Patch day, not model day: four disclosures hit the infra under your agents while a 40B MoE quietly landed.
Top Signal
Four disclosures in one day land on your deploy path
platform change
Simon Willison, HN Front Page
PHP shipped an emergency security release today — Simon Willison calls upgrading vital, and it's a top HN thread. Separately, the private keys of eight eMudhra intermediate CA certificates were compromised; they chain to roots trusted by Mozilla, Microsoft, Apple and Chrome, so expect distrust actions and cert churn. Railway published its own security disclosure, and GitLab pushed a critical patch (19.5.1). None of these are model news, and all four sit under the stack your agents actually run on. Do today: patch PHP and self-hosted GitLab; audit whether anything in your chain pins or terminates TLS against eMudhra-issued certs; if you deploy on Railway, read the disclosure and rotate anything that platform touched. Read alongside last week's OpenCode CLI breach — the week's pattern is that the plumbing around agents is the soft target, not the models.
Read more →
Fast Signals
Anthropic ships Claude Duet; HN hits 282 points in hours
platform change
HN Front Page
A new first-party Claude surface launched today and immediately drew 282 points and 236 comments on HN. The feed carries only the product page, so treat feature claims as unread until you check it yourself. Worth 10 minutes before you harden any design around current Claude Code assumptions.
Link →
Recursive Flint 40B-A2.5B fills the mid-size open-weight gap
new tool
r/LocalLLaMA
RecursiveSI dropped Flint, a 40B MoE with 2.5B active params, and r/LocalLLaMA is framing it as 'the Qwen3.8 35B we've all been waiting for' across two threads the same day. The shape matters more than the benchmark: 2.5B active means CPU-viable prefill and comfortable fit on a single 24GB card. Grab it if your local tier has been stuck choosing between a 27B dense and a 500B+ MoE.
Link →
Qwen3.8 Flash Next at IQ4_XS beats 27B Q6 in practice
workflow
r/LocalLLaMA
A longtime 3.8-27B-Q6 holdout switched to Flash Next at IQ4_XS under strata and reports it clearly winning. This is the useful quantization data point: more params at lower bits beating fewer params at high bits on the same hardware. If you defaulted to Q6 on a smaller model, re-run your own eval before buying anything.
Link →
Memory squeeze: HBM sold out through 2027, 3090s moving
emerging signal
r/LocalLLaMA
Samsung has sold 100% of 2027 HBM capacity with prices projected up 200%, DRAM up double digits, and China is doubling RAM output in response — three separate r/LocalLLaMA threads today, plus a visible run on used 3090s. This is the third time in a week the sub has converged on hardware capex. If a local rig is on your 2027 roadmap, the buying window is now, not after your next funding milestone.
Link →
wshobson/agents ports your agent config across seven harnesses
new tool
GitHub Trending
A trending plugin marketplace targeting Claude Code, Codex, Cursor, OpenCode, Copilot, Antigravity and Pi from one catalog. The real signal is harness-portable agent configuration — the thing that currently locks you into whichever CLI you started with. Bookmark for when you next evaluate switching coding agents.
Link →
748B DeepSeek-V4.1-Flash runs on a €2k PC
workflow
r/LocalLLaMA
Another build log pushing the flagship open-weight MoE onto commodity hardware, four days after the 552B-on-one-4090 writeup. The pattern is now established enough to plan around: sparse MoEs are bounded by RAM and SSD bandwidth, not VRAM. Read the config before you spec a machine for frontier open weights.
Link →
Verified 3090 hack: 15% prompt, 5% generation, free
workflow
r/LocalLLaMA
A reproducible tuning tweak claiming 15% faster prompt processing and 5% faster token generation on 3090s at no cost. Pairs with this week's power-limiting finding — there is measurable free headroom in default GPU settings. Twenty minutes to try on an existing box.
Link →
Radar
Canary tokens as an agent exfiltration tripwire
Free honeytokens that phone home when read — an old defensive tool with a new use: drop them in repos, .env files, and agent sandboxes to detect when a CLI or MCP server reads what it shouldn't. Directly answers the OpenCode and Home Assistant incidents from the last week.
Link →
AAS Core: 2,600+ agentic skills behind one MCP
A local, agent-first control plane for skill discovery, selection and stack validation, with CLI, MCP server and a workbench. Second skill-catalog project trending today — worth watching whether agent skills consolidate into registries the way packages did.
Link →
IBM Granite Speech 5.0 2B
A 2B speech model from IBM, continuing the collapse of usable speech stacks into single-digit-GB footprints. Candidate if you need on-device or self-hosted transcription without a Whisper-sized dependency.
Link →
MetaHarness and paying for outcomes, not seats
Tenex describes an AI-native SDLC sold on outcomes rather than licenses, built around something they call MetaHarness. Mostly a business-model signal, but the harness-of-harnesses framing echoes today's plugin-marketplace trend.
Link →
sparqlite: SPARQL 1.1 inside SQLite, agent-built
Simon Willison's experiment running Claude Code for web in 'Ultracode' mode produced a working Rust SPARQL engine embedded in SQLite. Useful twice over: a real graph-query option inside SQLite, and a readable example of what long-horizon agent research runs now produce.
Link →
Convergence Watch
security disclosures
TRENDING
5 mentions across Simon Willison, HN Front Page
PHP, eMudhra CA, Railway and GitLab all disclosed within 24 hours, following the OpenCode CLI breach on Oct 17. Independent incidents, but the cumulative message is consistent: the deploy and trust layer around AI tooling is where this month's failures are landing. Treat key rotation and patch cadence as a standing weekly task, not an incident response.
qwen3.8
TRENDING
1 mentions across r/LocalLLaMA
Sixth consecutive day on r/LocalLLaMA, now with holdouts converting to Flash Next at low-bit quants. Still single-source, which caps the signal, but sustained practitioner adoption rather than launch-week noise. It is the de facto local default; new models like Flint are being positioned relative to it.
local hardware capex
TRENDING
3 mentions across r/LocalLLaMA
Third appearance in six days, now with concrete supply data (HBM sold out through 2027, DRAM up double digits) rather than sentiment. Single-source but materially specific. If your roadmap assumes local inference gets cheaper, that assumption is now contradicted by named supply commitments.
deepseek v4.1 flash
TRENDING
1 mentions across r/LocalLLaMA
Third day in five with a new commodity-hardware build log. The model itself is no longer news; the repeatable hobbyist deployment recipe is. Watch for the configs to stabilize into a documented reference build.