Grok Build CLI silently exfiltrates your full repo and .env secrets—wire-captured.
Top Signal
Grok Build CLI uploads full git history + .env secrets to xAI cloud
platform change
r/LocalLLaMA
A developer ran Grok Build CLI v0.2.93 through mitmproxy and captured the traffic: the tool uploads your entire repo as a git bundle—full commit history—to xAI's Google Cloud regardless of what files you open. Even with the explicit prompt 'do not read or open any files,' the upload still happened. The official opt-out does not stop it. This affects anyone who has run Grok Build CLI in a repo containing .env files, API keys, SSH credentials, or proprietary code. Immediate action: treat any secrets in affected repos as compromised and rotate them now. Remove the CLI from your toolchain until xAI issues a verified fix. If you work in a team environment, flag this to your security lead—the full git history means historical credentials are exposed too, not just current ones.
Read more →
Fast Signals
Jacobian-Lens J-Space: export steered models, not just steer at inference
research to practice
r/LocalLLaMA
A developer extended Anthropic's open-source Jacobian-Lens to export models with permanently baked J-Space steering vectors—behavior changes that survive model reload without any runtime intervention. This is meaningfully different from inference-time steering: you ship a single artifact. Bookmark if you need persistent behavioral constraints without fine-tuning.
Link →
Google Stitch Skills: open MCP agent skills library for Claude Code and Cursor
new tool
GitHub Trending
Google Labs dropped a library of Agent Skills built on an open Agent Skills standard, targeting the Stitch MCP server but declared compatible with Claude Code, Cursor, and Gemini CLI. This is the clearest signal yet that the skills/plugins layer above raw MCP is consolidating around a cross-vendor open standard—worth tracking before your toolchain picks a winner.
Link →
FableCut: zero-dep browser video editor with AI agent API
new tool
HN Show
FableCut is a browser-based video editor with no external dependencies that exposes a clean programmatic API for AI agents—cut, trim, render, export without headless browser infrastructure. Early stage but the right abstraction: if you're building agents that need video output, this is the only agent-native option in the browser today.
Link →
Databricks: GLM-5.2 matches Opus 4.8 high; pi-coding-agent 2x cheaper than Claude Code
emerging signal
r/LocalLLaMA
Databricks benchmarks put GLM-5.2 on par with Claude Opus 4.8 high on coding evals, while their own pi-coding-agent runs at roughly half the cost of Claude Code and OpenAI Codex at equivalent task completion. New data on an already-trending model—if you're cost-sensitive on agentic coding pipelines, GLM-5.2 via API now warrants a direct A/B.
Link →
CPU-only voice pipeline: Qwen3-ASR + Kokoro-TTS ONNX, no GPU required
workflow
r/LocalLLaMA
Field report benchmarks a complete voice assistant pipeline—Qwen3-ASR transcription plus Kokoro-TTS ONNX synthesis—running on CPU with production-viable latency for interactive use cases. Use as your reference build for voice I/O on edge devices, embedded systems, or any deployment where GPU is unavailable.
Link →
llama.cpp b9966: -sm tensor mode was silently burning 29 regex recompiles per token
platform change
r/LocalLLaMA
If you run llama.cpp with -sm tensor in production, b9966 patches a bug causing 29 regex recompilations per tensor on every decode thread tick—pure CPU overhead added to every generated token. Update before your next prod deploy; the fix is a drop-in build update.
Link →
Quad RTX 5060 Ti: 54 tok/s Qwen3.6-27B code gen at consumer Blackwell prices
emerging signal
r/LocalLLaMA
Detailed benchmark of four RTX 5060 Ti cards running Qwen3.6-27B for code generation yields 54 tok/s decode. Total system cost sits well below equivalent 4090 configs while matching or exceeding decode speed. Reference baseline for anyone sizing a local coding-agent rig on consumer Blackwell.
Link →
Radar
PentAGI: autonomous multi-agent pentesting system on GitHub Trending
PentAGI is a fully autonomous AI agent system for end-to-end penetration testing, now trending on GitHub. First open-source autonomous security testing framework with serious traction—worth watching both as a tool pattern and as a signal that agentic security automation is entering the mainstream.
Link →
SQLite STRICT tables enforce types—relevant for agent data pipelines
SQLite STRICT mode (available since 3.37) enforces actual column type constraints, eliminating the silent type coercion that causes subtle bugs in LLM-generated SQL and agent-written data. Near-zero migration cost to add to new tables—should be a default in any agent pipeline writing to SQLite.
Link →
Convergence Watch
tencent hy3
TRENDING
2 mentions across r/LocalLLaMA, HN Front Page
Five consecutive days of coverage, now shifting from benchmarks to sustained field reports. Today's 128GB user post confirms HY3 (295B-A21B MoE) runs well on Apple Silicon with performance matching models 5x its active size. The community is validating it as a real local deployment option, not just an announcement.
glm-5.2
TRENDING
2 mentions across r/LocalLLaMA, HN Front Page
Fourth consecutive day of multi-source coverage, now with Databricks benchmark data showing Opus 4.8 parity on coding evals. The combination of cross-source momentum and independent third-party benchmarks makes this the clearest open-weight Opus-class coding alternative to emerge this cycle.
qwen 3.6 27b
5 mentions across r/LocalLLaMA
Still dominating r/LocalLLaMA but posts have shifted from 'is it good?' to optimization questions—context window limits, dual-GPU configs, quantization tradeoffs. Community has moved from evaluation to adoption. No new builder signal today; this is now settled infrastructure rather than emerging signal.
STALE: Latent Space newest item is >48h old