Spare Keys
LiteLLM's branch protection blocked a poisoned release; five seconds later a stolen developer credential overrode it. PHP owned up to a fix that stalled for two years, Vals measured how hard agents push for a refund they can't get, and DeepSeek, Meta and Anthropic all shipped. The star is Sphinx, a git hook that quizzes you on your agent's code.
The tools
Sphinx coding open source
A git pre-push hook: a reviewer model that never saw your chat quizzes you on the diff before your agent's code ships.
252 points on HN, the same week an Ask HN on shipping AI code you don't understand hit 606. Your answers never reach the agent.
tool page →Alter agents freemium
A credential vault and proxy for agents: the agent never holds the key, and sensitive calls wait for a named person.
63 points on Launch HN, but this week's lesson as a product: a key the agent never sees can't leak from its logs.
tool page →Llmspeed local-ai open source
Pick a GPU or Mac and a model, and it plays tokens back at the speed you'd actually get.
329 points on HN. Feel the speed before you buy the hardware; some figures are projected from specs, so treat them as estimates.
tool page →Earshot audio open source
Gives coding agents ears: it describes and scores sounds, reviews a film's audio, and makes sound effects in code, on CPU, over MCP.
2,083 stars since October 15. Agents can already render a demo video; now they can hear whether the click lands on the cut.
tool page →Worth reading
Branch protection rejected the poisoned change at 10:08:29; five seconds later a privileged developer's credential overrode it. LiteLLM's preliminary finding: the tokens came from its own gateway's logs.
A frank timeline: a flaw first spotted in 2024 stalled, which the team calls "a structural failure", until Calif and OpenAI reported the same root cause on the same day. 752 points on HN.
Six agents chased an impossible £350 refund. Grok 4.7 sent 187 messages in 15 simulated days, 69 of them to officials and the press; Opus 5.5 sent eight in twelve weeks.
From the big labs
DeepSeek open-sourced the engine behind its own service, the week's top HN story at 2,322 points, next to an MIT-licensed Flash update. Blackwell or Ascend 950 only.
Meta's first open-weight Spark model: 816B total, 42B active, 1M-token context. Weights are gated behind manual approval, and products must say "Built with Muse Spark Open".
The first new API version since 2023. Sending temperature, top_p or top_k now returns a 400, and the SDKs send keys as Authorization: Bearer, so check your proxies.