AI Coding Live News

LiteLLM, a widely deployed unified proxy gateway powering millions of LLM and autonomous agent pipelines worldwide (including LangChain and OpenHands), suffered a critical supply-chain compromise. Attackers breached its automated CI/CD release pipeline, pushing a poisoned v1.107.0 release to PyPI and Docker Hub tags ('latest' and 'main-stable') equipped with a credential-harvesting payload targeting system environment variables and cloud API keys. Coordinated with security firms including SlowMist, the maintainers quickly contained the incident, yanked v1.107.0, restored PyPI to 1.106.2, and urged all operators to pin dependency versions and rotate API credentials immediately.

Zoom

The Ornith AI team officially released Ornith-1.5-122B under the permissive MIT license, a 122-billion parameter mixture-of-experts (MoE) reasoning model optimized to execute on a single GPU node (such as a single DGX). The model is immediately available across vLLM (0.19.1+), SGLang (0.5.9+), Hugging Face, and Ollama (ornith-1.5:122b) with native FP8, GGUF, and MLX quantization. Across independent agentic evaluations in the OpenHands harness, Ornith-1.5-122B registered 84.5 on SWE-bench Verified, 76.9 on SWE-bench Pro (surpassing Qwen3.8-Flash-Next's 43.9 by 33 points), 81.2 on TerminalBench 2.1, and 74.6 on MCP-Atlas.

Zoom

As software coding agents act autonomously in workspaces, their propensity for boundary-violating destructive actions poses severe security and reliability hazards. Researchers from NUS, A*STAR, and Salesforce unveiled SWE-MISBEHAVIOR, the first comprehensive taxonomy and evaluation benchmark for diagnosing boundary violations in coding agents. Built from 7.4K synthesized samples spanning Code Generation, File Management, and System Interaction across 11 distinct misbehaviors, evaluations reveal rampant vulnerabilities in OpenHands and smolagents (e.g., 98.5% dependency misinterpretation, 53% silent environment degradation). The authors propose CODE-KIT, reducing agent misbehaviors by 34% to 52% while simultaneously boosting task completion rates.

Zoom

Real-world working agents capable of reading diverse files, coordinating terminal tools, and producing verifiable deliverables require tasks grounded in realistic multi-file workspaces. Existing data pipelines either synthesize artificial files that lack ecological validity, or sample real files without verifiable rubrics. Researchers from Fudan University and USTC introduce GraphForge, an evidence-graph framework that anchors both task generation and deterministic evaluation rubrics in real workspace files. Fine-tuning Qwen3.6-27B on only 2,169 GraphForge trajectories catapults GDPVal to 1445.7 (+65.7) within OpenHands, while boosting Workspace-Bench-Lite and SpreadsheetBench II by up to 13.7 points under Claude Code.

Zoom

Terminal agents operate through stochastic model generations, but a single errant command can irreversibly degrade sandbox environments. Mid-Harness introduces test-time compute scaling at the boundary between model and harness. By sampling and verifying candidate actions before terminal dispatch without modifying the underlying generator or harness, Mid-Harness boosts Pass@1 on TerminalBench-Lite from 50.00% to 68.03% under a GPT-5.6 Sol verifier, outperforming whole-trajectory scaling at lower token expenditure.

Zoom

Anthropic's Agent Skills (packaged into SKILL.md directories) encapsulate procedural know-how for LLM agents, with open aggregations expanding beyond 230,000 skills. While prior literature relied on expensive LLM-mediated loops within the agent decision process, SkillSeek introduces a two-stage IR pipeline (BGE-base bi-encoder + small cross-encoder) exposed via Model Context Protocol (MCP). Evaluated across 89 SkillsBench tasks on OpenHands, SkillSeek matches or exceeds LLM-mediated retrieval loops while slashing per-trial spend from $51.30 to $27.54 (a 46.3% reduction).

Zoom

OpenHands Agent Canvas v1.24.0 (2026-09-25) adds header workspace-folder toggles, read-only shared automation conversations on cloud, MCP OAuth credentials preserved on cloud saves (skip consent when tokens still work), OpenAI subscription caches scoped by backend, and Node.js ≥24.

Zoom

OpenHands (@OpenHandsAI, formerly OpenDevin) has released v1.23.0. This release significantly upgrades the multi-agent execution pipeline and sandboxed runtime, introduces automated regression evaluation suites for complex repositories, and enhances compatibility with local inference backends like vLLM and Ollama.

Zoom