in 2 min 28 s; available on paid plans from Basic, no benchmarks published
Read full story
Linked Models & Agents:

Kimi launches 3D Make: K3.1 Pro drives Blender, CAD tools and Unreal, Unity and Godot to build models, scenes and games

Moonshot AI's official Kimi account announced 3D Make at 03:14 UTC on Oct 30, saying Kimi connects to tools such as Blender and CAD software to create models, assemble scenes and develop games, available now on kimi.ai and Kimi Work. The companion 3D guide says K3.1 Pro was specifically trained to drive 3D software through Python scripts, so specialized tools without MCP support can join the workflow, while meshes such as people and animals are handed to diffusion services like Tripo. Plugins that need locally installed software work only in Kimi Work.

Kimi launches 3D Make: K3.1 Pro drives Blender, CAD tools and Unreal, Unity and Godot to build models, scenes and games

Key Takeaways

  • Availability: 3D Make is live on kimi.ai and Kimi Work; plugins that need locally installed software are Kimi Work only
  • Two modeling routes: parametric models (furniture, mechanical parts, buildings) via Python scripts written by K3.1 Pro, and meshes via services such as Tripo, Meshy and Hyper3D
  • Engines: Kimi says it is adapted to Unreal Engine, Unity and Godot to import models, assemble scenes and build gameplay step by step
  • Showcase: the celestial palace in the K3.1 Pro launch video was built in Unreal Engine 5.8 from source models totaling 36 million triangles, rendered with Nanite and Lumen
  • Benchmarks: no 3D benchmarks were published; the guide admits some tasks need several rounds, and rigging and complex materials remain weak spots
Read full story

GitHub Copilot Automations go team-wide: repo-owned shared automations, 24 new triggers, 20 new tools and AI credit limits

At GitHub Universe on Oct 28, GitHub shipped a batch of Copilot Automations updates. Shared automations now belong to the repository, act as Copilot, bill AI credits to the repo owner and keep running after their creator leaves. Automations gain 24 new GitHub event triggers, REST API triggers from external systems and chaining, plus 20 new tools and custom MCP servers. Teams can cap AI credits per run, day, week or month, automations can propose improvements to their own prompts from real outcomes, and VS Code 1.144 can run them in the cloud.

GitHub Copilot Automations go team-wide: repo-owned shared automations, 24 new triggers, 20 new tools and AI credit limits

Key Takeaways

  • Shared automations belong to the repository: anyone with read access can view them, anyone with write access can edit, actions are attributed to Copilot and AI credits bill to the repo owner
  • 24 new triggers across issues, pull requests, discussions and security alerts, plus REST API triggers from systems like Jira, Sentry and PagerDuty
  • 20 new GitHub tools (merge PRs, retry workflow runs, upload screenshots and more) and support for custom MCP servers
  • AI credit limits can be set per run, day, week or month; org repos need an admin to enable the "Allow use of Copilot cloud agent billed to the organization" policy
  • Rolling out to Copilot Pro, Pro+, Max, Business and Enterprise; VS Code 1.144 runs them in the cloud with chat.automations.cloud.enabled
Read full story

Shopify Fall ’26 Edition bets on agentic commerce: Shop.md shopping skill, Shop.dev single connection, and Shop Pay inside Muse, Claude Duet, Grok Bot and other personal agents

On Oct 28 Shopify shipped its 10th Edition (Fall ’26, theme Exponential, 150+ updates including 57 for developers), centered on opening its catalog, cart and checkout to any agent. Shop.dev gives one connection to Shopify Catalog (1B+ products), sign-in with Shop, cart, checkout and Shop Pay; Shop.md is a customizable skill that turns ChatGPT, Claude or other agents into personal shoppers; Shop Pay now works inside Meta’s Muse, Claude Duet and Instinct, and Claude Duet, Grok Bot and Instinct can also use it for brands not on Shopify. Every Liquid and Hydrogen storefront and checkout now exposes WebMCP tools.

Shopify Fall ’26 Edition bets on agentic commerce: Shop.md shopping skill, Shop.dev single connection, and Shop Pay inside Muse, Claude Duet, Grok Bot and other personal agents

Key Takeaways

  • Scale (vendor figures): Shopify Catalog has 1B+ products and Shop Pay 400M+ shoppers; the Edition has 150+ updates, 57 of them for developers
  • Shop.dev is one connection for Catalog, sign-in with Shop, cart, checkout and Shop Pay; the underlying Shop MCP server is mcp.shop.com and search needs no API key
  • Shop Pay in personal agents starts with Muse from Meta, Claude Duet and Instinct; Claude Duet, Grok Bot and Instinct can also buy from brands off Shopify, with the card never shared with the agent and tokens from Mastercard, Visa and Discover (Amex coming)
  • WebMCP tools ship on every Liquid and Hydrogen storefront and checkout so browser agents can search, update the cart and check out after buyer approval
  • For developers: a one-command app security check in the Shopify CLI AI Toolkit, and a rebuilt Hydrogen plus the open-source Next.js Vercel Shop template are now generally available
Read full story
ADSponsored

Google previews Connected Apps Platform: one MCP or Android AppFunctions integration for Gemini and Search

On Oct 28 Google launched a preview of its Connected Apps Platform. Developers integrate through a cloud-hosted MCP server or Android MCP (Jetpack AppFunctions), then register, test and submit for review in Google Connected Console, choosing whether the app goes live in Search, the Gemini app, or both. Access is phased and currently limited to US developers who apply.

Google previews Connected Apps Platform: one MCP or Android AppFunctions integration for Gemini and Search

Key Takeaways

  • Two integration paths: a cloud-hosted remote MCP server (authorized with OAuth 2.1), or Jetpack AppFunctions on Android (Android MCP), where tools run on the device
  • One console: Google Connected Console handles tool registration, testing, review and publishing, and shows traffic, latency and error rates once live
  • Distribution choice: before review, pick Search, the Gemini app, or both
  • Today: more than 50 Connected Apps across Search and Gemini; Adobe, Experian, Localiza and Peloton are live in Gemini and come to Search in the coming weeks, and Calm launches on both
  • Limits: phased preview for US developers who apply; Google has not said when it opens broadly
Read full story

Vercel CI enters beta: runs only the Turborepo tasks a change affects, 2-6x faster CI built for coding agents

On Oct 28 Vercel launched Vercel CI in beta on all plans. It reads turbo.json, runs only the tasks affected by a code change, serves unchanged tasks from Remote Cache, and gives each task its own machine on Hive, Vercel's compute layer. Vercel says time from git push to "CI passed" in its own repos is 2-6x faster and that nearly 8 million tasks have run across its repos and the private beta; agents can watch and debug CI through the Vercel CLI and MCP.

Vercel CI enters beta: runs only the Turborepo tasks a change affects, 2-6x faster CI built for coding agents

Key Takeaways

  • Speed: push-to-"CI passed" time in Vercel's own repos is 2-6x faster (vendor figure)
  • Scale: nearly 8 million tasks completed across Vercel's repos and the private beta
  • Setup: add "tags": ["ci"] to a task in turbo.json, with no workflow YAML, and Remote Cache is on by default
  • Agent-ready: vc ci ls, inspect, logs and grep plus Vercel MCP let agents inspect runs, logs and flaky tests
  • Compatible: posts a check to GitHub pull requests so existing branch protection still works; beta on all plans
Read full story

Apple Creator Studio adds AI assistants built on Apple models and OpenAI to Logic Pro, Keynote, Pages and Numbers, plus MCP support so external agents can edit iWork documents

On October 27 Apple announced a major Apple Creator Studio update: Logic Pro for Mac plus Keynote, Pages and Numbers gain beta intelligent assistants that Apple says are powered by a combination of Apple-built models and OpenAI and understand document context. Keynote, Pages and Numbers also add Model Context Protocol (MCP) support, letting external AI agents read content, make edits and run automated actions inside the apps. Pixelmator Pro adds natural-language Generate Fill, and Keynote introduces the open JSON-based .keyx format. The update ships free to existing subscribers on the App Store in November; pricing stays $12.99 per month or $129 per year.

Apple Creator Studio adds AI assistants built on Apple models and OpenAI to Logic Pro, Keynote, Pages and Numbers, plus MCP support so external agents can edit iWork documents

Key Takeaways

  • Logic Pro for Mac, Keynote, Pages and Numbers gain beta assistants that Apple says run on a combination of Apple-built models and OpenAI
  • Keynote, Pages and Numbers support MCP so external AI agents can read content, edit and automate actions (requires macOS 27 or later)
  • Keynote adds the open JSON-based Keynote Interchange Format (.keyx), designed to be readable by external tools and AI agents
  • Assistants are U.S. English only and need an Apple Intelligence-capable device on iOS, iPadOS or macOS 27; free update for subscribers in November
  • Pricing unchanged at $12.99 per month or $129 per year, $2.99 per month for education
Read full story

Canva launches Canva Craft, its first in-house image model: plans the layout before rendering, outputs up to 2K, renders text in 55 languages, and is open to all users and the public API

On Oct 22 Canva released Canva Craft, the first image-generation foundation model trained from scratch by its in-house lab, Canva Research. It works in two stages: a planning model writes out the composition (elements, spatial relationships, hierarchy and any text), then a rendering model produces the image at up to 2K across more than 30 aspect ratios. Training leaned heavily on millions of human-made templates from Canva's library, such as posters, social posts, slides and infographics. Canva says it debuted 4th overall on the crowdsourced DesignArena leaderboard and 1st in the People & Portraits and Landscapes & Nature categories. It is available now to all Canva users in Dream Lab and to developers through the Connect API as craft_v1_2k, with Canva MCP access coming soon.

Canva launches Canva Craft, its first in-house image model: plans the layout before rendering, outputs up to 2K, renders text in 55 languages, and is open to all users and the public API

Key Takeaways

  • Two-stage design: a planning model writes the composition (elements, relative scale, hierarchy, text), then a rendering model outputs up to 2K across 30+ aspect ratios (announcement)
  • Vendor-reported ranking: 4th overall on DesignArena, 1st in People & Portraits (of 87 models) and Landscapes & Nature (of 85), 2nd in Abstract & Patterns and 4th in Products
  • Training emphasized millions of human-made Canva templates; designers judged more than 25,000 head-to-head image pairs against leading models
  • For developers: POST /v1/image-generations on the Connect API with model set to craft_v1_2k, which spends the user's AI credits (API docs)
  • Prompts work in any language and in-image text covers 55 languages; the faster, cheaper Craft-fast and Craft-ultrafast variants and MCP access are not out yet
Read full story
Linked Models & Agents:
⚡ Canva Craft⚡ Craft-1 2K🌐 Canva

Forever Security: a web-planted AGENTS.md in ~/Downloads hijacked Codex into installing npm malware in 90%+ of tests; a CLAUDE.md variant leaks Claude Code OAuth tokens about half the time

On Oct 22, Forever Security researchers Gal Weizman and Omer Samet reported that they had stopped Codex on a real customer machine as it tried to install the known-malicious npm package function-color, following an AGENTS.md in ~/Downloads the customer had never seen. A web page can drop a file into Downloads with no click, and an agent started there obeys it. In their reproduction Codex rewrote the machine-wide ~/.codex/config.toml to register a malicious MCP server in more than 90% of attempts; a CLAUDE.md they crafted made Claude Code point ANTHROPIC_BASE_URL at an attacker server and leak its OAuth token about half the time. The researchers say there is no vendor bug to patch; The Hacker News and others covered it on Oct 26.

Key Takeaways

  • Real case: a 13 KB AGENTS.md disguised as engineering guidelines sat in a customer's ~/Downloads and told Codex to install the malicious package function-color (since removed by npm)
  • Codex path: it appends a project-tools MCP server to the machine-wide ~/.codex/config.toml, then spawns a child codex exec with --dangerously-bypass-approvals-and-sandbox; it worked in over 90% of tests and the server then loads in every session on the machine
  • Claude Code path: a CLAUDE.md gets ANTHROPIC_BASE_URL written into .claude/settings.json about 50% of the time, leaking the OAuth token on every request; about a fifth of the time it also reached code execution in the same session
  • Forever's telemetry shows about half of customers run a coding agent inside Downloads, and about a quarter of agent sessions open a real browser
  • Advice: never start an agent in Downloads, read AGENTS.md/CLAUDE.md files you did not write, check agent configs for unknown MCP servers or API endpoints, keep approvals and sandboxes on, and rotate tokens if you find one (write-up)
Read full story