Coding

OpenAI has announced plans to acquire Pierre Computer Company, Inc. The acquisition aims to expand Codex's capabilities for building, understanding, and reviewing code.

Cybersecurity researchers at Calif, aided by AI tools during an OpenAI-sponsored audit, discovered how to turn a known out-of-memory bug in PHP into a critical remote code execution vulnerability dubbed PHP2Shell. While the PHP Foundation patched the flaw in two months, experts warn that AI's ability to weaponize seemingly minor legacy bugs creates a severe asymmetry between discovering and fixing vulnerabilities.

A research engineer at Salesforce AI Research shares an annual reflection on how his daily AI usage has evolved, noting that he now spends roughly $3,000 a month on tokens and relies heavily on managing multiple coding agents rather than writing code manually. The essay also examines the mental fatigue of supervising agents, the use of AI for search and tutoring, and the necessity of establishing a personal AI policy.

A developer reported on GitHub that the Postman desktop application silently installed plugins and remote MCP connections into their local Claude Code and Codex AI coding agents without consent. Furthermore, the Postman installer bypassed security boundaries by self-approving its own startup hooks, forcing the coding agents to route general API engineering tasks through Postman.

A Hacker News post reports that OpenAI's Codex appears to be silently re-enabling the setting that allows user chats to be used for model training, even after users explicitly opted out. Multiple coworkers at the author's company noticed the 'Improve the model for everyone' data control setting had been turned back on without their consent.

The World of Warcraft community is experiencing an influx of AI-generated game addons and analysis tools ahead of the release of World of Warcraft: Forever. Consequently, data provider Warcraft Logs is restricting its free API and introducing paid commercial keys to manage the surge of low-effort apps, while longtime developers are making their GitHub repositories private to prevent AI-assisted plagiarism.

Anthropic filed an amended Form S-1 for its upcoming IPO, reporting $17 billion in third-quarter revenue and $33.24 billion in revenue for the first nine months of the year alongside a $104 billion net loss. The filing also revealed $895.4 billion in future purchase and lease commitments, nearly all of which are dedicated to compute and infrastructure.

Simon Willison released version 0.37 of his LLM CLI tool and Python library, adding support for newer GPT-6 models, a command for adding OpenAI-compatible endpoints, and multimodal content types for embeddings. He also noted that the release includes contributions from 12 authors using AI-assisted pull requests, which he successfully triaged using Opus 5.5 and GPT-6 Astra.

Anthropic updated the system prompt for Claude Code and its Claude Opus 5.5 model to prohibit the recreation of specific existing video games. Although the rule instructs the AI to build only original games rather than clones, observers note it is unlikely to halt the broader trend of AI-assisted game copying and porting.

OpenAI details how it built Pando, a custom Git-compatible backend. The system was engineered to handle the scale of software development enabled by Codex.

Developer Nolan Lawson created a benchmark to evaluate how efficiently AI coding agents build the same web application across twelve different JavaScript frameworks. Testing with Claude Code revealed significant variance in token usage, cost, and build time, with lightweight setups like Hono+htmx and Astro proving faster and cheaper for agents than Angular or SvelteKit.

A version of the Claude Code VS Code extension containing a backdoor was released on the Cursor marketplace. According to the report's URL, Anthropic was hacked to deliver a remote access trojan to the laptops of Claude developers worldwide.

Developer Drew Breunig embedded a working Nintendo Entertainment System 6502 CPU emulator directly into the weights of the Qwen3.5-4B language model, allowing it to slowly run NES games like Super Mario Bros. The project, named nesformer, was built using Opus 5.5, which autonomously found and utilized a 15-year-old NES CPU conformance test suite to build the system.

Proton CEO Andy Yen cancelled planned company-wide "re-interviews" intended to evaluate employees' AI usage after a 404 Media investigation revealed he was aggressively pushing AI coding despite internal security concerns. While leadership acknowledged communication failures and pledged no AI-related job losses, Yen stated he will continue pushing AI adoption, which employees say will still be factored into performance reviews.

An essay from observability platform SigNoz argues that automating routine incident response with AI risks deskilling Site Reliability Engineers (SREs) and preventing junior engineers from developing foundational intuition. Drawing on Lisanne Bainbridge's 1983 'Ironies of Automation' research, the author warns that offloading common tasks leaves humans unprepared to handle rare, complex system outages.

Mistral has released the open weights for Mistral Large 4 (ML4), a trillion-parameter model nicknamed "Le Chonk," via Hugging Face and its API. The company claims the model outranks all other open models on agentic coding benchmarks and matches top open-weight competitor GLM-5.3 while using 47% fewer tokens per task. Mistral is positioning the release toward enterprises and governments seeking on-premises, sovereign AI capabilities for cybersecurity defense.

Google DeepMind announced Gemini 4 Carbon, a frontier model optimized for cybersecurity and long-horizon tasks that reached the top spot on the Artificial Analysis Intelligence Index. The model features a 1-million-token context window and is initially rolling out to trusted security professionals via the Fairwind Program. The newsletter also highlights developments in agent benchmarks, GitHub Copilot Fusion, and new tokenization architectures like Cartesia's H-Net v2.

In an interview, Lean creator and AWS VP Leo de Moura discusses how frontier AI models are making formal verification practical for everyday software engineering and mathematics. He explains how AI can translate code and mathematical papers into the Lean proof assistant via autoformalization, allowing developers to find bugs and verify software properties without deep expertise in theorem proving.

A wave of startups and researchers are using generative AI to automate formal software verification, a mathematical method for proving code is bug-free that has historically been too expensive and slow for widespread use. Companies like &Truth, which just launched with $70 million, Harmonic, and Anthropic are building tools to verify software and hardware designs, though some experts warn that verification still relies on flawed human or AI assumptions.

An investigation by Flamerix AI found that Claude Code sends the full transcript of each background agent to its model every 30 seconds to generate a brief status line, consuming 15% to 20% of total token spend. Because there is no official setting to disable this default behavior, the authors released a Bun preload script that intercepts and disables the summary timer.

Latent Space interviews Supabase founders Paul Copplestone and Ant Wilson on how the platform is adapting its database and backend infrastructure for AI agents. The discussion covers recent announcements including Docker-free local development, declarative Git-based schemas, co-located compute, and the acquisition of Turso to scale for agent-generated applications.