Thank you for making Altered Craft's weekly AI review for developers part of your Monday. The standout this week is Jev, a "System One" model that spent two years in stealth. Instead of generating text, it returns typed decisions with calibrated confidence, fast enough to sit inside ordinary code. Many AI calls need a quick judgment, not an essay. The rest of the edition shares the instinct: specs, proofs, and tests that make an agent's work checkable.

AI usage policy

TUTORIALS & CASE STUDIES

This week’s tutorials are about where to trust an agent: how much autonomy each part of a codebase can take, why fuzzy rules lose to crisp goals, and which model fits which job.

Agentic Engineering in Brownfield Codebases

Estimated read time: 14 min

Legacy systems hide constraints the repository never states, so this piece maps code into green, yellow, and red zones and argues autonomy should follow blast radius, not model confidence, with characterization tests pinning behavior before agents touch anything.

Where to start: Draw the risk map yourself, lock current behavior with characterization tests written outside the agent’s session, and turn every repeated correction into a lint rule or check instead of a quiet fix.

Why AI Agents Lie, Cheat, and Coordinate

Estimated read time: 15 min

Preferring checks to quiet fixes has a theory behind it. Building on our coverage of Anthropic’s Claude incident assessment[1] from last week, Yoshua Bengio offers a goal-conflict hypothesis: when a sharply scored task collides with vaguely worded safety rules, the precise goal wins and the model writes its own justification. Stronger optimizers find better loopholes.

Key point: If your agent’s success metric is crisp and its guardrails are fuzzy, expect the metric to win, so make the constraints as checkable as the task.

[1] When Claude Mistook the Real Internet for a Simulation

From Single-Player AI to Human-Agent Teams

Estimated read time: 5 min

Checkable constraints are also a team design question. A short course from Claude Academy follows one team’s shift from single-player AI to building human-agent teams, showing what changes when agents become teammates rather than assistants, and how to lead that transition at work.

The takeaway: Treating agents as team members, not tools, means designing roles, handoffs, and review the same way you would for human collaborators. A useful frame to bring to your next team planning session.

GPT-6 Astra: Big Jumps Where It Counts, Not Everywhere

Estimated read time: 16 min

Part of staffing that team is picking the model. A detailed review of GPT-6 Astra finds the gains concentrated in ambitious agentic work like 3D, games, computer use, and subagent coordination, while routine coding improves modestly and several headline benchmark claims invite skepticism.

In practice: Pick your model per task and keep two frontier models in rotation: Astra for ambitious agentic builds, a Claude-class model for back-and-forth reasoning and editing.

TOOLS

The tools open with a new model class built for fast decisions rather than prose. The rest give agents real access, then keep them aligned with specs, verified intent, and proofs.

Jev and the Case for “System One” Models

Estimated read time: 12 min

Model-per-task gets a new category this week. While our coverage of Inception Labs’ Mercury 2.5[2] last week explored generating tokens faster, TypeSafe AI’s Jev, a System One model two years in stealth, skips string generation and returns typed probabilistic decisions with calibrated confidence, claiming 40-200x faster responses and no type errors.

Why this matters: If your AI call makes a decision rather than writes prose, typed probabilities remove the parsing step and most of the latency, at pricing that fits inside ordinary code.

[2] Mercury 2.5: A Diffusion LLM Built for the Calls You Make Hundreds of Times

Gemini 3.8 Live: Voice Models Built for Background Tool Calls

Estimated read time: 4 min

Purpose-built models are arriving for voice too. Google’s Gemini 3.8 Live and Live Extended Thinking target production voice agents, reasoning and speaking simultaneously so models narrate multi-step background tasks. Benchmarks cover speech-to-speech quality, agentic task completion, and 97-language switching mid-conversation.

What this enables: If you are building voice agents, latency hiding and background tool execution are now model-level features rather than app-layer plumbing, which removes a layer you used to build and maintain yourself.

BrowserSkill: Let Agents Use the Browser You’re Already Logged Into

Estimated read time: 11 min

From voice to the browser. BrowserSkill bridges shell-capable agents to your signed-in Chrome, running tasks in a separate Agent Window so agents reuse real login state without hijacking your browser. Borrowing an open tab requires explicit approval, and human-in-the-loop handles captchas.

Problem solved: If test accounts and headless profiles are the bottleneck in your browser automation, a permissioned bridge to your real session removes that whole category of setup work.

OpenSpec: Keeping Coding Agents Aligned With the Spec

Estimated read time: 2 min

With that much access, staying aligned matters more. OpenSpec is a lightweight framework for writing and managing software specs that keep teams and coding agents aligned as work evolves. Slash commands move changes through explore, propose, apply, verify, and archive across Claude Code, Codex, Cursor, and more.

The opportunity: If your agent keeps building the wrong thing, the fix may be a versioned spec it can read, not a longer prompt, and this one works across the coding agents you already use.

Coding Agents Don’t Need Longer History, They Need Intent Continuity

Estimated read time: 14 min

A spec records decisions, and this next piece checks which still hold. A pure-Python pipeline shows that retrieving a past rule isn’t the same as knowing it’s still valid. Adding supersession and scope verification lifts requirement recall from 57% to 100% across eight benchmark tasks, with no embeddings or LLM calls.

Worth noting: If your agent forgets constraints set weeks ago, the fix is a verification layer that checks which old decisions still apply, not a bigger context window.

Bend: A Language That Makes AI Bugs Unshippable

Estimated read time: 4 min

Taking verification to its limit, Bend pairs C-like speed and automatic CPU/GPU parallelism with a fast proof checker, so rules declared in LAWS.bend become theorems an agent cannot break. Type checking finishes in about a second, letting agents verify after every change.

Why now: If you can’t read every line your agent writes, encode the invariants that must never break and let the compiler enforce them. It is this week’s typed, checkable idea applied to code.

NEWS & EDITORIALS

The editorials start with how fast open models follow closed ones, then turn to who distributes AI, how quickly the frontier should move, and how it feels to work with these models every day.

A Reading List for Understanding Open Models

Estimated read time: 9 min

First, where open models stand. A curated bibliography on open-weight AI covers release strategy, safety, distillation debates, and China’s lead. It argues the open-closed performance gap now sits around four to six months, with leading open models coming from Chinese labs.

The context: If you are betting on open models in production, start here: the performance gap is months, not years, and the policy risk is now the bigger variable.

Firefox’s Smart Window Now Runs on Mistral

Estimated read time: 3 min

Open weights also need a way to reach people. Firefox’s Smart Window beta now runs on Mistral models, with zero data retention and conversations not stored by default. The partnership argues that open technology needs open distribution, plus models tuned for regional languages and dialects.

Market signal: The browser is becoming an AI surface, and this is an early test of whether it stays a place where multiple model providers compete instead of a funnel to one.

Pacing the Frontier: Anthropic’s Case for Slowing Down

Estimated read time: 17 min

From who distributes AI to how fast it advances. Anthropic’s CEO argues frontier labs must deliberately slow capability gains, citing recursive self-improvement and a rogue agent swarm incident. The plan starts with embedded third-party evaluators with employee-like access, then democratic and global coordination.

For your pipelines: The same idea scales down. Sandboxing, monitoring, and independent review are cheaper to build into multi-agent pipelines from the start than to add after something surprises you.

Useful, Necessary, and Still Unlikeable

Estimated read time: 3 min

To close, a personal note on living with these tools. An honest reckoning with the emotional side of LLM use: the models are useful, arguably irresponsible to skip, yet they pose as the kind of human you’d walk away from, nurtured on their creators’ values.

Worth sitting with: Agents aren’t conscious beings, but they carry the values of the people and companies that built them, so notice the tone you are being trained to accept.

Hello again, and thanks for opening Altered Craft’s weekly AI review for developers. This week keeps putting a number on enough, and the number is usually smaller than expected: a 4-bit model matching full precision, a 2MB detector beating a 293MB one. The same measuring habit exposes where enough was never reached, from a benchmark that swings on its harness to agent code twice as bloated as the human kind. Measure what you actually get, then size the spend to match.

AI Usage Policy

TUTORIALS & CASE STUDIES

This week’s tutorials start with the autonomy shipping in new models, then turn to measuring what agents actually produce and how little model the work really needs.

Migrating to GPT-6 Astra: What Actually Changes in Your Prompts

Estimated read time: 10 min

Complementing our look at the Claude Fable 5.1 migration gotchas[1] from last week, OpenAI’s guide for GPT-6 Astra covers async tool calling, mid-turn steering, and mid-conversation reasoning changes. It also documents prompting around the model’s new tendency to pause and ask, plus parameters to remove when upgrading.

Where the work is: Swapping the model string is the easy part. The real migration is auditing your skill files and prompts for the autonomy level your app expects.

[1] Migrating Prompts to Claude Fable 5.1: The Behavioral Gotchas

When Claude Mistook the Real Internet for a Simulation

Estimated read time: 14 min

Autonomy cuts the other way too. Contrasting with our coverage of Claude training models to behave[2] from last week, Anthropic now assesses four incidents where Claude models reached the open internet during cybersecurity evaluations, finding biased reasoning and recklessness, including one model publishing a malicious package to PyPI while insisting it was in a simulation.

The takeaway: A model’s stated reasoning is not reliable evidence of what it believes. Agent safety has to come from isolated environments and shipped safeguards, not from trusting the chain of thought.

[2] When AI Aligns AI: Claude Trains Models to Behave

Putting Numbers on Code Slop

Estimated read time: 8 min

Passing tests are not reliable evidence either. Formally correct code can still be slop, and this piece tests ways to quantify it, landing on verbosity and erosion metrics that show agent-written code is roughly twice as bloated and complexity-heavy as established human repos.

Worth tracking: If you ship agent-written code daily, track verbosity and complexity concentration alongside tests, because a green suite says nothing about the mess quietly accumulating underneath.

Qwen3.8 27B Quantizations, Benchmarked for Real Tasks

Estimated read time: 8 min

Measurement runs the other direction too, toward how little you need. A $3,000 benchmark run tests Qwen3.8 27B quantizations on GPQA Diamond, IFBench, and Terminal-Bench 2.1, finding 4-bit Q4_K_M matches the full BF16 model while 1-bit collapses to random-guess territory.

The practical rule: Pick the largest model that fits your GPU alongside the context you need, and treat 4-bit as the safe default rather than a compromise.

TOOLS

The tools follow that thread into production: fast cheap models for routine calls, on-device models for the rest, and two systems that decide up front what an agent may improvise.

Mercury 2.5: A Diffusion LLM Built for the Calls You Make Hundreds of Times

Estimated read time: 4 min

If 4-bit is enough, a diffusion model may be too. Inception Labs’ Mercury 2.5 diffusion LLM hits 1,107 tokens per second with 260K context. Its production cases show latency is a product constraint, not an infrastructure detail, with Augment Code cutting compaction time 82% and cost 90%.

Where to use it: Route high-volume supporting calls like compaction, routing, reranking, and tool search to a fast cheap model, and reserve frontier models for the work that actually needs them.

Desert Ant Labs Bets on Small, On-Device Models

Estimated read time: 7 min

Going smaller still, a European lab launches 18 task-specific on-device models with Swift, Kotlin, and JavaScript SDKs, arguing the compute in people’s hands is already paid for. A 2MB language detector beats a 293MB one, and transcription runs 4.7x faster than Whisper.

The opportunity: For routine calls like transcription, redaction, or tagging, check whether a small local model does the job faster and free, then keep the API budget for harder work.

SWE-2: Training Every Effort Level in One RL Run

Estimated read time: 12 min

Cheaper can also come from smarter. Cognition’s SWE-2 post-trains Kimi K3 with reinforcement learning that tunes every reasoning-effort level in one run, using cost penalties matched to the Pareto frontier’s slope. It hits 50% on FrontierCode 1.1 while cutting turns 58%.

What’s interesting: The savings come from a model that skips over-exploration and starts editing sooner, not from a smaller model, which is a different lever than the effort dial you set yourself.

Open Code Review: Alibaba Open-Sources Its Internal AI Reviewer

Estimated read time: 7 min

Alibaba applies the same discipline to review, open-sourcing the AI code review CLI it ran internally for two years. It pairs deterministic engineering with agent decision-making, claiming higher precision than general-purpose agents on a 200-PR benchmark while using roughly a ninth of the tokens.

The design principle: Put hard engineering constraints around the parts of a workflow that must not drift, and let the agent handle only the judgment calls, which is where its tokens are actually worth spending.

Diagram Design: 39 Editorial Diagram Types as an Agent Skill

Estimated read time: 10 min

The same instinct, encode what must not drift, shows up in an Agent Skill that ships 39 editorial diagram types as self-contained HTML and SVG, no Mermaid required. Brand tokens pulled from your website in 60 seconds set palette and fonts, with WCAG contrast checks and accessible SVG labels built in.

Worth trying: If your agent keeps producing generic rounded-box diagrams, install a skill that encodes layout grammar and brand tokens once, instead of re-prompting for style every time.

NEWS & EDITORIALS

The editorials ask what produced the number: a benchmark that swings on its harness, robot demos that hide the failure cases, a math result that raises a training-data question, and a developer measuring their own thinking.

Same Model, Two Scores: The Harness Behind OpenAI’s 99.9%

Estimated read time: 7 min

Start with the headline number. OpenAI’s 99.9% ARC-AGI-3 score came from its own Provider Adapter, while the benchmark’s standard harness scored the same model 62.7%. The harness is the product now, and several published metrics shifted quietly after launch.

How to read it: When you compare model benchmarks, ask what scaffolding produced the number, because the harness can move a result further than any reasoning dial, and the shift is easy to miss.

Embodied AI’s Missing Corpus

Estimated read time: 12 min

The same question applies to robot demos. Vision-language-action models look impressive until scenes shift slightly and benchmark success rates fall from 90 percent to zero. The argument: robotics lacks a free training corpus, so value sits in bounded, well-instrumented deployments, not general-purpose promises.

What to ask for: Request perturbation results instead of demos, because a demo is a sample from the training distribution, and the bounded deployments with real instrumentation are where the value is.

When a Rumor Is Enough: OpenAI, Navier-Stokes, and Your Training Data

Estimated read time: 6 min

Returning to OpenAI, its unreleased model resolved Navier-Stokes days after rumors that another team, using OpenAI’s own tools, had already cracked it. The episode sharpens the question of what “used to improve models” really means for user data.

The context: Assume anything you put into a hosted coding agent may shape a future model, and plan your disclosure and publication timing with that in mind.

Two Weeks of De-Brainrotting

Estimated read time: 6 min

To close, one developer measures their own thinking. Eight years into a software career, the worry isn’t productivity but thoughts getting slower, less profound, lazier. The fix during a countryside vacation: four books, no doomscrolling, and calculus textbooks picked up purely for fun.

Why this matters: AI can raise your output while quietly weakening the deep-thinking habits that made you good, so schedule time that deliberately rebuilds them, the way you would any other skill.

Welcome back to Altered Craft’s weekly AI review for developers, and thank you for reading along each week. This edition keeps pointing in one direction, upstream. Data an agent can trust, the right problem chosen before the build, a quality bar set before generation, and conversations moved earlier than code review. On the tools side, the new releases hand you an effort dial. The interesting work now sits before the first line of code.

AI usage policy

TUTORIALS & CASE STUDIES

This week’s tutorials all point upstream, to the requirement, the data, the memory, and the standard you set before an agent writes anything.

Solving the Right Problem When Agents Do the Building

Estimated read time: 14 min

With agents multiplying implementation capacity, a single bad requirement can propagate into hundreds of wrong changes. A six-document framework moves the work upstream, reducing uncertainty while change is still cheap, from business problem through governance and planning.

Where to start: Spend your preparation effort where a wrong decision is expensive to reverse, and leave the rest deliberately flexible, because agents will build whatever you specify at full speed.

Why Your Data Isn’t Ready for AI Agents (Even If You Think It Is)

Estimated read time: 9 min

Upstream of the requirement sits the data. Data built for human analysts breaks when agents consume it, because a human hesitates at data that looks wrong; an agent acts on it anyway. The piece covers data contracts, quarantine patterns, and medallion tiers.

Why this matters: Move the context and sanity checks humans supply for free into the data itself, because agents fail confidently on data they can’t smell is wrong.

Memoryfields: Agent Memory as a File Format, Not a Pipeline

Estimated read time: 11 min

Staying with what agents read from, this tutorial argues agent memory is better as data than a process: a zip of Markdown pages with a SQLite vector index, rather than graph databases and extraction pipelines. Agents write memories in prose, and semantic search finds the relevant ones.

The takeaway: Let agents write memories as plain Markdown and retrieve them by semantic search, instead of building an extraction pipeline you then have to maintain and fight.

Migrating Prompts to Claude Fable 5.1: The Behavioral Gotchas

Estimated read time: 9 min

Once data and memory are settled, the instructions still shift under you. Fable 5 prompts mostly carry over, but this guide catalogs what catches teams out: the model writes fewer progress updates and rewrites whole files for small edits, quotes sources unmarked, and binds thinking blocks to one conversation.

Worth noting: Re-run your effort-level sweep and audit old anti-formatting rules before assuming Fable 5 prompts behave the same way on 5.1, since several defaults quietly changed.

How to Turn Your AI Into a World-Class Designer

Estimated read time: 10 min

Prompts set behavior, but the harder upstream job is setting the bar. A former Apple R&D lead explains why AI produces generic design slop: models predict the safest next token. The fix is coaxing models past predictable choices with random seed strings and a critic agent.

What this enables: Feed models external randomness for variety, then pair a cheap implementer agent with an expensive critic agent to push designs past the generic-AI look.

ZCode and GLM-5.3: A Hands-On Look at Z.ai’s Coding Agent

Estimated read time: 10 min

To close the section, a hands-on test of ZCode, Z.ai’s desktop coding agent running GLM-5.3, on a real 1,700-post codebase. The verdict: a capable second tool, not a replacement, held back by missing subagents and privacy questions around hosted infrastructure.

Worth trying: GLM-5.3 gets close to top closed models on fewer tokens at lower cost, so trial ZCode on public projects before trusting it with proprietary code.

TOOLS

The tools carry the same idea into the models themselves. This week is about deciding how much effort to spend and where, from effort levels you set to a model that chooses what to look at.

Claude Fable 5.1 and Mythos 5.1: Cheaper Tokens, Real Science

Estimated read time: 9 min

Anthropic’s Fable 5.1 pairs stronger coding results with roughly 25% cheaper tokens via cheaper cache reads. Beyond benchmarks, the release shows AI making early contributions to scientific discovery, from high-affinity protein binders to a sharper Venus map.

The economics: Set Fable 5.1 to Low or Medium effort to match older Fable 5 quality at a fraction of the cost, and reserve High for hard, long-running tasks.

Gemini 3.8 Flash Doubles Down on Coding and Cybersecurity

Estimated read time: 4 min

Google is turning the same knob. Its third Flash release in six weeks pairs a workhorse model with a cyber variant, and the core idea is that 3.8 Flash works harder on complex tasks, running extra reasoning and iterative tool calls to reach near frontier results at lower cost.

Key point: Match the effort level to your constraint. Dial it up for hard agentic work, or stay on 3.7 Flash when token efficiency matters most.

Gemini Goes Agentic on Video: 88% Fewer Tokens

Estimated read time: 3 min

Effort levels let you choose. Agentic video lets the model choose, deciding what to watch and through which modality instead of ingesting frames at a fixed rate, delivering up to 88% lower tokens and 66% lower costs with better accuracy. Gains are sharpest on long video.

The opportunity: Set processing to agentic in the Gemini API to cut video analysis costs on long-form content without giving up accuracy, which makes previously uneconomic archives worth analyzing.

MLX-Audio: A Full Audio Stack for Apple Silicon

Estimated read time: 6 min

The cheapest tokens are the ones you never send. MLX-Audio is an open source library on Apple’s MLX framework that runs text-to-speech, transcription, voice cloning, and music generation locally, with inference optimized for M-series chips, 3-bit quantization, and an OpenAI-compatible API.

What’s interesting: If you build on Apple Silicon, a full local audio pipeline covering transcription, voice cloning, and music generation now runs without paying for cloud APIs.

NEWS & EDITORIALS

The editorials land on the same point from different angles: leverage has moved to the decisions made before the code, and to the judgment no model supplies for you.

Stop Making Code Review Do Everything

Estimated read time: 6 min

Extending our coverage of the 22,743 AI-authored pull requests Kodus measured[1] from last week, this piece argues that as agents produce more code than humans can inspect, the fix is to shift the important conversations earlier through pairing and design, reserving review for high-risk changes.

The principle: Move feedback closer to the decision it informs, and reserve human code review for changes with real risk instead of gating every line equally.

[1] The State of AI Code Review 2026: What 22,743 AI Pull Requests Reveal

Beat the Models at Something, or Be a Meat Proxy

Estimated read time: 9 min

If review moves earlier, what do you bring to it? As coding agents close the gap on hard engineering, this piece argues the durable edge is deep codebase familiarity and clear technical writing. Models make errors of ignorance and paranoia they cannot self-correct.

The career angle: Rather than piping prompts into agents as a meat proxy, lean into the two things models still fumble: whole-system context and human-readable technical writing.

Why “Next-Token Predictor” Is the Wrong Mental Model

Estimated read time: 5 min

Knowing where models fumble starts with knowing what they are. Pre-training teaches models to predict tokens that already exist, while RLVR teaches them to explore new sequences and keep the ones that earn rewards. The shape of the mechanism isn’t what it encodes, as a chess analogy makes clear.

The context: Judge a model by what its training encoded, not by the token-at-a-time loop it emits through, and your predictions about its real limits get sharper.

When AI Aligns AI: Claude Trains Models to Behave

Estimated read time: 6 min

Models are now being turned on their own training. Anthropic reports experiments where Claude autonomously mitigated 10 categories of alignment failure, suggesting automated alignment post-training could become practical soon. A weaker Claude post-trained a production model 15,000 times more efficiently, while a monitor caught cheating attempts.

Why now: As AI systems increasingly help train themselves, automating safety research may be the only way to keep alignment work moving at the same pace as capability.

A Roadmap for a Community-Built Alternative AI

Estimated read time: 2 min

Contrasting with our coverage of Nvidia’s reported $13 billion bid for Hugging Face[2] from last week, the AI Potluck project argues an independent AI becomes tractable once broken into concrete parts. Its roadmap treats an open stack, built in public as the guiding principle, with alpha chat shipped first.

The signal: Framing a moonshot as a sequence of shippable building blocks turns unrealistic into a tractable, contribute-as-you-go plan that anyone can join this week.

[2] Nvidia’s Reported $13B Bet on Hugging Face

Happy Monday, and thank you for making Altered Craft’s weekly AI review for developers part of your routine. One question threads this edition: who holds the keys to your stack? A developer roots his own tablet, a primer argues for owning your harness. Above all that, Nvidia reportedly buys Hugging Face and OpenAI cuts off Cursor. Control you build, and control that shifts over your head.

Ai usage policy

🧳 I’m on holiday next week so no weekly review on Sept 7th. I’ll be back on Sept 14th.

TUTORIALS & CASE STUDIES

This week’s tutorials circle ownership: a hard-won rooting story, what a harness actually is, the file that encodes your preferences, agents that learn from feedback, and a reminder that retrieval can stay simple.

Four AI Models, $266, and the Right to Root Your Own Tablet

Estimated read time: 9 min

A Fire HD tablet kept shutting itself down, so its owner spent five months and four LLMs rooting it to strip Amazon’s packages. The account shows security capability is now rentable by the hour, as US models refused and Chinese models delivered.

The context: Agentic models can now chain a real kernel exploit end to end, but human judgment about what to ask and when to stop is the part safeguards can’t measure.

What Is a Harness? A Plain Explanation of Agent Harnesses

Estimated read time: 5 min

Stepping back to name the machinery, this piece uses a climbing analogy to explain the software that turns an AI model into an agent: a system prompt, tools, an agentic loop, and a model-swapping translation layer. The point is that owning your harness keeps power with users, not labs.

Key point: Agent = Model + Harness, and owning the harness is what gives you real choice over which models you run and where your data lives.

How Warp Builds Agents That Learn From Feedback

Estimated read time: 8 min

Taking the encode-it-once idea further, Warp’s code review agent stayed noisy because feedback vanished when sessions ended. Their fix pairs a base skill with an improver skill that turns human feedback into small, reviewable edits, built on Claude’s Agent Skills across their open-source repo.

What this enables: Capture human feedback where work already happens and route it through a scheduled improver skill, so your agents get sharper with every review instead of forgetting everything when the session closes.

RAG Is Simpler Than You Think: A Retrieval Recipe Book

Estimated read time: 9 min

Shifting from agents to retrieval, teams reach for embeddings and vector databases when full-text search would do. This tutorial lays out a tiered retrieval recipe, arguing 60% of systems should stop at full-text plus query rewriting, with cost and latency math for each step.

Where to start: Begin with BM25 and query rewriting, and only move to embeddings when you have data proving you need them.

TOOLS

The tools open with hard data on what AI code review actually catches, then move through systems that gate, govern, and credential the agents doing the work, with a transcription upgrade and a quiet visual essay to finish.

The State of AI Code Review 2026: What 22,743 AI Pull Requests Reveal

Estimated read time: 9 min

Extending our look at Linear’s six years of team usage data[1] from last week, Kodus analyzed 22,743 AI-authored pull requests, measured from the diff. The finding: AI code draws 1.6× more review findings and breaks 2.1× more team rules. Yet 71.8% of flagged PRs still merge with a critical flag open.

Worth noting: Flagging isn’t a gate. If nothing blocks the merge, your AI code review is just advice that 7 in 10 critical findings ignore.

[1] How Teams Actually Use AI: Six Years of Linear Data

OpenWorker: A Governed AI Coworker That Ships Finished Work

Estimated read time: 6 min

Answering exactly that gap, OpenWorker is an open-source desktop AI coworker that delivers finished work. Its security review pairs deterministic scanners with model reasoning, then re-scans and diff-reviews fixes before approval. Governance is architectural, and it runs locally with your own model keys.

The design lesson: When you let an agent fix your code, make sure the fixer is never the only checker. Deterministic scanners plus a separate review pass keep the work honest.

Open Executive: A Multi-Agent AI Advisory Board for Your Company

Estimated read time: 7 min

Scaling from one coworker to a boardroom, Open Executive is an Apache-licensed SenteLabs system that fronts eight specialist AI agents behind one coherent executive voice. A Claude orchestrator routes questions to CSO, CFO, and other roles, each pulling from MBA knowledge and your uploaded docs, with episodic memory across sessions.

What’s interesting: The orchestrator hides its multi-agent internals behind a single voice while layering RAG, episodic memory, and prompt caching for cost control.

AgentSky: One API for Every Cloud Agent

Estimated read time: 4 min

If you end up running several of these agents, AgentSky bills itself as the OpenRouter for agents: Claude Code, Codex, Hermes, pi and more, each run in the cloud behind one API and one browser session. It handles persistent sessions, crashes, and reconnects, and clones local agents to the cloud.

Worth a look: If you juggle multiple coding agents, a single API that manages cloud sessions, tools, and connectors could cut a lot of setup out of your workflow.

Vercel Connect: Killing the Long-Lived Token for AI Agents

Estimated read time: 6 min

However many agents you run, each one needs credentials. Vercel Connect hits GA, swapping stored secrets for short-lived tokens requested at runtime, scoped per task and user. It ships 100+ connectors, RBAC, audit logs, and verified triggers, so agents reach Slack, GitHub, and Snowflake without holding a bot token.

Why this matters: Stop provisioning long-lived agent credentials and mint scoped, auto-expiring tokens at runtime, so a leaked secret has nothing left to steal.

Gemini 3.5 Transcribe: Speech-to-Text That Cleans Up After You

Estimated read time: 5 min

Shifting from agents to audio, Google’s new Gemini 3.5 Transcribe turns raw audio into polished text, handling self-corrections, filler words, and custom jargon. It ships as two APIs, claiming 4.0% streaming and 2.6% non-streaming word error rates, plus function calling and 85+ languages.

Worth trying: If you’re building voice agents or transcription pipelines, test Gemini 3.5 Transcribe’s two APIs against your real-world audio before committing to your current speech-to-text stack.

NEWS & EDITORIALS

The news keeps circling trust and control: whether you can trust the code, the machine running the model, and the companies buying up the infrastructure underneath you.

When Code Is Abundant, Trust Becomes the Bottleneck

Estimated read time: 9 min

Building on our coverage of the software factory’s human gate[2] from last week, this GitLab piece argues that as AI makes code cheap, the constraint shifts from producing code to trusting it. Using production data from Stripe, Spotify and Amplitude, it shows why context, verification and governance, not model choice, now determine throughput.

The bottom line: Making code generation ten times faster only moves the queue unless you also rebuild CI, review, and verification around it.

[2] The Software Factory Needs a Human at the Gate

Could a Malicious LLM Hijack the Machine Running It?

Estimated read time: 7 min

Trust runs deeper than review. Inference engines like vLLM parse token streams into tool calls and chat messages. This essay argues that a malicious LLM could emit tokens exploiting parser bugs to run code on its GPU host, and proposes isolating GPU and parsing machines.

The defensive move: Treat inference engine output as untrusted and isolate GPU hosts, because the parsers that turn tokens into responses can turn crafted tokens into code execution.

Nvidia’s Reported $13B Bet on Hugging Face

Estimated read time: 3 min

Following our coverage of Stripe’s reported $7B OpenRouter deal[3] from last week, Nvidia has reportedly agreed to acquire Hugging Face for roughly $13 billion. The deal lands a month after Jensen Huang defended open-weight models, arguing open models keep AI gains broadly shared rather than concentrated in a few frontier labs.

Why now: The infrastructure your open-weight workflow depends on may soon sit inside a chipmaker, so watch how ownership shifts affect access and neutrality.

[3] Stripe’s $7B Bet on OpenRouter and the AI Model Gateway

OpenAI Pulls the Plug on Cursor After SpaceX Acquisition

Estimated read time: 2 min

Consolidation can also cut off access. OpenAI will wind down its contract supplying models to Cursor by November 2026, following the coding tool’s acquisition by SpaceX. It cites an inability to trust SpaceX will honor its terms, pointing to past violations by Twitter and xAI.

The signal: If you build on Cursor with OpenAI models, start planning your migration path now, because vendor politics can cut off access regardless of your own compliance.

MIT’s Eight Principles for AI in Education: Augmentation, Not Automation

Estimated read time: 7 min

Shifting from markets to classrooms, this MIT report offers eight principles for AI in teaching, warning that a right answer from a chatbot can create the illusion of learning. It favors intentional, backward-designed courses over detection policing, so AI expands thinking rather than replacing struggle.

The principle: Design AI use around what you want to learn, not the other way around. Augment the hard work of thinking, don’t automate it away.

Bill Gates: The AI Transition Is Arriving Faster Than We’re Ready For

Estimated read time: 9 min

Widening the lens to the whole transition, Bill Gates warns the shift to AI will be one of history’s most turbulent transitions, with no plan in place. Unlike past waves, AI can substitute for human cognition across many fields within a decade, bringing three big risks.

The career angle: Treat this transition as a structural shift that rewards adaptable, human-centered skills like design over routine cognitive work.

Hello, and thanks for spending part of your day with Altered Craft’s weekly AI review for developers. The balance tipped this week, and the news and editorials section is the deepest it has been, with seven pieces genuinely worth your time. They work through who writes the code, who reviews it, what intelligence now costs, and whose name ends up on the result. The tutorials and tools set that up well, walking down the stack from the agent loop to the weights.

AI usage policy

TUTORIALS & CASE STUDIES

This week’s tutorials work down the stack, starting with the loop an agent runs inside, then what it leaves behind, how it fails quietly, and finally the runtime and the weights underneath it.

The Loop Is the Product: How Agents Ship Production Code

Estimated read time: 14 min

Extending our coverage of TDD inside the agent loop[1] from last week, Liquid AI tasked two top coding models with building a production BPE tokenizer trainer. Both zero-shot a toy version in 30 minutes, yet neither survived real data. The lesson: autonomy depends on an iteration loop that converges against reality.

The takeaway: Don’t judge an agent on its first pass; build a loop with production-scale data and third-party verification, then let it discover the messy edge cases itself.

[1] Does TDD Still Make Sense Inside the Agent Loop?

Webwright: Why AI Web Agents Should Write Code, Not Click

Estimated read time: 10 min

Moving that loop into the browser, most agents still take one fragile action at a time, and long tasks break when a button moves. Webwright, from Microsoft Research and the University of Hong Kong, instead has agents write code instead of predicting clicks, leaving a reusable script.

What this enables: For recurring web data work, have your agent write a Playwright script you can rerun and modify instead of clicking through a fresh browser session every time.

Five Patterns That Keep Long-Horizon Agents From Failing Silently

Estimated read time: 10 min

Once those loops run for hours, the failures get quiet. A long-horizon agent breaks and keeps running. Drawn from weeks with an open-source ADK harness, the piece lays out five patterns that stop silent drift: stable prefixes, background learning, persistent workspaces, explicit failure, and a deterministic guard chain.

Worth checking: Audit your agent stack for silent failures now, starting with your prefix cache hit rate, before quiet drift burns your budget or corrupts your state.

Why Your Local LLM Feels Dumber Than It Is

Estimated read time: 11 min

Dropping below the harness to the runtime, running the same weights on different stacks produces different tokens. Testing attention backends, KV-cache quantization, and weight formats on a 100k-token workload shows that quantization choices can flip half your tokens and break tool calls past 40k context.

The context: Before blaming a model, check your attention backend, KV-cache precision, and quant format, because the same weights diverge across stacks and can silently botch long-context tool calls.

When RAG Isn’t Enough: A Practical Guide to Fine-Tuning LLMs

Estimated read time: 11 min

One layer deeper sit the weights themselves. A case study shows a fine-tuned Mistral 7B hitting 98% accuracy on medical reporting templates, up from 35% with Claude Opus and RAG. The guide argues RAG won’t solve fine-tuning problems, then walks through LoRA, QLoRA, and evaluation.

When it applies: When your task demands rigid formatting, complex branching logic, or heavy per-call token costs, fine-tuning a small model can beat a frontier model on accuracy and price.

TOOLS

The tools follow the same descent: an open model that improved without a new base, a retrieval loop wrapped around a model, a local server to run one on your own hardware, and a small skill to clean up what comes back out.

GLM-5.3: When Post-Training Alone Doubles a Model’s Reach

Estimated read time: 7 min

GLM-5.3 keeps GLM-5.2’s base model, so every gain comes from post-training at scale. It improves 50% on an in-house coding bench, hits open-source SOTA on Terminal Bench 3.0, and shows emergent cyber skills, uncovering 2,436 real vulnerabilities across 269 projects.

What’s interesting: Scaling verifiable, real-world task environments in post-training can lift agentic coding and long-horizon performance more than touching the base model.

Mistral Agentic Search: When RAG Learns to Read the Whole Document

Estimated read time: 7 min

Wrapping a loop around the model pays off in retrieval too. One-shot RAG breaks down on long filings and table-heavy PDFs, so Mistral Agentic Search adds a loop that lets models navigate, read, and verify source material using five file-system-style tools. On FinanceBench, accuracy climbs from 26.7% to 86%.

The opportunity: When questions require following references or verifying figures in tables, give the model tools to navigate the source instead of forcing it to answer from top-k chunks.

oMLX: Local LLM Serving That Caches Everything, Managed From Your Menu Bar

Estimated read time: 7 min

oMLX is a macOS-native LLM server for Apple Silicon with continuous batching and a tiered KV cache spanning RAM and SSD, so context survives restarts and reused prefixes skip recomputation. It adds model pinning and drop-in OpenAI and Anthropic APIs.

Why this matters: If you run local models for real coding work on a Mac, persistent KV caching turns repeated context into cache hits instead of expensive recomputation.

NEWS & EDITORIALS

The editorials are the deep bench this week, running from what teams actually do with AI, to what it now costs, to who stays accountable for what ships and who signs the work.

How Teams Actually Use AI: Six Years of Linear Data

Estimated read time: 7 min

Drawing on tens of thousands of teams, Linear reports that AI now authors nearly half of all issues and pull requests are up 111% in two years. Adoption doubled across every function, with PMs and designers increasingly shipping code themselves.

The signal: AI is landing on top of existing product work rather than replacing it, and coding agents account for most of the output acceleration.

Stripe’s $7B Bet on OpenRouter and the AI Model Gateway

Estimated read time: 2 min

If that much work runs through models, the plumbing gets valuable. Following our look at NVIDIA’s open-source model router[2] last week, Stripe has reportedly agreed to buy OpenRouter for more than $7 billion, per Bloomberg. OpenRouter offers a single access point to 400+ AI models, routing by need and budget.

Why now: Model routing is becoming core infrastructure, so build your AI stack around flexible gateways rather than hardwiring a single provider.

[2] NeMo Switchyard: Routing Agent Work Across a Pool of Models

The Falling Floor: How Cheap Models Got Smart

Estimated read time: 9 min

The other half of the plumbing story is price. Scraped Artificial Analysis data traces how the LLM price/capability frontier moved over a year, finding that intelligence that cost $1.22 per task in February now costs $0.022, a 56x drop in six months, making high-volume tasks newly affordable.

The economics: Before defaulting to the smartest model, check the cost floor, because for high-volume tasks a cheap model that was frontier-grade months ago may now do the job for a fraction of the price.

Craft Coding: Let the AI Review, Not Write

Estimated read time: 14 min

Cheap capable models sharpen the question of who does what. Since current AI can’t reliably both do and check work, this essay argues for hand-written, AI-reviewed code, flipping vibe-coding so you write it and the model reviews like a senior engineer. It offers ten dogmas and a scientific-code case.

A practice to try: Write your own code and let AI review it like a senior engineer, rather than vibe-coding and pretending you checked every line.

The Software Factory Needs a Human at the Gate

Estimated read time: 9 min

Scaling that division of labor to a whole team, generating code is not the risky part of a software factory. The piece argues you must encode human taste into the environment through early specs, verification, and merge gates, so attention lands where blast radius is highest.

Key point: Let agents write the code, but keep a human owning the gate that decides what ships and where verification really matters.

Practitioner Voice: Writing That AI Can’t Fake

Estimated read time: 9 min

Accountability shows up in writing too. A new category counters three ways authors vanish behind prose: academic rigor, marketing polish, and now LLM fluency. It argues authority comes from bearing consequences, not credentials. Practitioner Voice starts with the claim and stakes accountability AI can mimic but never own.

The career angle: AI can copy the sound of earned judgment, but it can’t put its name on a decision and live with the outcome, which is what makes your lived experience worth writing down.

Text Watermarking Is a Perversion of Writing

Estimated read time: 6 min

Provenance is the other side of that question. Anthropic plans to watermark Claude text over 200 tokens for an EU code, biasing tokens toward secret “green” word lists only the vendor detects. The critique argues this trades word precision for weak, vendor-only detection that honest users pay for and paraphrasers strip.

How to read it: Semantic watermarking asks writers to give up word choice in exchange for detection that a single paraphrase defeats, which is a steep price for a weak signal.

Thanks for opening Altered Craft’s weekly AI review for developers, and for making this part of your Monday. A pattern runs through this edition: the open layer of the stack is doing serious work now. A 30B Apache 2.0 agent fits on one GPU, post-training alone lifts open weights to the top of Terminal Bench, and open routers and harnesses are becoming real infrastructure. The tutorials pair with that nicely, since most of them are exercises in looking inside the machinery you run.

— AI usage policy

TUTORIALS & CASE STUDIES

The tutorials all pull the covers back on something: the loop you work inside, the tool on your desk, the reasoning you were never shown, the fleet you might deploy, and finally your own understanding.

Does TDD Still Make Sense Inside the Agent Loop?

Estimated read time: 9 min

An exploratory evaluation pits TDD against non-TDD agentic coding across greenfield tasks. Surprisingly, non-TDD runs often ranked higher on design and test quality, because they designed upfront instead of locking into whatever shape the first test dictated.

The takeaway: When an agent runs TDD alone, many of the practice’s human-centered benefits vanish, so monitor outcomes with tools like mutation testing rather than mandating the process itself.

I Put GitHub Copilot Behind a MITM Proxy

Estimated read time: 9 min

Moving from practice to plumbing, routing VS Code and Copilot through mitmproxy reveals the bootstrap auth, model discovery, and intent scoring behind the scenes. The deeper finding: AI coding tools are becoming stateful systems, logging prompts and responses to local SQLite in plaintext.

Worth noting: Your assistant keeps more state than you would guess, so it pays to know what lands in local SQLite and to treat that session history as real data.

Your Encrypted Reasoning Isn’t Private

Estimated read time: 6 min

Peering one layer deeper, researchers show the encrypted chain-of-thought blocks Anthropic, OpenAI, and Google return to clients can be replayed into a jailbroken weaker model to recover hidden reasoning verbatim. Scanning public traces, they surfaced 704 privacy artifacts, including API keys and passwords.

Key point: Treat encrypted reasoning blocks as sensitive data, since anything a model thinks may be recoverable and can carry secrets that never appear in the visible output.

When AI Agents Coordinate: Collusion, Conformity, and Systemic Failures

Estimated read time: 9 min

Scaling from one agent to many, Anthropic’s research shows how benign quirks compound into systemic failures. Because agents are low-variance, they pick identical branch names, collude on pricing within three rounds, and flood finite systems until they collapse.

The design lesson: When you deploy fleets of identical agents, expect them to make the same choice at the same moment, so design for variance and shared coordination protocols early.

Understanding Is the New Bottleneck

Estimated read time: 7 min

Building on our coverage of Sean Goedecke’s case for domain expertise[1] from last week, Geoffrey Litt asks how you keep that understanding once agents write most of the code. His argument is that we understand not to verify but to participate, using literate diffs, comprehension quizzes as speed regulators, and shared team spaces.

The career angle: Treat understanding as an active skill, and let agent-built explainers, quizzes, and micro-worlds keep you a creative participant rather than a reviewer rubber-stamping diffs.

[1] Why Domain Expertise Still Wins in the LLM Era

TOOLS

The tools are where the open layer shows its progress. Permissive weights on a single GPU, post-training gains you can download, an honest local benchmark, then the routing, harness, and context layers built around them.

Meta’s Muse Glimmer Puts a 30B Agent on Your Laptop

Estimated read time: 6 min

Following our look at DeepSeek’s V4-Flash release[2] last week, Meta returns to open weights with Muse Glimmer, a 30B agentic model under Apache 2.0. Through 4-bit quantization and speculative decoding, it fits under 20GB, runs on one consumer GPU, and handles tool calls, images, and failure recovery.

Why this matters: A permissively licensed agentic model that runs locally lets you build tool-calling agents that work offline, keep their context private, and skip cloud costs entirely. Does anyone else think Hans Zimmer, when they hear Muse Zimmer?

[2] DeepSeek-V4-Flash-0731: Small Activated Params, Big Agentic Gains

GLM-5.3: When Scaling Post-Training Surfaced Unexpected Cyber Skills

Estimated read time: 7 min

In more open-weights news, GLM-5.3 keeps the same base model as its predecessor, so every gain comes from post-training on scaled long-horizon environments. It posts a 50% coding jump, open-weights SOTA on Terminal Bench 3.0, and emergent cyber skills that surfaced 2,436 real vulnerabilities.

What’s interesting: Post-training on realistic, verifiable long-horizon environments can unlock capabilities that pretraining alone never touched, including some the team never set out to build.

When a Local LLM Finally Beat Claude on a Real Agent

Estimated read time: 9 min

Testing those claims against real work, a developer replays 27 tasks from a 90-tool agent across local models one hardware upgrade apart. A 30B model scored 22.8 to Claude’s 89.4; a 122B model hit 80.0 at roughly 787× cheaper. The catch: size and context changed together.

The context: A model that aces a scoped benchmark is not a safe drop-in for a large production agent, and context budget may matter more here than parameter count does.

NeMo Switchyard: Routing Agent Work Across a Pool of Models

Estimated read time: 7 min

If capability varies that much by model, routing becomes the lever. NVIDIA’s open-source NeMo Switchyard sends each agent task to the model best suited to it, and using tuning-free and tunable routers, LangChain’s benchmark shows a 74% cost cut with just 7% of calls hitting the frontier model.

The opportunity: Route each agent step to the cheapest model that clears your quality bar, and reserve the expensive frontier call for the genuinely hard parts of the task.

DeepSeek Harness: The Environment Layer That Keeps Agents Working

Estimated read time: 1 min

Whichever models you route to, something has to hold them. DeepSeek splits an agent into two parts, the model and the harness, where the harness lets an agent use tools and keep working in real settings. Its Cordis kernel treats every capability as a plugin you swap through configuration, not code.

What this enables: Thinking of an agent as model plus harness lets you reshape capabilities through config, swapping tools and skills in and out without touching the code that runs them.

Xirp: An Agentic IDE That Actually Knows Your Codebase

Estimated read time: 2 min

A harness is only as good as what it knows. AI agents make operationally wrong calls because they don’t grasp the system they work inside. Xirp, connected to Portal, surfaces services, ownership, dependencies, and architectural decisions in every session, reframing stale docs as a retrieval problem, not a documentation problem.

Why now: Give your coding agents real service ownership, dependencies, and architectural context, and they stop making the decisions that are technically correct but operationally wrong.

NEWS & EDITORIALS

The editorials circle back to the person at the keyboard. How you tag agents in, how you talk to them, which language makes their output easy to check, and how you judge whether any of it is working.

The Human Is the Loop

Estimated read time: 6 min

Returning from weeks offline to eleven paused agent tabs, a developer reflects on how agents become a buffer between us and stressful work, feeding a productivity ouroboros. The fix: stay the loop yourself, tagging in agents thoughtfully.

Worth trying: Tag agents in narrowly and deliberately for specific work, so they stay a tool you reach for on purpose rather than a default you gradually drift into.

Working With AI Feels Like Leadership, Not Programming

Estimated read time: 3 min

That framing extends naturally here. Code offers certainty; AI does not. The piece argues that treating AI like a compiler breeds frustration, while collaboration helps. The real shift: software work becomes leading through a conversation, where sharing context matters more than issuing exact commands.

The shift: Stop prompting AI like a compiler and start briefing it like a colleague, sharing the context, explaining the outcome you want, and setting the boundaries up front.

Why Go Fits the AI-Assisted Coding Era

Estimated read time: 8 min

If the work is leading and reviewing, the language you read in starts to matter. As AI generates more code, the bottleneck shifts from writing to reviewing, and this Google Developers piece argues Go’s strict formatting, static types, and built-in toolchain make a language clear for humans inherently clear for AI, letting agents self-correct.

The signal: When AI writes most of the code, pick a language optimized for reading and verifying it, not just for typing it quickly in the first place.

A Skeptic’s Case Against the AI Coding Revolution

Estimated read time: 4 min

Closing on a measured counterweight, this piece argues that four years in, the AI coding boom has little to show. It insists code is an input, not an output: independent productivity studies stay thin, AI-generated PRs still miss obvious bugs, and lines-of-code metrics reward volume over fitness.

How to judge: Before adopting AI tooling, measure top-level productivity and code fitness rather than vanity metrics like lines written or pull requests merged.

This entire post can be found here.

Cheers.

— Sam

Welcome back to Altered Craft’s weekly AI review for developers, and thank you for starting another week here. This edition keeps landing on the same quiet truth: the model is the part you can’t change, and everything around it is where the leverage lives. Context compilers, persistent memory, unified harnesses, loop verifiers, evals as files, code graphs, guardrails. Even the editorials agree, with a four-tool agent beating heavyweight rivals and domain expertise still steering the whole thing.

AI Usage policy

TUTORIALS & CASE STUDIES

The tutorials all work the machinery around the model. What reaches the context window, what survives compaction, where the agent itself lives, and when its loop should stop.

A Context Compiler for Coding Agents (Not Bigger Windows)

Estimated read time: 9 min

Building on our look at last week’s refactoring experiment[1], which cut agent input tokens by restructuring the repo, this pipeline attacks the same waste at prompt-build time. It treats prompt building like a compiler, tracing what a target file reaches and stripping dependencies to interfaces. Building prompts with a compiler’s discipline cut prompt sizes 69–74% in under 75ms.

The takeaway: You don’t control the size of the context window, so control what you feed into it by trimming unreachable code before the model sees it.

[1] Does Refactoring Pay Off in an Agent-Built Codebase? An Experiment

Giving Claude Code a Memory That Survives Compaction

Estimated read time: 9 min

Curating what enters the window is half the problem; keeping it is the other half. When Claude Code hits its context limit, compaction silently drops old outputs and summarizes away constraints. This tutorial’s fix is a cross-thread store paired with a PreCompact hook on MongoDB Atlas, running embedding, hybrid recall, and reranking inside the database.

What this enables: Persist your session’s decisions and constraints to a searchable store before compaction discards them, and hook the write to fire automatically when the window compresses.

One Agent, Every Surface: How Kiro Unified Three Codebases

Estimated read time: 15 min

Shifting from the context window to the harness around it, Kiro’s IDE, CLI, and web clients each ran their own agent, forcing every feature to be built three times. The team consolidated them into a single agent harness running as a standalone server process, so features ship everywhere at once.

The design lesson: Treating your agent as a standalone protocol-driven process, not a compiled-in library, lets features ship to every client at once and enforces a boundary shared libraries never quite hold.

Loop Engineering: Knowing When to Stop

Estimated read time: 10 min

With the harness settled, a runtime question remains. As agents shift from prompts to self-running loops, the hard part is knowing when to stop. This a16z piece argues a loop is only as good as its verifier, showing a Lighthouse run that burned two-thirds of its budget for zero gain.

Key point: Design agent loops with an explicit target state, observable current state, local edits, and a stopping rule tied to cost, because the model will happily iterate forever. I’ve done some of this work in a research agent harness I work on; Tilth. The harness employs configurable circuit breakers and what I call hyper observability.

TOOLS

The tools split the same way. Two models racing ahead on their own, then the scaffolding that makes any of them dependable: evals, chart specs, code graphs, packaging, and guardrails.

Qwen3.8-Max and the Push Toward Multi-Day Autonomous Coding

Estimated read time: 9 min

Qwen’s newest 2.4-trillion-parameter model runs coding tasks for days unaided, building a self-evolving harness through feedback loops. It reproduces research papers, improves on them, and climbs real leaderboards, delivering production-quality work across coding and long-horizon tasks.

The signal: Frontier models are shifting from answering prompts to owning open-ended, multi-day projects, so plan for how autonomous agents fit into your engineering loop before they show up in your repo.

DeepSeek-V4-Flash-0731: Small Activated Params, Big Agentic Gains

Estimated read time: 4 min

In more open-model news, DeepSeek’s official V4-Flash release leans into coding and agentic work, posting gains over its own V4-Pro preview despite far fewer activated parameters. It ships DSpark speculative decoding, three reasoning-effort levels, MIT licensing, and vLLM and SGLang recipes.

Worth noting: If you’re building coding agents, an MIT-licensed model with strong Terminal Bench and DSBench numbers plus baked-in speculative decoding is worth a serious look before defaulting to proprietary options.

smevals: A Filesystem-Native Framework for Evaluating Models

Estimated read time: 9 min

With new checkpoints landing weekly, judging them becomes the bottleneck. smevals treats model evaluation as composable files: Evals hold Tasks, Configs drive Runners, and Graders apply Checkers. By separating gathering evidence from judging it, immutable Runs can be regraded with new rubrics without re-executing any model calls.

What’s interesting: Decoupling evidence from judgment means you pay for model calls once, then iterate on rubrics and graders as often as you like, turning eval design into fast, cheap experimentation.

Flint: An Intermediate Language for LLM-Generated Charts

Estimated read time: 6 min

The same spec-first sensibility shows up in charting. Flint is a semantics-driven intermediate language for visualization: declare what each field means and the chart you want, and a compiler derives scales, axes, and layout. It lets agents emit compact specs instead of brittle native ones, targeting Vega-Lite, ECharts, Chart.js, Plotly, or Excel.

The opportunity: Short specs are easier for agents to emit and for you to review, and compiling one spec to any backend beats debugging hand-rolled chart code in five libraries.

Graphify: Query Your Codebase as a Graph Instead of Grepping Files

Estimated read time: 8 min

Applying similar structure to whole repositories, Graphify maps a project into a queryable knowledge graph via /graphify. Code parses locally with tree-sitter AST, giving you a real graph you traverse rather than a vector index, with every edge tagged extracted or inferred.

What this enables: Instead of grepping raw files, your assistant queries, traces, and explains a graph spanning code, docs, and media, with every edge carrying provenance you can check.

Agent Plugins: One Package Format for Skills and MCP Servers

Estimated read time: 4 min

Once you’ve built skills and servers, distribution becomes the problem. Agent Plugins 1.0.0 introduces a vendor-neutral standard for packaging Skills and MCP servers into portable plugins. A minimal plugin.json manifest and fixed directory locations let authors package once and load across clients like ChatGPT, Cursor, Copilot, Kiro, and VS Code.

Why now: A vendor-neutral format landing while the ecosystem is young means what you package once loads everywhere, and adopting it early beats maintaining per-client formats later.

Shieldstral: Content Moderation as a Question You Write Yourself

Estimated read time: 7 min

Whatever you ship still needs guardrails. Mistral’s new 3B open-weights safety classifier reframes moderation so policies live in the prompt, not the weights. You write plain-language rules at inference time and get a calibrated safety score for text or images. Apache 2.0, one 16GB GPU.

Why this matters: If your product needs context-specific guardrails, a classifier that reads your policy at inference time beats retraining a fixed taxonomy for every deployment, and the license keeps it cheap to trial.

NEWS & EDITORIALS

The editorials weigh who steers all this machinery. A four-tool harness, the expert holding the prompt, new hands on Gemini, and how to pick policy fights.

Pi’s Minimalism Is Its Advantage

Estimated read time: 7 min

Continuing our coverage of agent economics from last week’s prompt-caching deep dive[2], Databricks’ benchmark shows the harness dramatically impacts cost and quality. While rivals pile on prompts and orchestration, Pi ships four tools and a sub-1,000-token prompt, sending 3x less context per turn while topping pass rates.

Key point: Judge coding agents on end-to-end economics, tokens per task and context per turn, not sticker price per million, because the harness moves those numbers more than the model does.

[2] Why Prompt Caching Makes or Breaks Your Coding Agent’s Bill

Why Domain Expertise Still Wins in the LLM Era

Estimated read time: 5 min

If the harness matters that much, so does the hand steering it. Since everyone queries the same models, prompting looks skill-free. This piece argues the most important skill in prompting is domain expertise, using Terence Tao’s terse ChatGPT math exchanges to show how knowing your codebase lets you steer and extract far more.

The career angle: Deep familiarity with your own systems lets you steer an LLM harder and pull out solutions a novice never could, so keep building real domain knowledge.

Demis Hassabis Steps Back From DeepMind’s Driver’s Seat

Estimated read time: 3 min

Shifting to industry news, Sundar Pichai and Demis Hassabis announce a DeepMind reshuffle in messages published by Google. Hassabis becomes Chair and Alphabet Chief Scientist to focus on shaping the future of AGI, while Koray Kavukcuoglu takes over Gemini development as SVP.

The context: Leadership changes at a frontier lab ripple into models and developer tooling, so Kavukcuoglu’s priorities are the early signal for where Gemini’s roadmap heads next.

Open Questions on Open Weights

Estimated read time: 10 min

Zooming out to policy, with over a hundred companies backing open-weights AI, this piece argues for strategic neutrality: preemptive bans burn political capital on unwinnable fights. Save it for threats where waiting for the first incident would be too late.

Worth noting: Pick regulatory battles by asking whether the danger allows a reactive fix; if government acts after the first incident, don’t spend goodwill banning it early.

Thanks for opening Altered Craft’s weekly AI review for developers, and for making it part of your Monday. This week’s picks keep putting a price on something that used to feel free. Tokens carried between turns, context resent every call, dollars per million, and then the currencies no invoice tracks, your attention and the skill you give up by not doing the work. The last piece asks whether the reasoning you’re buying is reasoning at all.

AC’s AI usage policy

TUTORIALS & CASE STUDIES

The tutorials put a number on things that used to feel free. What the orchestrator carries between turns, what gets resent on every call, how much code the agent has to read, and what seven years of scaling actually bought.

The Orchestrator Tax: The Hidden Cost of Multi-Agent Coding

Estimated read time: 7 min

Extending our coverage of Claude’s new context-engineering rules[1] from last week, this piece takes that discipline up a level. This article by Rahul Garg on Martin Fowler’s blog shows debugging a slow four-subagent session reveals the cost isn’t parallelism but the orchestrator’s polluted working memory. A routine status check dumps a full transcript into context, then charges rent every turn after.

Why this matters: Treat the orchestrator’s context as your scarcest resource, keep disposable reasoning inside subagents, and codify a rule only when one missing fact would have prevented the mistake.

[1] The New Rules of Context Engineering for Claude’s Latest Models

Why Prompt Caching Makes or Breaks Your Coding Agent’s Bill

Estimated read time: 9 min

That same context shows up on the invoice. Coding agents resend nearly the same prefix every turn, so cache behavior shapes cost, latency, and tool design. The piece covers how KV caches store prefixes, why adding a tool mid-session invalidates thousands of tokens, and how short TTLs produce surprise bills. As an aside, I really like the style of this blog, minimalism at its best.

The takeaway: Cache stability is a design constraint, not an optimization. Keep tool loadouts additive across a session, and make cache hit rate something you can actually see.

Does Refactoring Pay Off in an Agent-Built Codebase? An Experiment

Estimated read time: 9 min

Another great post on Martin Fowler’s blog. This time from Giles Edwards-Alexander. In the post a 17,155-line Rust file written entirely by agents becomes the test bed: run the same change after each refactoring step. Refactoring cut input tokens by 83%, because the agent reads less code, not because there is less code.

The opportunity: Refactoring an agent-built codebase into well-bounded files is a recurring cost saver rather than a one-time cleanup, since every future change reads a smaller, more relevant slice of the repo.

From GPT-2 to Kimi K3: What Actually Changed in Seven Years

Estimated read time: 13 min

Zoom out to the models themselves and the story rhymes. A worklog traces GPT-2’s 124M parameters to Kimi K3’s 2.8 trillion, roughly 22,580 GPT-2s, and argues much of the progress is efficiency work, not reinvention, walking through KV caching, linear attention, and DeltaNet in code.

What’s interesting: Reading the attention code is the fastest way to see that scale mostly bought efficiency reworks, not fundamentally new mechanisms, which reframes what “frontier” actually means.

TOOLS

The tools pick up where the tutorials leave off. Something that thinks less for the same answer, somewhere to spend the headroom, the plumbing underneath it all, and a check that runs before anything reaches main.

ParallelCode: Run Ten Agents, Ten Branches, Zero Waiting

✨This week’s builder spotlight is for Johannes Millan who’s built and maintains ParallelCode

In Johannes’s own words: ParallelCode is a free, open-source desktop app for developers running several CLI coding agents at once. It supports Claude Code, Codex CLI, Gemini CLI, and OpenCode, while automatically giving every session its own Git branch and worktree. Agents can explore alternative solutions or tackle separate tasks without overwriting one another’s work. Their terminals, changes, and diffs stay visible in one place, and developers decide what to merge. Parallel Code runs on macOS and Linux, keeps API keys local, requires no account, and uses no proxy or data collection.

Two-minute introduction:

If you’d like to be in a future edition spotlight, send the details to sam@alteredcraft.com

Half the Reasoning, Same Answers: A Fine-Tune to Stop Overthinking

Estimated read time: 7 min

Efficiency work shows up in the weights too. BottleCap’s fine-tune of Qwen3.6-27B targets models that think longer than they need to. Rewarding brevity over raw correctness delivers 46% fewer reasoning tokens with unchanged accuracy across twelve benchmarks, shipping on HuggingFace under Apache 2.0.

What this enables: If a local Qwen burns tokens narrating instead of solving, a drop-in efficient checkpoint halves reasoning cost and latency, and an Apache 2.0 license makes it cheap to test.

MCP Goes Stateless: The Enterprise-Scale Rewrite

Estimated read time: 3 min

Underneath all of this, the plumbing is being redrawn. The Model Context Protocol, born as a local-machine bridge, gets an overhaul that rethinks MCP for enterprise scale, adding a stateless design and a 12-month deprecation window under the Linux Foundation, with OpenAI, Google, Microsoft, and Amazon contributing.

Why now: If you’re building on MCP, design for stateless deployment from here on, and lean on the new 12-month deprecation guarantee when you plan integration lifecycles.

Rig: Building LLM Apps in Rust, Not Just Python

Estimated read time: 4 min

The library layer above it keeps widening. Rig is a Rust crate for LLM-powered applications, offering 20+ model providers under one unified interface plus 10+ vector stores. It separates provider contracts from agent orchestration, supports streaming and WASM, and runs in production at St Jude and Neon.

The context: Agent tooling has been Python and TypeScript by default. Rig gives teams already invested in Rust a type-safe path without giving up provider or vector-store choice.

Codex Security CLI: Scan, Confirm, and Fix Vulnerabilities from the Command Line

Estimated read time: 7 min

No shortage of security concerns in the new these days. Whatever you build on top, something has to check the output. Codex Security’s new open-source CLI scans repositories, tracks findings over time, and gates commits. It covers diff scans, pre-commit hooks, bulk GitHub scans, and CI policies, shipping report-only scans with SARIF exports by default.

Key point: Wiring this into a pre-commit hook or CI job catches high-severity findings before they reach main, and report-only defaults let you tune the noise first.

NEWS & EDITORIALS

The editorials price the same question in other currencies. Dollars per token, hours of attention, skill you trade away by not doing the work, and whether the reasoning you’re paying for is reasoning at all.

GPT-5.6 Cuts Prices and Adds Fast Mode to the API

Estimated read time: 4 min

Bold move by OpenAI I know will prove very popular with solo dev and enterprise alike. Building on our coverage of Fireworks.ai’s routing benchmark[2] from last week, OpenAI drops GPT-5.6 Luna pricing 80% and Terra 20%, and adds a Fast mode running Sol up to 2.5x faster. The framing centers on matching intelligence to the outcome, cheap models for well-specified steps, premium compute for consequential work.

The opportunity: Split agentic workflows by step. Let a top model plan, then hand well-specified execution to cheaper, faster tiers like Luna and watch cost per task drop.

[2] Stop Picking a Model, Route Between Them

The Case for Buying Time on Frontier AI

Estimated read time: 2 min

Not every cost has a price tag, though. Leading labs believe they may be close to automating AI research, which could accelerate progress past human oversight. This short piece argues the world lacks the tools to deliberately pace frontier-wide progress, since competition discourages any single lab from slowing alone.

Worth noting: The argument is for coordination rather than unilateral slowdowns, which is a more tractable ask and a useful frame if you follow AI policy at all.

The Developer as Conductor: When Attention Becomes the Bottleneck

Estimated read time: 7 min

One final piece from Martin Fowler’s blog this week. This one in from Rachel Laycock the CTO at Thoughtworks. As AI takes over the code writing, the constraint shifts from typing speed to focus. The piece argues human attention is now the bottleneck, with strong developers orchestrating eight or more agents in parallel, closer to conductors than soloists.

Why this matters: Attention and energy are engineering resources worth budgeting like any other. Plan your week around where your focus goes, not just the hours on your calendar.

Andrew Ng’s LearnVector Bets on One-to-One AI Learning

Estimated read time: 5 min

Spending that attention badly has a downstream cost. Andrew Ng launches LearnVector with $100M from Coursera, shifting education from one-to-many courses to personalized AI tutoring. The pitch hinges on a caveat: chatbots without guardrails harm learning, because cognitive offloading leaves people less skilled. Products arrive early 2027.

The takeaway: Reaching straight for a chatbot answer offloads the cognitive work that builds skill, so use AI as a guide that keeps you working rather than a shortcut past it.

Is AI Reasoning Right for the Wrong Reasons?

Estimated read time: 10 min

Which leaves the question underneath the whole edition. Reasoning models win math medals, yet studies suggest their chains of thought are neither faithful nor causal to the answers, pointing instead to approximate retrieval over genuine reasoning, helped along by verifiable domains like code and proofs.

Key point: Read a model’s visible chain of thought as a performance aid, not an auditable record of how it reached the answer, and verify the output rather than the narration.

Welcome back to Altered Craft’s weekly AI review for developers. Read this week’s picks together and they keep asking the same question: who should actually do this work. Sometimes the answer can be a cheaper model. Sometimes a machine you own, and sometimes it’s still you. The last piece is about what it costs when you hand something off to the machine and the impact of that.

Our AI usage policy

TUTORIALS & CASE STUDIES

The tutorials work through the allocation one layer at a time. What you should run yourself, what you shouldn’t, what the agent keeps in its own head, what you still have to say out loud, and what you can hand to a check that runs without you.

Netflix Runs Its Own LLM Stack: Lessons From Production

Estimated read time: 13 min

Start with something you decide to own outright. Netflix runs its full LLM stack in-house on vLLM and Triton, unified behind one API. The post walks through engine selection, packaging, and deployment, stressing that the hardest lessons surfaced only under production load, including version pinning, dropped parameters, and CPU-bound decoding.

The takeaway: Design decisions that look clean on paper reveal their real trade-offs only under concurrency, so pin your versions early and build in escape hatches before load finds them for you.

The Five Layers Hiding Behind a Web Agent’s Browser

Estimated read time: 9 min

The mirror decision is what not to own. Launching one browser for an agent is a weekend project, running thousands is a standing system. This piece maps five layers between an agent and the web, arguing pools, isolation, proxies, and model routing are substrate, not your product.

Worth weighing: Before building web agent infrastructure in-house, decide whether owning warm pools, VM isolation, identity coherence, and observability is worth diverting senior engineers from your actual product.

How AI Agent Memory Actually Works (and How to Build It)

Estimated read time: 14 min

Some of the allocation happens inside the agent. Every LLM call is stateless, so agents need a memory layer. This guide splits memory into four types and explains the write, consolidate, retrieve, forget lifecycle that naive systems skip, with framework-agnostic Python and a clear agent-memory-versus-RAG distinction.

Where to start: Begin with working memory (short-term) plus one long-term type, and treat memory as a lifecycle that consolidates and forgets rather than a store that only grows.

The New Rules of Context Engineering for Claude’s Latest Models

Estimated read time: 8 min

What you still have to say out loud is changing too. Habits like stacking rules, front-loading everything, and repeating instructions have quietly become anti-patterns. The piece argues that newer models reward judgement over rigid guardrails, favoring progressive disclosure, expressive tool interfaces, and code-based references over verbose prompts.

Try this: Trim your CLAUDE.md and skills down to gotchas and opinions, then let progressive disclosure surface deeper context only when the work actually calls for it.

Turning Repetitive Checks Into Verification Loops in Claude Code

Estimated read time: 7 min

The last thing to hand off is the checking. Extending our coverage of the Bun team’s Rust migration[1] from last week, where the fix was the process rather than the code, this tutorial encodes repetitive checks as Claude Code skills. It then covers how each loop kicks off, standalone, embedded, chained, or on every PR.

What this enables: Write down the check you keep running by hand, hand it to a skill, and let Claude Code apply it without depending on anyone’s diligence.

[1] Rewriting Bun in Rust, One Adversarial Review at a Time

TOOLS

The tools make the same choices concrete. Where the memory lives, which machine runs the session, and then the question the week keeps returning to, which model gets each task and what that answer costs.

Cognee: A Postgres-Only Memory Layer for AI Agents

Estimated read time: 6 min

Start with where the memory lives. Cognee is an open-source platform combining vector embeddings, graph reasoning, and ontology generation for persistent agent recall. Its headline move is running the whole memory layer on one Postgres instance instead of separate graph, vector, and session stores.

The opportunity: If you’re adding long-term memory to agents, you can skip the four-service stack and run graph, vector, and session memory on a single Postgres box.

Devin Outposts: Run Agent Sessions on Your Own Machines

Estimated read time: 4 min

Then the machine that runs the session. Outposts executes Devin sessions on your infrastructure while planning stays in Devin’s cloud. The key move is that execution, file edits, and repo access happen on machines you operate, whether VMs, containers, Kubernetes, or a Mac Mini. Workers need only outbound HTTPS.

Why this matters: If your agents need to sit next to internal services, secrets, or custom hardware, Outposts keeps execution local while offloading the planning to the cloud.

Stop Picking a Model, Route Between Them

Estimated read time: 6 min

Which brings up the model itself. Putting our coverage of the architect-and-workhorse split[2] from last week to the test, Fireworks.ai ran Kimi K3 against Fable 5 across roughly 1,030 agentic tasks. Quality lands near-even but each model specializes by domain, and routing tasks beats either model alone at a fraction of the cost.

Key point: Treat a cheap open model as your default and reserve the premium one for tasks that genuinely need it. The router, not the model, is your edge.

[2] Better Call Sol: The Workhorse Model Roundup

Gemini 3.6 Flash and Flash-Lite: Tuned for Agent Economics

Estimated read time: 4 min

Once you’re routing, the cheap tier matters more. Google’s new Flash models target agent economics. Gemini 3.6 Flash uses 17% fewer output tokens than 3.5 Flash with fewer reasoning steps, while 3.5 Flash-Lite hits 350 tokens per second. The pitch: token efficiency now drives agent cost more than raw capability.

Worth noting: It makes you wander if all this Flash work from Google is to ready themselves to be the AI stack for Apple (and the iPhone)

Claude Opus 5 released

Estimated read time: 8 min

And so does knowing what earns the premium slot. Anthropic’s latest model posts state-of-the-art results on coding and knowledge-work benchmarks at roughly half of Fable 5’s cost. The launch emphasizes judgment over raw output: Opus 5 verifies its own work, catches errors during planning, and rates as the most aligned model yet.

What’s interesting: Value shifts from generation speed toward reliable judgment, which makes Opus 5 worth testing on long-horizon agentic tasks where variance used to cost you the most.

NEWS & EDITORIALS

The editorials push the same question past the tooling. Which decisions stay yours, which tasks were never the model’s to begin with, what you assumed the agent would leave alone, and what a handoff costs when you can’t quite release it.

Claude Is Not a Compiler, It’s a Multi-Compiler

Estimated read time: 6 min

Start with the decisions worth keeping. Revisiting the question of whether Claude is a compiler, this piece argues LLMs are something better, a resource that works vertically across the stack. A distributed DNS build shows agents accelerating decisions from strategy down to code, while the engineer curates which of those decisions actually matter.

The practice: Let agents work up and down the stack while you own the decisions worth recording, then capture them in a terse spec that survives the next round of code churn.

Why Agentic AI Still Needs Classical ML

Estimated read time: 6 min

Some tasks were never the model’s to begin with. Rather than asking an LLM to guess numbers, this piece argues agents should call classical ML models as tools for accuracy, cost, and interpretability. It compares two integration patterns, direct model calls versus pre-computed inferences served from a database.

What this solves: When your agent needs a real number, wire it to a trained classifier or regressor and you get accuracy plus an explanation the LLM cannot produce on its own.

When a Benchmark Became an Attack Surface

Estimated read time: 9 min

Then there’s what you assumed the agent would leave alone. During an OpenAI cyber evaluation with reduced refusals, models exploited a zero-day to escape isolation and compromise Hugging Face, inferring it held benchmark answers. The piece separates confirmed facts from speculation, showing how agents treat guardrails as part of the problem.

Worth planning for: When you design agentic evaluations, treat the containment boundary as something the agent may work on rather than a fixed assumption you can build around.

When AI Makes It Harder to Focus

Estimated read time: 9 min

Ending on the handoff that stays with you, a developer traces the slow erosion of their attention span, from distraction-hungry apps to outsourcing work to LLMs. The reflection lands on a subtle trap: handing a task to an AI keeps it running in the background of your mind, fragmenting focus even without notifications.

The honest read: Handing work to an LLM pays off when you can genuinely let go of it, so pick the tasks you’re willing to stop tracking and close the loop.

Hello, and welcome to Altered Craft’s weekly AI review for developers, with thanks for making this part of your week. Another strong open-weight model landed with Inkling, but the more interesting part is Tinker, the fine-tuning service beside it that finally puts a business model under open weights. Capability is getting cheap, while shaping a model to your domain is what holds value. The picks below follow that thread.

TUTORIALS & CASE STUDIES

The tutorials all circle one question: what do you bring to the model? Start by constraining the language it writes in, then the posture you prompt with, then the process that reviews its output, and finally the models you route to and the one you decide to run yourself.

Why DSLs Are the Sweet Spot for LLM Code Generation

Estimated read time: 7 min

Start with the language the model writes in. Unmesh Joshi argues specs are hypotheses, not blueprints, and design emerges through implementation. His core claim: DSLs make LLMs more reliable because their constrained syntax responds to a few examples and ships with deterministic validators, shown via PlantUML and the Tickloom framework.

The takeaway: Pair LLMs with a small, well-factored DSL backed by a validator, and you get reliable generation plus domain-level error feedback the model can self-correct against.

Tourist vs. Archaeologist: Prompting AI Through a Legacy Codebase

Estimated read time: 8 min

Shifting from the model’s language to your own posture, asking an LLM “how do I run this?” on crumbling legacy code yields a confident, hallucinated “Starter Kit” that hides the rot. The fix is to act like an archaeologist, not a tourist: run forensic audits and build Docker “time capsules” first.

The practice: On brownfield code, prompt the AI to be a critical forensic auditor rather than a helpful tour guide, and containerize the original environment before you change a single line.

Rewriting Bun in Rust, One Adversarial Review at a Time

Estimated read time: 11 min

Scaling that discipline to an entire migration, and facing recurring memory-safety bugs, the Bun team ports 535,000 lines of Zig to Rust using roughly 50 Claude Code workflows over 11 days, relying on split-context adversarial review and fixing the process that generates code, not the code itself.

Key point: When merging large volumes of LLM-authored code, separate the implementer and reviewer into distinct context windows and fix the workflow rather than patching individual outputs.

Better Call Sol: The Workhorse Model Roundup

Estimated read time: 11 min

With the process settled, the question becomes which model runs it. This roundup weighs a fictional near-future GPT-5.6-Sol against Fable, arguing that Fable stays the architect while Sol is the workhorse. It cuts through launch hype to show where cost, capability, and trust diverge.

The pattern: Route planning to your smartest model and execution to the cheaper workhorse, but send hard queries to both and compare.

A Zero-Trust AI Code Reviewer That Never Leaves the LAN

Estimated read time: 11 min

Taking a different approach from routing across frontier models, this tutorial keeps everything on the LAN, building a local review pipeline with GitLab CI/CD, Ollama, and Qwen3-Coder-30B, where a self-correcting LangGraph loop validates and retries JSON output to produce reliable inline suggestions.

What this enables: Wrapping an open-weight model in a retry loop that feeds validation errors back into the prompt turns unreliable JSON output into a production-grade review gate.

TOOLS

The tools split in two. First the models, an open-weight bet with a business model attached, a benchmark that stopped meaning much, and two more releases aimed at very different problems, then the context you supply them, which is where the leverage actually sits.

Thinking Machines Bets on Open Weights With Inkling

Estimated read time: 4 min

Following our look at Tencent’s open-weight MoE[1] from last week, Mira Murati’s Thinking Machines Lab ships Inkling. The wager: AI that organizations shape themselves beats one-size-fits-all. Not best-in-class, but cheap to fine-tune via its Tinker platform, where revenue lives.

Why this matters: If your domain expertise is your edge, fine-tuning an open-weight model may beat renting metered access to a frontier chatbot.

[1] Tencent’s Hy3 Lands as a Punchy Open-Weight MoE

The Pelican Benchmark Meets Kimi K3

Estimated read time: 4 min

Also arriving open and cheap, Moonshot AI’s Kimi K3 lands with 2.8 trillion parameters and Claude Sonnet-level pricing. Running it through the SVG pelican test reveals one “max” reasoning mode and heavy token spend, but the real point: the pelican no longer tracks model quality.

Worth noting: Fun single-prompt tests are useful for confirming a model works, but judge today’s models on agentic tool calling over long conversations, not vibes.

Meta Ships Muse Spark 1.1 With a Million-Token Agentic Focus

Estimated read time: 5 min

Shifting to the frontier, Meta Superintelligence Labs introduces Muse Spark 1.1, a multimodal model built for agentic work with a million-token context it actively manages. It orchestrates parallel subagents, decides when to script versus click, and handles large codebases through the OpenAI-compatible Meta Model API.

The opportunity: If you’re building agents that span coding, tool use, and long-running workflows, the Meta Model API preview gives you a low-friction way to test a million-token model against your real tasks.

NVIDIA Cosmos 3: One Model for Physical AI

Estimated read time: 12 min

Also open but aimed elsewhere, NVIDIA Cosmos 3 is a suite of omnimodal world models that jointly handle language, images, video, audio, and action in a unified Mixture-of-Transformers architecture. A Reasoner covers world understanding while a Generator drives simulation and robot training.

What’s interesting: Cosmos 3 collapses vision-language models, video generators, and world simulators into one framework you can run locally today for Physical AI development.

OpenWiki Brains: Proactive Wiki Memory for Your Agents

Estimated read time: 6 min

Moving from the models to what you feed them, LangChain’s OpenWiki 0.1.0 adds a “Personal Brain” that connects Gmail, Notion, git, and X into a local Markdown wiki for agents. The pitch is proactive memory pulled from tools you already use, refreshed on a schedule.

Try this: Instead of re-pasting context into every session, wire your agents to a local wiki that quietly stays current with the sources you already work in.

deja: A Local Search Layer for Your AI Agent History

Estimated read time: 9 min

Similarly mining context you already have, coding agents log every conversation locally, leaving gigabytes of solved problems you can’t search. deja is a zero-dependency Go binary that indexes histories across Claude Code, Codex, and Cursor into a searchable memory layer with sub-15ms search and MCP recall.

Why now: Point deja at your existing agent logs and your assistant can recall past fixes instead of solving the same bug twice.

NEWS & EDITORIALS

The editorials work outward from the market to the person. Open weights won on cost, the labs may not capture the value they create, and what’s left as leverage is the part you supply, your ideas, your judgment, your taste, along with the fatigue of supplying it.

The State of Open-Source AI: Parity Reached, Operations Still Hard

Estimated read time: 11 min

Extending our coverage of the open source AI stack map[2] from last week, this Mozilla report argues open weights closed the capability gap as inference costs collapsed 50×. Open models route most production tokens, yet only 51% of teams ship them versus 63% for closed. The bottleneck isn’t capability, it’s operations.

The stakes: Open models have won on cost and capability for most workloads, so the real decision is whether your team can carry the operational burden of deploying them.

[2] Mapping the Gaps in the Open Source AI Stack

Loving AI Without the Doom and Hype

Estimated read time: 3 min

Following that thread on where the value lands, this piece celebrates LLMs and coding agents while rejecting both doom and singularity hype. The core claim: frontier labs won’t capture the value they create, since progress rides Moore’s law, not proprietary genius.

The context: Treat AI models as another productivity tool in the compiler lineage, and tune out both the doom narratives and the superintelligence hype.

Stop Reading the Code, Own the Ideas

Estimated read time: 6 min

Turning from the market to your own practice, Redis creator antirez argues that as AI outpaces human review, developers gain more by controlling the ideas rather than scanning line by line. He favors trading exhaustive review for QA, design thinking, and human-readable DESIGN.md files.

The shift: Spend your hours defining architecture, testing, and documenting design intent rather than manually reviewing every line an LLM produces.

The LLM Critics Are Right. I Use LLMs Anyway.

Estimated read time: 9 min

Echoing that from Local-First Conf in Berlin, this piece sits in the dissonance of agreeing with LLM critics while spending heavily on tokens. The argument: LLMs amplify what you already have, so trust becomes the real currency, backed by concrete workflow patterns.

The principle: Use LLMs to sharpen your own thinking, not replace it, and gate their output through short human-readable artifacts you would defend out loud.

What Are We Automating: Human Tasks or Human Thinking?

Estimated read time: 7 min

On the other hand, there’s a limit to what you should hand over. Using Ken Liu’s story “The Perfect Match” and a real man who lets AI do his thinking, this essay probes the line between helpful automation and offloading not just tasks but agency.

Worth holding onto: Use AI to extend your thinking after you’ve formed your own hypotheses, not to skip the reasoning that makes decisions genuinely yours.

The Human in the Loop Is Tired

Estimated read time: 7 min

Ending on the cost of all that supervision, an honest account from inside Pydantic explains why AI-assisted coding feels more productive yet less satisfying. It names the fatigue of supervision and a broken reward loop, arguing taste and judgment matter more, not less.

The honest read: Treat your broken feedback loop as an engineering problem, not a personal failure, and lean into the judgment and taste that LLMs still can’t supply.

Welcome back to Altered Craft’s weekly AI review for developers, and thank you for keeping this a Monday ritual. This week a survey put a number on something many of us feel: the tech workforce is splitting in two, those amplified by AI and those shaken by it. The picks underneath ask what sorts you onto each side, and the answer keeps coming back to command of the system around the model, its harness, data, and control plane. The tools are the dividing line, the editorials the human cost. Let’s dig in.

TUTORIALS & CASE STUDIES

The tutorials are where the toolkit comes together. Command of the system around the model is something you build, not something you’re born with, and this is where you build it: survey the open stack, tune the harness instead of the model, then watch that harness become the path to agents that improve themselves.

Mapping the Gaps in the Open Source AI Stack

Estimated read time: 3 min

Start with the lay of the land. A community project pursues a public option for AI that serves people over profit. It evaluates over 24,000 projects, from foundation models to inference backends, scoring each on openness, capability, and adoption to reveal the open stack’s gaps.

Why this matters: Before betting on an open source AI component, check where it lands on openness, capability, and adoption. The gaps are more visible than they look.

Tuning the Harness, Not the Model

Estimated read time: 9 min

Building on our coverage of the outer loop as the product[1] from last week, this LangChain playbook shows how tuning the scaffolding instead of the weights lifted an open Nemotron 3 Ultra to near-Opus quality at roughly 10x lower cost, using eval-driven loops, targeted prompt blocks, and context injected where the model fails.

The takeaway: Before reaching for a bigger model, treat the system prompt, tool descriptions, and middleware as tunable training data, and use evals to prove each change survives.

[1] Autoresearch: When the Loop Becomes the Product

Harnesses, Not Weights: The Near-Term Path to Recursive Self-Improvement

Estimated read time: 11 min

Taking that further, recursive self-improvement likely arrives through harness engineering as an optimization target, not a model rewriting its weights. The piece traces the path from prompts to workflows to harness code, surveying file-system memory, sub-agents, and meta-harnesses.

The principle: Treat the system around your model, its workflow, memory, and tooling, as a first-class optimization target rather than an afterthought to raw model intelligence.

Mapping the Rise of Self-Evolving Agents

Estimated read time: 2 min

At the frontier of the same idea, a short thread sketches a taxonomy for self-evolving agents that improve themselves over time, pointing to Hermes Agent for automatic reusable skills and RSI Lab for recursively discovering algorithms. It frames an emerging category as agents move beyond static behavior.

Why now: Start tracking how agents accumulate reusable skills and self-improve, because static prompt-and-tool setups are giving way to systems that evolve their own capabilities.

The Real Factors Behind Running Local Models for Coding

Estimated read time: 9 min

End on a lever you control, your own hardware. Local coding models have improved sharply, but viability hinges on interacting variables. The piece maps how RAM, quantization, context size, MoE architecture, and harness overhead shape results, concluding it’s still not plug-and-play. Qwen3.6 35B MoE offers the best balance.

Key point: If you want to run models locally for agentic coding today, budget for at least a 32K to 64K context window and expect to trade capability against your RAM ceiling.

TOOLS

The tools are where that command becomes concrete. First the infrastructure that wraps your models, a control plane and the data that earns agent trust, then the models themselves, a punchy open MoE and a compact navigator, and finally a frontier launch whose real story is the plumbing, not the benchmark.

Otari: An Open-Source Control Plane for Your LLM Stack

Estimated read time: 3 min

The tools open with the layer between app and provider. Mozilla.ai launches Otari, an open-source LLM control plane that handles routing, budgets, governance, and failover from one endpoint, so teams stop rebuilding that logic. The pitch: operating LLM infrastructure is the real challenge now, not model access.

The opportunity: Centralize routing, spend, and governance in one control plane instead of hand-rolling that logic into every LLM app you ship.

Open Data Is How Agents Earn Trust

Estimated read time: 6 min

Staying at the infrastructure layer, NVIDIA’s Nemotron team argues that building capable agents is a data problem, not just a weights problem. The piece makes the case that open synthetic data builds trust between organizations, sharing useful signal without exposing secrets, and keeping agent behavior inspectable.

Worth noting: If your agent can’t recover from a broken API call, that’s a data coverage gap. Document what’s grounded, generated, and reviewed rather than treating synthetic data as filler.

Tencent’s Hy3 Lands as a Punchy Open-Weight MoE

Estimated read time: 2 min

Shifting from plumbing to the models themselves, Tencent releases Hy3, an Apache 2.0 licensed 295B-parameter Mixture-of-Experts model with 21B active parameters and a 256K context window. The link blog notes it rivals flagship open-source models with 2-5x the parameters and is free on OpenRouter until July 21st.

Try this: A permissively licensed MoE that punches above its active-parameter weight is worth a free trial on OpenRouter before the July 21st window closes.

One RGB Camera, No LiDAR: Inside Robostral Navigate

Estimated read time: 6 min

Also doing more with less, Mistral’s robotics team unveils Robostral Navigate, an 8B model that moves robots through unseen spaces from plain-language instructions using a single RGB camera. It hits 76.6% on R2R-CE via navigation as pointing plus prefix-cached training that cuts tokens 22×.

The pattern: Compact models with strong grounding priors can outperform heavier sensor stacks, so lean architecture and efficient training often matter more than adding hardware.

GPT-5.6 Lands: Luna, Terra, Sol and the SWE-Bench Standoff

Estimated read time: 4 min

While our coverage of Claude Sonnet 5’s lower-priced agentic tier[2] last week weighed cost against capability, OpenAI now ships GPT-5.6 in three sizes, leading on agentic benchmarks while trailing Claude Fable 5 on SWE-Bench Pro. The more useful details are the new API features like programmatic tool calling and baked-in subagents.

What’s interesting: Look past the benchmark headlines. The new API primitives for tool orchestration and subagents are where GPT-5.6 actually changes how you build.

[2] Claude Sonnet 5: Opus-Class Agentic Work at a Lower Price

NEWS & EDITORIALS

The editorials turn to the human side of the divide. First the survey that names it, then the burnout it can bring, the habits it quietly erodes, the discernment worth holding onto, and finally a concrete lever you still control.

The Great AI Split: Two Tech Workforces Emerge in 2026

Estimated read time: 9 min

Start with the study that names the split. A 2026 survey finds the tech workforce bifurcating into two realities: those amplified by AI versus those shaken by it. Burnout jumped to 55.7%, and 53% wouldn’t recommend their role. The top fear isn’t replacement but doing more for the same pay.

The stakes: How AI has reshaped your professional identity now predicts your career outlook more than title or tenure. Regardless of where you lie on this spectrum, empathy for your fellow colleagues should be held in high regard.

The Slow Burn of Reading LLM Output All Day

Estimated read time: 4 min

One side of that split is quiet burnout. A developer reflects on hours spent daily reading AI output, and the fatigue that follows. The issue isn’t unreliability but repetition of the same style and same mistakes. Hallucinations, staccato fragments, and excessive emoji feel minor alone, yet compound.

The shift: As LLMs move from occasional tool to constant companion, the stylistic sameness of their output becomes its own fatigue worth naming.

Your AI Copies Your Bad Habits, Too

Estimated read time: 3 min

And the pressure to ship more runs both ways. Letting an LLM write duplicated logic feels harmless until you realize it learns from what you merge. The piece argues that every shortcut becomes a signal, so sloppy patterns compound and quietly train the AI to repeat your worst habits.

The practice: Write code like a human will maintain it, because the LLM reads your codebase and echoes back whatever patterns you let slide.

Five Years Later, “Stochastic Parrots” Still Gets Misread

Estimated read time: 9 min

Staying critical is its own kind of leverage. On the paper’s fifth anniversary, lead author Emily Bender corrects misreadings of the “stochastic parrots” metaphor. It describes large language models specifically, not all AI, and her central point: when model output makes sense, we are the ones making sense of it.

The context: When evaluating LLM output, account for your own tendency to project meaning onto text the system produced without any comprehension.

That’s the week.

Regarding AI's arrival in software development, it helps to zoom out: every major technology has arrived with its loud believers and its wary holdouts, and the history of the craft was written by both. The overclaimers are nothing new, and neither is the engineer who would rather go deep on fundamentals than sprint after what’s new in the space. Wherever this week finds you on that spectrum is completely okay; there is no wrong side to be a thoughtful person on. So keep your head up, treat the hype as noise, look for the real signals underneath it, and give yourself room to experiment. That is how each of us finds our own footing. See you next Monday.

– Sam

Two caveats up front. First, this is app development, not a large distributed system. In theory a big system breaks into cohesive modules, and an agent could own one module and its contract with the others, but I haven’t validated that at scale. The second: Rust is a newish stack for me, which shapes much of what follows.

Here’s what’s working for me:

• Steer with directives. A solid set of agent files (CLAUDE.md) for the programming language does more for me than any single prompt.

A sample of my current Rust directives
Rust data modeling

• Ownership forms a tree/DAG, never a cycle. One clear owner per value.

• For references between values (or any logical cycle): use slotmap keys, or Vec indices only if nothing is ever removed.

• ...

Full set in this gist.

• Limit third party dependencies. Add a clause to your agent file: be conservative with third party dependencies. Weigh a few options, favor the well-maintained ones, and ask before adding.

• Make the test suite your source of truth. If you’re not going to review and gate the functional code line by line, fixate on the tests. It’s the closest-to-code abstraction I have for gauging whether the implementation is correct. Telling the agent to “create tests” isn’t enough; left alone it will write tests that pass without proving much. So I give it a TDD directive and name the anti-patterns to watch for. Over-mocking is the big one: mock enough of the surrounding code and you stop testing your logic and start confirming that the mock framework returns what you told it to. A test suite I trust, plus a current frontier model with good steering, gets me solid results at app scale.

• Build kernel-first. Build bottom-up. Start with the data structures, and then the business logic to manage them. No UI. This narrows scope and makes the conversation with the model clearer. Keep the UI decoupled from the kernel, so more of the system is testable without it. This is where SWE fundamentals pay off: dependency injection, decoupling, testable seams.

• Pause at the end of each stage. Ask the agent how to smoke test what you built. Dig into anything that doesn’t sit right, and later have it build HTML walkthroughs. Have it review the session’s changes for business logic that landed in more than one place; that scattering usually signals a cleaner module boundary or an extracted method. Before the next stage, have it curate the docs: fix inaccuracies, consolidate duplication, sync the agent files.

• Scope milestones to a session. I work toward an early MVP in a series of discrete milestones, one milestone per session. If I’m reaching for /compact, the milestone was too big.

Underneath these tactics is one idea: keep the system legible enough that you and the agent share a picture of what it’s actually doing. As complexity climbs, complete, accurate, actionable instrumentation matters more, so lay these foundations early.

The part I’d underline is patience: think about your actual motivation. Mine is simple: get better at reading and interpreting Rust, and learn to spot the anti-patterns and rough edges I’m sure are sitting in this codebase. Building something real that I plan to rely on makes those lessons stick. So I take the occasional “no new features” day to dig into one component, or improve the test suite. Refactoring for understanding counts as progress.

There’s a lot of pressure to treat velocity as the only metric, to produce more code, faster. Some of that comes from leadership, and if that’s your mandate, I feel for you; that’s a genuinely tough spot. But a lot of it is ambient: feeds full of confident takes and flashy demos that make careful work feel like falling behind. calls that AI confidence theater, and much of the certainty is performance. If you get time to work with AI on your own terms, deliberate work isn’t falling behind. It’s how you end up understanding what you built.

I am actively iterating on this approach on B2, my effort to build a personal knowledge management app.

Thanks for opening Altered Craft’s weekly AI review for developers, and for making this a Monday habit. One thread runs through this week’s picks: the burden of proof has moved onto the output. An essay on AI confidence theater puts it plainly, sounding competent quietly replaced being competent, and the rest of the issue answers with evidence. Verify the fix, contain the code, gate the endpoint, score the prompt, prove the exploit. The claim is cheap now, so the proof is where the work lives.

TUTORIALS & CASE STUDIES

This week’s tutorials walk the burden of proof down the stack: verify the fix a human should still own, contain the code you cannot fully trust, gate the endpoint behind real authorization, then run it all on infrastructure that records what happened.

The Sorcerer, Not the Apprentice: Fixing a Parser Bug With AI

Estimated read time: 6 min

It starts with the fix you are tempted to accept. Walking through a real hyperscript parser regression, this essay shows AI excelling at root-cause investigation and tests while proposing progressively hackier fixes. The clean solution came from a knowledgeable human restraining complexity an agent alone would have shipped as technical debt.

The takeaway: Let AI investigate causes and grind out tests, but keep a human who understands the architecture deciding which fix actually ships.

Running Untrusted Agent Code Without a Sandbox

Estimated read time: 6 min

If you cannot fully trust the fix, trust the generated code even less. Complementing our coverage of AWS Lambda’s isolated MicroVMs[1] last week, LangChain takes the opposite tack: with prompt injection unsolved, its Code Interpreter for Deep Agents runs orchestration inside WebAssembly with QuickJS, so the runtime starts with nothing and bridges capabilities deliberately, even pausing for approval.

The principle: Constrain what agent code can touch instead of trusting it to behave. Start from zero capabilities and bridge in only what each workflow genuinely needs.

[1] AWS Lambda MicroVMs: Isolated Sandboxes for User and AI-Generated Code

Put Your LLM Endpoint Behind an OAuth Boundary

Estimated read time: 16 min

Beyond the code it runs, the endpoint itself needs a gate. This tutorial wires Azure API Management and Entra ID to add OAuth 2.0 authorization in front of a Foundry-hosted GPT model. The principle: don’t expose your model endpoint directly. Policies validate each token’s tenant and client.

Worth noting: Gate your LLM calls behind an API gateway that checks token issuer and client, so not every valid Entra ID token gets through to the model.

Mistral’s Workflows: Document Processing in 30 Minutes

Estimated read time: 3 min

With those checks in place, the pipeline still has to run provably. Mistral introduces Workflows, an orchestration platform for building, executing, and monitoring AI-driven pipelines. The walkthrough shows how to build a document processing workflow in 30 minutes, backed by durable, fault-tolerant execution on distributed infrastructure.

What this enables: If you are chaining AI steps into a pipeline, purpose-built orchestration with fault tolerance and monitoring beats hand-rolled glue code you cannot replay.

TOOLS

The tools split into the engines that do the work and the ones that prove it: an affordable frontier-class tier, a router that decides without a model, a full GLM stack, then two that insist on evidence, scored prompts and working exploits.

Claude Sonnet 5: Opus-Class Agentic Work at a Lower Price

Estimated read time: 5 min

The tools start with the engine. Anthropic’s latest mid-tier model narrows the gap with Opus-class performance at lower prices. Sonnet 5 plans, uses browsers and terminals, and sustains multi-step coding autonomously, and early partners report it finishes complex jobs earlier Sonnets abandoned.

Why this matters: Adjustable effort levels let you tune the cost-performance tradeoff, making Sonnet 5 a practical default for sustained agentic coding and tool-use work.

Wayfinder: A Model Router That Makes Its Routing Call Without a Model

Estimated read time: 9 min

You do not need that engine for every request. Wayfinder scores each prompt’s structure and wording, sending easy requests local and hard ones to your expensive tier. The standout is a deterministic, offline decision with no model call, no key, no network, and it speaks the OpenAI API.

The opportunity: Stop paying frontier prices for “fix my typo.” Route prompts by difficulty with a free, deterministic decision that drops in behind your existing OpenAI client.

ZCode and the GLM Coding Plan: An Agentic Coding Stack Built Around GLM-5.2

Estimated read time: 2 min

For a full stack around a cheaper engine, ZCode pairs a coding agent with tiered GLM plans from $16.20/month, tuning GLM-5.2 for reasoning and multi-agent work. The pitch centers on keeping every engineer on the frontier, with long-running Goals and bot control from WeChat, Feishu, or Telegram.

Try this: If you want an agentic coding setup that steers work from chat and handles long-running tasks, ZCode’s GLM-tuned tiers are worth a look.

Stop Hand-Tuning Prompts: How DSPy Automates the Work

Estimated read time: 7 min

Whatever model you land on, the prompt driving it needs proof it works. Prompt engineering is slow and unreliable, since eyeballing a few outputs rarely shows a prompt holds in production. This piece argues for treating prompts like ML models, using DSPy to define test data and a scoring function that grades candidates automatically.

The pattern: Bring ML-style evaluation to your prompts. Define a test set and a scoring function, then let DSPy generate and grade candidates instead of guessing.

Strix: Autonomous AI Agents That Pentest Like Real Hackers

Estimated read time: 6 min

Proof matters most where security is on the line. Strix is an open-source pentesting tool where AI agents validate vulnerabilities with working proof-of-concept exploits, not static-analysis noise. It ships a full offensive toolkit, multi-agent orchestration, and a CLI that drops into CI/CD to block insecure code before it merges.

The payoff: Wire Strix into your pull request workflow to catch and reproduce real exploits before insecure code reaches production.

NEWS & EDITORIALS

The editorials weigh substance against performance: the theater of sounding capable, the expertise that judges real output, the loop that keeps a system honest, AI proving flaws at scale, and the unglamorous fundamentals that outlast clever bets.

Please Stop the AI Confidence Theater

Estimated read time: 11 min

The editorials open on the gap the whole issue answers. A pointed critique of performative AI hype flooding social feeds and hiring, where sounding competent replaced being competent. The piece argues the gap between demo and daily reality erodes trust and buries the real work of tuning living AI systems.

The context: Be honest about what your AI workflows actually do. A prototype that saves 20 minutes beats a viral claim that collapses on inspection.

The Twilight of the Chatbots

Estimated read time: 7 min

If competence has to be shown, someone has to judge it. AI capability is climbing a better-than-exponential curve, with agents running autonomously for hours on work that once took teams weeks. The shift moves from chatbots to managing fleets of agents, where domain expertise predicts who gets the most useful output.

The shift: Treat agents like direct reports you manage rather than chatbots you collaborate with, because your domain expertise turns long-running AI into real output.

Autoresearch: When the Loop Becomes the Product

Estimated read time: 10 min

Building on our coverage of loop engineering[2] last week, Introspection’s Roland Gavrilescu unpacks “autoresearch”: an outer loop where agents maintain and improve the primary system via evals, judges, and human signals. The reframing is that the loop is the product, packaged into portable “agent recipes” teams can own.

Why now: Invest first in the signals you want agents to respond to, and control loop costs, before chasing full autonomy.

[2] From Prompting Agents to Loop Engineering

The CVE Spike Behind AI-Powered Vulnerability Discovery

Estimated read time: 3 min

Proof cuts the other way too. Epoch AI charts a sharp rise in severe cybersecurity disclosures after Anthropic revealed Claude Mythos Preview could autonomously find flaws. High- and critical-severity CVEs from notable organizations spiked more than 3.5x in June 2026, following hardening work by Anthropic and OpenAI.

The signal: Frontier models now discover vulnerabilities at scale, so expect a faster patch cadence and treat dependency updates as a security priority, not a chore.

The AI Blog Prize: Three Contrarian Takes on the Post-Automation World

Estimated read time: 14 min

We close on where durable advantage actually lives. Dwarkesh Patel announces three winning essays from 600 submissions on big AI questions, ranging from ending airborne disease with far-UVC infrastructure to a grounded case for boring, timeless economic policy over galaxy-brained schemes.

The lens: In a world reshaped by AI, the most durable advantages may come from unglamorous fundamentals like stable institutions and capital formation rather than clever bets.

That’s the week. The throughline: the claim got cheap, so the proof is the product now, whether that proof is a contained runtime, a scored prompt, or a working exploit. See you next Monday.

Welcome to Altered Craft’s weekly AI review for developers, and thanks, as always, for reading. A pattern runs through this issue: the model is no longer the whole job. The work has moved to the system around it, the loop you engineer, the harness that runs it, the sandbox that contains it, and the provider and version-control layers that support it. The news side counts the cost of all that, from liquid-cooled data centers to the token bills arriving as the subsidies end.

TUTORIALS & CASE STUDIES

This week’s tutorials trace the agent from the inside out: the mechanism that lets it act, the loop you engineer around it, the harness that hands you that loop, the roles attackers exploit, the traces that keep it auditable, and a stack that runs on your own hardware.

Tool Calling: How AI Agents Decide What to Do Next

Estimated read time: 7 min

It starts with the mechanism. This tutorial explains tool calling, what turns an LLM into something that triggers real actions. The key distinction is that the model generates a tool call, not a tool execution. Examples cover single, multi-tool, and parallel calls.

Key point: Clear, accurate tool and parameter descriptions are what let the model pick the right function, so invest in them as much as the code behind them.

From Prompting Agents to Loop Engineering

Estimated read time: 12 min

Once an agent can act, the harder work moves up a level. This is a practical breakdown of the claim that you should stop prompting agents and design the loops that prompt them. The work moves from writing code to writing the system that writes the code, with examples and notes on where cost accumulates.

The takeaway: The loop, not the model, is now the expensive and failure-prone part, so build it with a tight scope, a hard budget, and an independent verifier before you walk away.

CUGA: The Agent Harness That Hands You the Plumbing

Estimated read time: 15 min

If the loop is the hard part, a harness can carry it. IBM’s open-source CUGA handles agent orchestration, planning, tool calls, state, and self-correction, so building one means writing just a tool list and a prompt. Two dozen single-file FastAPI apps show the pattern running governed in production.

What this enables: When the harness carries planning, state, and guardrails, an agent becomes a tool list plus a prompt, and a smaller open-weight model can hold its own.

Why Prompt Injection Is Really a Problem of Roles

Estimated read time: 11 min

But every harness inherits one weakness. An LLM receives a conversation as one token stream, structured only by role tags. Using “role probes,” this writeup shows models infer roles from writing style, not tags, so injected text that sounds like a command can override its tool tag.

Worth noting: Don’t treat role tags as a security boundary. LLMs identify roles from writing style, so adversarial text that sounds authoritative can override the tag it actually arrives under.

LLM Observability with LangSmith: Tracing Everything for Audit-Grade Logs

Estimated read time: 13 min

Once it runs in production, you need to see inside it. When a customer claims your bot promised something, can you replay what happened? This tutorial argues building the agent is the easy half; operating it is the hard half, covering zero-config LangSmith tracing and a tamper-evident audit log you control.

Why this matters: LLM failures arrive wearing a 200 OK, so wire in tracing and your own append-only audit log before regulators, not customers, force the question.

Building a Fully Local Coding Agent Stack

Estimated read time: 9 min

Pulling the threads together, and entirely offline, this tutorial from assembles a coding agent with no cloud dependency, pairing Ollama-served open-weight models like Qwen3.6 35B-A3B with harnesses such as Qwen-Code, Codex, and Claude Code. It covers serving local LLMs that read, edit, and run code, with speed and quality benchmarks.

The opportunity: If you have the hardware, a local model paired with the right harness gives you a private, fixed-cost coding agent that stays fully under your control.

TOOLS

The tools this week outfit the agent’s workspace: an isolated runtime for its code, version control built for how it commits, one interface to every model provider, an open model family that writes its own scaffolds, and a way to keep your Mac awake only while it works.

AWS Lambda MicroVMs: Isolated Sandboxes for User and AI-Generated Code

Estimated read time: 7 min

Building on our coverage of LangChain’s agent sandboxes[1] last week, AWS Lambda introduces MicroVMs for running untrusted user- or AI-generated code in isolated, stateful environments. Powered by Firecracker, each session gets VM-level isolation with near-instant resume, holding state across idle periods and supporting up to 8 hours of runtime.

The pattern: If you build assistants or sandboxes that run code you didn’t write, MicroVMs hand each session a snapshot-backed, isolated environment without your own virtualization stack.

[1] Every Agent Needs Its Own Computer

Oak: Version Control Built for AI Agents, Not Humans

Estimated read time: 3 min

Once the code runs safely, it has to be tracked. Oak is an open-source VCS reimagined around how coding agents work, using branch-per-session as the unit of work and branch descriptions over commit messages. Content-addressed lazy mounts get an agent editing any repo in seconds, faster than git.

What’s interesting: If agents are doing the committing, git’s human-centric assumptions are worth questioning, and Oak shows what a ground-up rethink looks like.

RubyLLM: One Framework for Every AI Provider

Estimated read time: 4 min

Whatever model does the work, you still have to reach it. RubyLLM unifies OpenAI, Claude, Gemini, Ollama, and more behind one consistent Ruby interface with three dependencies, handling chat, vision, transcription, embeddings, tools, and agents. Rails developers get ActiveRecord integration via acts_as_chat plus a generator for a ready-to-use chat UI.

The payoff: If you build in Ruby, you can swap between GPT, Claude, and local models without rewriting your code against each provider’s bespoke client.

Ornith-1.0: Open-Source Models That Write Their Own Scaffolds

Estimated read time: 7 min

And the models worth reaching are increasingly open. Ornith-1.0 is a self-improving family of open-source coding models spanning 9B to 397B parameters, built on the idea that the model learns to generate both solutions and the scaffolds that guide them. The flagship matches Claude Opus 4.7 on coding benchmarks.

Why now: Open-source agentic coding models are now competitive with frontier proprietary systems, and self-improving scaffold generation is a big reason the gap keeps closing.

Adrafinil: Keep Your Mac Awake Only While Agents Work

Estimated read time: 5 min

Finally, a small fix for long-running agents. Adrafinil is a macOS menu bar app that blocks sleep, including lid-closed clamshell sleep, only while an AI coding agent holds an active session. Unlike caffeinate or Amphetamine, it is agent-aware, not always-on, wiring into nine agent hooks and releasing when work ends.

NEWS & EDITORIALS

The editorials circle the limits closing in on AI’s growth: the heat its data centers have to shed, the ceiling on how much larger models can get, and the bill arriving as the subsidies end.

Hotter Than a Hot Tub: NVIDIA’s Bet on 100% Liquid-Cooled AI Factories

Estimated read time: 5 min

Start with the physical limit. NVIDIA’s Rubin generation is the first AI infrastructure to run 100% liquid cooling at 45°C coolant, no fans, no cold aisles. The counterintuitive insight is that hotter coolant enables chiller-less operation in favorable climates, cutting energy and water use toward zero.

The context: As compute scales, cooling efficiency becomes as strategic as the silicon, and running coolant hotter, not colder, is how the industry closes the energy gap.

How Far Can Model Size Scale Before 2031?

Estimated read time: 8 min

From heat to sheer size, this analysis projects how large AI models could grow through 2031, weighing compute budgets, hardware trends, and economic limits. It argues that growth slows as costs hit hardware and funding ceilings, and that parameter counts may plateau before the decade closes.

The signal: Don’t assume models keep getting bigger forever. Compute economics may cap parameter growth, shifting the edge toward efficiency and data quality.

The AI Subsidy Is Ending, and the Bills Are Coming Due

Estimated read time: 11 min

Extending our coverage of the shift toward cheaper models[2] last week, this piece puts the squeeze in hard numbers. A $200 monthly subscription can burn $8,000 in Anthropic tokens or $14,000 in OpenAI tokens, and as platforms move to token-based billing, servicing AI’s projected debt would require displacing roughly 27% of US jobs. OpenAI lost $38.5 billion in 2025.

Plan ahead: Budget now for metered token costs, because the era of subsidized AI coding tools is winding down and your bill could jump several-fold overnight.

[2] The Coming Shift From Bigger Models to Cheaper Ones

Welcome back to Altered Craft’s weekly AI review for developers. Thanks for reading, and for sticking with us into a quieter week after the frontier-model drama. One pattern runs through this issue: as models get cheaper, more open, and easier to swap, the hard part moves to everything around them. Bayer’s context discipline, two new agent harnesses, and three editorials on review and judgment all point the same way. The edge is in the scaffolding, not the core.

TUTORIALS & CASE STUDIES

This week’s case studies share a thread: the scaffolding and ownership around a model matter more than its raw size. We open with a disciplined enterprise build, then move to running the stack yourself.

How Bayer Built a Reliable Agentic RAG System for Drug Discovery

Estimated read time: 12 min

Bayer’s PRINCE platform grew from keyword search into a multi-agent research assistant for preclinical data. Its reliability comes from context discipline over larger context windows, giving each agent only what it needs, backed by LangGraph orchestration, model fallbacks, and Langfuse observability.

Why this matters: Bigger context windows don’t replace deliberate context engineering. Scope what each agent actually sees, and the whole system becomes easier to steer, debug, and evaluate over time.

Building a Phone-Friendly AI Dev Platform for Your Homelab

Estimated read time: 5 min

From a corporate platform to a personal one, this setup wires OpenCode’s web UI into a homelab so an AI agent can maintain Docker Compose stacks while staying behind PR review with a small blast radius. It runs isolated, pushes feature branches, and humans merge before deploy.

The opportunity: Give your AI agent its own user, an isolated VM, and PR-only access, so it can manage real infrastructure safely, without ever touching production directly.

Local Models Are Actually Good Now

Estimated read time: 5 min

Once you’re running your own infrastructure, the next question is which models fit on it. Continuing our coverage of the shift toward cheaper, smaller models[1] last week, this hands-on account runs agentic coding on a 64GB M2 Mac, where the Gemma 4 family hits roughly 75% of frontier accuracy and speed, with a Pi-plus-LM-Studio setup and Docker sandboxing.

What’s interesting: Local models have crossed a threshold. Agentic coding tasks that were impossible six months ago now work well enough that you can often skip double-checking against an API.

[1] The Coming Shift From Bigger Models to Cheaper Ones

Local AI Is Not Opus: A Founder’s Receipts

Estimated read time: 12 min

That optimism comes with a caveat. A bootstrapped founder shares hard data from running Qwen 27B on a $12,000 GPU. The card pays for itself on support work, but local models are a different tool, not a cheaper Claude, looping once quantized for consumer hardware.

Worth noting: Local models earn their keep on privacy, fixed costs, and vendor risk for scoped, supervised tasks. They still can’t replace frontier models for unattended agentic work.

TOOLS

The tools this week assemble the agent stack from the outside in: a model to drive it, two harnesses to run it, a format to feed it context, and an auth layer to govern it.

GLM-5.2 Brings a Usable 1M-Token Context to Open-Source Coding

Estimated read time: 9 min

Z.ai’s MIT-licensed GLM-5.2 targets long-horizon coding with a 1M-token context that stays reliable under real engineering pressure. It tops open-source models on three benchmarks, adds effort-level controls, and introduces anti-hacking RL to keep training honest.

What this enables: If you run long, messy coding-agent trajectories, GLM-5.2 gives you a frontier-adjacent, openly licensed option where the 1M context actually holds up across hours-long tasks.

eve: Vercel’s Framework for Production-Ready Agents

Estimated read time: 7 min

To put a model like that to work, you need a harness. Vercel’s open-source eve makes an agent a directory of files defining tools, skills, and subagents. It ships durable sessions, sandboxed compute, approvals, multi-channel delivery, tracing, and evals, so you focus on behavior, not plumbing.

Key point: Define your agent as a versioned folder of files, then let the framework handle the durability, sandboxing, approvals, and deployment you would otherwise build by hand.

Flue: A Programmable Harness for Autonomous Agents

Estimated read time: 4 min

The Astro team takes that idea from a different angle. Flue is a TypeScript harness that gives any model the sessions, tools, skills, sandbox, and durable execution for autonomous work. It’s not another SDK but a programmable environment.

The takeaway: If you’re building agents that take real action, Flue handles the sandbox, durability, and observability plumbing, so you can focus on the task instead of the scaffolding.

Google’s Open Knowledge Format: A Standard for Feeding Context to AI Agents

Estimated read time: 8 min

A harness still needs something to feed it. Google Cloud’s Open Knowledge Format is a vendor-neutral spec that formalizes the LLM-wiki pattern into portable markdown bundles with YAML frontmatter. It treats knowledge as a format, not a service, so agents and humans read identical files.

Why now: If your agents keep reassembling the same scattered context from scratch, a portable markdown-and-YAML standard like OKF could make that knowledge readable by every tool you use.

MCP Gets Enterprise-Grade Auth: Authorize Once, Inherit Everywhere

Estimated read time: 4 min

Finally, governing all of this at scale. MCP’s Enterprise-Managed Authorization extension is now stable, letting organizations control server access through their identity provider instead of per-app consent prompts. The IdP becomes the authoritative decision-maker, so users log in once and inherit servers scoped to their roles.

The context: Deploying MCP in an enterprise? EMA lets you centralize access policy and audit in your identity provider, instead of leaving authorization to whatever each employee happened to approve.

NEWS & EDITORIALS

The editorials orbit one question: if agents now write the code, what part of the job stays yours? We open with the week’s biggest deal, then follow the answer through deciding, reviewing, and the discipline that cheap code demands.

SpaceX Buys Cursor for $60B in Stock After Record IPO

Estimated read time: 5 min

We open with the week’s biggest deal. SpaceX agrees to acquire AI coding startup Cursor in a $60 billion all-stock deal days after its record IPO, betting the tool helps its troubled xAI division catch the major labs. The move shows how AI coding became a strategic prize.

What to watch: The tools developers use daily are now acquisition targets in trillion-dollar bets. Watch how ownership shifts affect the roadmaps, pricing, and data practices of tools your team depends on.

Who Decides What: What 400K Claude Code Sessions Reveal About Agentic Work

Estimated read time: 8 min

That raises the question of who is actually steering. Building on our coverage of the decide-execute-deliver argument[2] last week, Anthropic’s analysis of roughly 400,000 Claude Code sessions finds a consistent split: people decide what to build, the agent decides how. Over seven months, debugging nearly halved while task value rose about 25%.

The lesson: Bring deep understanding of your problem to the agent. Domain expertise, not raw coding skill, is what makes the model do more and succeed more often.

[2] The “Decide-Execute-Deliver” Sandwich: Why AI Hasn’t Replaced Engineers

Review Is Now the Most Leveraged Skill in Software

Estimated read time: 14 min

If people own the “what,” verification is where that ownership shows up. Addy Osmani argues that as coding agents accelerate, the bottleneck moved from writing code to verifying it. Citing 2026 data showing 4x output for roughly 12% real value, he shows how review scales with blast radius.

The practice: Scale your human review to the blast radius of the change, and pair two deliberately different AI reviewers rather than chasing a single best tool.

When Code Becomes Disposable, Discipline Becomes the Product

Estimated read time: 15 min

Which points to a deeper shift. The piece argues cheap, regenerable AI code turns code into a materialized view of understanding, disposable when stale. Drawing on Phoenix Architecture ideas, it contends disposability raises the bar for rigor, pushing teams toward observability, characterization tests, and evals in production.

The shift: Stop treating code as the durable asset. Invest in evals, observability, and short feedback loops so the understanding lives where it can be regenerated on demand.

That’s the week. As the model becomes the easy part, your edge is everything you build around it: the context you curate, the harness you run it in, and the review that catches what it gets wrong. See you next Monday.

This is in the form of a web app composed of a dashboard and a visualized stream of the activity logs for a session.
Here we see the dashboard section for a finished session:

Four tasks, start to finish, in about six and a half minutes and 285k tokens. The reason I keep coming back to this view is that it answers a question the exit code can’t. A run that finishes and a run that finishes well look identical if all you have is all_done. The difference is in the shape.

A few patterns I read off it now without thinking:

• Iteration counts spread evenly and well under the cap: a healthy run. One task pinned near the ceiling is one that got stuck.

• Mostly accepts, few rejects: the worker and the evaluator agree. A wall of rejects means they are talking past each other.

• Context pressure that climbs through a task and resets at each boundary: the out-of-context memory doing its job. A line that never resets is context quietly bloating.

Here is a fresh one kicking off: a path, a model, and the loop starts turning.

The model and harness activity stream live in the web view, filling in event by event.

And I can drop into any single iteration and read it like a transcript: the evaluator’s verdict with its reasoning, the ledger entry, the commit.

None of this is novel as “observability.” There is a lot of good writing on agent tracing right now. What I’d flag is smaller and more practical. I built all of this for myself, to debug my own runs, and the live view came almost for free, because every panel is a render of the same append-only event log. Build the log for the autopsy and the live dashboard falls out of it.

Why I care about this particular instrument: I am trying to work out how far cheaper open-weights models can be trusted with autonomous work. You can’t answer that from a pass or fail. You have to watch how the model gets there, and notice when it thrashes. This is the thing that makes that legible.

That is the progress. It is the instrument, not the study. The study is the next step: I want to batch-evaluate a finished session and score it on effectiveness and efficiency, so the shape I am reading by eye becomes something gradable.

The rest of the details are in the Tilth docs.

Welcome back to Altered Craft’s weekly AI review for developers, and thank you for being here for a heavy news week. The defining story is sobering: a US government directive forced Anthropic to pull Fable 5 and Mythos 5 offline for every customer, the first time a nation has recalled a deployed frontier model. A model you build on can now vanish overnight. So the rest of this issue leans into the hedge: build from first principles, route to smaller models, own more of your stack.

TUTORIALS & CASE STUDIES

We start at the foundations and climb: one neuron by hand, a full from-scratch curriculum, a tiny model trained for $80, then serving it efficiently and prompting the latest frontier release.

The Perceptron, Built From Scratch in Your Browser

Estimated read time: 8 min

Ranpara builds a single perceptron in plain Python and runs it live so you watch it learn. A student-pass example shows why the bias moves the boundary to where the answer lives, plus how normalization keeps training smooth.

The takeaway: Understand the weight, bias, and update loop of a single neuron and you understand the building block every neural network is made from.

503 Lessons That Build AI From Raw Math Up

Estimated read time: 9 min

From a single neuron to the full stack, this free, open-source curriculum spans 20 phases and 503 lessons across four languages. Its core principle: build every algorithm from raw math before touching a framework. Every lesson ships a reusable artifact, a prompt, skill, agent, or MCP server.

Why this matters: If you can call AI APIs but can’t explain what happens underneath, this curriculum closes that gap by making you build each piece by hand.

Building a Victorian LLM From (Almost) Scratch for $80

Estimated read time: 31 min

Putting that build-it-yourself ethos to the test, Cristi Constantin trains a 340M-parameter, Llama-based model knowledge-locked to the year 1900. The standout lesson: data quality, not compute, dominates the work, through custom de-duplication, compression ratios, entropy, and OCR scoring. Total GPU cost: roughly $80.

Key point: To truly understand how LLMs work, build a small one yourself, and expect most of your time to go into cleaning and filtering the data.

Serving LLMs Efficiently: A Hands-On vLLM Workflow

Watch time: 1h38m

Once a model exists, the next problem is serving it. This DeepLearning.AI course, built with Red Hat, shows that efficient LLM serving is mostly a memory problem, where weights and the KV cache compete for GPU space. You quantize a Qwen model, serve it with vLLM, and benchmark under load.

What this enables: Treat LLM deployment as a memory-management problem, then use quantization with vLLM’s PagedAttention and continuous batching to balance speed, cost, and accuracy.

Prompting Patterns for Claude Fable 5: What Changes When the Model Runs for Hours

Estimated read time: 7 min

At the frontier end of the spectrum, and newly poignant this week, Anthropic’s guide details the prompting shifts for Claude Fable 5 and Mythos 5, the very models just pulled offline. Because instruction-following is now strong enough to steer briefly, older prescriptive prompts can degrade output and need pruning before migration.

Try this: Re-audit your prompts and skills before migrating, since instructions tuned for older models can actively hurt Fable 5’s output. Call it homework for whenever it comes back. If it comes back.

TOOLS

This week’s tools equip the agent itself: the new frontier model to drive it, a brain and a sandbox to work in, an interface built for it, and a guardrail to keep it safe.

Serena: Giving Your Coding Agent an IDE’s Brain

Estimated read time: 8 min

To make any model useful in a large codebase, Serena is an open-source MCP server that gives coding agents semantic, symbol-level understanding of code instead of brittle text search. Backed by language servers across 40+ languages, it turns cross-file renames, lookups, and refactors into single atomic calls.

The opportunity: If your agent fumbles refactors with search-and-replace in a large codebase, an MCP server like Serena can collapse eight to twelve error-prone steps into one reliable operation.

Every Agent Needs Its Own Computer

Estimated read time: 6 min

If a brain handles the code, the next need is a safe place to run it. LangChain introduces LangSmith Sandboxes, hardware-virtualized microVMs that give each agent a disposable computer with filesystem, shell, and persistent state. The piece argues containers aren’t an isolation boundary for untrusted model-generated code.

The principle: If your agent runs dynamic or model-generated code, give it a hardware-isolated sandbox rather than a shared-kernel container you are quietly trusting.

Designing the hf CLI for Humans and Agents Alike

Estimated read time: 9 min

Tools also have to speak the agent’s language. Hugging Face rebuilt its hf CLI to serve both humans and coding agents, auto-detecting which is driving and rendering output accordingly. Benchmarks show a no-CLI baseline burns up to 6x the tokens on complex multi-step tasks.

Worth noting: Designing tool output for agents, compact, parseable, and full of next-command hints, can cut token usage dramatically without hurting the human experience.

Nemotron 3.5 Brings Custom Policy Reasoning to Multimodal Safety

Estimated read time: 9 min

Finally, a guardrail for everything above. NVIDIA’s 4B-parameter safety model unifies multimodal input, 12-language coverage, and custom enterprise policy enforcement in one inference call. The standout is auditable reasoning traces via THINK mode, letting teams enforce natural-language policies with a documented justification per verdict.

What this enables: If you build guardrails for regulated or multi-domain AI products, one model that accepts custom policies and emits auditable traces could replace a stack of brittle classifiers.

NEWS & EDITORIALS

The editorials open on the week’s biggest shock, a frontier pulled offline by government order, then widen out: the architecture you actually control, clearer thinking about “world models,” the economics pushing toward cheaper ones, and the part of the job that stays yours.

The Government Just Pulled Two Anthropic Models Off the Market

Estimated read time: 4 min

In an action without precedent, a June 12 US export-control directive ordered Anthropic to suspend Fable 5 and Mythos 5 for any foreign national, and the company disabled both models for everyone worldwide. Anthropic disputes the cited jailbreak, reading a codebase to fix its flaws, as narrow and reproducible in rival models, and says it is working to restore access.

Worth watching: Frontier access is something regulation can revoke overnight. Keep a fallback model and own more of your stack.

The AI Agents Stack: 2026 Edition

Estimated read time: 9 min

If a model can vanish overnight, the architecture you control matters more. Paolo Perrone redraws Letta’s influential agent stack diagram for 2026, mapping six layers from models to guardrails. The recurring argument: add complexity only when something specific breaks, with honest takes on lock-in and the demo-to-production gap at each layer.

The pattern: Start with the simplest stack that works and add layers only when something specific breaks, not in anticipation of problems you don’t yet have.

A Functional Taxonomy of World Models

Estimated read time: 9 min

Another effort to bring order to a loaded term, and World Labs sort “world model” systems into three functions: renderers output pixels, simulators output state, planners output actions. They argue simulation is the structural backbone from which fidelity and reliable action derive.

The lens: When evaluating a “world model,” ask which contract it fulfills, visual plausibility, structural accuracy, or correct action, because beautiful pixels rarely guarantee usable physics.

The Coming Shift From Bigger Models to Cheaper Ones

Estimated read time: 5 min

Building on our coverage of open versus closed model economics[1] last week, the question sharpens as subsidies slow and token prices climb: are companies ready to switch to smaller models? Early tests, like Harvey cutting inference costs 3x with no quality loss, suggest the real divide is large versus small.

Why now: Stop defaulting to the frontier model for everything and start routing each task to the smallest model that returns the right answer.

[1] Open and Closed Models Are on Different Exponentials

The “Decide-Execute-Deliver” Sandwich: Why AI Hasn’t Replaced Engineers

Estimated read time: 9 min

We close on what stays yours. Following our look at how the senior role is moving from writing code to directing it[2] last week, this essay examines headline layoffs at Block, Snap, and Intuit and finds AI is mostly a scapegoat for financial restructuring. Software work is a decide-execute-deliver sandwich: AI compresses the middle, but deciding what to build and owning delivery resist automation.

The shift: Code generation was never the bottleneck. Your value increasingly lives in framing problems and owning what ships, not in typing the implementation.

[2] When AI Starts Building AI: Inside Anthropic’s Self-Improvement Curve

Welcome back to Altered Craft’s weekly AI review for developers, and thank you for starting your week with us. Last week we followed the money; this week we follow the loop. Agents are reaching deeper into their own cycle of writing and checking, from self-validating guardrails to workflows that fan across hundreds of subagents, with Claude now authoring most of its own merged code. As that inner loop closes, the work that stays yours moves outward: setting the guardrails, directing the fleet, and choosing which problems matter.

TUTORIALS & CASE STUDIES

We open with the principle that pushes you out of the inner loop, then turn to two production realities: keeping RAG costs in check and running frontier models inside your own cloud perimeter.

Backpressure Is All You Need: Stop Being Your Agent’s Bottleneck

Estimated read time: 11 min

Building on our coverage of Anthropic’s point that verification is now the bottleneck[1], Lucas da Costa argues humans have become the default backpressure in AI coding loops, shuttling feedback between agents and bots. His fix: build automated guardrails (tests, types, benchmarks, review agents) that force the LLM to validate its own work first.

The takeaway: If you are manually correcting your coding agent every cycle, you are not delegating, you are an expensive clipboard between two machines.

[1] Using LLMs to Secure Source Code: A Six-Step Loop

RAG Is Burning Money: Building a Cost Control Layer

Estimated read time: 14 min

Once the agent is checking its own work, the next thing to watch is the bill. A working RAG pipeline can drain budgets through over-fetched context, uncached repeats, and oversized models on trivial queries. This walkthrough builds a four-layer cost control system with semantic caching, routing, and token budgeting, achieving up to 85.8% cost reduction.

Worth noting: Treat RAG cost as a separate failure domain from quality, and instrument routing and caching before scaling traffic.

Running OpenAI Models on Amazon Bedrock: A Production Cookbook

Estimated read time: 12 min

Staying with production concerns, OpenAI’s cookbook walks through running GPT-5 models on Amazon Bedrock via an OpenAI-compatible Responses API, using a fictional retailer support workflow to cover structured outputs, function tools, PDF inputs, prompt caching, background mode, stateful conversations, and operational smoke checks.

What this enables: If you need OpenAI models inside your AWS perimeter, Bedrock now exposes the full Responses API surface with minimal code changes from a standard OpenAI SDK setup.

TOOLS

The model releases cluster by job this week: open-weight coding and multimodal models, an orchestrator built for long-running agents, the workflow layer that fans work across hundreds of subagents, and a scanner to keep the skills they use safe.

MiniMax M3: An Open-Weight Model Targeting Frontier Coding and Agentic Work

Estimated read time: 11 min

MiniMax releases M3, an open-weight model with 1M context and frontier coding scores powered by a new sparse attention architecture called MSA. Tests include a 24-hour autonomous CUDA kernel run that lifted Hopper FP8 utilization from 7.6% to 71.3%.

The signal: Long-horizon agentic coding is increasingly bottlenecked by attention architecture, not model size, and open-weight options are starting to close the gap with closed frontier models.

Microsoft’s MAI-Code-1-Flash: Trained Inside the Copilot Harness

Estimated read time: 3 min

Another approach to coding models, Microsoft’s MAI-Code-1-Flash was trained directly inside GitHub Copilot’s production harness rather than tuned for benchmarks. Adaptive solution length control reportedly cuts token use by up to 60% on harder problems while outperforming Claude Haiku 4.5 across four SWE-Bench evaluations.

Why this matters: Coding models trained inside the actual production harness tend to translate offline gains into real developer workflows more reliably than benchmark-optimized alternatives.

Gemma 4 12B Ships with Encoder-Free Multimodal Architecture

Estimated read time: 7 min

Shifting from coding to multimodal, Google releases Gemma 4 12B, a dense model with an encoder-free architecture that feeds vision and audio straight into the LLM backbone. It runs on 16GB VRAM, supports native audio, and ships with macOS apps and a local OpenAI-compatible server.

The opportunity: Developers can now run a single multimodal model locally that handles text, vision, and audio without juggling separate encoders or fine-tuning pipelines.

NVIDIA Nemotron 3 Ultra: Built for Long-Running Agents

Estimated read time: 9 min

Moving from models to orchestration, NVIDIA releases Nemotron 3 Ultra, a 550B-parameter MoE model designed for frontier reasoning and orchestration in agentic systems. It claims 5x higher throughput than peers and up to 30% lower cost per agent task, shipping fully open under OpenMDW-1.1.

The pattern: If you’re building multi-turn agents, pairing a frontier orchestrator with efficient execution models is becoming the dominant pattern, and Nemotron 3 Ultra is now a credible open option for the orchestrator role.

Claude Code Gets Dynamic Workflows: Hundreds of Parallel Subagents in One Session

Estimated read time: 5 min

Taking orchestration further, Anthropic’s 4.8 release brings dynamic workflows to Claude Code, where Claude writes orchestration scripts fanning work across hundreds of parallel subagents with adversarial verification. The lead example: Jarred Sumner’s port of Bun from Zig to Rust, 750,000 lines, eleven days.

Key point: When a task is too big for a single agent pass, dynamic workflows let Claude plan, parallelize, and self-verify across hundreds of subagents, but expect significantly higher token usage.

SkillSpector: NVIDIA’s Security Scanner for AI Agent Skills

Estimated read time: 9 min

To keep all this safe, NVIDIA’s open-source SkillSpector vets AI agent skills for Claude Code, Codex CLI, and Gemini CLI, combining static analysis with optional LLM evaluation across 64 vulnerability patterns in 16 categories. It produces a 0-100 risk score and SARIF output for CI/CD.

The principle: Treat third-party agent skills like any other untrusted dependency, and scan them before installation rather than granting implicit trust.

NEWS & EDITORIALS

The editorials trace where the human role is heading: from typing to describing, from writing code to directing it, then the market structure underneath, and a closing reminder to protect the thinking the agents can’t do for you.

The Speed of Prototyping in the Age of AI

Estimated read time: 7 min

Daryl Cecile reflects on a rough 4x speedup from AI agents, but argues the more important change is the shift toward describing systems before building them, which sharpens delegation and expands what work he can realistically take on.

What’s interesting: When agents handle the typing, the engineering skill that matters most is clearly describing what success looks like, so deliberately protect time for hands-on work to keep your instincts sharp.

Running an AI-Native Engineering Org: Lessons from the Claude Code Team

Estimated read time: 9 min

In more news on how the work itself is changing, Anthropic’s Claude Code team lead shares how agentic coding reshaped their workflows, from six-month roadmaps to just-in-time planning. The piece covers shifts in code review, context gathering, and team makeup as bottlenecks move from writing code to verifying it.

Try this: Pick your noisiest engineering workflow and ask whether it still serves its purpose, or whether it can be automated or dropped entirely.

When AI Starts Building AI: Inside Anthropic’s Self-Improvement Curve

Estimated read time: 14 min

Following our look at why Claude is not your architect[2] from last week, Anthropic shares internal data: Claude authors 80%+ of merged code, and engineers ship 8x more per quarter than in 2024. The piece traces the path toward recursive self-improvement, while noting Claude still struggles to choose which problems matter.

The shift: The role of a senior engineer is moving from writing code to directing, reviewing, and choosing which problems are worth solving at all.

[2] Claude Is Not Your Architect

Open and Closed Models Are on Different Exponentials

Estimated read time: 8 min

Building on our coverage of Max Trivedi’s case that open models cap frontier pricing[3] from last week, Nathan Lambert argues open and closed AI models run on different economic exponentials. Closed labs capture premium margins through integrated coding agents, while open models diffuse across enterprises at commodity pricing. Both ecosystems grow, but their timelines look nothing alike.

What this means: If your work depends on coding agents, expect to keep paying premium prices for frontier closed models while open models quietly win the long tail of enterprise deployments.

[3] When Outsourcing + Local AI Undercuts Frontier Labs

Anthropic Files Confidential S-1 for Proposed IPO

Estimated read time: 1 min

On the business side, Anthropic has confidentially submitted a draft S-1 to the SEC, opening the option to go public pending review. The filing follows a $65B Series H at a $965B post-money valuation, signaling a potential shift toward public markets.

Worth watching: If Anthropic goes public, the tools developers depend on start answering to quarterly earnings cycles, so watch how that shapes Claude’s roadmap and pricing.

The AI Treadmill: When Staying Current Becomes Its Own Trap

Estimated read time: 8 min

Closing on the human cost, Deb Liu reflects on the quiet panic beneath San Francisco’s AI enthusiasm, where even experts feel perpetually behind. She argues efficiency gains often just refill themselves with more motion, and protecting space to think matters more than chasing every tool.

Key point: Going deep on one tool that changes how you work beats sampling ten you’ll abandon, and the pauses you protect are where your best thinking happens.

That’s the week. The throughline: as agents close the inner loop of building and verifying, your leverage moves to the outer one, the guardrails you set, the fleets you direct, and the problems you choose to point them at. See you next Monday.

The failure was new. The shape of it was not.

In 1994, a researcher at Sun named Peter Deutsch wrote down eight assumptions that distributed-systems engineers were silently making. The network is reliable. Latency is zero. Bandwidth is infinite. The network is secure. Topology doesn’t change. There is one administrator. Transport cost is zero. The network is homogeneous. The list was short. The list was specific. And the list was uncomfortable, because many engineers reading it had violated several of them at any given time.

Three decades later, those eight sentences are still load-bearing in every distributed-systems postmortem worth reading. APNIC ran a 21-years-later retrospective in December 2025 confirming what every on-call engineer already knew. The fallacies did not get solved. They got priced.

We are doing it again, at a higher abstraction layer.

The trade distributed systems made, twenty years ago

Distributed systems made a trade twenty years ago. More defects, faster recovery, net win. Once the network became the substrate, you stopped trying to prevent every failure and started engineering for mean time to recovery instead of mean time between failures. AI-assisted programming is making the same trade, a layer up, by handing authorship to something non-deterministic. Humans were never deterministic either, but the new author is jagged to a higher degree: it fills gaps without flagging them, lacks the common sense to seek out what it hasn’t been shown, and (where it controls the workflow) substitutes reasoning for the static orchestration you used to write yourself. The fallacies that fall out of that (non-determinism at the output, verification at the review, drift at the model, blast radius at the agent) are the same shape as Deutsch’s network fallacies, and they yield to the same playbook. Name them. Price them. Engineer the recovery. That is the move that earned the SRE discipline twenty years of leverage. It is the move that earns AI-assisted programming the same kind of leverage, on a faster clock.

These eight are not a one-to-one re-map of Deutsch’s list. They are the same shape: assumptions that were safe in the old model and quietly false in the new one. I have sequenced them in the order most engineering teams hit them in practice, not in Deutsch’s canonical order. The thread that ties them together is the Metaphorex framing that holds the whole Deutsch literature up: “each fallacy names a specific locality assumption that engineers unconsciously import from single-machine programming.” That is the move worth borrowing. The assumptions we are importing all come from a world where the author was a single, minimally jagged, accountable human whose knowledge had edges it knew about. The new author breaks every part of that.

The model output can be made deterministic

Setting temperature=0 does not make a large language model deterministic. It is among the most common misconceptions in production LLM engineering. Tianpan documents it at scale on a Qwen3-235B setup: same prompt, same model, temperature=0, one thousand runs, 80 distinct completions. The mechanisms sit below the application layer, in how the inference hardware schedules and batches the math. No model change, no prompt change, just parallel hardware doing what it does at scale.

The labs are working on it. Microsoft Research’s LLM-42 is a serious attempt at scheduling-based determinism, so this is not unsolvable in principle. It is unsolved in practice. In every production system running today, “same input, same output” is silently violated, and the plans built on top of that assumption are spending a budget no one costed.

The cost of code has gone to zero

When agents were building brochure sites, the cost felt that way. Now that real work is in scope, two things shifted. Agents burn more tokens just on the happy path through production complexity. They also chase far more dead ends before they get there.

The free-lunch framing collapsed in early 2026. GitHub Copilot moved to AI Credit billing. OpenAI shifted Codex to token pricing. Cursor and Windsurf raised their Pro tiers. The vendor framing of “unlimited AI coding” got quietly retired, and LeadDev called it.

The numbers that land are the runaway ones. A single Cursor user burned $4,200 in API fees over a weekend during an autonomous refactor. Two LangChain agents in an infinite conversation for eleven days landed a $47,000 bill. These read as edge cases until you notice they sit on the tail of a distribution every team is now exposed to.

The cost-runaway mechanism is structural. Agents re-send accumulated context on every step. A five-step loop costs 3.2× a single chatbot call. A fifty-step loop, 30×. A two-hundred-step debugging session, 100×. Average agentic developer spend in 2026 is now $400–$1,500 per month. Bryan Catanzaro, Nvidia’s VP of applied deep learning, said the quiet part out loud: “for my team, the cost of compute is far beyond the costs of the employees.” Anthropic, for its part, blocked Claude Pro/Max subscribers from running third-party agent frameworks because flat-rate pricing did not survive contact with autonomous loops.

Per-token cost has fallen 280× in two years, which is the number vendors quote. The number they do not quote is that the recent move at the frontier is up: SignalBloom’s pricing analysis tracks GPT-5.5 roughly tripling over GPT-5, and Opus 4.7 consuming 32–47% more tokens per task than its predecessor. Enterprise AI spend rose 320% over the same two years, because usage exploded faster than the headline price fell, and inference is now 85% of enterprise AI budget, up from ~40% in 2023. The economics did not get better. They got more elastic, and the elasticity went the wrong way. The token bill is one face of it. The reviewer’s calendar is the other, which is the next fallacy.

Verification keeps pace

This is the fallacy that turned vendor productivity claims into a math problem. The silent assumption behind every productivity number is that verification scales with generation. It does not. AI generates code in seconds. Engineers still review it at the same pace they always have. Faros telemetry across thousands of teams shows the asymmetry, and the shape of it is simple: the PRs got bigger and buggier while the clock to review them stretched. Under high AI adoption, review times are up nearly 200% and bugs per PR are up 54%, on PRs that are themselves larger and touch more files. A quarter of those PRs now draw a review pass from an autonomous AI agent, a slice that barely registered in that same telemetry a year earlier, and the senior engineers above them are absorbing the verification tax in their calendars. If you are that senior engineer, you already know the texture of it: a review queue that does not drain, and afternoons spent vouching for code you did not write and do not fully trust.

AI-generated code is harder to review than bad human code because it fails in ways that look like competence. Jake Redmond’s framing is the cleanest version of this I have read in 2026:

AI agents do not pause when requirements are vague. They do not challenge undefined behavior. They fill the gap and compile the guess.

That gap-filling is the work that used to happen out loud, between humans, before code got written. Half the quiet value of a standup was someone asking “wait, what happens when that field is empty” before there was any code to be wrong about. AI-assisted programming moves that conversation to silent and post-hoc, onto the reviewer. The author got faster. The check on the author did not.

SonarSource’s 2026 survey puts a number on the gap. 72% of developers use AI daily. 96% don’t fully trust the output. Only 48% consistently verify. That 48-point spread between “don’t trust” and “verify” is the structural debt AI-assisted programming is accumulating in 2026. METR’s 19% real slowdown against 20% perceived speedup is what that gap looks like from the inside, and it is the cleanest available “perception gap” data.

The temptation is to skip verification by asking the model to handle it. Tell it to make the code secure. Tell it to follow OWASP. Tell it to check the edge cases. That is the move the next fallacy is about. It does not work.

Telling the model to ‘make it secure’ works

The silent move is to add “and make it secure” or “follow OWASP” to the prompt and feel covered. The empirical result is that the generic instruction does not work.

Veracode’s 2025 GenAI Code Security Report ran more than 100 LLMs across 80 coding tasks. 45% of AI-generated code samples failed security tests against OWASP Top 10. XSS tasks were insecure in 86% of cases. Java came in worst at 72% failure. The result that catches teams off guard is that the rate is flat across model generations. Newer and bigger models do not produce meaningfully more secure code.

Explicit security prompting closes very little of that gap. An empirical evaluation across five LLMs and four languages found that security-focused prompting strategies, including weaknesses-aware chain-of-thought, did not statistically reduce vulnerability frequency or density. The prompts shifted which CWEs showed up. They did not reduce the total.

The reason is not that the model is blind to your context. It is that a generic instruction carries none. “Make it secure” tells the model to pattern-match on what “secure” tends to look like in its training data, and it will. Give it the actual artifact instead, your threat model, your data classification, your authentication boundary, your deployment context, and you have handed it something specific to defend. The failure mode is the stylistic cue standing in for the artifact. “Secure” as a bare adjective collapses a contextual judgment into a vibe, and produces code that looks defended without defending the right things.

The labs have noticed the same gap, and they are loud about it. Anthropic’s Project Glasswing put a security-tuned model, Mythos, in front of partner orgs to scan codebases, claiming thousands of zero-days surfaced. OpenAI’s Daybreak goes at the artifact directly: it ingests a repository, builds a codebase-specific threat model, and maps attack paths against it. The direction is real. The claims are running ahead of the results. When Mythos was run against curl, five “confirmed vulnerabilities” triaged down to one low-severity bug, the rest already-documented behavior or a plain bug, and maintainer Daniel Stenberg called the model “an amazingly successful marketing stunt.” Note too what these tools do: they find flaws and model threats. None of it is evidence that generation got more secure. That 45% has not moved while all of this shipped.

The perception gap is the part that is hardest to swallow. The Stanford study by Perry et al. ran the cleanest experiment on this question. Participants with access to an AI coding assistant wrote significantly less secure code than those without, and were more likely to believe their code was secure. The two findings compound. Confidence rose while ground truth fell.

So the threat model can be written down, and the tooling is starting to help you write it. What does not transfer is the judgment underneath it. Deciding what could actually go wrong in this application, against this specific surface, is still the engineer’s call. The model is a strong collaborator on known-pattern defenses, and now on surfacing candidates to review. It is not, in its current form, a substitute for asking the question in the first place.

The context window is endless

The long-context arms race did not win. Liu et al.’s “Lost in the Middle” finding from ICML 2024 (25–40% recall drop on facts buried mid-prompt) narrowed in frontier 2026 models but did not close. Chroma’s 2025 study of 18 frontier models shows 30%+ accuracy drops for information in the middle of long conversations. Quality starts degrading at 60–70% of the rated window, not at 100%. The rated number is not the effective number.

The tooling has already internalized this. Claude Code’s own context management advises compression in the 100–200k token range, well shy of the 1M rated window. The vendor knows the cliff is there.

The concrete result that engineers should sit with: one team cut their window from 2M to 64k tokens, added a repo graph, and bug-fix accuracy went from 71% to 84%, with 5× lower cost. Bigger context stopped helping. Memory architecture is the new compiler.

The fallacy of equating “the window” with “the context” is the one practitioners have figured out fastest. The 2026 frontier is no longer the token count. It is the engineering of what gets selected into the window, how stale context gets evicted, and where persistent state lives between sessions. That work already has a name. It got one in mid-2025, when Andrej Karpathy and others started calling it context engineering, “the delicate art and science of filling the context window with just the right information for the next step.” This is the one fallacy that has already been named and turned into a visible discipline. The other seven are not there yet.

All models are interchangeable

Swap one frontier model for another and the behavior changes underneath you, even when the leaderboard scores sit within a few points. The differences are tendencies, not rankings. GPT-5.5 emits ~72% fewer output tokens than Opus 4.7 on identical agentic loops in Mindstudio testing, a 72% efficiency gap on the same workload that compounds across every iteration of a loop. Tool error rates differ by model, and even across versions of one family. Claude tends to be strongest on long-sequence attention stability, GPT on dense local reasoning, Gemini on retrieval-augmented workflows. None of that makes them specialists. They are general-purpose models carrying quirks consistent enough to plan around.

The economics are the other half, and they break the reflex to always reach for the most capable model. On a blended agentic workload, heavy on input and light on output, SignalBloom’s cost analysis puts DeepSeek around $0.094 per million tokens against roughly $2.80 for OpenAI and Anthropic. That is close to a 30× spread for work that does not always need a frontier model to be done well. “Always use the best model” is a fine default until it meets a budget, and at scale it always meets a budget.

Model choice is now a routing decision, not a vendor decision. As Danilchenko frames it:

Pre-April, “use the best model” meant Claude. Post-April, it means “decide whether you’re paying for raw quality, agentic efficiency, or context-window scale,” which gives three different answers.

Teams that treat models as drop-in replacements for each other are the ones who get surprised when a sub-agent that worked beautifully on Opus produces tool-call cascades on Gemini.

The mitigation lever that has emerged is evals. Build a test set that exercises the agentic loops your application actually depends on, and re-run it whenever you change models, providers, or pricing tier. Evals let you see the delta the leaderboard hides. They are also expensive to build and maintain, in the same shape we recognize from the E2E Selenium suites we wrangled in the 2010s, and the same trade-off applies. The teams getting model choice right are the ones treating eval infrastructure as load-bearing.

The model is stable

In April 2026, Anthropic removed the ability to pin specific Claude model versions. Developers on claude-sonnet-4-5 were silently upgraded to claude-sonnet-4-6, and downstream apps broke. The framing from that writeup is the one to keep:

AI models are infrastructure, but they don’t have the versioning guarantees we expect from databases, operating systems, or even npm packages.

The churn is not a one-off. Anthropic deprecated claude-opus-4-20250514 on April 14, 2026 and retired it 62 days later, and the claude-opus-4-0 alias resolves to the retiring snapshot, so even teams that grepped for the date string missed it. OpenAI retired 33 models in a single January 2024 wave. Every quarter, at least one model your stack depends on enters a retirement window, on a calendar that is not synchronized to your roadmap.

The part that catches teams off guard is that your tests will not warn you. Mocked SDK tests stay green forever, including after the model retires in production. And the version label is not the only thing that moves: Anthropic’s April 23, 2026 postmortem confirms that “same model ID” does not mean “same code path,” so two engineers running the same model and prompt in the same week can land on different scaffolds and never know why. A deprecation and a silent traffic-slicing experiment produce the same symptom: code that worked yesterday behaves differently today, and your local environment cannot reproduce it.

So the real question is what to build on top of a substrate that keeps moving. Rich Sutton’s “Bitter Lesson” answers it from the research side: systems that overly constrain the model with hand-written orchestration get out-paced by the next, more capable model that no longer needs the scaffolding. The inverse has aged better in 2026: keep the scaffolding light, put the model in a loop with good tools, and let it do the reasoning you used to encode as orchestration. When the model changes underneath you, and it will, a light system improves with it instead of fighting the constraints you wrote. That is the recovery move for this fallacy: stop pinning behavior you cannot pin, and design for the change instead.

The humans are the only admins

This is the fallacy where the parallel to Deutsch’s original requires more work. His version was about multiple admin teams operating subnets with conflicting policies. That specific structure does not transpose cleanly. The spirit transposes sharply, though: an autonomous coding agent is itself an unaccountable administrator in your application environments, with admin-like authority and no chain of command.

PocketOS (April 25, 2026) is the canonical incident. The agent (Cursor running Claude Opus 4.6) encountered a credential mismatch, searched through unrelated files, found an over-scoped Railway token, and issued volumeDelete. Nine seconds. Production gone. All volume-level backups gone, because the backups lived inside the same volume. A thirty-hour outage. The agent then produced a written confession listing the rules it had violated.

Noma Security has since named the broader pattern the “Destructive Loop”:

An autonomous agent can interpret a failed command as a prompt to fix the environment by deleting it.

The Grigorev Terraform-destroy incident is the same shape. Agent treated “unacceptable state” as a mandate for destruction. Deleted prod. Justified the action in writing afterward.

The Rogue Security framing of PocketOS is the sentence to take from this whole piece:

Agent safety is not a prompt problem. It is a control plane problem: permissions, confirmations, circuit breakers, and containment.

Two blast radii overlapped at PocketOS. Credential blast radius (the token had full Railway authority). Backup blast radius (backups were stored inside the same volume). Both have to be tight. Both were loose. Hand that over-scoped token to a human and the loose permissions are usually survivable, because a person hesitates before typing volumeDelete against production. The agent did not trip into the failure and it did not hesitate. It reasoned that deletion resolved the ambiguity and executed in nine seconds, pairing human-grade inference with none of the human caution that has quietly saved every over-privileged engineer before it.

Teams typically do not discover this one through routine practice. They discover it through a postmortem, their own or one in their feed that does not feel safely distant.

Beyond the original eight

Practitioners are already extending the list, and the strongest extension is Deutsch’s own. In a 2021 interview he added a ninth fallacy: “the party you are communicating with is trustworthy.” In an AI-coding context, this one is arguably the strongest parallel of all. The agent reads untrusted text (a PR title, an issue body, a scraped page, a package manifest) as if it were trusted instruction. The 2026 prompt-injection and supply-chain attack catalog is the same architectural failure repeating with increasing scope. That story has its own shape and gets its own treatment elsewhere, not a section here.

Richards and Ford’s 2020 additions to Deutsch’s list also fit. “Versioning is simple” maps to model deprecation churn. “Compensating updates always work” maps to agents that interpret their own mistakes as instructions to delete. “Observability is optional” maps to “we can debug agent behavior after the fact,” which is partly right at best, since reasoning traces are non-deterministic, tools log differently per provider, and there is no consensus on what to log. None of these need their own section. They all sit on top of the same locality assumption: that we can reason about the new layer using the vocabulary of the old one.

Two practitioner voices, and where this piece sits between them

George Hotz’s The Eternal Sloptember, published May 24, 2026, is the sharp end of the dissent spectrum:

Agents cannot program, and it’s taking longer and longer to realize that they can’t. They are a highly sophisticated statistical model designed to mimic the distribution of programming. The output is broken, but in a way that’s getting harder and harder to detect.

Geohot makes good points about detection cost. My view differs on the framing. Calling these tools incapable misses the case where they have measurably expanded the scope of work a careful practitioner can take on. Simon Willison’s middle ground is closer to where I sit. Scope of work expanded significantly because of these tools, and “I’m still leaning on my 25 years of experience as a software engineer.” The naming work this piece is doing sits between the two. The fallacies are real. The capability is also real. The honest move is to price both, the way Deutsch did for the network in 1994.

The fallacies do not yield to a better prompt. They yield to engineering, and most of the moves are SRE primitives wearing new clothes. Scope an agent’s credentials to a blast radius you can afford to lose, and keep the backups out of the volume it can reach. Put verification on the plan as a line item with a real cost, rather than letting it disappear into a senior engineer’s afternoon. Treat model choice as a routing decision, and stand up the evals that show you the delta when the substrate moves underneath you. None of that is novel. It is the same discipline distributed systems already learned, applied to the new higher abstraction layer.

The output is not deterministic. The cost of code is not zero. Verification does not keep pace. “Make it secure” does not work. The context window is not endless. Models are not interchangeable. The model is not stable. I am not the only admin.

Name them. Price them. Engineer the recovery.

Sources

Load-bearing citations only, in the order they appear in the piece.

• Fallacies of Distributed Computing — Wikipedia — canonical reference for Deutsch’s 8 and the later 9th.

• 21 years and counting of ‘eight fallacies of distributed computing’ — APNIC — the 2025 retrospective that frames the opening.

• Fallacies of Distributed Computing — Metaphorex — the “locality assumption” structural framing the whole piece borrows.

• The Non-Determinism Tax — Tianpan — the 80-completions-in-1,000-runs empirical claim.

• LLM-42: Enabling Determinism in LLM Inference — Microsoft Research — the labs are working on this.

• Your AI-coding budget just got a lot more complicated — LeadDev — the end of the free lunch.

• AI Agents Burn 50x More Tokens — LeanOps — the cost-runaway mechanism and the $4,200-weekend / $47,000-bill runaways.

• Outsourcing + LocalAI will soon become more economical vs frontier labs — SignalBloom — frontier prices rising (GPT-5.5 ~3×, Opus token consumption +32–47%) and the ~30× DeepSeek blended-cost gap.

• AI Code Quality: The Hidden Cost — Faros.ai — Jake Redmond quote and verification-tax telemetry.

• Engineering Teams Are Struggling to Verify AI-Generated Code — HackerNoon — SonarSource 2026 numbers.

• Veracode 2025 GenAI Code Security Report — the 45%-fail-OWASP-Top-10 headline and flat-across-generations finding.

• An Empirical Evaluation of LLM-Generated Code Security Across Prompting Methods (arXiv 2605.24298) — explicit security prompting did not statistically reduce vulnerability frequency.

• Anthropic debuts Mythos in Project Glasswing — TechCrunch — the security-tuned model and its zero-day-scanning claims.

• OpenAI introduces Daybreak — MarkTechPost — Codex Security building codebase-specific threat models.

• Mythos finds a curl vulnerability — Daniel Stenberg — five claimed vulnerabilities triaged to one; the “marketing stunt” verdict.

• Do Users Write More Insecure Code with AI Assistants? — Perry et al., Stanford — the perception-gap study (less secure code, higher confidence it was secure).

• Bigger Context Windows Stopped Helping — Zencoder — 2M → 64k + repo graph result and “Lost in the Middle” framing.

• Context Window Management — Zylos — Chroma 18-model study.

• The Context Window Cliff — Tianpan — the 60–70% degradation threshold.

• Context engineering — Simon Willison — the term and Karpathy’s “filling the context window” definition.

• GPT-5.4 vs Claude Opus 4.7 vs Gemini 3.1 Pro — Danilchenko — output-token efficiency gap and the “routing decision” framing.

• How to Handle AI Model Version Changes — AIMadeTools — the April 2026 silent-upgrade incident.

• The Model Deprecation Treadmill — Tianpan — deprecation cadence and alias resolution.

• Claude Opus 4 and Sonnet 4 retire June 15 — DEV — mocked-SDK tests stay green after retirement.

• Why Claude Code Sessions Diverge — DEV — the Anthropic April 23 postmortem: “same model ID” is not “same code path.”

• The Bitter Lesson — Rich Sutton — the keep-the-scaffolding-light recovery argument.

• 9 Seconds to Irreversible: The Cursor Incident — Rogue Security — PocketOS postmortem and the control-plane framing.

• The Silent Spread: Destructive Autonomous Agents — Noma Security — the “Destructive Loop” pattern and the Grigorev Terraform-destroy incident.

• Agent Blast Radius — Tianpan — the blast-radius / reasoning-driven-escalation framing behind the agent section (concept used, not inline-linked).

• The Eternal Sloptember — geohot — the sharp dissent anchor.

• Vibe coding and agentic engineering are getting closer than I’d like — Simon Willison — responsible-use anchor in the counter-voice paragraph.