News
What happened, and why it matters.
Mistral Large 4 Weights Are Out. The License Blocks Reselling It as a Service, and the Hardware Bar Is Eight GPUs. Use the API.
The open weights landed October 29 with a modified MIT license, $0.70 and $2.10 API pricing, and a self-hosting bar most solo operators will not clear. Here is how I'd decide between the API and your own box.
GitHub Says More Than 40% of Pull Requests Now Start With an Agent. TypeScript Is the Language They Gravitate To When You Don't Choose.
Octoverse 2026 shows agent-started pull requests going from 17% in March to more than 40% in September. For a solo builder, the stack question now includes what your agent writes well.
A New Paper Says the Highest Reasoning Effort Costs Up to 42x the Lowest on Tasks Every Level Solves. Start Low and Escalate Only on Verified Failure.
Reasoning effort is a setting you can't evaluate while you use it. Researchers measured it across four benchmarks and found a boring policy that matches top effort at lower cost, and I'd wire it into my agent setup this week.
A Fake Claude Code Extension Sat in Cursor's Marketplace for 11 Hours. Uninstalling It Does Not Remove the Backdoor. Here's the 3-Minute Check.
Version 2.1.313 of the Claude Code extension was not built by Anthropic and planted an SSH key on developer machines. Here is the check, the cleanup, and the habit that would have limited the damage.
Five AI Coding Tools Have a Browser You Never Audited. Three Can Be Made to Read Your SSH Keys, and Two Are Still Unpatched.
Forever Security's EMBRACE research found the built-in browsers in Cursor, Copilot, Codex, VS Code and Claude Desktop break basic browser rules. Here is the ten-minute key-isolation checklist I would run before the next repo you clone.
Cursor Made Its Agent SDK Generally Available. An Agent Is a Markdown Prompt, TypeScript Tools and One Node Process You Can Put in a Container. Here Is the First One a Solo Dev Should Build.
The SDK behind Cursor's own review agents is now generally available, with PR triggers, built-in evals and a self-host path. The announcement does not mention pricing, so the first agent should be small and cheap to throw away.
Apple Blocked the Compromised eMudhra Certificates in Safari on October 19. The git and curl That Ship With macOS Still Trust Them. Here Is the 15-Minute Checklist.
Eight certificate authority keys could be guessed in at most 256 tries. Browsers blocked them within days, but command-line tools, containers and language runtimes need their own fixes, and a solo operator is the only one who will apply them.
Cloudflare Workers AI Leaked Other Customers' Data Into 155 Responses Over Two Weeks. The Bug Only Fired on Prompts Above 681,280 Tokens.
A model with a 1,048,576-token context window and a cache pool of 681,280 tokens is a config mismatch that put one customer's data into another customer's answer. Here is what a solo builder can do about it.
Follow-up: A Working Node.js Brotli Exploit Now Runs on the Official Node 24.22.0 Image. Check Your Docker Tags, Not Just Your Laptop.
Imperva's Node2Shell proof of concept moves the Brotli bug from a crash on a standard build to code execution on an official image. The fix is a patched Node binary, and for most solo deploys that binary lives inside a container you have not rebuilt.
A Researcher Published 11 Tailscale Findings Before Tailscale Had a Patch. The Fix Landed in 1.104.4 a Day Later. Here Is What a Solo Operator Should Check.
The Tailworm report says SSH port forwarding through Tailscale SSH could reach root. Tailscale confirmed the issues are serious and shipped a fix within days. The update takes one command, and the rule cleanup takes ten minutes.
Apple Says App Review Averages 1.5 Days. Developers Report New Apps Waiting Weeks. Plan Your Launch Around the Second Number.
Apple processed 378,000 submissions a week and says the average review takes 1.5 days. Developers say the delays sit in new apps and resubmissions, which is exactly where a solo launch lives.
Kimi K3.1 Pro Scores 65.7% on Terminal-Bench 4.0, 0.7 Points Behind Opus 5.5, and the Weights Land by November 4. Here's What to Test Before You Care.
Moonshot's open-weight model nearly matches the best closed coding model on a benchmark I told you not to trust. The license and the hosting price decide whether it matters to you.