Supply chain prompt injection hits the vibe-coder ecosystem; a new CLI catches AI code rot before it ships.
Top Signal
AISlop: CLI catches AI code smells that pass linting and tests
new tool
HN Show
Kenny released aislop (github.com/scanaislop/aislop), a CLI that scans codebases for AI-generation artifacts: empty catch blocks, useless comments, duplicated helpers, dead code, and similar patterns that linters miss. Born from direct use of Claude Code, Codex, and opencode. The problem it targets is real — AI agents produce code that compiles, passes tests, and ships, then gradually degrades maintainability. Unlike static analysis tools, aislop is tuned to the specific failure modes LLM-generated code exhibits. Action: add it as a CI gate on PR diffs generated by coding agents. Early days (~56 HN points), so shape it to your codebase's needs. If you're shipping AI-assisted code at any volume, this category of tool will become table stakes.
Read more →
Fast Signals
Dev embeds data-nuking prompt injection in OSS code targeting AI agents
emerging signal
r/LocalLLaMA
A developer, frustrated with vibe-coding culture, reportedly hid a prompt injection in published code designed to nuke data when executed by an AI coding agent with broad file access. This is the supply chain attack vector builders have been warned about — malicious instructions embedded in dependencies, silently executed by agents. Treat any LLM-assisted code review of external deps as a hard security boundary, not a convenience.
Link →
Anthropic publishes detailed Claude sandboxing architecture
platform change
Simon Willison
Anthropic's engineering blog documents exactly how they isolate Claude across products — process boundaries, capability restrictions, audit trails. Simon Willison flags it as unusually thorough for an industry that rarely documents sandboxing. Required reading if you're deploying Claude agents in production or designing agent isolation for any LLM system.
Link →
Cursor releases official plugin spec and plugin repo
platform change
GitHub Trending
Cursor published a formal plugin specification and official plugins repo (cursor/plugins on GitHub Trending), with each plugin as a standalone directory containing a .cursor-plugin/plugin.json manifest. This mirrors Claude Code's skill file pattern. The plugin surface area for AI coding agents is formalizing fast — define your domain-specific plugins now before ecosystem conventions lock in.
Link →
Harness: meta-skill that generates specialized agent teams and their skills
new tool
GitHub Trending
revfactory/harness (GitHub Trending) is a meta-skill for Claude Code that takes a domain description and outputs a full agent team spec — specialized agents, their roles, and the skill files they use. It's skill-file generation automated. Low stars, early days, but directly extends the skill files trend into structured multi-agent territory.
Link →
MTP hits 3.34x faster inference on Gemma 4 & Qwen 3.6 across vLLM + llama.cpp
research to practice
r/LocalLLaMA
An RTX 6000 PRO benchmark confirms multi-token prediction at 3.34x inference speedup across both vLLM and llama.cpp for Gemma 4 and Qwen 3.6 — real-world prosumer hardware, not a lab claim. If you're serving local models and haven't enabled MTP, this is the benchmark that justifies the config change today.
Link →
Pyodide + service worker runs full Python ASGI apps entirely in-browser
workflow
Simon Willison
Simon Willison documents a technique for running ASGI Python apps (Flask, FastAPI, Datasette) entirely client-side via Pyodide and a service worker — no server required. Datasette Lite ships this today. Directly actionable for zero-infrastructure demos, client-side data tools, or offline-capable Python apps without a JS rewrite.
Link →
MOSS-TTS 1.5: open-source voice cloning drawing cross-source attention
new tool
GitHub Trending, r/LocalLLaMA
OpenMOSS/MOSS-TTS hit both GitHub Trending and r/LocalLLaMA independently for high-fidelity voice cloning, multi-speaker dialogue, and environmental sound generation. Appears to be a credible open-source alternative to ElevenLabs-tier voice work. Bookmark if voice I/O is on your roadmap.
Link →
Radar
Gemma 4 dense-to-MoE: community does post-release model surgery
JDONE-Research released AIOne-Agent-52B-A36B-it — Gemma 4 31B dense mutated into a native additive-MoE architecture, not a simple merge or quant. Community-level architecture modification post-release is becoming a pattern worth tracking as a technique for inference efficiency.
Link →
LiteParse: fast open-source doc parser from LlamaIndex team
run-llama/liteparse (GitHub Trending) is a Rust-backed open-source document parser aimed at LLM pipelines. From a credible team; evaluate as a self-hosted alternative to LlamaParse's paid tier if you have heavy document ingestion needs.
Link →
Use HTML as your agent's output format for free diagram rendering
r/LocalLLaMA thread argues for HTML as the primary response format for local agents — models can render diagrams, tables, and visual layouts inline without extra tooling. Zero-friction technique: change your system prompt and render in a webview.
Link →
Parallax: parameterized local linear attention for language models
New attention mechanism derived from nonparametric statistics, claims sub-quadratic cost without standard attention's overhead. Not production-validated yet, but architecturally distinct enough from current approaches to track as a potential replacement.
Link →
Convergence Watch
qwen3.6
TRENDING
10 mentions across r/LocalLLaMA, r/LocalLLaMA, r/LocalLLaMA, r/LocalLLaMA, GitHub Trending
Four consecutive days as the dominant local inference topic. Today's development: Nvidia released an official NVFP4 quant (nvidia/Qwen3.6-35B-A3B-NVFP4) and community benchmarks show 125 tok/s on 2x 4060 Ti for q4xl. Conversation has shifted from capability to production tuning — quant selection, VRAM strategy, and multi-GPU tensor split are the active threads. Model is settling into workhorse status.
ai coding agent plugin ecosystem
TRENDING
5 mentions across GitHub Trending, GitHub Trending, GitHub Trending, HN Show, GitHub Trending
Cursor plugins spec, compound-engineering-plugin (Claude Code/Codex/Cursor), claude-code, harness meta-skill, and Zot coding harness all surfaced today across independent sources. The plugin and skill layer for AI coding agents is formalizing simultaneously across every major tool. Builders who define domain-specific plugins now establish an early structural advantage before conventions solidify.
moss-tts
2 mentions across GitHub Trending, r/LocalLLaMA
First appearance across two independent sources in a single day. High-fidelity open-source voice cloning with multi-speaker dialogue and environmental sound support. Early signal — watch for third-source confirmation before committing integration effort.