AI Coding Live News

Claude Code Sent Account Emails in User-Agent Headers: Anthropic Engineer Apologizes, 2.1.317 Adds a Privacy Mod, Next Release Removes Email From Model Context

GitHub issue #107757 (2026-11-05) reported that Claude Code put the signed-in account email into the User-Agent of web requests to third-party sites, which the reporter linked to a flood of scam emails; the issue drew 955 reactions and the HN thread hit 1,582 points. Lydia Hallie, who works on Claude Code, apologized on HN: the email was added to model context so @author tags would stop hallucinating names, and the next release (expected early next week) removes it. The interim fix is the built-in privacy mod on by default in 2.1.317+, whose own README calls it a courtesy, not a boundary.

Key Takeaways

  • Cause (per an Anthropic engineer): the signed-in email sat in model context, and when the model wrote its own curl it used it as a User-Agent contact
  • Reach: issue #107757 has 955 reactions and 103 comments; the HN thread reached 1,582 points and 506 comments
  • Stopgap: from 2.1.317 (npm, Nov 2) the default-on cc-plugin-privacy mod refuses Bash/PowerShell calls that hold the email and name a User-Agent
  • Gaps (per its README): WebFetch, WebSearch, MCP tools, scripts, variables and emails in URLs are not checked
  • Status: stable is still 2.1.311 and latest is 2.1.319; the real fix needs the next release that drops email from context
Read full story

Apiiro: Claude Code's "Don't Ask Again" Saves Approved Commands—Passwords Included—to settings.local.json; 2,539 Secrets Found on Public GitHub

On 2026-11-05 Apiiro researchers Shmulik Cohen and Matan Giladi reported that when a Claude Code user picks "Yes, and don't ask again" on an exact command, the command is saved verbatim—any password or token included—to the project's .claude/settings.local.json. Of 104,185 public GitHub copies of that file, 1,122 hold at least one secret; counting git history, shared settings.json and saved agent transcripts, the total is 2,539 secrets across 1,994 repos. Apiiro did not test whether the credentials work and advises rotating first, then cleaning up.

Key Takeaways

  • Trigger: when "don't ask again" saves an exact command, any password or token in it lands verbatim in .claude/settings.local.json
  • Scale (Apiiro figures): 1,122 of 104,185 public copies (~1.1%) hold secrets, 1,379 distinct; 2,539 secrets across 1,994 repos overall
  • Mix: over a third open a database directly (379 DB passwords), plus 43 SSH logins, 42 GitHub/GitLab/npm tokens and 23 AWS keys
  • Scanner gap: gitleaks flagged 564 and TruffleHog 643; 215 files were missed by both, mostly passwords typed inside commands
  • Fix: rotate every secret the file ever held, then git rm --cached and add it to the repo's own .gitignore; prefer pattern rules like npm test *
Read full story

Microsoft Foundry Local Wires Qwen3.8-27B into GitHub Copilot: Local Coding Agent on ~24 GB VRAM; Vendor Terminal-Bench 2.1 ~73.0

On 2026-11-05 Microsoft Foundry blogged that Foundry Local CLI 0.13.0+ can run 4-bit Qwen3.8-27B (~18 GB weights) on-device via ONNX Runtime and connect it to GitHub Copilot through Bring Your Own Key. Needs an NVIDIA GPU with at least 24 GB VRAM (about 64K context on 24 GB; up to the model's 262K max on 32 GB+). Vendor-cited model-card scores include Terminal-Bench 2.1 73.0 and SWE-bench Pro 61.7; Microsoft also reports higher generation speed than same-quant llama.cpp on RTX 5090 and DGX Spark. Mac and AMD support are still on the roadmap.

Microsoft Foundry Local Wires Qwen3.8-27B into GitHub Copilot: Local Coding Agent on ~24 GB VRAM; Vendor Terminal-Bench 2.1 ~73.0

Key Takeaways

  • Shape: Foundry Local 0.13.0+ runs 4-bit Qwen3.8-27B (~18 GB weights) and connects to the GitHub Copilot app via BYOK
  • Hardware: NVIDIA GPU with >=24 GB VRAM; ~64K context on 24 GB, up to 262K on 32 GB+; install CUDA/cuDNN yourself
  • Vendor-cited model-card scores (not a 4-bit re-run): Terminal-Bench 2.1 73.0, SWE-bench Pro 61.7, NL2Repo-Bench 42.3, DeepSWE 1.1 42.2
  • Stack: ONNX Runtime + DFlash2 speculative decoding + INT4/KV quant + prefix caching; Microsoft says the gap vs llama.cpp widens past 131K tokens
  • Limits: Microsoft says cloud models still win on hard reasoning; Mac/AMD not shipped; Copilot CLI local model does not imply offline—set COPILOT_OFFLINE separately
Read full story

PSI Announces Aaronson–Ambainis Conjecture Proof: Non-Public Anthropic Model, Lean Formalization Open-Sourced

On 2026-11-06, Physical Superintelligence (PSI, @psipbc) said its internal research system, running non-public Anthropic model instances, produced a complete proof of the Aaronson–Ambainis conjecture (open since 2008) on day three, accepted by Lean, then improved the result twice. The research page and Lean 4 formalization repo are public. Vendor wording; no journal peer review yet; the README still asks humans to check that the formal statement matches the printed conjecture.

PSI Announces Aaronson–Ambainis Conjecture Proof: Non-Public Anthropic Model, Lean Formalization Open-Sourced

Key Takeaways

  • Sources: PSI research page 2026-11-06 + @psipbc original post + GitHub physical-superintelligence/aaronson-ambainis
  • Claim: complete proof on day three, accepted by Lean; two later improvements also Lean-accepted (vendor wording)
  • Implication: if the conjecture holds, quantum machines get at most polynomial speedups on random unstructured inputs; PSI now calls it a theorem
  • Checkability: public Lean 4.33/Mathlib repo; four main theorems with no sorry/extra axioms; README still leaves statement fidelity to human readers
  • Limits: Anthropic model unnamed, no journal peer review, paper prose not machine-checked — cite as vendor claim
Read full story
Linked Models & Agents:
ADSponsored

Voyager Opens vork: Headless 3D/VFX Engine for Agents; Core API ~2,500 Tokens; Free Research Preview

On 2026-11-06, Voyager/vork author Ravi Parikh (@ravisparikh; GitHub swag) posted on X announcing vork: a headless 3D/VFX engine for AI agents (Rust + Slang, Vulkan/Metal). Official docs say getting-started help is about 2,500 tokens; a million uniquely steered birds rendered in about 97 seconds on one NVIDIA L4. Research-preview source is at github.com/voyager-so/vork and free during preview. First-hand author announcement, not a big-lab product line.

Voyager Opens vork: Headless 3D/VFX Engine for Agents; Core API ~2,500 Tokens; Free Research Preview

Key Takeaways

  • Source: Ravi Parikh (@ravisparikh) X post 2026-11-06 + voyager.so/vork and GitHub voyager-so/vork (research preview)
  • Design: no GUI; agents author scenes/shaders/cameras/physics as code, then render and revise; getting-started help ~2,500 tokens (vendor)
  • Perf (official site): ~1M birds on one L4 in ~97s; vs projected Blender EEVEE with finished flock ~8–11× (excludes ~3 min warmup)
  • Author X post also claims up to ~24× and EEVEE ~31 min—prefer the site's careful comparison; label author claims
  • Limits: no fog/volumes yet; heavy interiors may abort on Mac; path tracer slower than Cycles; free source-available preview
Read full story
Linked Models & Agents:

GitHub Project Rubicon: New Git Storage Hits ~5,000 Concurrent Agents and ~7,200 Pushes/sec in Internal Tests

On 2026-11-05 GitHub Engineering detailed the next-gen Git storage announced at Universe (codename Rubicon). Vendor internal tests: ~5,000 concurrent agents and ~7,200 pushes/sec on one repo with low-latency reads. Objects live in Azure Blob; reference updates go through Ref-CAS; disposable virtual replicas serve compute. Limited private preview; broader rollout early next year.

GitHub Project Rubicon: New Git Storage Hits ~5,000 Concurrent Agents and ~7,200 Pushes/sec in Internal Tests

Key Takeaways

  • Source: GitHub Blog Inside GitHub's new Git storage architecture (2026-11-05) + @github; prior series Building… and The bridge…
  • Scale (vendor internal tests): ~5,000 concurrent agents and ~7,200 pushes/sec on one repo with low-latency reads
  • Architecture: objects/packs in Azure Blob; refs + pack manifest in Ref-CAS; virtual replicas scale out; compaction/GC on separate nodes
  • Principles: coordinate only reference updates; decouple storage from compute so adding read capacity does not slow writes
  • Availability: limited private preview; broader rollout early 2027; Git workflows unchanged for developers
Read full story
Linked Models & Agents:

JetBrains 2026.3 Ships Air Natively: Run Claude Agent, Codex, Copilot, Junie in-IDE; BYO Subscriptions Locally; Junie Lite Free

On 2026-11-06, JetBrains (@jetbrains) amplified Head of AI in IDE Denis Shiryaev: starting with 2026.3, Air ships with all JetBrains IDEs. Connect Claude Agent, Codex, GitHub Copilot, and Junie in-IDE, and add Gemini CLI, OpenCode, and more via the ACP registry; local sessions need no JetBrains AI subscription, and Junie Lite is free with a JetBrains Account. Official 2026.3 blogs (IntelliJ / CLion / PyCharm, ~2026-11-05) and jetbrains.com/air/ides match.

JetBrains 2026.3 Ships Air Natively: Run Claude Agent, Codex, Copilot, Junie in-IDE; BYO Subscriptions Locally; Junie Lite Free

Key Takeaways

  • Source: @jetbrains amplify on 2026-11-06 of @literallydenis (JetBrains Head of AI in IDE); CLion/IntelliJ 2026.3 blogs ~2026-11-05
  • Ship: Air ships natively with all JetBrains IDEs from 2026.3 (follow-on to October EAP)
  • Agents: Claude Agent / Codex / Copilot / Junie out of the box; Gemini CLI, OpenCode, Antigravity, Pi via ACP registry
  • Billing: local BYO ChatGPT/Copilot/Google/Claude subscriptions or API keys—no JetBrains AI required; Junie Lite free with a JetBrains Account
  • Capabilities: parallel Git worktrees, line comments on diffs, MCP/Skills, IDE symbol search/refactor/inspections/run configs; debugger in IDEA/CLion
Read full story

OpenAI Codex CLI 0.167.0: Agent Command Center with Unread Marks, Backend Switching that Keeps Drafts, Vertex AI Setup Wizard

On 2026-11-06 OpenAI shipped Codex CLI 0.167.0 on GitHub and the ChatGPT/Codex changelog. Open the agent command center with codex agents --no-daemon (unread results marked); switch connected backends in the terminal session picker while keeping drafts; preview local images; expand patches during approval prompts; optionally enable a Google Cloud Vertex AI setup wizard.

Key Takeaways

  • Official: GitHub rust-v0.167.0 (2026-11-06T01:40Z) and same-day ChatGPT/Codex changelog entry
  • Command center: codex agents --no-daemon; unread results marked in the center and session picker
  • Multi-backend: switch connected backends from the terminal session picker while keeping drafts
  • UX: local image previews in supported terminals; expand patch details while an approval prompt is open; network approval prompts close when requests end and serialize per endpoint
  • Auth: enable gcp_setup_wizard for Vertex AI under Sign in another way (ADC or credential file); opt into macOS/Windows system proxies from /experimental
Read full story
Linked Models & Agents:

Cursor Launches Live Apps: Cloud Agents Build, Add Postgres, Cursor SSO and Hosting, Run Security Checks, Then Share a Link

On November 5 Cursor shipped Build Live Apps: describe a tool to a cloud agent and Cursor builds the web app, adds Postgres if needed, sets up Cursor SSO auth and hosting, runs deterministic and agentic security checks, then publishes to a domain you choose with a shareable link for people, groups or the whole team. Works with Origin and GitHub repos on all paid plans with cloud agents enabled.

Cursor Launches Live Apps: Cloud Agents Build, Add Postgres, Cursor SSO and Hosting, Run Security Checks, Then Share a Link

Key Takeaways

  • Flow: start a cloud agent and say you want an app; Cursor handles scaffolding, Postgres if needed, Cursor SSO auth and hosting
  • Publish: pick a unique domain for a live link; repos on Cursor Origin and GitHub, GitLab and others "coming soon"
  • Safety: deterministic and agentic checks (secrets in files, exposed credentials) run first; nothing goes live until checks pass and you publish
  • Controls: admins see every app and secret, add review rules, approve blocked publishes and unpublish any app
  • Sharing & plans: behind Cursor sign-in for people, groups or the team, public sharing on individual plans; all paid plans with cloud agents
Read full story

GitHub Copilot Comes to JetBrains Air: Run Coding Tasks Locally in the IDE or in Isolated Cloud Environments via ACP, Billed to Your Copilot Subscription

On November 3 GitHub announced on its official changelog that GitHub Copilot is now available in JetBrains Air. The integration is built on the Agent Client Protocol (ACP): developers pick Copilot in Air's agent picker, delegate coding tasks, track several sessions in parallel and review changes next to their code. Tasks can run locally in a JetBrains IDE or in isolated cloud environments through Air Teams, and they draw on the Copilot subscription rather than JetBrains AI credits.

GitHub Copilot Comes to JetBrains Air: Run Coding Tasks Locally in the IDE or in Isolated Cloud Environments via ACP, Billed to Your Copilot Subscription

Key Takeaways

  • Copilot now appears in JetBrains Air's agent picker and works with an existing Copilot account
  • The integration uses the Agent Client Protocol (ACP) and can be used alongside the existing GitHub Copilot plugin
  • Developers can track multiple agent sessions in parallel and review changes next to their code using project context and IDE tools
  • Cloud tasks run through Air Teams, each in a Docker container on a fresh virtual machine, with traffic through a proxy and no state kept between tasks
  • Cloud tasks use the Copilot plan rather than JetBrains AI credits, but Air analytics do not include Copilot usage and admins cannot set Copilot spending limits inside Air
Read full story
ADSponsored

GitHub Copilot Comes to Xcode's Built-In Coding Assistant in Public Preview With Xcode 27.3 Beta, Supported on All Copilot Plans

GitHub's official changelog says Copilot now works directly in Xcode's built-in coding assistant, in public preview starting with Xcode 27.3 beta. It needs macOS Tahoe 26.6 or later, is set up under Xcode > Settings > Intelligence, and supports all Copilot plans; the existing Copilot for Xcode extension stays available.

Key Takeaways

  • Copilot joins Xcode's native coding assistant in public preview, starting with Xcode 27.3 beta
  • Requires macOS Tahoe 26.6 or later
  • Set it up under Xcode > Settings > Intelligence; all Copilot plans are supported
  • The existing GitHub Copilot for Xcode extension remains a separate option
  • Apple's Xcode 27.3 beta 1 release notes list it under Coding Intelligence
Read full story

Google Antigravity v2.29 Brings Remote Agents and a Gemini Live Voice Mode: Agent Sessions Run in a Google-Managed Cloud and Keep Working After You Close Your Laptop, Rolling Out to AI Pro and Ultra

Ivan Leo, who works on developer experience at Google DeepMind, shared the official docs for Antigravity's new Remote Agents feature on X on November 4. Per the docs, Remote Agents run agent sessions and tools in an isolated, Google-managed remote environment, so tasks keep going when you close your laptop or browser or switch between desktop and mobile. Sessions start from the Antigravity App, the Antigravity CLI (1.4.12+, agy --remote-agent) or the web at antigravity.google.com, and remote projects can attach GitHub repositories, Google Drive files and uploads. It is rolling out gradually to Google AI Pro and Ultra subscribers on personal accounts; it is not available on the free plan, AI Plus or business accounts. The official changelog shows this ships in Antigravity v2.29.0 (November 3), which also starts rolling out a voice mode powered by Gemini Live for handing requests to the agent by voice, redesigns the Automations page into Scheduled, Always on and Paused lists, and adds a native Jupyter notebook viewer.

Key Takeaways

  • Remote Agents run in an isolated Google-managed environment with no local machine required; Remote Control instead connects to your own computer or server, and the web sidebar switches between them.
  • Three entry points: a New Remote Project in the Antigravity App, agy --remote-agent in CLI 1.4.12+, or antigravity.google.com in any browser, including mobile.
  • Remote projects can attach GitHub repositories (cloned automatically), Google Drive files and uploads (8 MiB per file, 100 MiB per project, 2 GiB per account).
  • CLI remote sessions default to the always-proceed (turbo) permission preset, so commands run without approval; locally installed MCP servers, plugins and skills are not available remotely yet.
  • Also in v2.29.0 (November 3): a Gemini Live voice mode rolling out gradually, a redesigned Automations page, and native rendering of .ipynb notebooks.
Read full story

Axion 1.0 Open Agent Foundation Model: Two SFT Stages Plus RL, 35B-A3B Reproduction Checkpoint Under Apache 2.0, Full Recipe Released

arXiv paper 2611.03233 by Yuqi Jia, Yunjie Tian and five co-authors introduces Axion 1.0, an agent foundation model that is open beyond its weights. It uses just two lightweight SFT stages plus reinforcement learning, with no dedicated mid-training, DPO or on-policy distillation, and about 18K SFT trajectories in total. Training code is hosted under the bytedance GitHub organization, and the training data and an Axion 1.0-35B reproduction checkpoint (Qwen3.6-35B-A3B base, 35B total / 3B active, Apache 2.0) are on Hugging Face; weights for the paper's 122B model are listed as coming soon.

Axion 1.0 Open Agent Foundation Model: Two SFT Stages Plus RL, 35B-A3B Reproduction Checkpoint Under Apache 2.0, Full Recipe Released

Key Takeaways

  • A minimal recipe: SFT stage one for self-contained scientific reasoning, stage two for tool use and information seeking, then RL for long-horizon interaction, with 18,363 SFT trajectories and 484 RL tasks
  • The release covers data construction, generation, filtering, verification, prompts and training code (GitHub), not just weights
  • The 35B reproduction checkpoint scores 52.8 on HLE, 60.4 on SEAL-0, 85.0 on FrontierScience Olympiad and 55.0 on FrontierScience Research (HF model card)
  • The paper's 122B model reports 59.0 on HLE with restricted website access and 66.7 on FrontierScience Research; 122B weights are not out yet
  • All scores are self-reported; the HF card lists Claude Opus 5 at 63.6 on HLE, so Axion still trails the strongest closed models
Read full story
Linked Models & Agents:
⚡ Axion 1.0-35B⚡ Axion 1.0-122B⚡ Qwen3.6-35B-A3B🌐 ByteDance🌐 Hugging Face

Vercel Security Review Enters Public Beta: Vulnerability Review on Every GitHub Push, One-Click Fixes with Vercel Agent

On November 3 (US Pacific time), Vercel launched Security Review in public beta. It is a new Vercel Agent capability alongside Code Review and Investigation: once enabled, every push to connected GitHub repositories triggers a diff-only vulnerability review that finishes in seconds. Findings land in the Security dashboard, PR comments and the CLI, and can be fixed with one click by Vercel Agent or pulled into your own coding agent via vercel security vulnerabilities. It is available to Pro and Enterprise teams, and reviews are free until November 10.

Vercel Security Review Enters Public Beta: Vulnerability Review on Every GitHub Push, One-Click Fixes with Vercel Agent

Key Takeaways

  • Trigger: every GitHub push (including direct pushes to production) is reviewed automatically; only the diff is scanned, which Vercel says finishes in seconds, so it can run on every preview and production deployment
  • Beyond pattern matching: the agent traces how changed code is reached, checks existing protections and rechecks each finding, which Vercel says catches logic flaws such as missing authorization checks
  • Teams can write security policies in plain language, scoped to projects or the whole team, and manage them with vercel security policy
  • Pricing: Vercel Agent rate, model tokens at provider cost with no markup, plus $0.25 per million tokens; reviews are free until November 10, 2026, while Agent fixes are billed
  • Availability: public beta for Pro and Enterprise teams; Vercel has not published detection-rate or false-positive benchmarks
Read full story

Epic Confirms Unreal Engine 5.9: Preview Next Week With Improved AI Workflows and Web Back as a Target Platform

On November 3, the official Unreal Engine account said UE 5.9 is happening, with a Preview build next week that includes improved AI workflows, web as a target platform, and rendering and animation updates; changes are already landing in the 5.9 branch on GitHub, with more details to come. This reverses Epic's June State of Unreal stance that 5.8 was the last planned major UE5 release, with 5.9 kept only as an option. UE 5.8 shipped the Experimental Unreal MCP plugin, which lets MCP clients such as Claude Code and Cursor drive the editor; the 5.9 AI workflow changes likely build on it, but Epic has not published a feature list yet.

Key Takeaways

  • Timing: the official post went out at 13:05 UTC on November 3 and says the 5.9 Preview arrives next week; the exact date and the final release date are not announced
  • Scope (per Epic): improved AI workflows, web as a target platform, and rendering and animation updates; changes are already landing in the 5.9 branch on GitHub
  • Context: in June, State of Unreal called 5.8 the last planned major UE5 release; UE6 targets Early Access at the end of 2027, with the full release 12 to 18 months later
  • AI groundwork: the Experimental Unreal MCP plugin in 5.8 embeds an MCP server in the editor at http://127.0.0.1:8000/mcp by default, loopback only and with no authentication
  • Reach: about 2,552 likes, 251 reposts, 114 quotes and 215K views at fetch time
Read full story