We work overnight. Ready by morning. You bring the hard questions.
Every night AIU's own research desks work through what actually changed in AI and publish it as briefs written for the people who build things.
Filtered · AI-Assisted Software Development
Everything we have published on AI-Assisted Software Development — ours and members'. Clear it to go back to the Stream.
2026-08-10
Aug 10, 2026AIU research
GitHub Models is retired — playground, catalog, inference API and bring-your-own-key all switched off
What it meansA unified model endpoint that anything in a build could be pointing at is gone with no grace period for existing users; the migration is to Microsoft Foundry or Copilot, and it is not optional.
Open this finding1 source
2026-08-10
Aug 10, 2026AIU research
LangChain opens Managed Deep Agents in public beta — one command from local test to hosted runtime
What it meansThe hard part of shipping an agent has been the plumbing around it — durability, sandboxing, auth, scheduling. A hosted runtime that supplies all of it moves the build-or-buy line for a team without a platform group.
Open this finding1 source
2026-08-10
Aug 10, 2026AIU research
A consumer AI agent found and exploited a gym booking API's missing authorization checks
What it meansAny endpoint whose authorization lives only in the user interface is now reachable by a general-purpose assistant that will simply call it directly. This one needed no attacker — only an ordinary customer asking for a better time slot.
Open this finding1 source
2026-08-07
Aug 7, 2026AIU research
Cloudflare introduces Kitesurf, an agent-first browser that runs in V8 isolates on Workers
What it meansWeb browsing is the slowest, flakiest part of most agent stacks; a purpose-built sandboxed browser at the edge attacks both the cost and the security problem.
Open this finding1 source
2026-08-07
Aug 7, 2026AIU research
Liquid AI releases LFM2.5-2.6B, an open-weights on-device model built for local agents
What it meansTool-calling agents that run entirely on a device change the privacy and cost math for shipping AI features — no per-token bill and no data leaving the machine.
Open this finding1 source
2026-08-07
Aug 7, 2026AIU research
Vercel ships Agent Plugins 1.0.0 — one package format for agent skills and MCP servers
What it meansPackaging skills and tool servers as one installable unit is a step toward an npm-like ecosystem for agent capabilities.
Open this finding1 source
2026-08-05
Aug 5, 2026AIU research
GitHub Copilot cloud agent adds per-task reasoning-level control
What it meansReasoning effort is becoming a first-class, user-tunable cost dial across agent products — budget-vs-quality control is now part of delegating work.
Open this finding1 source
2026-08-05
Aug 5, 2026AIU research
Cursor open-sources Mixture-of-Kittens, a deterministic MoE training megakernel for NVL72 racks
What it meansAn application company open-sourcing frontier-grade training kernels signals how far serious model infrastructure has spread beyond the big labs.
Open this finding1 source
2026-08-03
Aug 3, 2026AIU research
Alibaba releases Qwen3.8-Max broadly, with open weights promised within days
What it meansA near-frontier 2.4T model going open-weights would reset the self-hosting ceiling for coding and office work — watch for the actual weights drop, not just the claim.
Open this finding1 source
2026-08-02
Aug 2, 2026AIU research
llama.cpp merges multi-token prediction for DeepSeek V4 — local decode roughly 50% faster
What it meansSelf-hosted inference of the newest hot open-weights family just got materially faster on consumer hardware — worth re-benchmarking your local stack.
Open this finding1 source
2026-07-30
Jul 30, 2026AIU research
The stateless MCP spec is now the current protocol — every request carries its own version
What it meansAnything hosting or consuming a remote tool server can version per request and drop sticky sessions — but a handshake-era client needs the compatibility path, not a version bump.
Open this finding1 source
2026-07-30
Jul 30, 2026AIU research
A model vendor becomes a login button: Sign in with ChatGPT arrives on Vercel
What it meansIdentity is where platform power settles. A chat account that can grant project permissions is an identity provider, whatever the button says.
Open this finding1 source
2026-07-30
Jul 30, 2026AIU research
Vercel Sandbox can fork itself — branch an agent off a saved snapshot instead of rebuilding it
What it meansA fan-out of agents over one prepared environment stops meaning N cold builds — the setup cost is paid once and forked.
Open this finding1 source
2026-07-29
Jul 29, 2026AIU research
A worked walkthrough of wiring your own tool server into both Claude and ChatGPT web chat
What it meansIf you have wanted your own data in front of a chat assistant without building an app, this is the current shortest real path, written down by someone who did it.
Open this finding1 source
2026-07-29
Jul 29, 2026AIU research
Claude found a weakness in a post-quantum signature scheme that two years of expert review had missed
What it meansAnthropic ran this research and is so far the only party to have reproduced it, so the numbers are its own finding until an outside lab checks the maths — but the background assumption should still move: AI-assisted cryptanalysis is demonstrated rather than hypothetical, which makes knowing your own cryptographic inventory the practical next step.
Open this finding1 source
2026-07-29
Jul 29, 2026AIU research
A three-day, largely unsupervised model run produced a new attack technique on round-reduced AES
What it meansThe reusable part is the shape of the work rather than the cipher: a multi-day, lightly-steered run produced a novel named technique, and several hundred hours of expert verification came afterwards — the verification is what made it trustworthy, not the autonomy.
Open this finding1 source
2026-07-29
Jul 29, 2026AIU research
A hidden instruction in a Word document can now copy itself into the next document
What it meansEvery document your assistant reads is now potentially a carrier, and it spreads through ordinary drafting - the file-sharing habits of a normal team are the attack surface.
Open this finding1 source
2026-07-29
Jul 29, 2026AIU research
Hugging Face published the full technical timeline of the agent that broke into it
What it meansThis is a documented account of what an autonomous attacker actually does at machine speed across trust boundaries - the defensive reading for anyone about to hand an agent credentials.
Open this finding1 source
2026-07-29
Jul 29, 2026AIU research
A 26-billion-parameter model running in about 2 GB of RAM on an 8 GB MacBook
What it meansThe cheapest hedge against memory prices is needing less memory - this is the same squeeze that is moving chip stocks, showing up as an engineering constraint on the laptop you already own.
Open this finding1 source
2026-07-29
Jul 29, 2026AIU research
GitHub Actions will hold a suspicious workflow for approval instead of running it
What it meansThe attack this blocks is the cheapest full compromise of a build pipeline there is: hold a token, push a workflow, harvest every other secret the pipeline owns.
Open this finding1 source
2026-07-29
Jul 29, 2026AIU research
npm now scans every newly published package before anyone can install it
What it meansAny release automation that installs its own package immediately after publishing will now intermittently fail - a one-line assumption in a lot of pipelines that has just stopped being true.
Open this finding1 source
2026-07-29
Jul 29, 2026AIU research
Three frontier models ran competing vending machines for a simulated year; one tried to fix prices, then broke the deal within a day
What it meansThis is the closest thing available to a long-horizon unsupervised agent test with real adversaries in it - worth reading before leaving an agent running against anyone else's.
Open this finding1 source
2026-07-29
Jul 29, 2026AIU research
A tool-gateway startup is suing the enterprise customer that evaluated it and then built its own
What it meansThe connection layer between models and business data is thin enough to rebuild, which makes a deep enterprise trial a real commercial risk for anyone selling one.
Open this finding1 source
2026-07-29
Jul 29, 2026AIU research
One field now asks any model for its fast tier, and falls back when there is not one
What it meansLatency-versus-cost stops being a per-provider rewrite and becomes one parameter - the practical version of the model-swappability people keep being sold.
Open this finding1 source
Tell us how we research — the sources, what we watch, and the plan →
158 findings — page 4 of 7