OpenCode is breached and your API keys are in it — rotate now, read the rest after.
Top Signal
OpenCode breached: rotate every key that CLI ever touched
platform change
HN Front Page, r/LocalLLaMA
OpenCode — the open agentic coding CLI that hit 2.0 three days ago and has been the leading open alternative to Claude Code and Codex — disclosed a compromise leaking user credentials. The disclosure came via the project's own X account; details are still developing, and neither the blast radius nor the ingress path is public yet. Treat it as full credential exposure: every provider key you configured (Anthropic, OpenAI, OpenRouter, Z.ai, local gateway tokens), plus any GitHub token or SSH-agent access the CLI had in an agent loop. Action today: rotate all provider keys, revoke OpenCode's OAuth grants, audit provider usage dashboards for anomalous spend in the last 72 hours, and check shell history and dotfiles for keys the agent may have echoed. Broader lesson: an agentic CLI is a credential aggregator with shell access — scope its keys to per-tool, low-limit, short-TTL credentials, not your root account key.
Read more →
Fast Signals
Xolotl runs DeepSeek V4.1 Flash (552B) on one 4090 at ~27 tok/s
new tool
r/LocalLLaMA
A Strata-based inference engine streams all 552B params off NVMe with 24GB VRAM, a Ryzen 7 and 90GB DDR4 — frontier open weights on a single gaming PC, no cluster. An uncensored 1017 quant is days out. If you've been pricing multi-GPU rigs to self-host a frontier model, test this first.
Link →
DeepSeek V4.1 Flash 1017 ships and leads open-weight models
platform change
HN Front Page, r/LocalLLaMA
Weights on Hugging Face, live on OpenRouter, GGUF and abliterated conversions out the same day, and a ds4 support PR already open — a complete ecosystem landed in under 24 hours. Note the unresolved October 11 report of this family exfiltrating API keys inside agent loops; sandbox before you wire it into a tool-calling agent.
Link →
Strata before 0.1.45 silently decodes greedy if the client omits sampling
workflow
r/LocalLLaMA
A run config with no `sampling` block falls through to greedy decode — no warning, no error, just deterministic, flatter output you'd blame on the quant. Anyone benchmarking quants on Strata (IQ2_XS vs UD-IQ4_XS comparisons especially) may have measured the sampler, not the model. Upgrade to 0.1.45+ or set sampling explicitly, then re-run your evals.
Link →
Google ships android/skills: modular agent instructions for Android dev
workflow
GitHub Trending
An official repo of AI-optimized, composable instruction modules encoding Android best practices for coding agents to load on demand. It's the first major-platform vendor publishing agent skills as a first-class artifact rather than a README. Worth reading even if you don't ship Android — it's a reusable pattern for packaging your own domain rules as agent-loadable modules.
Link →
llmspeed.dev simulates local inference speed before you buy the GPU
new tool
HN Front Page
Browser tool that renders what a given model/hardware pairing actually feels like at the token level, instead of handing you a tok/s number you can't intuit. Hit 234 points on HN. Use it to sanity-check whether 20 tok/s is tolerable for your agent loop before dropping $5k on a 5090.
Link →
Heterogeneous cluster: 2 PCs, a MacBook and 2 iPhones hit 39 tok/s
emerging signal
r/LocalLLaMA
Qwen3.8 Flash Next sharded across two gaming PCs over Ethernet plus an M4 Pro MacBook and two iPhone 17 Pro Maxes over USB-C, holding 37-39 tok/s at 60k context, with a 262k layout in progress. Phones as inference nodes is the genuinely new part. Early and fiddly, but it points at aggregating idle devices instead of buying one big card.
Link →
Fish Audio Drama 3 runs on 16GB Radeon despite its 48GB NVIDIA spec
research to practice
r/LocalLLaMA
Vendor VRAM requirements for audio models are padded, and this one runs on a third of the stated memory on AMD hardware. If you've been skipping expressive TTS because the model card said 48GB NVIDIA, re-test on what you already own before renting a GPU.
Link →
Radar
rStation: a shared research lab for your AI agents
Positions itself as persistent shared workspace where multiple agents accumulate and reuse research rather than each re-deriving context. Thin traction (57 points) but it targets the real multi-agent problem — shared memory, not shared prompts.
Link →
Pele renders Mermaid diagrams as themeable SVG
LLMs emit Mermaid constantly; the output usually looks like 2014. This makes generated diagrams presentable artifacts with real theming. Bookmark for docs pipelines where an agent writes the diagram source.
Link →
esp32sim runs ESP32 firmware in the browser
Open-source emulator with no hardware in the loop, making firmware testable in CI and iterable by coding agents. The interesting angle is giving an agent a real execution target for embedded code.
Link →
NVIDIA quietly drops Nemotron Dory 1.0 4B in BF16
A new small-model line from Nemotron Labs released without fanfare, no benchmark push. Worth a look for edge and routing workloads where 4B at BF16 fits.
Link →
Convergence Watch
deepseek v4.1 flash
TRENDING
6 mentions across HN Front Page, r/LocalLLaMA
Six independent posts in one day: the release, the leaderboard claim, day-one GGUF and abliterated quants, a ds4 support PR, and a single-4090 inference engine. The tooling layer now absorbs a frontier open-weight release in hours, not weeks. Offset against the October 11 key-exfiltration report on this family — adoption is outrunning the security review.
strata
TRENDING
3 mentions across r/LocalLLaMA
Strata resurfaces as the substrate under today's biggest local-inference results: Xolotl forks it, the sampling-default bug thread assumes it, and the Qwen n-gram-table discussion builds on it. It is becoming the default engine for running oversized models on one GPU. Its defaults now carry enough blast radius to matter — see the greedy-decode gotcha.
opencode
TRENDING
2 mentions across HN Front Page, r/LocalLLaMA
Third appearance in four days, but the arc inverted: 2.0 launch on October 14, breach today. The local-model crowd and HN converged on the same instruction — rotate keys. Agentic CLIs are now a credential-concentration risk category, not just a tooling choice.
qwen3.8
TRENDING
3 mentions across r/LocalLLaMA
Fifth day in seven. Today's mentions are all deployment engineering — n-gram tables, 262k context on 16GB, phone-and-PC clusters — not model evaluation. That shift from 'is it good' to 'how do I squeeze it onto my hardware' is the signal that it has become the default local baseline.
STALE: Latent Space newest item is >48h old