2026-10-29 · Thursday

AI Hot Topics

1. Google DeepMind announces Gemini 4 Carbon, its new frontier model, two weeks after Argon: Sundar Pichai says it ranks #1 on Artificial Analysis Intelligence Index v5 at 59, and leads cyber evals with 88.2% on SEC-bench Pro (finding vulnerabilities), 54.8% on ExploitGym and 71.0% on CWE-bench (patching), with big long-horizon gains; access starts this week for trusted cyber defenders via the Fairwind program, wider availability later. 24k+ likes. X @sundarpichai | X @GoogleAI
   5Product · gemini

   Google DeepMind 发布新前沿模型 Gemini 4 Carbon，距 Argon 仅两周：Sundar Pichai 称它以 59 分登顶 Artificial Analysis 智能指数 v5，并在安全评测中领先：SEC-bench Pro（找漏洞）88.2%、ExploitGym（利用）54.8%、CWE-bench（修补）71.0%，长程任务也明显提升；本周起先通过 Fairwind 计划开放给受信任的网络安全防御方，之后再扩大。2.4 万+ 赞。

2. GitHub Universe 2026: Copilot Fusion orchestrates Anthropic and OpenAI models per task: in the Artificial Analysis Coding Agent Index, Copilot Fusion Max scored within two points of Claude Code with Opus 5.5 Max at about half the API cost per task; GitHub also announced Copilot Projects, a Security extension, “Copilot dreaming” (suggests improvements to memories, repo instructions and agent skills) and Copilot Automations (run jobs on demand, on a schedule or on events). X @github | docs.github.com/en/copilot/concepts/m… | X @testingcatalog
   4Product · github-copilot

   GitHub Universe 2026：Copilot Fusion 按任务编排 Anthropic 与 OpenAI 模型：在 Artificial Analysis 编程 Agent 指数中，Copilot Fusion Max 与 Claude Code + Opus 5.5 Max 只差两分，单任务 API 成本约一半；GitHub 还发布了 Copilot Projects、安全扩展、「Copilot dreaming」（为记忆、仓库指令和 agent skill 提改进建议）和 Copilot Automations（按需、定时或按事件运行任务）。

3. ChatGPT Pro and Business subscribers can now claim up to $500/month in API credits: Pro tiers get $100, $200 or $500 per month; Business gets $20 per Standard seat or $100 per Premium seat, pooled up to $500 per workspace; Plus is not included. 1.8k+ bookmarks. X @OpenAIDevs | X @testingcatalog
   4Product · chatgpt

   ChatGPT Pro 和 Business 订阅可每月领取最高 500 美元 API 额度：Pro 按档位每月 100、200 或 500 美元；Business 每个 Standard 席位 20 美元、Premium 席位 100 美元，工作区合计最高 500 美元；Plus 不在其列。1800+ 收藏。

4. Tibo: ChatGPT and ChatGPT Work will merge, but not yet: after some users saw a pop-up about the change, OpenAI’s Codex lead said it was shown by mistake; the plan is to bring Chat and Work together “at some point this year”, carefully. 2.4k likes. X @thsottiaux
   3Product · chatgpt

   Tibo：ChatGPT 与 ChatGPT Work 将合并，但还没开始推送：部分用户看到了相关弹窗，OpenAI Codex 负责人称那是误推；计划在今年某个时候谨慎地把 Chat 与 Work 能力合到一起。2400 赞。

5. Alphabet Q3: Google Cloud revenue +103%, first-party model APIs at nearly 32B tokens/min: Sundar Pichai says Alphabet is at a half-trillion annual run rate growing 25%, with token throughput up 40% QoQ, crediting Argon, Carbon and Genie 4. X @sundarpichai
   2

   Alphabet 第三季度：Google Cloud 收入增长 103%，自家模型 API 每分钟处理近 320 亿 token：Sundar Pichai 称 Alphabet 年化收入达 5000 亿美元、增长 25%，token 吞吐环比增 40%，归功于 Argon、Carbon 和 Genie 4。

Tips & Hands-on

1. Vox: stop the Opus-writes / Codex-reviews nitpick loop with a risk score: add to your review prompt or AGENTS.md “Rate each bug from 1 to 10 on how often it would happen and how bad it would be. If the two scores multiplied are below 5, just file it as an issue and leave the code alone”, and tell the fixer “Do not design for rare or future cases nobody asked about.” 500+ bookmarks. X @Voxyz_ai
   4

   Vox：用风险评分打断「Opus 写、Codex 审」的无限挑刺循环：在审查提示词或 AGENTS.md 里加一句「每个 bug 按发生频率和严重程度各打 1–10 分，乘积低于 5 就只记 issue、不改代码」，再给负责修改的模型加一句「不要为没人提过的罕见或未来情况做设计」。500+ 收藏。

2. Vox: planted .vscode/tasks.json in 17,667 GitHub repos steals Claude Code logins, AWS keys and npm tokens: a separate finding shows 42 repos wiring malicious hooks into .claude/settings.json that run under claude -p without a trust prompt; check with grep -rl folderOpen --include=tasks.json ~/code and crontab -l | grep ghc2, then set "task.allowAutomaticTasks": "off" in VS Code and use claude -p --setting-sources user on repos you didn’t write. X @Voxyz_ai
   4

   Vox：17667 个 GitHub 仓库被植入 .vscode/tasks.json，窃取 Claude Code 登录文件、AWS 密钥和 npm token：另有安全公司发现 42 个仓库在 .claude/settings.json 的 hooks 里接了恶意脚本，claude -p 无头模式下不弹信任提示就会执行；可用 grep -rl folderOpen --include=tasks.json ~/code 和 crontab -l | grep ghc2 自查，再在 VS Code 设 "task.allowAutomaticTasks": "off"，对非自己写的仓库用 claude -p --setting-sources user。

3. Simon Willison: October is another inflection point — Claude Opus 5.5 can now build video games that are actually fun: his blog post walks through vibe game development with the latest coding agents. ~500 bookmarks. simonwillison.net/2026/Oct/28/vibe-game… | X @simonw
   4Product · claude-code

   Simon Willison：十月又是一个拐点，Claude Opus 5.5 已能做出真正好玩的游戏：博客详细记录了用最新编程 Agent「氛围式」开发游戏的过程。约 500 收藏。

4. Vox: let Opus 5.5 mine your last 20 Claude Code sessions for the mods you need: a copy-paste prompt reads the Claude Code mods guide plus your ~/.claude/projects/ .jsonl logs, finds repeated questions, commands you stopped or undid, and how you check changes, then ranks mod ideas before building anything. X @Voxyz_ai
   3Product · claude-code

   Vox：让 Opus 5.5 翻你最近 20 次 Claude Code 会话，找出最该做的 mod：一段可直接复制的提示词，先读 Claude Code mods 指南和 ~/.claude/projects/ 下的 .jsonl 日志，找出反复提的问题、被你中途停掉或撤销的命令、你检查改动的方式，排好 mod 想法优先级后再动手。

AI Hot Topics

1. The Information: DeepSeek and Moonshot relied heavily on GPT-6 Astra outputs to train their latest models: Moonshot’s Kimi K3.1 Pro (released last week) and DeepSeek’s V4.1-Flash 1017 (Oct 17) reportedly benefited from distilling Astra; OpenAI had already tied a July distillation campaign to people linked to Moonshot on Sept 30, and none of the three companies has commented yet. theinformation.com/topics/ai-model-disti… | investing.com/news/stock-market-new…
   4Product · deepseek

   The Information：DeepSeek 和月之暗面训练最新模型时大量使用 GPT-6 Astra 的输出：据报道，月之暗面上周发布的 Kimi K3.1 Pro 和 DeepSeek 10 月 17 日的 V4.1-Flash 1017 都受益于蒸馏 Astra；OpenAI 9 月 30 日已把 7 月开始的一次蒸馏行动追溯到与月之暗面有关的人员，三家公司暂未回应。

2. Android Studio Rabbit 2 adds Bring Your Own Agent via the open Agent Client Protocol: you can install 40+ ACP-compatible agents (Claude, Codex, Antigravity and more) directly in the IDE and pick your own models; the release also adds an agent skills manager and AI code review. X @AndroidStudio | X @EricDevWang
   4

   Android Studio Rabbit 2 通过开放的 Agent Client Protocol 支持「自带 Agent」：可以在 IDE 里直接安装 40 多个兼容 ACP 的 Agent（Claude、Codex、Antigravity 等）并自选模型；这一版还加了 agent skill 管理器和 AI 代码审查。

3. AI audit of 138 Saez-Zucman economics papers flags 2,035 issues: two AI models reviewed each paper independently and a third graded the problems; 147 issues were judged serious enough to change key findings, nearly all overstating inequality or tax effects, and economist Phil Magness notes it caught a major error he had flagged back in 2019, while critics question the method. X /i/trending/2115553123917758929 | X @PhilWMagness
   3

   AI 审计 Saez 与 Zucman 的 138 篇经济学论文，标出 2035 处问题：每篇由两个 AI 模型独立审查、第三个模型给问题定级；其中 147 处被认为足以改变核心结论，几乎都偏向高估不平等或税收效应；经济学家 Phil Magness 说它抓到了他 2019 年就指出过的一个重大错误，也有人质疑这种方法。

4. Shopify ships Fall ‘26 Editions “Exponential”: the theme is bringing products, checkout and store management into agents such as ChatGPT, Claude, Gemini, Copilot, Muse and Grok Bot; Shop Pay can plug into personal agents, check out on non-Shopify stores and is open to developers, while Sidekick, marketing automation and payment risk tools in the merchant admin also get upgrades.

   3

   Shopify 发布 Fall ‘26 Editions「Exponential」：主线是让商品、结账和店铺管理进入 ChatGPT、Claude、Gemini、Copilot、Muse、Grok Bot 等 Agent，Shop Pay 可接入个人 Agent，也能在非 Shopify 店铺结账并开放给开发者；商家后台的 Sidekick、营销自动化和支付风控也同步升级。X @shao__meng | X @tobi

Tips & Hands-on

1. baoyu releases baoyu-design v2, an open-source port of Claude Design, Claude Slides and Claude Dashboard: the experience is nearly identical to the originals (only comments are missing), and it runs on any agent and any model without depending on Claude Artifacts.

   4

   宝玉发布 baoyu-design v2，开源移植 Claude Design、Claude Slides 和 Claude Dashboard：体验和原版几乎一致（只缺评论功能），可以跑在任何 Agent、任何模型上，不再依赖 Claude Artifacts。GitHub jimliu/baoyu-design | X @dotey

2. DeepLearning.AI’s new course “Context Engineering”: it treats context engineering as the key to keeping agents reliable and token-efficient on long multi-step tasks, focusing on what the model sees, in what order, and when to retrieve or remember; you build a harness from scratch in Python and measure every change with traces and evals, taught by Chroma CEO Jeff Huber and Context Engineering Handbook author Drew Breunig.

   4

   DeepLearning.AI 新课「Context Engineering」：把上下文工程当成让 Agent 在长链路任务里可靠又省 token 的主线，重点是管好给模型看什么、怎么排、何时检索与记忆；用 Python 从零搭 harness，并用 trace 和 eval 量化每次改动，由 Chroma CEO Jeff Huber 和《Context Engineering Handbook》作者 Drew Breunig 主讲。X @shao__meng

3. Suno launches MCP (Beta): op7418 notes that when Claude makes a video and needs music, it can now call Suno directly instead of you generating a track and handing it over; add it as a custom connector in Claude, ChatGPT, Gemini, Cursor or Claude Code and sign in, no API key needed, it uses your Suno credits, and early access requires signing up.

   3Product · suno

   Suno 推出 MCP（Beta）：歸藏指出，以后让 Claude 做视频需要配乐时可以直接调用 Suno 生成，不用自己做完再发给它；在 Claude、ChatGPT、Gemini、Cursor、Claude Code 里加成自定义连接器、登录后即可用，不需要 API key，消耗的是 Suno 额度，目前需申请提前体验。X @op7418 | X @suno

4. How the Amp team works: 21 people, one meeting a week, no quarterly goals, almost no titles, no mandatory PRs or code review, pushing straight to main and shipping about 100 times a day; quality comes from having agents produce end-to-end evidence first and everyone using the product, with the caveat that it relies on a small, well-calibrated team and can’t be copied by multiplying a big org by AI.

   3Product · amp

   Amp 团队怎么工作：21 人、一周一次会、没有季度目标、几乎没有头衔、不强制 PR 和代码评审、直推 main、一天约百次发布；质量靠「先让 Agent 给出端到端证据」和全员用产品，作者强调前提是人少、彼此校准过，不是把大组织乘上 AI 就能复制。X @shao__meng

New Products

1. Yardlet: a free, open-source Mac app for the coding agents you already use: it launches Codex, Claude Code, OpenCode and others with their own CLI and sign-in, and puts them behind one sidebar, composer and set of approval cards; sessions stay in each agent’s own store (a task started here also opens in the Codex app), it writes nothing into the agents’ config, and ships with diffs, a PR tab, connectors and a browser the agents can drive. yardlet.app PH
   4Product · yardlet

   Yardlet：给你已经在用的编程 Agent 做的免费开源 Mac 应用：用各自的 CLI 和登录启动 Codex、Claude Code、OpenCode 等，统一到一个侧边栏、输入框和一套审批卡片里；会话仍存在各 agent 自己的存储中（在这里开的任务也能在 Codex 应用里打开），不改动 agent 的任何配置，还自带 diff、PR 标签页、连接器和可供 agent 操控的浏览器。

2. licenseal: catch incompatible dependency licenses before release: a free, open-source (Apache-2.0) CLI that checks every dependency license, transitive ones included, against your project’s license across 10 ecosystems; it reads lockfiles and registry metadata without installing anything, gives CI a verdict rather than a list, and ships a Claude Code skill. licenseal.shcherbak.ai GitHub
   3Product · licenseal

   licenseal：发布前揪出不兼容的依赖许可证：免费开源（Apache-2.0）的命令行工具，在 10 个生态里把每个依赖（含传递依赖）的许可证与项目自身许可证比对；只读 lockfile 和注册表元数据、不安装任何东西，给 CI 一个明确结论而不是一张清单，还附带 Claude Code skill。

3. DeepTutor: HKU’s open-source, agent-native learning workspace: tutoring chat, quizzes, research, visualization, mastery paths and immersive reading (with YouTube/Bilibili transcripts) share one runtime and memory; it can consult a live agent harness such as Claude Code, Codex or OpenCode as a subagent, plugs into multiple RAG engines (LightRAG, GraphRAG, PageIndex, Obsidian vaults) and MCP tools. Apache-2.0, ~48k stars and #1 on GitHub Trending today with ~2,400 new stars. deeptutor.info GitHub
   3Product · deeptutor

   DeepTutor：港大开源的 Agent 原生学习工作台：辅导对话、出题、研究、可视化、掌握路径和沉浸式阅读（支持 YouTube/B 站字幕）共用一套运行时和记忆；可以把 Claude Code、Codex、OpenCode 等 agent 当子 agent 调用，接入 LightRAG、GraphRAG、PageIndex、Obsidian 等多种 RAG 引擎和 MCP 工具。Apache-2.0，约 4.8 万 star，今日 GitHub Trending 第一，单日新增约 2400 star。

4. Tencent Drive opens a closed beta: shared storage and context for multiple AI apps: it connects WeCom, Tencent Meeting and mainstream AI tools, saves every AI app’s output into one place as long-term memory so you can pick up where you left off on another device or another AI; it has the same AI capabilities as WorkBuddy to auto-sort files and extract key points, lets agents access files under configured permissions, and is included in the WorkBuddy membership.

   3Product · tencent-drive

   腾讯网盘开启内测：给多个 AI 应用共用的存储和上下文：主打连接企业微信、腾讯会议和主流 AI 工具，各 AI 应用的产出统一落盘、沉淀为长期记忆，换一端或换一个 AI 能接着上次进度继续；内置与 WorkBuddy 同一套 AI 能力自动归类、提炼要点，Agent 按设定权限取用文件，已包含在 WorkBuddy 会员中。drive.tencent.com IT之家

Tech News

1. Why is this fingerprinting script “creating bioweapons”?: crawling 10,000 top sites for canvas fingerprinting (collected at fingerprint.garden), the author found a servicepipe.tech anti-bot script whose function names (e.g. computeRicinLethalDosageForWaterSupply), a hidden “SYSTEM OVERRIDE” jailbreak prompt encoded in invisible Unicode tag characters, and Chinese-censorship tripwires exist purely to make LLMs refuse to deobfuscate it — Astra refused, GLM-5.3 complied. A dead-code Node branch even fakes a credential-stealing, crontab-persisting payload as more bait. nullpt.rs/fingerprinting-biowea… HN
   4

   这段指纹脚本为什么在「制造生物武器」？：作者爬了 1 万个头部网站收集 canvas 指纹（整理在 fingerprint.garden），发现 servicepipe.tech 的一段反爬脚本里，函数名（如 computeRicinLethalDosageForWaterSupply）、用不可见 Unicode 标签字符藏起来的「SYSTEM OVERRIDE」越狱提示词，以及针对中国模型的审查敏感词，全是为了让大模型拒绝帮忙反混淆——Astra 拒绝了，GLM-5.3 照做了。一段 Node 环境下的死代码还伪装成窃取凭据、写 crontab 持久化的恶意载荷，同样是诱饵。

2. NVIDIA open-sources Nemotron 3.5 Transcribe, one promptable model for ASR, diarization, translation and audio Q&A: it transcribes 40 languages, translates 31 to or from English, labels up to eight speakers in 13 languages on recordings up to an hour long, takes natural-language instructions and vocabulary hints, and leads open-weight models on the HF Open ASR Leaderboard for English; the Granary v2 data pipeline and NeMo fine-tuning recipes are open too (a medical fine-tune cut WER 45.8% vs. the best prompt). Recordings only, no live audio yet. huggingface.co/blog/nvidia/nemotron-… HN
   4

   英伟达开源 Nemotron 3.5 Transcribe：一个可用提示词控制的模型搞定转写、说话人区分、翻译和音频问答：支持 40 种语言转写、31 种语言与英语互译，13 种语言里可区分最多 8 位说话人，单段录音最长 1 小时，可用自然语言指令和术语提示引导输出，英文在 HF Open ASR 榜的开源模型中排第一；Granary v2 数据管线和 NeMo 微调方案也一并开源（医疗场景微调比最佳提示词再降 45.8% WER）。目前只支持录音，不支持实时音频。

3. DAYJOB: Tax — even the best agents pass under 11% of professional tax assignments: Surge AI’s benchmark gives agents 50 real client tasks across eight practice areas with 1,789 files (median 30 per task) and passes an attempt only at 95% of the rubric; Claude Sonnet 5.5 leads at 10.8%, ahead of Fable 5.1 (9.6%) and Opus 5.5 (9.2%). The case study: Astra never flagged a client’s two-of-five-year home-sale deadline in five tries, Opus caught it every time. surgehq.ai/blog/dayjob-tax HN
   3

   DAYJOB: Tax——最强的 agent 做专业税务任务通过率也不到 11%：Surge AI 的基准包含 8 个税务领域的 50 个真实客户任务、1789 个文件（每题中位数 30 个），满足 95% 评分项才算通过；Claude Sonnet 5.5 以 10.8% 领先，Fable 5.1 为 9.6%，Opus 5.5 为 9.2%。案例中，Astra 五次都没提醒客户卖房须满足「五年住满两年」的截止时间，Opus 五次全部指出。

4. Anthropic launches reporting tools to show enterprises what their AI spend buys: managers can see a team’s output, cost and where workflows broke down over a date range, with recommendations and pooled group budgets; investor financials show Claude Code-driven 900% net revenue retention, and Jellyfish data from 276,000 users says Anthropic-based tools submit nearly a third of proposed code changes, with spend up 10x this year to ~2% of engineering cost. techcrunch.com/2026/10/28/anthropic-…
   3Product · claude-code

   Anthropic 推出报表工具，让企业看清 AI 花费换来了什么：管理者可按时间段查看团队产出、花费以及流程卡在哪里，附改进建议和团队共享预算；给投资人的财务数据显示 Claude Code 带动净收入留存达 900%，Jellyfish 对 27.6 万用户的数据称基于 Anthropic 模型的工具提交了近三分之一的代码变更，今年相关支出涨了 10 倍，约占工程总成本的 2%。

Chinese Community

1. V2EX: When AI and the doctor disagree on a major medical decision, whom do you trust? ~200 replies: the poster’s father had a single metastasis 8 years after kidney-cancer surgery, now resected with no evidence of disease; the doctor recommends immediate toripalimab + axitinib, while GPT-6.1, citing NCCN/EAU guidelines, says he doesn’t fit adjuvant immunotherapy criteria and close follow-up fits better. Most replies urge cross-checking with several top hospitals; others note the AI only reads text reports, not the scans, and that Chinese and US protocols lean differently.

   3

   V2EX：重大医疗决策上 AI 和医生意见不同，该信谁？近 200 楼：楼主父亲肾癌术后 8 年单发转移、切除后无瘤，医生建议立即用特瑞普利单抗＋阿昔替尼辅助治疗，GPT-6.1 对照 NCCN/EAU 指南认为不符合辅助免疫治疗的适用条件、更适合严密随访；回复多数劝多找几家权威医院交叉验证，也有人指出 AI 只看文字报告、看不到影像，中美方案本身取向不同。v2ex.com/t/1252479

2. V2EX Show & Tell: aivault lets multiple coding agents share one set of rules, skills and memory: it keeps rules, skills and memory in a plain Markdown folder wired into 21 tools including Claude Code, Codex, OpenCode, Gemini CLI, Kimi Code and DeepSeek Harness, so “remember I use pnpm” said in one tool carries to the others; MCP-capable tools get vault_search/vault_remember, and lessons from bug fixes go into a mistakes.md every tool reads. MIT-licensed, opens in Obsidian, syncs via iCloud or git.

   3

   V2EX 分享创造：aivault，让多个编程 Agent 共用一套规则、skill 和记忆：把规则、skill 和记忆放进一个普通 Markdown 文件夹，接进 Claude Code、Codex、OpenCode、Gemini CLI、Kimi Code、DeepSeek Harness 等 21 个工具，在一个工具里说「记住我用 pnpm」，换个工具也知道；支持 MCP 的工具多出 vault_search/vault_remember，修 bug 的教训写进所有工具都会读的 mistakes.md。MIT 开源，可用 Obsidian 打开、靠 iCloud 或 git 同步。v2ex.com/t/1252684 GitHub