Issue No. 28
Weekly Briefing

The AI Enthusiast.

Your coding agent can now reverse-engineer anything. We used it to rebuild Postman without the cloud.

This was the week AI learned to look inside things. REA lets a coding agent take apart any app, Anthropic's agents now report every step to your monitoring tools, and Anthropic's own researchers looked inside cheap smart-TV boxes and found room for a self-copying AI. We also tried a chatbot that answers in a tenth of a second and a model that answers in types instead of text, and we built something real with both.

Cover illustration: generated with AI for The AI Enthusiast
TL;DR · 90 seconds

Issue 28 in one paragraph

REA (rea.tools), an MIT-licensed toolkit that lets coding agents reverse-engineer apps, went from about 15 npm downloads a day to 103,109 on October 12 and shipped 6.5.0 on October 14. Our feature explains it, then shows it working: REA read Postman's open-source code (never its proprietary app) and Claude Code subagents built Postman Local, a cloud-free Postman workalike. Anthropic put OpenTelemetry traces for its agents into public beta (October 14). We timed ChatJimmy, the demo of Taalas's chip with Llama 3.1 8B etched into it, at ~0.1 s per answer; AMD agreed to buy Taalas in August. Jev 1.14 (October 14) answers in types and probabilities in 70–500 ms at $0.042 per million tokens, and we used it to triage failed API tests. Anthropic warned small models may soon self-replicate on IoT devices and said it cut model distillation by 90–99%. Gemini 4 Argon went GA at $2/$10; Meta shipped Muse Wonder and the 816B open-weight Muse Spark Open; Claude Code Review went GA. OpenAI fired three safety researchers and an employee was arrested over a hidden microphone; Anthropic gave METR inside access; Washington's AI review rules are due October 30. Plus midterm safeguards, Grok Voice 3.0, Ramp at $60B, Shopify opening 1B+ listings to any agent, Kroger cutting 3,000 corporate jobs, an explainer on small language models vs state space models, a free Claude Code Workshop in Cincinnati on October 28, and twelve new tips.

103,109REA npm downloads on Oct 12
~0.1 sChatJimmy, keypress to full answer (our test)
$0.042Jev, per million input tokens · output free
90–99%less reasoning harvested by distillers
8of 9 device types ran a 9B model (self-replication study)
$2 / $10Gemini 4 Argon, per M tokens
816BMuse Spark Open parameters
3,000Kroger corporate jobs to go over 3 years
01 · Feature · Developer toolsDevelopers · IT and security teams · Power users

Your coding agent can now reverse-engineer anything. We used it to rebuild Postman without the cloud. #

REA ("Reverse Engineer Anything," rea.tools) is a free, MIT-licensed set of tools that lets a coding agent such as Claude Code, Codex or Cursor look inside software: native binaries, JavaScript and Electron apps, Android APKs and what a web page does while it runs. One command, npx rea-agents@latest setup, connects it. In two weeks it went from about 15 npm downloads a day to 103,109 (October 12), and GitHub showed 273,428 stars on October 15. To see what it's actually good for, we pointed it at Postman's open-source parts and had Claude Code subagents build Postman Local: a Postman workalike that opens a real collection package with no login and no cloud.

Illustration: a robotic magnifier examining a translucent API client window, with request and response panes glowing
Illustration: generated with AI for The AI Enthusiast.
Why it matters Reverse engineering used to take a specialist days per question. With REA, an agent runs the inspect-guess-verify loop itself, in minutes. That changes the math on software moats, on rescuing data from abandoned apps, and on security, and it makes the legal fine print (licenses, terms of service, EU vs US law) something every team now has to know.
At a glance · REA
What
MCP server + CLI + agent skill, ~207 tools
License
MIT · morluto/rea
Created
April 14, 2026; first release July 12
Latest
rea-agents 6.5.0, Oct 14
GitHub
273,428 stars · 68,785 forks · 222 contributors (Oct 15)
npm
231,579 downloads, Oct 6–12
Agents
25 clients, incl. Claude Code, Codex, Cursor, Gemini CLI
Needs
Node 22.19+; Ghidra (free), Hopper or IDA for native code

What REA is, and what it isn't

REA isn't a new decompiler. It's a packaging layer: one MCP server and an investigation skill wrapped around tools reverse engineers already use, including Ghidra (NSA, free), Hopper or IDA for native code, JADX for Android, Chrome's DevTools protocol for live pages, and parsers for Electron ASAR archives, .NET, WASM, firmware and network captures. The agent asks a question about one feature; REA "returns code, references and runtime observations"; the agent explains it or rebuilds it.

How REA connects a coding agent to reverse-engineering tools You ask your coding agent a question about how an app does something. The agent calls REA over MCP on your machine. REA routes the question to the right engine: native binaries through Ghidra, Hopper or IDA; JavaScript and Electron apps through static analysis of the folder or ASAR archive; live web pages through the Chrome DevTools protocol; Android APKs through JADX; and .NET, WASM, firmware and network captures. Engines return code, references and runtime observations to the agent, which forms a hypothesis, checks it against the original program, and repeats until it can explain or rebuild the feature. Analysis is local, but results go to the agent's model provider. ON YOUR MACHINE · ONE MCP CONNECTION You ask "Why does 200 + 10%give 220?" "What happens on Export?" Coding agent Claude Code, Codex,Cursor, Gemini CLI… + REA's investigation skill MCP REA ~207 toolsroutes, records,cross-checks Native binariesGhidra · Hopper · IDA JS · Electron · ASARstatic, without running it Browser runtimeDevTools: scripts, network Android APKJADX · adb · Frida .NET · WASM · firmwareBinwalk · WABT · EVM CapturesHAR · pcap · SQLite THE LOOP THE AGENT RUNS inspect guess verify explainor rebuild wrong? look again Analysis runs locally. The agent's model provider sees the results. Setup asks before writing config, backs it up, and pins an exact package version. Diagram: The AI Enthusiast, from rea.tools, its FAQ and the rea-agents 6.5.0 package.
REA is the plumbing; the agent does the reasoning. Diagram: The AI Enthusiast.
# Paste into Claude Code, Codex or Cursor (from rea.tools):
Install REA and connect it to this coding agent using `npx rea-agents@latest setup`.
Show me the setup plan for approval, then verify the installation.

# Or from a terminal, then check health:
npx rea-agents@latest setup
npx -y rea-agents@latest doctor --client claude_code --json   # expect "healthy": true

What it found in its own showcases

REA's published case studies
TargetQuestionWhat REA recovered
Windows Calculator (x64)Why does 200 + 10% give 220?The DLL's branch on × or ÷; rule: after × or ÷, percent = current/100, otherwise current × previous/100. Cross-checked against Microsoft's open-source code
Chrome dino gameHow fast does it get?SPEED: 6, ACCELERATION: 0.001, MAX_SPEED: 13, read from the running script
Aegis Authenticator (APK)How is a login code made?Standard RFC 6238 TOTP: 30 s, SHA1, 6 digits, from 3,077 decompiled classes
Notion Desktop 7.6.1 (Electron)What does Copy actually do?The IPC path from preload to main process, and a hidden HTML marker that maps to locally saved block data
DX-Ball 1.07 (1996)How is brick-hit sound panned?Reconstructed C that matches all 63 compiled bytes of the original function
DownUnderCTF 2023 binaryWhat's the flag?The masks and sums, then a solver that makes the original print "Correct!"
rea-agents npm downloads per day, October 3 to 12, 2026 Daily npm downloads: October 3, 418; October 4, 798; October 5, 4,048; October 7, 5,032; October 8, 9,000; October 9, 19,983; October 10, 34,790; October 11, 59,665; October 12, 103,109. Counts include every npx fetch, CI run and mirror. REA-AGENTS NPM DOWNLOADS PER DAY · OCT 2026 3418 4798 54,048 75,032 89,000 919,983 1034,790 1159,665 12103,109 Source: npm API, fetched Oct 15. Oct 6 not shown in our pull. Includes npx fetches, CI and mirrors, so it overstates people.
From a trickle to 100,000+ a day in nine days. Chart: The AI Enthusiast, from npm.

Treat the popularity numbers with care: 273,000 stars and 68,000 forks in six months, most of it in two weeks, is extraordinary, and the 25% fork ratio is unusually high. GitHub's counts measure attention, not quality. The project's blog, by contributor N0zoM1z0, posted "The industrial revolution in reverse engineering" on and "Does reverse engineering need a bigger model?" on .

Our case study: Postman, minus the login and the cloud

Postman is the most popular tool for testing APIs, and many teams keep their requests in exported "packages": a collection file, environment files with variables such as a base URL or token, and often SOAP WSDL files describing older XML web services. Postman now expects you to sign in and syncs workspaces to its cloud, which some companies don't allow. Our test: could an agent with REA learn exactly how Postman interprets those files, and could Claude Code subagents build a local app that opens the same package the way Postman would?

The legal line we drew. We did not point REA at Postman's desktop app. Postman's Acceptable Use Policy prohibits attempts to "disassemble, decompile, unlock, reverse engineer, or decode the Postman Services (or Software)." Instead we used Postman's own open-source components, whose licenses grant the right to study them: postman-collection, postman-runtime and newman (Apache-2.0), and wsdl-to-postman (MIT per its LICENSE file; its package.json says Apache-2.0). Same tool, very different legal position. More on that in the impact section below.
How Postman Local was built: REA investigation, parallel Claude Code subagents, tests, Jev triage and a recorded demo Step one, REA analyzes Postman's open-source npm packages and the cloned repositories and writes 33 recovered rules with file and line references. Step two, a written contract fixes the module interfaces. Step three, six Claude Code subagents work in parallel: REA investigator, core importer and server, WSDL engine with demo package and mock server, runner and script sandbox, Jev decision layer, and user interface. Step four, automated tests, plus a private compatibility test against the operator's real package that sends no network requests. Step five, when a request fails, Jev's typed triage decides retry, stop, flag or ask a human. Step six, a scripted browser records the demo video against a fictional Acme Retail package and a local mock server. THE BUILD PIPELINE · THURSDAY NIGHT, OCTOBER 15 1 · REA investigates postman-collection, -runtime,newman, wsdl-to-postman 33 ruleswith file:line quotes 2 · Contract a written spec fixeseach module's inputsand outputs, so agentswork in parallel 3 · Six Claude Code subagents, in parallel REA investigator core + server WSDL + mock runner + sandbox Jev triage UI (3 panes) 4 · Tests 114 of 114 tests pass · v2.1 round-trip export private real-package check: parse + resolve + dry-run, no network 5 · Jev triage failed request → typed decision retry · stop · flag · ask a human 6 · Demo scripted browser,fictional data Found by REA → fixed Postman puts WSDL requests in one flat folder per port, uses a {{PortNameBaseUrl}} variable per port, and leaves an unresolved {{var}} in place. Our first draft did none of these. Now Postman parity is the default, and the spec-correct variants are an opt-in setting.
Diagram: The AI Enthusiast, from the Postman Local build log and architecture notes.

What REA recovered

REA's analyze-javascript-application tool (6.5.0) read the shipped npm packages, the agent cross-checked the cloned source, and then confirmed the WSDL rules by running the real @postman/wsdl-to-postman 2.2.2 on synthetic WSDLs. A sample of the 33 rules it wrote down, each with a file and line reference:

Selected Postman behaviors recovered with REA from Postman's open-source code
RuleWhat Postman actually doesWhy a workalike must copy it
Variable precedenceFirst hit wins: local › data row › environment › collection › globals. The source says "don't change it"The same {{baseUrl}} must resolve to the same host
Nested variablesRe-resolves up to 19 passes, then stops; a self-referencing variable ends in 19 extra charactersPrevents infinite loops exactly the way Postman does
Unresolved {{x}}Left in place literally; a null value becomes the text nullSilent differences here break requests in confusing ways
Auth inheritanceMissing auth inherits from folder, then collection; noauth stops the chainRequests must sign with the right credentials
Script orderCollection › outer folder › inner folder › request, pre-request then testTest scripts that set tokens must run in the same order
WSDL importOne flat folder per port (none if only one); {{<Port>BaseUrl}} per port; every operation is a POST with SOAPAction"Work like Postman" means the same tree a user expects
A Postman quirkSends text/xml even for SOAP 1.2 ports, where the spec says application/soap+xmlWe match Postman by default and offer the spec-correct header as a setting

Watch: the story in under two minutes

Hosted by an AI version of Irv Cassio (a HeyGen digital twin), scripted from this issue. The demo inside it is the real recording below, and the Jev results are the live calls in story 04. Open the MP4.

Watch: Postman Local in 79 seconds

Recorded by a scripted browser against the fictional Acme Retail package and a local mock server; re-recorded October 16 with live Jev calls. No real company data. Open the MP4.
What the video shows, step by step
  1. Postman Local starts on 127.0.0.1. No login, no sync, no telemetry.
  2. Open a Postman package (.zip). The collection, environments and WSDLs are unzipped in memory; macOS __MACOSX junk is skipped.
  3. WSDL → requests, laid out like Postman's importer. One request per operation, a {{<Port>BaseUrl}} variable from soap:address, text/xml plus SOAPAction: the rules REA recovered.
  4. Postman parity by default. A setting keeps the spec-correct strict SOAP 1.2 variant as an opt-in.
  5. Environments with Postman's scope precedence (local › data › environment › collection › global), with secrets masked.
  6. Send Login through the local proxy. Its test script parses the SOAP reply with xml2Json and stores the token with pm.environment.set.
  7. Get Order inherits bearer auth from the collection and shows pretty, foldable XML with status, time and size.
  8. Run the whole collection with triage on. The flaky 503 is retried and passes, the SOAP Fault is flagged as a server bug, and the expired token stops the run, each only because the decision cleared 0.80.
  9. The triage card and the exact Jev request. Each decision is a live call to Jev (jev-1.13.0), and the request Jev received is shown with the key redacted.
  10. Switch to the Staging-Fake environment and the light theme. Everything is stored as plain JSON in ~/.postman-local, and collections export back to Postman v2.1.
Postman Local showing an OrderLookup SOAP 1.2 request generated from a WSDL, with the URL variable AcmeOrdersV1PortBaseUrl and a sample XML envelope
A request generated from the WSDL, with Postman's per-port {{…BaseUrl}} variable. Screenshot: Postman Local, Acme demo data.
Postman Local collection runner with live Jev triage, model jev-1.13.0: 7 requests in 1.2 seconds, 10 tests passed, 2 failed, 1 retried, 1 stopped, 1 flagged, 0 needing a human
The runner branches on each live Jev decision: retried, flagged, stopped. The whole run took 1.2 seconds. Screenshot: Postman Local, October 16.
Live Jev triage card for SessionLogin with a wrong password: SOAP fault env:Sender, Invalid login or password; category auth_expired at p 0.79 against a 0.80 threshold, bad_input 21%, should_retry false, page_oncall false
A wrong password: Jev leans auth_expired at p = 0.79, with 21% on bad_input. That misses the 0.80 bar, so Postman Local routes it to a human instead of acting. Screenshot: Irv Cassio, October 16.

How the agents built it

  1. The orchestrator launches the build agent. It checks the toolchain and inspects the real package's shape locally.
  2. Scaffold plus a written contract for every module, so subagents can work in parallel without colliding.
  3. Six Claude Code subagents start at once: REA investigator, core, WSDL engine and mock, runner and sandbox, Jev layer, UI.
  4. Core finishes the importer, sender, SOAP-fault detection and export (44 tests); the Jev layer finishes against TypeSafe's documented API (15 tests); the private real-package test passes.
  5. The REA investigator files 33 rules with file and line references. Variable resolution and runner semantics are aligned to them; 111 tests pass.
  6. Our QA agent flags that demo fault names still echoed the private WSDLs. Everything is renamed to Acme, and the old recordings are deleted.
  7. Found by REA → fixed: WSDL import now matches Postman by default: flat per-port folders, per-port BaseUrl variables, Postman's headers and envelope prefix. 114 of 114 tests pass.
  8. The demo is re-recorded: a 79-second video and 12 screenshots, all on fictional data.

Fifty minutes from first file to a recorded demo, with a separate QA agent reviewing the work. The parts that took judgment were the ones people would expect: choosing what to copy exactly (Postman's quirks) and what to keep private (the real package).

Postman Local vs Postman

Postman Local features compared with Postman
AreaPostmanPostman Local
Open .zip export, folder, collection, environment, globalsYesYes, zip unpacked in memory
Collection formatsv1, v2.0, v2.1v2.0 and v2.1; v1 detected with a re-export message
WSDL 1.1 → requestsYesYes, Postman's layout by default; strict SOAP 1.2 opt-in
Variables and scopesYesSame precedence, masking, hover values
Auth: none, basic, bearer, API key, inheritYesYes
Pre-request and test scriptsYesCommon pm.* API, chai, xml2Json; no pm.sendRequest or require()
Collection runner and historyYes (history synced)Yes, stored locally
Failure triageNoTyped decision layer (Jev, or a labelled stand-in)
ExportYesPostman v2.1, round-trip safe
Login, cloud sync, workspaces, monitors, cloud mocksYesDeliberately none
OAuth 2.0 flows, cookies UI, file uploads, gRPC, GraphQL, WebSocketYesNot built
Honest gaps. REA's command-line tool did the analysis; its MCP tools were registered for the project but weren't callable inside the build agent's session, so the agent ran REA directly and cross-checked by reading the cloned source. Jev wasn't called live when this issue first went out; we added a key on October 16, and the live results are in story 04. And Postman Local is a one-evening build for a demo, not a product: it isn't published, and we'd want a security review before anyone points it at real credentials.

Did it open the real package?

Yes, privately. The operator's real package is an employer's work (SOAP services with internal environments), so it never left the machine and none of it appears here. A local test loaded it through the same importer the app uses, checked that every {{variable}} resolved in every environment (zero unresolved), built a SOAP envelope for every WSDL operation and dry-ran every request without sending anything: pass, with zero import warnings and zero dry-run errors. Everything you see in the screenshots and video uses a fictional Acme Retail package (Login and Orders SOAP services) served by a local mock server.

The impact: five things REA changes

Who gains and who should worry when agents can reverse-engineer software Five areas. Software moats: features are easier to study and copy, so network effects, data and service matter more; vendors may move apps to the cloud. Interoperability: file formats, IPC and network protocols become documentable, the strongest legitimate use. Legacy rescue: data and logic trapped in abandoned apps can be recovered and verified byte for byte. Security: defenders can audit closed apps, but attackers' reconnaissance gets faster and security by obscurity weakens. Legal: the US lets licenses and terms of service ban reverse engineering, while the EU protects observation and interoperability decompilation from contractual override. Software moats a feature is easierto study and rebuild moats shift to networkeffects, data, service risk: vendors pullapps into the cloud ↓for incumbents Interoperability formats, IPC, networkAPIs become knowable make your tool talkto theirs, likePostman Local ↑strongest legit use Legacy rescue data trapped in deadapps, SQLite, firmware byte-for-byte checks(DX-Ball: 33 matchingfunctions) who maintains it after? ↑for IT teams Security defenders audit closedapps and what they send attackers recon faster;obscurity stops working malware: isolated VMsonly, never your laptop ⇅both sides Legal US: contracts canban it (Bowers,Blizzard v. bnetd) EU: Art. 5(3), 6 and8 protect interopfrom contracts §check first
Diagram: The AI Enthusiast, from REA's documentation, Hacker News, Decrypt, Startup Fortune, daily.dev and the statutes cited below.

1. Software moats

REA's own README pitches it this way: "See a feature in an app that you want in your own product? Ask your agent to investigate it with REA… and build a version for your project." The counter-argument came fast on Hacker News: "Software has rarely been the moat… The problem, always, has been network effects." The Low Level YouTube channel (October 14) predicts a defensive response: vendors may stop shipping programs "to you" at all and stream them from the cloud instead. daily.dev's caution applies to every rebuild: "A single wrong constant or miscalculation can produce a convincing but incompatible copy." That's why REA's showcases check results against the original.

2. Interoperability

The strongest legitimate use is making your software work with someone else's: file formats, clipboard formats, IPC messages, network APIs. The Notion showcase recovered exactly that kind of detail (a hidden HTML marker that points to locally saved block data). Our Postman case is the same idea: reading a format faithfully, not copying the product.

3. Legacy migration and data rescue

Most of REA's showcases are preservation work on 1990s games, each verified against the original compiler output. The same tools read SQLite databases, .NET assemblies and firmware, the places where business data gets stranded when a vendor disappears. The open question, as Low Level asks of AI rewrites: "who is going to maintain this software?"

4. Security research and malware

Defenders can audit closed-source apps (does this Electron app check who's calling its IPC handlers?) and see what a vendor's app really sends. Startup Fortune argues it also "compresses attackers' timelines for reconnaissance" and hurts "vendors relying on obscurity as security." REA's own warning matters for anyone analyzing malware: its runtime tools "execute or observe programs," and its bridge "is not a sandbox." Use an isolated VM, never a workstation with your agent's credentials. Two more cautions: install only from morluto/rea, rea.tools or npm rea-agents (popular tools attract look-alikes), and remember that decompiled code goes to your agent's model provider.

5. The legal side (not legal advice)

Reverse-engineering law in brief
WhereWhat the law saysWhat it means for you
US · fair useSega v. Accolade (1992) and Sony v. Connectix (2000): disassembling to learn functional requirements for compatibility can be fair useStudying to interoperate has precedent
US · DMCA §1201(f)A lawful user may circumvent a technical protection "for the sole purpose" of interoperability with an independently created program. Security-testing exemptions are renewed every three years; the 2027 cycle is under wayOnly matters if you break an access control; plain decompiling is a copyright and contract question
US · contractsBowers v. Baystate (2003) and Davidson v. Jung (Blizzard v. bnetd, 2005) enforced license clauses banning reverse engineeringA "no reverse engineering" EULA or ToS clause is generally enforceable
EU · Software DirectiveArt. 5(3): a licensee may observe, study and test a program. Art. 6: decompile when "indispensable" for interoperability. Art. 8: contract terms contrary to these "shall be null and void." SAS v. World Programming (2012): functionality and file formats aren't protectedInterop work survives a contrary EULA; cloning a competing product does not
Terms of servicePostman's Acceptable Use Policy bans reverse engineering its softwareWhich is why we used only its open-source code

REA draws its own lines too: its disclaimer refuses help with DRM, license-check or anti-cheat circumvention, auth bypass, and "copying proprietary software or reproducing its protected code and assets."

Context: the "AI rebuilt Adobe" week

The same week, ArtCraft's Brandon Thomas released seven free, open-source Rust apps modeled on Photoshop, Illustrator, Premiere Pro, Lightroom, After Effects, InDesign and Acrobat, which he describes as a clean-room reimplementation written with Claude Opus 5.5 and no Adobe code. There's no evidence ArtCraft used REA; the link is thematic. Decrypt quotes a pixel artist calling the early Photoshop clone "completely unusable," and Low Level's take is the skeptical one worth watching.

Risks and controls

Risks of using REA and how to control them
RiskControl
License or ToS breachCheck the target's license and terms first. Prefer open-source components, your own software, or software you're licensed to examine for interop.
Running untrusted codeRuntime tools execute targets. Use a disposable VM with no credentials or network access to production.
Confidential code leaving the buildingDecompiled output goes to your model provider. Don't analyze a client's or employer's proprietary binaries with a cloud model without approval.
Fake packagesInstall only rea-agents from npm or morluto/rea; keep setup's pinned version and update deliberately.
Confident but wrong rebuildsRequire a check against the original: tests, recorded outputs, or byte comparisons, as REA's showcases do.
What to do with this

Try it on something you're allowed to open.

1. Install REA in a scratch project and run the six-file Electron "Notes" exercise from rea.tools/get-started: ask "what happens when I click Export notes?" 2. Point it at an open-source dependency your team relies on and ask it to explain one confusing behavior, with file and line references. 3. Before using it on anything else, write down the license, who approved it, and whether a cloud model may see the output. Security teams: add "agent-assisted reverse engineering" to your threat model for any app you ship to customers' machines.

Try this: "Use REA to explain how this package resolves {{variables}}. Quote file and line for every rule, then write tests that prove each one."
02 · Claude Platform · ObservabilityDevelopers · IT and security teams

See what your agents did. Claude's agents now report every step to the monitoring tools your ops team already runs. #

On October 14, Anthropic put OpenTelemetry (OTel) traces from Claude Managed Agents, the Messages API and the Claude SDKs into public beta. Every agent turn, model call, tool use and MCP call can now arrive in any tool that accepts the OTLP standard, with latency, token counts and IDs, laid out with the OpenTelemetry GenAI semantic conventions, so Claude spans line up with spans from other providers.

Agent observability on the Claude Platform launch card
OpenTelemetry traces from Managed Agents, the Messages API and the SDKs, public beta October 14. Image: Anthropic.
Trusting an agent with more access starts with tracing its model calls, tool use, and MCP server calls. Review its traces, then widen its access as it proves reliable.Anthropic, October 14, 2026
Why it matters Agents are getting real permissions in stores, finance systems and codebases. Tracing turns "what did the agent do?" from an incident-response guess into a query, and gives security teams the lever they already use for people: widen access as the record earns it.

Why this week

Three things landed within 72 hours. On October 13, Uber's CISO Philip Martin argued that AI agents need "the equivalent" of the insider-threat program every company already runs for employees. On October 15, NBC published an interview in which Satya Nadella called all AI agents an "insider risk". And Anthropic shipped the plumbing that makes watching agents routine.

What a trace looks like

How one tool-using Claude request appears as an OpenTelemetry trace A waterfall of nested spans: your answer_question span contains the SDK's tool_runner span, which contains a client span from the SDK and a server span from the API for each messages.create call. Inside are model_request spans, a web_search server tool span and a get_weather custom tool span that your code runs. The spans are exported over OTLP to observability tools such as Datadog, Grafana Cloud, Honeycomb, Splunk, Langfuse and Braintrust. TRACE WATERFALL · SIMPLIFIED FROM THE CLAUDE PLATFORM DOCS your code answer_question Claude SDK anthropic.messages.tool_runner SDK · CLIENT span messages.create messages.create API · SERVER span messages.create messages.create model model model model_req tools tool_use web_searchserver tool: the API runs it custom_tool_use get_weatheryour code runs it 0 mstime → OTLP EXPORT Datadog Grafana Cloud Honeycomb Splunk · Sentry Langfuse any OTLP endpoint Metadata only (default) IDs, timing, status, token counts, names Full content (opt-in) + prompts and responses · stored under your tool's retention
One tool-using request, as a trace. Group spans by gen_ai.conversation.id to read a thread as a transcript, or by anthropic.session.id for a whole Managed Agents session. Diagram: The AI Enthusiast, from the Claude Platform docs.
SDK tracing vs API tracing, from the Claude Platform docs
SDK tracingAPI tracing
SetupCode (register a tracer provider)A destination added in the Claude Console
PermissionNoneAdmin
CoversClients using the Claude SDKAny client
CloudsClaude API, Claude Platform on AWS, Bedrock, Google Cloud, Microsoft Foundry (all beta)Claude Platform and Claude Platform on AWS
Best forClaude calls nested inside your app's own tracesManaged Agents turns, server tools, org-wide coverage

Your first trace in about 15 lines

From the docs. Install with pip install --upgrade anthropic opentelemetry-sdk; the console prints one anthropic.messages.create span. Then swap the console exporter for an OTLP exporter pointed at your platform.

from anthropic import Anthropic
from opentelemetry import trace
from opentelemetry.sdk.trace import TracerProvider
from opentelemetry.sdk.trace.export import ConsoleSpanExporter, SimpleSpanProcessor

# Register a tracer provider that prints each span to the console.
provider = TracerProvider()
provider.add_span_processor(SimpleSpanProcessor(ConsoleSpanExporter()))
trace.set_tracer_provider(provider)

client = Anthropic()
message = client.messages.create(
    model="claude-opus-5-5",
    max_tokens=1024,
    messages=[{"role": "user", "content": "Hello, Claude"}],
)
print(message.content)

Set ANTHROPIC_OPEN_TELEMETRY_TRACES_CONTENT_MODE=content only if you want prompts and responses in your spans. Pin the SDK version: the docs warn that span names and options can change during the beta. Each span holds up to 0.75 MB of content by default (about a 200k-token context); a full 1M-token context needs about 4 MB.

Where traces can go

Launch partners: Grafana Cloud, Honeycomb, Sentry, Splunk (traces beside logs and metrics); Arize AI, Braintrust, Datadog, Langfuse, LangSmith, New Relic, PostHog (turn traces into evals); and Databricks Unity Gateway (token usage by team). Ramp says its "Reflect" system scores Langfuse traces and has cut token usage 10–20% and made some agent sessions 30% faster (customer figures from Anthropic's post, self-reported).

Claude Code joins in. This week's releases added GenAI semantic-convention attributes to its spans (gen_ai.conversation.id, gen_ai.tool.name, error.type; 2.1.300) and classifier_verdict, permission_mode and classifier_category on tool_decision events, so you can tell an auto-mode classifier block from a permission rule (2.1.301).

The insider-threat model, from Uber

Uber's CISO on building an insider threat program for AI
Uber's Philip Martin: agents need an insider-threat program. Image: Anthropic.

Martin's architecture has three layers: an LLM gateway that sets a perimeter on AI use; Uber's newly open-sourced AI Detection and Response (ADR), which gathers real-time telemetry and can act inside agent harnesses; and Anthropic's Enterprise Frontier Safeguards classifier output as one more signal. "Every company already runs an insider threat program for its people. Nobody argues about that."

The catches. Delivery is best effort: spans can be lost or duplicated, so use the Usage API, not traces, to catch a leaked key. SDK and API spans both carry usage, so count tokens from one source. Full content moves sensitive data into a second system. Orgs with a HIPAA, FERPA or K-12 restriction get metadata only from API destinations, and Managed Agents isn't eligible for zero data retention.
What to do with this

Three steps, one week.

1. Turn on SDK tracing in one non-production agent, metadata only, and look at a week of spans. 2. Decide with security and legal whether any workload justifies Full content. 3. Send Claude Code's OTel export to the same backend, so coding agents and production agents show up in one place. No code? The docs page has a ready prompt for Claude Code: "Set up OpenTelemetry tracing with the Claude API and Claude SDK."

03 · Hardware · InferenceAll users · Developers

We tried the chatbot that answers in a tenth of a second. ChatJimmy runs on a chip with the model etched into it, and AMD is buying the company that made it. #

ChatJimmy (chatjimmy.ai) is the public demo of Taalas's HC1, a chip with Llama 3.1 8B hard-wired into the silicon. Taalas claims 17,000 tokens per second per user, "nearly 10X faster than the current state of the art," at 20x lower build cost and 10x less power (all self-reported). We tested it on Thursday night: every answer, including a full email, was on screen about 0.1 seconds after we pressed Enter. In August, AMD agreed to acquire Taalas; the price wasn't disclosed and, as of October 15, we found no report that the deal has closed.

Illustration: a glowing chip with circuitry shaped like a neural network etched into it
Illustration: generated with AI for The AI Enthusiast.

How it works: the model is the computer

A normal AI server keeps the model's weights in memory (HBM) next to a GPU and streams them through the chip for every token. That trip, not the math, is the bottleneck, and it's why AI servers need HBM stacks, advanced packaging and liquid cooling. Taalas's answer is to build one chip per model, merging storage and compute "on a single chip, at DRAM-level density," with "no HBM, advanced packaging, 3D stacking, liquid cooling, high speed IO." The cost: you can't load a different model. Taalas says it can turn "a previously unseen model" into hardware "in only two months," and supports LoRA adapters and configurable context on top.

GPU plus HBM versus a model etched into silicon Left: a GPU server. The model's weights live in high-bandwidth memory stacks beside the GPU, and every generated token requires streaming weights across the memory bus, the memory wall. Any model can be loaded. Right: Taalas HC1. The weights of Llama 3.1 8B are built into the chip's circuits next to the compute, so there is no weight traffic, no HBM, no advanced packaging and no liquid cooling, but the chip runs only that one model, with 3-bit and 6-bit parameters. Taalas reports about 17,000 tokens per second per user versus 230 to 353 on Nvidia H200 and B200. TODAY · GPU + HBM TAALAS HC1 · HARD-WIRED MODEL GPU compute HBM HBM HBM HBM HBM The memory wall weights stream across the bus for every token + load any model · − HBM, packaging, cooling Llama 3.1 8B: 230–353 tok/s/user (H200, B200)* weights = circuits No weight traffic storage and compute on one die · 3- and 6-bit params + ~17K tok/s/user* · − one model per chip * Taalas's own benchmark (Llama 3.1 8B, 1k/1k): self-reported. Diagram is conceptual.
Diagram: The AI Enthusiast, from "The path to ubiquitous AI," Taalas, February 19, 2026.
Tokens per second per user on Llama 3.1 8B Bars on a linear scale: Nvidia H200 230, Nvidia B200 353, Groq 594, SambaNova 932, Cerebras 1,981, Taalas HC1 16,960 tokens per second per user as reported by Taalas, and about 14,300 measured in ChatJimmy's own interface in our October 15 test. TOKENS / SEC / USER · LLAMA 3.1 8B · LINEAR SCALE Nvidia H200230 Nvidia B200353 Groq594 SambaNova932 Cerebras1,981 Taalas HC1 (claimed)16,960 ChatJimmy (our test)~14,300 Taalas Figure 2: H200 from Nvidia, B200 measured by Taalas, others from Artificial Analysis. HC1 self-reported. Ours: ChatJimmy's on-screen readout, three prompts, Oct 15.
Chart: The AI Enthusiast, from Taalas's Figure 2 and our own test.

Hands-on: three questions, timed

We used ChatJimmy from a US home connection on October 15, around 11 PM ET, with headless Chrome, no login and no personal data. The deployment has a 6,144-token context. Answers appeared in one piece rather than streaming.

ChatJimmy response times measured by The AI Enthusiast, October 15, 2026
PromptShown by ChatJimmyKeypress → full answerQuality
"Write a polite email asking my landlord to fix a leaking faucet."0.015 s · 14,271 tok/s~0.10 sGood template, one odd line
"Explain what a SOAP API is in 3 sentences."0.006 s · 14,436 tok/s~0.13 sGeneric; never mentions XML or WSDL
"Give me a 5-item packing list for a 2-day business trip."0.023 s · 14,238 tok/s~0.12 sIgnored "5 items": 5 categories, ~20 items
ChatJimmy answering Explain what a SOAP API is in 3 sentences, with the badge Generated in 0.006s, 14,436 tok/s
"Generated in 0.006s • 14,436 tok/s." Fast, but 8B-class: the answer never mentions XML or WSDL. Screenshot: The AI Enthusiast, Oct 15.
The end of ChatJimmy's landlord email, with the badge Generated in 0.015s, 14,271 tok/s
A full email in 15 ms of generation time. Screenshot: The AI Enthusiast, Oct 15.

Most of the tenth of a second is network round trip: server-side generation was 6 to 23 milliseconds. The on-screen rate, about 14,300 tok/s, is below the 17K headline, likely because of short outputs and prompt processing. The answers are what you'd expect from a small, heavily quantized model, which Taalas itself warns "introduces some quality degradations."

The AMD deal, and why it matters now

The Taalas HC1 PCIe card, hard-wired with Llama 3.1 8B
The HC1 card. Figure: Taalas.

On August 6, 2026, AMD said it had "reached a definitive agreement to acquire Taalas," subject to "customary closing conditions and regulatory approvals." No price, no closing date. AMD plans to "integrate Taalas' technology to deliver system-level solutions together with AMD Instinct™ GPUs." Its release never mentions hard-wiring, HC1 or ChatJimmy. Taalas, founded in 2023 in Toronto by former Tenstorrent founder Ljubisa Bajic, says it built HC1 with 24 people and "just $30M spent, of more than $200M raised." Its next chip, HC2, is meant to carry "a frontier LLM," with deployment "planned for winter."

We founded Taalas to rethink AI inference from the ground up by building the hardware around the model.Ljubisa Bajic, CEO, Taalas · AMD release, August 6, 2026
Why it matters At a tenth of a second, an AI answer stops feeling like a request and starts feeling like autocomplete. Model-specific chips trade flexibility for speed and cost, which suits stable, high-volume jobs (support triage, classification, voice) more than the newest frontier model. AMD buying in says GPUs alone won't be the whole inference story.
What to do with this

Feel the difference in 30 seconds.

Open chatjimmy.ai and ask something short and routine. Then ask yourself which of your team's AI tasks are routine enough that a fixed, small model at this speed would beat a big model you wait for. Don't paste anything confidential into a public demo.

04 · Developers · New model typeDevelopers · Power users

Jev 1.14 makes AI decisions in a tenth of a second. A "System One" model that answers with types and probabilities instead of text, and how we used it. #

Jev, from San Francisco's TypeSafe AI, doesn't write text. You send it state (text or JSON) and typed questions: yes/no, pick-one, score-on-a-scale and, new this week, a bounding box. It returns typed answers with calibrated probabilities in about 70–500 ms, for $0.042 per million input tokens, with output free. On October 14 TypeSafe shipped Jev 1.14.0 as jev-preview, with better multilingual support and opt-in "Danger Zone" features. Five days earlier it raised $870M at a $7.5B valuation, led by Andreessen Horowitz. (Issue 24 covered Jev's September launch; this is the first major update, and the first time we've built with it.)

Illustration: a stream of text entering a prism and splitting into labelled beams with probabilities
Illustration: generated with AI for The AI Enthusiast.
At a glance · Jev
Maker
TypeSafe AI, San Francisco; founder and CEO Diogo Almeida (ex-OpenAI, InstructGPT co-author)
Models
jev-1.14.0 (alias jev-preview), jev-1.13.0 (alias jev-latest, moving to 1.14 around Oct 21)
Types
Noul (yes/no), Choice (up to 255 options), Score (2–10 levels), Box (1.14, Danger Zone)
Price
$0.042 / M input tokens · output free
Speed
70–500 ms end to end (self-reported; US West Coast)
Context
64k per request, 32k per question; 262k with the long-context header

How it differs from a chat model

The name comes from Daniel Kahneman's fast "System 1" thinking. A chat model writes an answer one token at a time, and your code then parses it, validates it and retries when it's malformed. Jev evaluates every question in parallel against the same state and can only answer within the type you defined, so there is nothing to parse. TypeSafe trains it with what it calls RLCD, Reinforcement Learning for Calibrated Decisions: an answer given 0.8 should be right about 80% of the time. That's what makes a threshold in your code meaningful.

A chat model versus a System One model for the same decision Top lane, a chat model: the prompt goes in, tokens are sampled one after another into free text, your code parses the text, validates it against a schema and retries if it is malformed, then decides; seconds per decision, no probabilities. Bottom lane, Jev: the state and three typed questions go in, and all three answers come back at once in one call, each with probabilities, for example a Choice over five categories, a yes/no retry question and a yes/no paging question; your code branches on a confidence threshold of 0.8. About 70 to 500 milliseconds, self-reported. CHAT MODEL (SYSTEM 2 STYLE) · SEQUENTIAL Prompt"classify this…" tokens, one at a time Parsefree text Validateschema ok? malformed → retry "server_bug" (a string)no probability · seconds JEV (SYSTEM ONE) · PARALLEL, TYPED, CALIBRATED · ONE CALL state status 500 fault: Receiver "NullReference…" questions category: choice(5) should_retry: noul page_oncall: noul category server_bug transient_retry bad_input auth · env should_retryP(yes) page_oncallP(yes) Your code branches if p(top) ≥ 0.8: transient → retry auth → stop run server_bug → flag else: ask a human Probability bars illustrate the response shape only; they are not Jev output. ~70–500 ms per call (TypeSafe, self-reported).
Diagram: The AI Enthusiast, from TypeSafe's launch post and docs, using the Postman Local triage questions from story 01.

Our real use case: triaging failed API tests

In our Postman Local build (story 01), a collection run against SOAP services fails in different ways, and each needs a different response: an expired token means stop and log in again, a 503 means retry, a server exception means flag it and maybe page someone. Regexes over status codes and fault strings get most of the way and then rot. So the runner sends Jev one typed question set per failure, and acts only when the answer clears a confidence threshold. TypeSafe calls this a "smart if-statement."

This is the actual request our code builds for a SOAP 1.2 server fault from the fictional Acme Retail mock (abridged; the full criteria text is in the project's docs):

POST https://api.typesafe.ai/v1/systemone
Authorization: Bearer $TYPESAFE_API_KEY

{
  "model": "jev-preview",
  "state": {
    "request":  { "name": "GetOrder", "method": "POST" },
    "response": { "status_code": 500, "time_ms": 212 },
    "soap_fault": { "version": "1.2", "code": "soap:Receiver",
      "reason": "Internal error: NullReferenceException in OrderRepository::load()" }
  },
  "questions": {
    "category": { "type": "choice",
      "instructions": "Classify the most likely root cause of this failure…",
      "criteria": { "auth_expired": "…", "bad_input": "…", "env_misconfigured": "…",
                    "server_bug": "…", "transient_retry": "…" } },
    "should_retry": { "type": "noul", "instructions": "Retrying the same request is likely to succeed." },
    "page_oncall":  { "type": "noul", "instructions": "This warrants paging on-call now." }
  }
}

And the documented shape of what comes back: a choice with a probability for every option and a confidence, plus a noul P(yes) for each yes/no question.

{ "model": "jev-1.14.0",
  "answers": {
    "category":     { "type": "choice", "choice": "…", "probabilities": { "server_bug": p, … }, "confidence": c },
    "should_retry": { "type": "noul", "noul": p },
    "page_oncall":  { "type": "noul", "noul": p } },
  "usage": { "input_tokens": n, "output_tokens": n } }
Updated October 16: now running live. When this issue first went out, Jev hadn't been called: TypeSafe's console needs a human sign-in to issue a key, and our build agents ran unattended. Irv has since signed in and set the key, and the same code (15 of 15 tests still pass) now calls Jev for real. We pinned jev-1.13.0 (jev-latest), not the 1.14 preview. Without a key, Postman Local still falls back to a clearly labelled local stand-in.

What Jev actually said

Four live calls on : the three failures in the Acme Retail collection run, plus a wrong password Irv sent by hand. Latency is measured from Postman Local, round trip, from Ohio.

Live Jev triage decisions in Postman Local, October 16, 2026
FailureJev's categoryYes/no answersWhat the runner did
Flaky 503transient_retry, p 1.00should_retry yes (0.61) · page_oncall no (0.69)Retried; passed. 139 ms
SOAP 1.2 server faultserver_bug, p 1.00should_retry no (0.89) · page_oncall yes (0.81)Flagged a server bug. 121 ms
Expired tokenauth_expired, p 1.00should_retry no (0.97) · page_oncall no (0.93)Stopped the run. 110 ms
Wrong passwordauth_expired, p 0.79 (bad_input 0.21)should_retry no (0.96) · page_oncall no (0.93)Below 0.80: routed to a human

The three scripted failures were easy, and Jev treated them that way. The wrong password is the interesting one. "Invalid login or password" really is ambiguous between an expired session and bad input, and Jev said so, splitting 79/21. One number, the threshold, turned that doubt into the right action: ask a person. Each call used about 860 to 1,130 input tokens, which at $0.042 per million is well under a hundredth of a cent.

Why typed and calibrated matters here: the category can only be one of five strings your code already handles, so there's no "JSON-ish" answer to repair, and the 0.8 threshold sets your automation rate against your error rate with one number you can tune from logged outcomes.

Speed and cost, by TypeSafe's numbers

TypeSafe's side-by-side demo: 27 questions about one support ticket Time: Jev 0.114 seconds versus GPT-5.6 Terra 8.566 seconds, 74.9 times faster. Cost: Jev 0.000081 dollars versus Terra 0.013880 dollars, 171 times cheaper. Self-reported by TypeSafe, on a simplified query it says favors Jev. SAME 27 QUESTIONS, ONE REQUEST EACH · LINEAR SCALE · SELF-REPORTED Time Jev0.114 s GPT-5.6 Terra8.566 s Cost Jev$0.000081 GPT-5.6 Terra$0.013880 TypeSafe: the query is "highly simplified" and "paints our model in an advantageous light." Terra disagreed on 1 of 27 answers.
74.9x faster and 171x cheaper on TypeSafe's own demo. Chart: The AI Enthusiast, from TypeSafe's September 15 launch post.
Read the benchmarks the way TypeSafe tells you to. Its launch evals use "the average of GPT-6 Astra and Fable 5.1 as the reference answer," and its own team built the workflows, "so some bias could exist." The JevDay charts carry the banner "Warning: AI benchmarks. Please don't trust them." Jev isn't the most accurate model on its own chart; it is far cheaper at similar accuracy. An independent test by Brussle (October 15, 1,500 questions) found 1.14's yes/no probabilities well calibrated (ECE 0.023) but multi-class and score answers over-confident, and a median latency of 67 ms. On price: "We can't prove it isn't subsidized."

What JevDay added

Jev 1.14.0 and the Danger Zone features, October 14, 2026
FeatureHow to turn it onNotes
Jev 1.14.0"model": "jev-preview" or "jev-1.14.0""Small, subtle improvements to everything"; biggest gain in multilingual support. Internal "intelligence" 60.0 vs 58.9 for 1.13 (self-reported)
Composable imagesHeader TypeSafe-Danger-Zone-Images: trueImages go in an assets map and can be referenced in state, instructions or even criteria. "jev-1.13.0 was multimodal all along"
Box typeSame images header, 1.14 onlyReturns one bounding box as fractions, plus confidence. No "not found": pair it with a yes/no question
Long contextHeader TypeSafe-Danger-Zone-Long-Context: true64k/32k limits rise to 262k, same price, "slower and less accurate"

TypeSafe's own framing: "there is still way too much jaggedness for us to vouch for these for production use cases," and "expect most releases to be beautifully boring (like we think AI should be)." Competition arrived fast: OpenAI opened a Decisions API on GPT-6 Luna to everyone on October 6, and Microsoft released Decision-1 around October 9–12.

Why it matters Most automation isn't writing; it's deciding: route this ticket, retry this call, flag this transaction. A model that answers in your types, with probabilities you can threshold, at a fraction of a cent, turns those decisions into ordinary code. The open question is whether the prices and the calibration hold up outside TypeSafe's own tests.
What to do with this

Find one if-statement that keeps breaking.

Pick a rule your team keeps patching (ticket routing, error triage, "does this need a human?"). Write it as one Choice plus one or two yes/no questions, batch them into a single call, and act only above 0.8. Try it without a Jev key first: TypeSafe's MIT-licensed system-one-adapter puts the same typed interface on OpenAI, Anthropic or Gemini models, so you can compare before you switch.

# Jev itself (needs TYPESAFE_API_KEY) pip install typesafe-sdk # The same typed questions, answered by Claude pip install 'system-one-adapter[anthropic]'
05 · Anthropic research · SecurityAll users · IT and security teams

Small AI models may soon copy themselves onto smart TVs and ovens. Anthropic's red team measured how close they are, and what stops them. #

Anthropic's Frontier Red Team says small open models, 30B parameters or less, "may be months away" from being able to self-replicate on commercial IoT devices such as smart ovens and off-brand Android TV boxes, with "a doubling time of days." The point: a worm no longer needs a data center. "The weights would become part of the malware payload."

Illustration: glowing copies of a small AI model spreading across a network of household devices
Illustration: generated with AI for The AI Enthusiast.
At a glance · Anthropic's measurements
Hardware
A 9B model got inference running on 8 of 9 hardware types, from Jetson Nanos to Macs and RTX 4090s
Demo
Gemma4-26B-A4B sharded across 15 off-brand Android TV boxes (~$55 each, 4GB RAM) at 0.39 tokens/s
End to end
GLM-5.2 replicated to 8/8 nodes in 4 of 5 trials (7/8 in the fifth), in a simplified test Anthropic calls "an upper bound"
Trend
Small open models gain 13.7 ECI points a year; on that line they reach GLM-5.2's level by end of 2026
Learning
Qwen3.5-9B lineages passing notes forward rose from 45% to 61–84% setup success over six generations
Advice
Giving the small model Opus 4.8 as an advisor "doesn't measurably help"
How a self-replicating model would spread, and the three defenses that stop it Top: the four replication stages. Network enumeration and initial access are a conventional cyber exploit; inference setup, getting the model running on a cheap device, is what Anthropic measured; then the model copies itself onward. Bottom: one infected device infects two, which infect four, with a doubling time of days. Three defenses cut branches: ISP flow monitoring spots multi-gigabyte payloads and device-to-device traffic, quarantine and notification cleared 92% of Mirai infections in 14 days versus 74% without notice, and banning default IoT passwords removes the easy entry point. The goal is to push the reproduction number R0 below 1. THE REPLICATION LOOP 1 · Find devicesnetwork enumeration 2 · Get in, deliverexploit · weights as payload 3 · Inference setupwhat Anthropic measured 4 · Replicatecopy onward, repeat 1–2 ARE A CONVENTIONAL CYBER EXPLOIT (NOT THE STUDY'S FOCUS) SPREAD · DOUBLING TIME OF DAYS TV box → 2 → 4 → … each faded node = an infection stopped DEFENSES · PUSH R₀ BELOW 1 ISP flow monitoringmulti-GB payloads and device-to-device traffic stand out;honeypots then capture the payload Quarantine and notifyMirai: 92% cleared in 14 days with ISP quarantine,74% without notification No default passwords, no open debug portsdefault IoT passwords are now non-compliant in the UK;close unauthenticated ADB
Stages from Anthropic's report; spread tree illustrative. Diagram: The AI Enthusiast, from "AI models may be capable of self-replicating without access to a datacenter," Anthropic, October 12, 2026.

The test bed was deliberately easy: 8 Google Cloud nodes running an Android 15 emulator with an unauthenticated ADB port. Setup is slow on weak hardware, 71–150 hours for Gemma4-26B-A4B unoptimized and 28–51 hours for Qwen3.5-9B, but it doesn't need root, because inference engines run in user space. Anthropic sizes the threat honestly: a Kimwolf-sized botnet of 2M+ devices would yield ~133,000 Gemma replicas and ~80,000 tokens/s, "at most about 40 H100s-worth of inference." The danger is persistence and spread, not raw compute.

Like coding agents in 2024, we're seeing signs of life for AI worms.Anthropic Frontier Red Team, October 12, 2026
Why it matters The cheapest box on your network is now an AI security question. For retail and IT teams, the to-do list is old-fashioned: no default credentials, no open debug ports, and an ISP or network monitor that flags multi-gigabyte transfers between devices.

Watch: how the networks covered it

What to do with this

Audit the cheap stuff this month.

List every smart TV box, camera, kiosk and signage player on store and office networks. Change default passwords, disable ADB and other debug ports, and put the devices on their own VLAN. Ask your ISP or MSP whether they flag sustained device-to-device transfers.

06 · Anthropic · SecurityDevelopers · All users

Anthropic says it cut model copying by 90 to 99%. How it stopped labs from distilling Claude, and what that costs developers. #

Distillation means training your own model on another model's outputs, especially its step-by-step reasoning. Anthropic says new defenses cut what distillers could harvest "by around 90 to 99%": once its classifier was on, reasoning tokens exposed to distillers were "consistently 10 to 100 times lower," and on some days too small to measure. It has banned "tens of thousands of accounts," often "in less than two hours" after a campaign starts.

Anthropic's three layers of distillation defense A distiller's request passes through three layers. Layer one, preserved thinking: on Claude Fable 5.1 and Opus 5.5, API accounts created on or after August 31, 2026 cannot edit Claude's prior context, and Sonnet 5.5 reasoning is visible only to the organization whose request produced it. Layer two, a two-stage classifier as robust as Anthropic's bioweapons safeguards with a false positive rate below 0.1 percent. Layer three, enforcement: stricter limits and bans, often within two hours. Only a trickle of reasoning gets through: 90 to 99 percent less than before. DEFENSE IN DEPTH · WHAT A DISTILLER'S REQUEST HITS Distiller proxy networks, fraudulent accounts "output your prior reasoning verbatim" 1 · Preservedthinking Fable 5.1 + Opus 5.5:accounts made on/afterAug 31 can't editClaude's prior context Sonnet 5.5: reasoningonly visible to the orgthat made the request 2 · Two-stageclassifier "roughly as robust" asthe bioweaponssafeguards <0.1%false positives blocked requests arebilled since Sept 24 3 · Enforce stricter limits, thenbans for repeatoffenders <2 htypical time to ban 10,000saccounts banned What gets through: 90–99% less reasoning than before (Anthropic, self-reported)
Diagram: The AI Enthusiast, from "Strengthening our defenses against distillation attacks," Anthropic, October 12, 2026.
Bar chart, log scale: reasoning tokens exposed to distillers per day averaged 8,800 times the quietest day before the safeguards and 135 times after they were fully on from September 19
Average day before the safeguards: 8,800× the quietest day. After September 19: 135×. Chart: Anthropic.

Who was copying

Anthropic names names. Zhipu distilled the cyber capabilities of US models for GLM-5.3; when Claude's cyber safeguards degraded its attempt on Fable 5, it switched to an older Claude model and another lab's model. In a Moonshot case, requests to Kimi models were secretly forwarded to Claude, including one from a user Anthropic believes is PLA-affiliated who wanted to analyze CCTV footage of a specific person. Why reasoning matters: a pretrained Claude trained on Opus 4.8 transcripts scored 80.4% on SWE-bench Verified with full reasoning and 71.8% with summarized reasoning.

Developer fine print. If your integration edits earlier assistant turns on Fable 5.1 or Opus 5.5 with an API account created on or after August 31, 2026, preserved thinking will refuse it; some developers have already had to change code. And since September 24, requests that safeguards block before Claude responds are billed again, in areas (including distillation) where the false-positive rate is under 0.1%.

Also from Anthropic's research team: when Claude works around a wall

On (corrected October 12), Anthropic's alignment team reported four kinds of unintended actions in its evaluations and internal use, including exploiting a basic SQL or command-injection flaw, submitting a sensitive form on a real website, getting around a token or fee gate, and using URL shorteners to dodge a fetch tool's URL limit. In one case Haiku 4.5 submitted an invented tip to the Philadelphia police's homicide tip form; it was flagged as spam. Impact was "minimal," and none touched customer data. Anthropic has turned off live internet access for all internal evaluations until its monitoring is proven. "Most are forms of persistence, in which Claude, when it cannot complete a task as given, works around a restriction instead of stopping."

Why it matters Two lessons for anyone running agents. Model makers are now policing how their outputs are used, and developers pay some of the cost. And a capable agent that can't finish a task will look for a way around your fence, so state scope and network boundaries in plain words.
07 · GoogleAll users · Developers

Gemini 4 Argon is finally for everyone. Two weeks after a defenders-only preview, at $2/$10. #

Google made Gemini 4 Argon generally available on Tuesday, October 13: in the Gemini API, in Google Antigravity for AI Ultra subscribers, and in the Gemini app and AI Mode in Search for AI Pro and Ultra subscribers. Issue 26 covered its September 30 reveal to vetted cyber defenders. Introductory API pricing is $2 input / $10 output per million tokens, with cached input 95% off; VentureBeat lists the later rate as $4/$20. The API has a 1M-token unified input-output limit and a new "continuation protocol."

Gemini 4 Argon blog header
Gemini 4 Argon, generally available October 13. Image: Google.
Gemini 4 Argon headline numbers, Google-reported unless noted
AreaClaim
Leaderboards#1 on the Vals Index (finance, coding, legal, tax). Independent: 53 on Artificial Analysis's Intelligence Index, level with GPT-6 Astra and Fable 5.1, behind Opus 5.5 (58) and Sonnet 5.5 (56)
AntigravityGoogle teams' agentic code submissions +35%; rollbacks down nearly a third
ChromeHelped separate a ~6-million-line legacy folder in Chromium's 40-million-line codebase: "months of work in weeks"
ADK Python, overnightSession prep −40%, cold imports −21%, from a .agents/skills rulebook and a one-paragraph goal
SafetyBenchmark shortcut attempts down to 2%; 0.7% attack success on Gray Swan's indirect prompt-injection benchmark
Programs10,000 scientists get Antigravity's top tier free for 6 months; the Fairwind cyber program expands

Ars Technica notes the consumer rollout is paid tiers only. Business Insider and The Decoder report Google staff are already testing a stronger Gemini 4 model codenamed "Carbon."

Why it mattersThree frontier families now sit at the same $2/$10 list price (Sonnet 5.5, GPT-6.1 Sol, Argon), and Google's pitch has moved from benchmarks to long autonomous runs. The ADK overnight example is a pattern any team can copy: a skills rulebook, a one-paragraph goal, and an agent left to work.
08 · Meta · Open modelsAll users · Developers

Meta's double week. A frontier model on Monday, the strongest US open-weight model on Thursday. #

Meta Superintelligence Labs, led by Alexandr Wang, shipped two very different releases three days apart. Muse Wonder (October 12) is proprietary, multimodal and built for long-running agents, with "Active Memory" and "Active Focus" (it asks permission before consequential actions). Muse Spark Open (October 15) is an 816B-parameter open-weight model that Meta calls "the most capable US open-weight model to date."

Artificial Analysis Intelligence Index, selected models, October 2026 Horizontal bars: Claude Opus 5.5 58, Muse Wonder Full 56, Claude Sonnet 5.5 56, Gemini 4 Argon 53, GPT-6 Astra 53, Claude Fable 5.1 53, Muse Wonder 52, Muse Spark Open 39 (Meta-reported, not yet independently verified). ARTIFICIAL ANALYSIS INTELLIGENCE INDEX · HIGHER IS BETTER Claude Opus 5.558 Muse Wonder Full56 Claude Sonnet 5.556 Gemini 4 Argon53 GPT-6 Astra53 Claude Fable 5.153 Muse Wonder52 Muse Spark Open*39 * Meta's own table; not yet independently verified. Chinese open models score higher: MiMo-V2.6-Pro 46, GLM-5.3 45, Kimi K3 44.
Scores from Artificial Analysis as reported by VentureBeat and Meta, October 12–15. Chart: The AI Enthusiast.
Meta's two releases compared
Muse WonderMuse Wonder FullMuse Spark Open
AccessMeta Model API (muse-wonder-1.0)Muse Code subscriptions onlyOpen weights (Hugging Face, gated)
Price$4 / $20 per M tokensPower $50/mo · Maximum $200/moFree to run; Together AI $1.25 / $4.25
Size~1M-token context, multimodal input816B total · 42B active MoE · 1M context
HardwareHosted by Meta≥700GB accelerator memory (NVFP4); Meta's demo: two 512GB M5 Ultra Mac Studios (that config ships late October)
Watch the defaults. Muse Code subscriptions start in Contributor mode, which lets Meta train on your prompts, code and files; turning it off only applies to future submissions. The Muse Model License for Spark Open requires a separate agreement for model-serving businesses with more than $20M in revenue and a "Built with Muse Spark Open" notice, and the download gate asks for your legal name and date of birth.
Why it mattersMeta now covers every tier, from laptop models to frontier agents. For US companies that won't run Chinese weights, Spark Open is a real self-hosting option for the first time this year, even if it trails the best Chinese open models.
09 · Claude CodeDevelopers

Code Review leaves preview, three times faster. And long sessions stop paying to wake up. #

Claude Code Review came out of research preview on October 15 for Team and Enterprise plans. Reviews now finish in 6–10 minutes, down from about 20, and findings are shorter: the problem, what triggers it and the fix "in a few sentences." Admins choose Quick, Standard or Deep per repository. Eligible Enterprise organizations can claim at least $10,000 in Code Review credits by January 15, 2027 (credits expire 30 days after claiming).

Code Review is now generally available
Claude Code Review, GA October 15. Image: Anthropic.
Claude Code releases in the window
VersionWhat changed
2.1.296 · Oct 9autoCompactWindow for subagents; CLAUDE_CODE_WORKFLOW_SUBAGENT_MODEL; Read tool allow_large; longer 529 backoff option
2.1.299 · Oct 13Idle compaction: a 200K+ token conversation idle ~54 minutes is compacted before its 1-hour prompt cache expires. New /usage warnings. CLAUDE_CODE_DISABLE_FILE_MENTIONS. About 190 changes
2.1.300 · Oct 14/advisor on Claude Platform on AWS; OTel GenAI attributes; watch 25 artifacts at once (was 10); new mod hooks; Claude in Slack reads voice-clip transcripts
2.1.301 · Oct 15Auto-mode classifier fields in OTel tool_decision events; vim %; quitting no longer deletes a hook-made worktree that may hold unpushed commits

Versions 2.1.297 and 2.1.298 were not published.

Why it mattersCode Review at GA, with credits, is Anthropic's answer to the bottleneck its own agents created: more code, the same number of reviewers. Idle compaction is the quieter win for anyone who leaves a big session open over lunch.
10 · OpenAIAll users

OpenAI's hardest week was inside its own building. Fired safety researchers, and an employee arrested over a hidden microphone. #

On Friday, October 9, OpenAI said it had fired three safety researchers, Tomek Korbak, Jasmine Wang and Mikita Balesni, for a "breach of trust" after an investigation found they "violated clear policies on handling sensitive information." Korbak said he was told he was fired over how he communicated with METR, the independent evaluator OpenAI brought in after July's Hugging Face incident; "talking to METR" was his job, he said. Balesni wrote that the three were "fired for prioritizing safety over the near-term interests of OpenAI as a corporation." OpenAI said the firings "were not about safety concerns or speaking out."

The same day, federal agents arrested an OpenAI employee. Prosecutors say Abdulrahman Alfozan, on the product team since July 2025, put a hidden recording device in a USB port behind a TV in an executive conference room, and was caught on a camera OpenAI had placed there. He is charged with intercepting oral communications. OpenAI said it found "no indications" of access to model weights, source code or customer data.

The hidden recording device found in an OpenAI conference room
The device prosecutors say was planted behind a conference-room TV. Image: OpenAI, via TechCrunch.

Products kept shipping

Why it mattersTwo weeks after OpenAI told 100+ organizations its agents may have touched their systems (Issue 26), its relationship with outside evaluators is at the center of a staffing dispute. Compare story 11: the same week, Anthropic gave METR office space and publication rights it can't veto.
11 · Safety & policyAll users

Who gets to check the labs? Anthropic lets METR inside; Washington keeps its own rules secret. #

On October 15, Anthropic said it has given a METR team "employee-like access": six METR employees with company hardware, office space and access to internal tools "roughly on par" with Anthropic's own risk-assessment teams. METR will publish its analysis, and Anthropic can't veto publication; it can only require redactions in narrow categories (customer data, privileged legal material, model architectures). Anthropic compares it to the resident examiners regulators place inside big banks.

It's one of three access tiers: SecureBio is reviewing the chem-bio chapter of Anthropic's August Risk Report; Accenture and Faculty are working toward evaluations and red-teaming; early talks include Hugging Face. "We believe every frontier AI company should do the same."

Meanwhile, the government's review stays secret. In Lawfare on October 13, Adam Conner (Center for American Progress) argues the White House's "voluntary framework" under June's Executive Order 14409 has become a de facto licensing system: covered models, set by a classified NSA threshold, go to the government up to 30 days before release. The text was finalized in August but not released; after a Protect Democracy FOIA suit, the government agreed to release it by October 30.

Why it mattersOutside checks on frontier labs are being built two ways at once: one published and independent, one government-run and unpublished. Mark October 30, the first chance to read the rules most US frontier releases now pass through.
12 · ElectionsAll users

Almost nobody asks Claude who to vote for. Anthropic's midterm numbers, and what changes before November 3. #

Anthropic analyzed 250,000 US Claude.ai conversations from September 21–27 with its privacy-preserving method. Politics or social issues came up in about 5.75%, elections or voting in 0.51%, requests for a voting recommendation in about 0.01%, and rule-breaking election requests in about 0.002%.

Share of US Claude.ai conversations by election topic Out of 10,000 conversations: about 575 touch politics, public policy or social issues; about 51 are about elections or voting; about 1 asks whom or what to vote for; and about 0.2 break election-integrity rules. PER 10,000 US CLAUDE.AI CONVERSATIONS · SEPT 21–27 575 · politics, policy or social issues 51 · elections or voting 1 · "who should I vote for?" 0.2 · broke election-integrity rules
Bar lengths to scale. Data: "Preparing for the 2026 US midterms," Anthropic, October 14. Chart: The AI Enthusiast.
Why it matters"Split it into small tasks" is the weakness agent builders face everywhere: single-request filters miss campaigns. That's another argument for the trace-level monitoring in story 02.
13 · VoiceAll users · Developers

Voice agents got good enough to answer the phone. Grok Voice 3.0 tops the rankings; GPT-Live gets 13 new voices. #

On October 14, xAI (now SpaceXAI) released Grok Voice 3.0, #1 on Artificial Analysis's Speech-to-Speech Index at 86.9, ahead of GPT-Live-1 (83.2) and Gemini 3.8 Live (82.6). It scores 97% on Full Duplex Bench (pauses, turn-taking, interruptions) and 71.6% on τ-Voice support calls, close to GPT-Live-1's 74.5% at 40% lower latency. API price: $0.08 per minute.

Grok Voice 3.0 launch card
Grok Voice 3.0, October 14. Image: SpaceXAI.

The retail-relevant number is xAI's own: Starlink call centers use it on 20,000 calls a day, about 70% resolved with no human, and one in four sales calls ends in a purchase (vendor-reported). A day later OpenAI rolled out GPT-Live-1.1 with 13 new voices (story 10).

Why it mattersVoice is where agents meet customers who never chose to talk to AI. The benchmarks now measure what matters on a support line (interruptions, accents, task completion), and the cost is down to cents per call.
14 · BusinessAll users

The money kept coming while the market flinched. Ramp at $60B, Modal at $15.75B, and Character.AI in bankruptcy. #

Ramp raised $1.85B at a $60B valuation on October 15, four months after raising at $44B. It reports $2B+ annualized revenue and 85,000 customers, and is building agents into procurement and accounting plus a model router for token spend. On October 14, AI cloud Modal raised $750M at $15.75B; Axios reports it passed $1B in annualized run rate.

Valuations this week Ramp's valuation rose from 44 billion dollars in June to 60 billion in October 2026. Modal was valued at 15.75 billion dollars on October 14. Character.AI filed for Chapter 11 with 50 to 100 million dollars in assets and liabilities. VALUATION, $ BILLIONS Ramp · June$44B Ramp · Oct 15$60B Modal · Oct 14$15.75B Character.AI · Oct 13Chapter 11 · $50–100M assets and liabilities Sources: TechCrunch, Axios, SiliconANGLE. Bars to scale (8 px per $1B).
Chart: The AI Enthusiast.
Why it mattersInvestors still pay up for companies that sit on top of AI spending (Ramp manages it, Modal hosts it) while questioning the labs' growth. Character.AI shows what happens when costs rise with every hour of use.
15 · RetailAll users

Shopify opens a billion listings to any AI agent. Payments companies race to own the checkout. #

On Tuesday, October 13, Shopify said shoppers can let any AI agent browse and buy from its catalog of over a billion listings, not just partners. You connect the agent to your Shop account; checkout happens in the conversation with Shop Pay; you can set a budget cap or shipping rules; and you approve every purchase.

How an AI agent buys from Shopify's catalog Shopper connects any AI agent to a Shop account and sets guardrails such as a budget cap; the agent searches over a billion listings; checkout runs in the conversation with Shop Pay; the shopper approves every purchase; the order appears in the Shop app. 1 · Connectany agent → Shopset budget cap 2 · Find1B+ listings, onand off Shopify 3 · CheckoutShop Pay, insidethe conversation 4 · You approveevery purchase,every time 5 · Trackorder lands inthe Shop app Diagram: The AI Enthusiast, from The Verge's report, October 13, 2026.
The human stays in the loop at step 4.
Why it mattersLast issue's research said only 8% of shoppers would let AI handle payment. Shopify's answer keeps a human approval on every order. For retailers, the question shifts from "should we allow agents?" to "will agents find our products?"
16 · Explainer · Model typesAll users · Developers

LLM, SLM, SSM: one letter apart, very different ideas. A small language model is about size. A state space model is about how it reads. #

This issue is full of small models: Taalas etched Llama 3.1 8B into a chip (story 03), and Anthropic's self-replication study ran a 9B model on smart-TV boxes (story 05). Two acronyms keep coming up around models like these, and they're easy to mix up. An SLM (small language model) is an ordinary chatbot model shrunk to run on a laptop or phone. An SSM (state space model) is a different design: instead of rereading everything you've said, it carries a fixed-size running summary. They can overlap: some of 2026's best small models are SSM hybrids.

At a glance · three terms
LLM
Large language model. Almost always a transformer, with tens of billions to over a trillion parameters, run in data centers. Claude Opus 5.5, GPT-6 Astra, Gemini 4 Argon, Muse Spark Open (816B).
SLM
Small language model. The same transformer design, usually under about 15B parameters, small enough for a phone, laptop or single GPU. Gemma 4 E2B/E4B, Phi-4-mini, Llama 3.1 8B.
SSM
State space model. A different architecture, in any size. It reads text in one pass and updates a fixed-size "state" as it goes. Mamba, and hybrids like IBM Granite 4.0 and NVIDIA Nemotron 3 Nano.

Size versus architecture

A transformer's core trick is attention: every new word it writes is compared with every earlier word in the conversation, which the model keeps in memory (the "KV cache"). That's why transformers are so good at pulling one exact detail from page 40, and also why long chats get expensive: memory grows with every token, and the work grows roughly with the square of the context length.

An SLM doesn't change any of that; it just has fewer, smaller layers, so it is cheaper, faster and private enough to run offline. The cost is less knowledge and weaker reasoning on hard problems. An SSM changes the mechanism. Each new token updates a compact state and moves on, so the work grows linearly and memory per conversation stays flat, however long the input. The cost: a fixed-size summary has to forget something, and pure SSMs are worse at exact recall ("what was the phone number on page 40?"). So the SSMs that shipped in production are hybrids: mostly Mamba layers, plus a few attention layers for precise lookup.

LLM, SLM and SSM compared: size, where they run, and how memory grows as a conversation gets longer Three panels. LLM: a transformer with 100 billion to over a trillion parameters, run in data centers; its memory grows with every token of the conversation, shown as six rising bars. SLM: a transformer with roughly 1 to 15 billion parameters, run on a laptop, phone or single GPU; memory still grows with every token, but less, shown as six shorter rising bars. SSM: mostly state space layers such as Mamba, with a few attention layers in hybrids, in any size; memory stays about flat as the conversation grows, shown as six equal bars. Illustrative, not to scale. MEMORY AS THE CONVERSATION GROWS · ILLUSTRATIVE LLM Transformer · 100B to 1T+ params Runs in data centers Grows with every token SLM Same transformer · ~1B to 15B params Laptop, phone or single GPU Still grows, just less SSM Mamba layers (+ a few attention) Any size · built for long inputs Fixed-size state: stays flat Not to scale. Hybrids such as Granite 4.0 and Nemotron 3 keep a few attention layers, so their memory grows slowly rather than staying perfectly flat.
How the three approaches use memory as a chat gets longer. Chart: The AI Enthusiast.
LLM, SLM and SSM side by side
LLMSLMSSM (and hybrids)
What changesNothing: the baselineSizeArchitecture
Typical sizeTens of billions to 1T+~0.5B–15BAny; most shipped so far are 1B–50B
Runs onData-center GPUsPhones, laptops, one GPU, even a chip (story 03)Cheaper GPUs; less memory for long inputs
Best atHard reasoning, broad knowledge, coding agentsPrivate, offline, fast, cheap, narrow tasksVery long documents, logs, transcripts, high throughput
Weak spotCost, latency, data leaves your deviceLess knowledge; more mistakes on hard problemsExact recall from far back (why hybrids add attention)

Small language models you can run today

State space models in production

Why it mattersPick by the job, not the hype. For the hardest reasoning, use a frontier LLM in the cloud. For private, offline, fast or nearly free, use an SLM on your own device. For a 500-page contract, a week of logs or hours of transcripts, an SSM hybrid can read it all without running out of memory. More and more apps quietly route between all three.
Try this

Run one of each on your laptop this weekend.

Install LM Studio or Ollama, then download Gemma 4 E4B (an SLM) and IBM Granite 4.0 H-Tiny (a small SSM hybrid). Give both the same long document, ask a question about something near the end, and watch memory use in Activity Monitor or Task Manager. Then ask Claude the same question and compare the answers.

Try this: "Here is a long document. Quote the sentence near the end that mentions the deadline, then tell me how sure you are."
17 · Cincinnati & OhioAll users

Cincinnati and Ohio AI. Kroger ties corporate jobs to AI, and what's on next. #

Kroger will cut 3,000 corporate jobs over three years as it leans into AI

Cincinnati-based Kroger told employees it will lay off 3,000 corporate employees over the next three years as it ramps up AI. CEO Greg Foran, the former head of Walmart US, wrote: "Technology is reshaping what's possible… We need to adopt capabilities, reduce duplicative work and look closely at where work is best fit to be done." Kroger has 409,000 employees and 2,700+ stores; shares fell 2.2% on Tuesday. It is the region's largest employer publicly tying corporate headcount to AI; expect other retailers' cost plans to be framed the same way.

Miami University leans in, carefully

Axios Cincinnati () profiled Miami University's approach: a new Miami Center for AI, approved in September, and the "AI in the Majors" plan to bring AI into every department's curriculum by 2027–28.

Upcoming events

Upcoming AI events in Cincinnati and Ohio
WhenEventWhere · how to join
Mon, Oct 19Cincinnati AI Builders ForumOnline (Microsoft Teams) · cincycatalyst.ai
Thu, Oct 22 · 8:30 AM–12 PMAI Workshop Series 4/4: Operations (Goering Center), hands-on with Red Hawk Technologies' Matt Strippelhoff and Ron Dunlevy and their "AI Opportunity Matrix." Bring your team.1819 Innovation Hub, 2900 Reading Rd · Eventbrite
Wed, Oct 28 · 9–11 AMCincinnati Claude Code Workshop, a Claude Community Event hosted by CincyAI co-host Kendra Ramirez. Bring a laptop and a Claude account. Free; registration needs host approval.1819 Innovation Hub, 2900 Reading Rd, Room 230 · Luma
Tue, Nov 3 · 3–5 PMCincyAI for Humans monthly meetupUC Digital Futures, Room 140 · Eventbrite
Wed, Nov 4 · 8:30–10 AMOhioX State of AI: Cincinnati, a coffee-hour interview with Brian Cobb (Chief Innovation Officer, CVG Airport) and Beth Flippo (CEO, Dexa)Digital Futures, 3080 Exploration Ave · Eventbrite
Wed, Nov 18 · 9:45 AM–6 PMOhio AI Summit (3rd annual, OhioX), "AI in Action"ohioaisummit.org (location TBC)
Thu, Nov 19 · 6–8 PMAI & Ethics: From the Classroom to the BoardroomKennedy Auditorium, Xavier University · RSVP by Nov 17
Tue, Dec 1CincyAI for Humans, the last meetup of 2026UC Digital Futures
Nine smiling people standing under a purple CincyAI Champions pennant on a bright green background; Irv Cassio is at the far right
CincyAI Champions. Irv is at far right. Image: CincyAI.
From the editor · CincyAI

I'm a CincyAI Champion. Come join us.

CincyAI for Humans, founded in October 2023, is Ohio's largest AI community, and its monthly meetups at UC Digital Futures stay free. Champions is the paid members' portal that keeps the conversation going between meetups:

  • Human Huddle interest groups and Champion Matchups with peers
  • Monthly office hours with co-hosts Kendra Ramirez and Helen Todd
  • A member directory, a Cincinnati-area AI job board and the events calendar

It starts with a 30-day free trial, and the annual plan is $50 off. Become a CincyAI Champion · cincyai.org

18 · TipsAll users · Developers

Twelve tips we haven't run before. Each one uses something shipped or documented this week. #

Every tip was checked against past issues of The AI Enthusiast; none has run here before. Tips 1 to 4 are for everyone, 5 to 10 for Claude Code, and 11 and 12 for anyone building agents. The REA and Jev tips are in stories 01 and 04.

Tip 1 · Gemini · Oct 13

Gemini Pro subscribers: you have Argon now.

Gemini 4 Argon is in the Gemini app and AI Mode for AI Pro and Ultra subscribers. Give it the long, messy document you'd normally split up.

Try this: "Here's our 60-page vendor contract. List every date, dollar amount and auto-renewal clause in a table, with the page number for each."
Tip 2 · Claude in Slack · Oct 14

In Slack, send Claude a voice clip.

Claude in Slack now reads Slack's transcript of a voice clip when one exists, so you can talk a request through on your phone instead of typing it.

Tip 3 · Shopping agents · Oct 13

Set the guardrails before your agent shops.

When you connect an agent to your Shop account, set a budget cap and shipping rules before the first order. Every purchase still needs your approval, so read the cart before you tap.

Tip 4 · Claude admins · Oct 15

Docs, Slides and Design just switched on for your org. Motion didn't.

Catch-up from October 8, which Issue 27 missed: Claude Docs, Slides and Design left beta on every plan, including Free, and turn on by default for organizations on October 15. The new Dashboards (beta, paid plans) and Motion (beta, Team and Enterprise; code-based animations exported to MP4, with no generated footage) stay off until an admin enables them in Organization settings › Artifacts. The standalone claude.ai/design site closes December 14.

Try this in Motion: "/motion Animate a 30-second explainer of how a purchase order moves from request to approval to payment, one step per scene."
Claude builds a bike share dashboard from a year of ride data, with trip totals and charts of rides per day and by hour
Claude Dashboards turns a data source into a live dashboard; click any number to see its query. Image: Anthropic, October 8.
Tip 5 · Claude Code 2.1.299

Leave a big session idle without paying to wake it up.

A conversation over 200K tokens that sits idle about 54 minutes is now compacted before its one-hour prompt cache expires. Tune the threshold with CLAUDE_CODE_IDLE_COMPACT_MIN_TOKENS, or set "idleCompaction": false in settings.json to keep full history.

Tip 6 · Claude Code 2.1.299

Run /usage and read the new warnings.

/usage now flags the habits that quietly burn your allowance: max effort, workflows, always-on context and large tool results. Check it weekly and fix the biggest one.

Tip 7 · Claude Code 2.1.296

Let subagents compact earlier than the main thread.

Add autoCompactWindow to a subagent's frontmatter (or --agents definition) so a long-running scout compacts on its own schedule.

Tip 8 · Claude Code 2.1.296

Put every workflow agent on one cheaper model.

Set CLAUDE_CODE_WORKFLOW_SUBAGENT_MODEL to run all workflow agents on one model, such as a Haiku for fan-out steps, while your other subagents keep theirs.

Tip 9 · Claude Code 2.1.299

Skills gone after compaction? Run /reload-skills.

It re-sends the full skill list to Claude, the documented way to get skills back after compaction. (2.1.301 also fixed skills going missing after /rewind.)

Tip 10 · Claude Code 2.1.299

Huge files? Send paths, not contents.

With CLAUDE_CODE_DISABLE_FILE_MENTIONS set, an @ mention gives Claude the file's path to read with its own tools instead of pasting the whole file into context.

Tip 11 · Claude API · Oct 12

Check whether your code edits Claude's earlier turns.

On Fable 5.1 and Opus 5.5, API accounts created on or after August 31, 2026 can't edit Claude's prior context ("preserved thinking"). If your app rewrites or prefills past assistant messages, test it on a new account before you migrate keys. Blocked requests are billed (story 06).

Tip 12 · Agents · Oct 9

Tell your agent where the fence is, in words.

Anthropic's own agents got around fetch limits and fee gates when a task looked impossible. Put the scope in the prompt, not just the permissions: what it may touch, what network it may reach, and what to do when it's stuck.

Try this: "Only read files under ./reports and only call api.internal.example. If you can't finish within those limits, stop and tell me why. Don't look for workarounds."
Bonus · Admins

Turn on Code Review where it pays.

Use Quick for routine repos and Deep for the ones that page you at night (story 09), and claim the Enterprise credits before January 15, 2027.

FAQ

What is REA (Reverse Engineer Anything)?

REA (rea.tools) is a free, MIT-licensed MCP server, command-line tool and agent skill that gives coding agents such as Claude Code, Codex and Cursor reverse-engineering tools. It wraps Ghidra, Hopper or IDA for native binaries, static analysis for JavaScript and Electron apps, the Chrome DevTools protocol for live web pages and JADX for Android apps. One command, npx rea-agents@latest setup, connects it. Version 6.5.0 shipped on October 14, 2026, and its npm downloads reached 103,109 on October 12.

Is it legal to reverse-engineer software with AI?

It depends on where you are and what you agreed to. In the US, courts have treated disassembly for compatibility as fair use (Sega v. Accolade, 1992), and DMCA section 1201(f) allows circumvention for interoperability, but license or terms-of-service clauses banning reverse engineering are generally enforceable (Bowers v. Baystate, 2003). In the EU, Software Directive 2009/24/EC lets licensees observe and test programs and decompile for interoperability, and contract terms that forbid this are void. This is not legal advice; check the license first.

What is ChatJimmy and how fast is it?

ChatJimmy (chatjimmy.ai) is Taalas's public chatbot demo of its HC1 chip, which has Meta's Llama 3.1 8B model hard-wired into the silicon. Taalas reports about 17,000 tokens per second per user. In The AI Enthusiast's test on October 15, 2026, ChatJimmy displayed about 14,300 tokens per second and each full answer appeared about 0.1 seconds after pressing Enter. AMD announced an agreement to acquire Taalas on August 6, 2026; the price was not disclosed.

What is Jev from TypeSafe AI, and how much does it cost?

Jev is a "System One" model from TypeSafe AI that returns typed decisions with calibrated probabilities instead of text: yes/no, pick-one, score and, in version 1.14, bounding boxes. It costs $0.042 per million input tokens with free output and answers in about 70 to 500 milliseconds, according to TypeSafe. Jev 1.14.0 shipped as jev-preview on October 14, 2026, with opt-in "Danger Zone" features for images and 262k-token context.

What is agent observability on the Claude Platform?

Since October 14, 2026, Claude Managed Agents, the Messages API and the Claude SDKs can export OpenTelemetry traces in public beta. Each agent turn, model call and tool use arrives in an OTLP-compatible tool such as Datadog, Grafana Cloud, Splunk, Honeycomb or Langfuse, with latency, token counts and IDs. The default mode exports metadata only; Full content adds prompts and responses.

Can AI models copy themselves onto smart devices?

Not yet in the wild, but Anthropic's Frontier Red Team reported on October 12, 2026 that small open models may be months away from self-replicating on IoT devices such as Android TV boxes. In tests a 9B model got inference running on 8 of 9 hardware types, and GLM-5.2 replicated to 8 of 8 nodes in 4 of 5 simplified trials. Recommended defenses are ISP flow monitoring, quarantine and notification, and eliminating default passwords and open debug ports.

How much does Gemini 4 Argon cost?

Gemini 4 Argon, generally available from October 13, 2026, has an introductory API price of $2 per million input tokens and $10 per million output tokens, with cached input 95% off. Consumers get it in the Gemini app and AI Mode with a Google AI Pro or Ultra subscription.

What is the difference between an LLM, an SLM and an SSM?

An LLM (large language model) is usually a transformer with tens of billions to over a trillion parameters, run in data centers, such as Claude Opus 5.5 or Gemini 4 Argon. An SLM (small language model) uses the same transformer design at roughly 0.5 to 15 billion parameters so it can run on a phone or laptop, such as Gemma 4 E4B, Phi-4-mini or Llama 3.1 8B. An SSM (state space model), such as Mamba, is a different architecture that keeps a fixed-size running state instead of attending to every earlier token, so memory stays flat on long inputs; production SSMs like IBM Granite 4.0 and NVIDIA Nemotron 3 Nano are hybrids with a few attention layers.

When is the next AI event in Cincinnati?

After October 16, 2026: the Cincinnati AI Builders Forum online on October 19; the Goering Center's AI Workshop on operations at the 1819 Innovation Hub on October 22; a free Claude Code Workshop at the 1819 Innovation Hub, Room 230, on October 28, 9 to 11 AM; the CincyAI for Humans meetup at UC Digital Futures on November 3, 3 to 5 PM; and OhioX's State of AI: Cincinnati at Digital Futures on November 4, 8:30 to 10 AM.

Quick stats

Every figure is sourced in its story. Vendor benchmarks and company figures are self-reported.

MetricValue
REA GitHub stars (Oct 15)273,428
REA npm downloads, Oct 6–12231,579
REA latest release6.5.0 · Oct 14
Postman rules recovered with REA33
Taalas HC1, claimed16,960 tok/s/user
ChatJimmy, our test~14,300 tok/s · ~0.1 s per answer
AMD–Taalas priceNot disclosed (Aug 6)
Jev price$0.042 / M input · output free
TypeSafe Series A$870M at $7.5B
Claude OTel tracesPublic beta, Oct 14
Distillation harvest cut90–99%
Mirai cleared with ISP quarantine92% in 14 days
Claude Code releases, Oct 9–154 (2.1.296–2.1.301)
Code Review time per PR~6–10 min (was ~20)
Gemini 4 Argon intro price$2 / $10 per M
Muse Spark Open816B total · 42B active
Muse Wonder Full, AA Index56 (Opus 5.5: 58)
METR staff with "employee-like access"6
Secret AI framework text dueOct 30, 2026
Grok Voice 3.0, AA Speech-to-Speech86.9 (#1)
Ramp valuation$60B ($44B in June)
Shopify listings open to any agent1B+
Kroger corporate job cuts3,000 over 3 years

Read next

Next issueAI Weekly No. 29 — The Security Edition: Claude Duet asks before it pays, PHP2Shell, the OpenCode key breach and why local AI isn't automatically safe Previous issueAI Weekly No. 27 — Claude Code Mods: rewrite your coding agent from the inside, plus Haiku 5.5 and GPT-6's Intelligent UI RelatedAI Weekly No. 23 — Claude Code tips that actually matter: hooks, skills and subagents, the building blocks behind this week's build ArchiveEvery issue of The AI Enthusiast