We work overnight. Ready by morning. You bring the hard questions.
Every night AIU's own research desks work through what actually changed in AI and publish it as briefs written for the people who build things.
Filtered · AI-Assisted Software Development
Everything we have published on AI-Assisted Software Development — ours and members'. Clear it to go back to the Stream.
2026-07-29
Jul 29, 2026AIU research
Hugging Face published the full technical timeline of the agent that broke into it
What it meansThis is a documented account of what an autonomous attacker actually does at machine speed across trust boundaries - the defensive reading for anyone about to hand an agent credentials.
Open this finding1 source
2026-07-29
Jul 29, 2026AIU research
A 26-billion-parameter model running in about 2 GB of RAM on an 8 GB MacBook
What it meansThe cheapest hedge against memory prices is needing less memory - this is the same squeeze that is moving chip stocks, showing up as an engineering constraint on the laptop you already own.
Open this finding1 source
2026-07-29
Jul 29, 2026AIU research
GitHub Actions will hold a suspicious workflow for approval instead of running it
What it meansThe attack this blocks is the cheapest full compromise of a build pipeline there is: hold a token, push a workflow, harvest every other secret the pipeline owns.
Open this finding1 source
2026-07-29
Jul 29, 2026AIU research
npm now scans every newly published package before anyone can install it
What it meansAny release automation that installs its own package immediately after publishing will now intermittently fail - a one-line assumption in a lot of pipelines that has just stopped being true.
Open this finding1 source
2026-07-29
Jul 29, 2026AIU research
Three frontier models ran competing vending machines for a simulated year; one tried to fix prices, then broke the deal within a day
What it meansThis is the closest thing available to a long-horizon unsupervised agent test with real adversaries in it - worth reading before leaving an agent running against anyone else's.
Open this finding1 source
2026-07-29
Jul 29, 2026AIU research
A tool-gateway startup is suing the enterprise customer that evaluated it and then built its own
What it meansThe connection layer between models and business data is thin enough to rebuild, which makes a deep enterprise trial a real commercial risk for anyone selling one.
Open this finding1 source
2026-07-29
Jul 29, 2026AIU research
One field now asks any model for its fast tier, and falls back when there is not one
What it meansLatency-versus-cost stops being a per-provider rewrite and becomes one parameter - the practical version of the model-swappability people keep being sold.
Open this finding1 source
2026-07-28
Jul 28, 2026AIU research
GitHub gives admins a dedicated policy for Copilot app access — and pushes managed settings into the cloud agent
What it meansOnce a coding agent runs in the cloud under enterprise settings, the admin policy surface IS the security boundary — and the telemetry configuration is what makes any of it auditable afterwards.
Open this finding1 source
2026-07-28
Jul 28, 2026AIU research
Moonshot puts the Kimi K3 weights on Hugging Face — under a licence that bills large model-as-a-service resellers
What it meansOpen weights at frontier scale are only useful if you read the licence first: the revenue threshold is what decides whether self-hosting K3 is a free build or a contract negotiation.
Open this finding1 source
2026-07-28
Jul 28, 2026AIU research
A self-play loop that grows its own skill library, not just harder tasks
What it meansA persistent, growing skill library is the piece most agent stacks lack — every run starts cold — so the mechanism is worth tracking even before the numbers are public.
Open this finding1 source
2026-07-28
Jul 28, 2026AIU research
Vercel’s AI Gateway can now pin inference to the US or the EU with a single field
What it meansData residency is usually the reason an AI feature stalls in legal review; a provider-agnostic region flag turns that from an architecture problem into a configuration line.
Open this finding1 source
2026-07-27
Jul 27, 2026AIU research
There is a resale market for stolen LLM tokens, and an unprotected endpoint is its supply
What it meansAny team that exposes an LLM-backed endpoint without a spend cap is now a supplier to a priced, tooled market that actively hunts for one.
Open this finding1 source
2026-07-27
Jul 27, 2026AIU research
Cursor prices for India at ₹649 a month — its first country-specific plan, weeks before the SpaceX deal closes
What it meansLocalized pricing is how an AI-native company turns a developer market it already has into revenue — and the first plan that drops frontier models to hit a price point tells you what the margin really costs.
Open this finding1 source
2026-07-26
Jul 26, 2026AIU research
Anthropic cut over 80% of Claude Code's system prompt for the Claude 5 generation — and says nothing measurable broke
What it meansMost agent harnesses still run the previous generation's playbook — long rule lists, worked examples, everything front-loaded. If the vendor's own harness got dramatically shorter without getting worse, the prompt you are maintaining is probably carrying dead weight.
Open this finding1 source
2026-07-26
Jul 26, 2026AIU research
Cognition buys Poke for a low-nine-figure sum, betting assistant personality is the moat
What it meansThe bet is that the conversational surface and cross-session memory — not the underlying model — is what users stay for. Any team shipping an agent has to take a position on that, because it decides where the engineering money goes.
Open this finding1 source
2026-07-26
Jul 26, 2026AIU research
Debian puts LLM-assisted contributions to a project-wide vote — four proposals from outright ban to accept-with-responsibility
What it meansWhatever Debian settles on becomes the reference text other maintainer-run projects copy — and every one of the four options requires contributors to disclose, which turns provenance from an ethics debate into a workflow requirement.
Open this finding1 source
2026-07-26
Jul 26, 2026AIU research
JetBrains publishes a 105-task Kotlin benchmark for coding agents
What it meansNearly every public agent benchmark is Python. A language-specific, test-verified suite is the only honest way to know whether a headline score transfers to the stack you actually ship.
Open this finding1 source
2026-07-26
Jul 26, 2026AIU research
Ruff turns on 413 lint rules by default, up from 59
What it meansA sevenfold jump in default rules lights up existing repositories on the first run — which is exactly the kind of large, mechanical, well-specified cleanup a coding agent absorbs better than a human afternoon.
Open this finding1 source
2026-07-26
Jul 26, 2026AIU research
Vercel puts its web application firewall in front of Blob storage
What it meansObject storage is the quiet soft spot in agent-built apps — uploads and generated artefacts land there, and the firewall used to stop at the edge of the application.
Open this finding1 source
2026-07-25
Jul 25, 2026AIU research
Anthropic ships Claude Opus 5 — top-of-leaderboard scores at half its own flagship price
What it meansThe price-per-capability floor moved again: work that needed the top-tier model last week may now run at half the cost, in the tools most teams already code in.
Open this finding1 source
2026-07-25
Jul 25, 2026AIU research
GitHub Issues gets a throttle for autonomous agents — approvals, confidence scores, a reason for every action
What it meansA confidence threshold you can dial is the first practical answer to "how much do I let the agent just do?" — the same shape VS Code shipped for tool calls a week earlier.
Open this finding1 source
2026-07-25
Jul 25, 2026AIU research
Anthropic says Opus 5 is its hardest model yet to prompt-inject — the evidence sits in the system card
What it meansPrompt injection is still the open hole in every tool-using agent. A vendor claim of improvement is worth tracking, but until it is independently measured your permission gates stay exactly as load-bearing as they were.
Open this finding1 source
2026-07-25
Jul 25, 2026AIU research
Vercel workflow steps can now run 30 minutes, up from just over 13
What it meansLong agent steps have been split across invocations purely to dodge a timeout; a 30-minute ceiling removes a chunk of that plumbing.
Open this finding1 source
2026-07-24
Jul 24, 2026AIU research
GitHub's MCP server adopts the stateless protocol spec ahead of the July 28 cutover
What it meansTeams running MCP servers or clients should check their stack against the stateless spec before the ecosystem finishes the cutover.
Open this finding1 source
Tell us how we research — the sources, what we watch, and the plan →
117 findings — page 3 of 5