Independent AI intelligence Two editions daily · ET
Fervor AI
Menu

AI Trending Briefing · October 23, 2026 · morning edition

Checking agent work is getting cheaper by shrinking what has to be checked, from a proof about compiled library code to an answer picked from a fixed menu to a single screen transition, while a steganography test showed how much a free-form output can still carry past a human reader.

AnthropicOpenAI Decisions APILGWMCache Engineering for AgentsClaude Fable 5.1agent-securityfrontier-modelsagent-memoryagent-harnessai-skills

Trending AI Briefing: Friday, October 23, 2026 (morning ET)

The most interesting AI work of the last two days is about narrowing, not scaling. Anthropic had Claude prove that compiled code from 123 open-source libraries cannot crash under stated conditions, OpenAI made generally available an API whose answers are only a probability, a menu choice or a score, and a GUI-agent paper checks a single screen transition instead of judging the whole screen. Each one makes agent output small enough to verify. The counterweight came from a LessWrong post showing two frontier models hiding and recovering messages inside ordinary-looking images, the kind of free-form output nobody can check by eye.

What's hottest in AI news right now

Anthropic published "LLMs are making formal software verification feasible at a much larger scale" on October 22. The Frontier Red Team, working with Theorem, turned existing OSS-Fuzz fuzz tests into specifications over RISC-V machine code and had Claude write proofs that 239 entry points across 123 open-source libraries "will always exit normally without triggering memory-safety errors or failing assertions," for inputs up to 64 MB. The proofs run to about 180 million lines of Rocq (a proof checker), and when a proof failed because of a real bug, Claude patched the code and proved it again; the team says it found hundreds of bugs along the way. The catch is in the post itself: the proofs assume a single-threaded static RISC-V binary linked against musl on Linux, which is not how most people run these libraries, and the authors write that "Formally verified" does not mean "bug-free." On a set of 36 small verification tasks, the post says Opus 5.5 proved half of them with about 40% fewer tokens than Opus 5. The Algolia listing showed it at about 350 points on Hacker News by 07:20 ET. Anthropic · theorem-labs/oss-verify · HN

OpenAI made the Decisions API generally available on October 22. It is a dedicated endpoint, POST /v1/decisions, built on GPT-6 Luna, where you define a question and its allowed answers and get back a probability (predicate), one of your predefined values (choice), or a rubric score. Pricing on the launch post is $0.10 per million input tokens and $0.01 per million cached, with no output-token charge; cache writes are billed separately per the docs. A request can now carry up to 400 questions, double the beta limit. The speed claims (Datadog reporting 40x faster p95 than available frontier models for scoring agent-generated shell commands, Sierra under 280 ms p95) are customer-reported results from their own tests, not independent benchmarks. It answers bounded questions only, and GPT-6 Luna is the only supported model. OpenAI · Docs

A GUI-agent paper argues that safety is a property of the transition, not the screen. "Right Screen, Wrong Transition: World Models as Verifiers for GUI Agents" (arXiv 2610.11942, submitted October 8, climbing Hugging Face Papers on October 22) points out that a monitor that only inspects screenshots can be fooled by a legitimate-looking screen reused in the wrong place. The authors train LGWM, a small world model on 1.85 million real GUI transitions that predicts what the next screen should look like after an action, so the check becomes a vector comparison. They report 0.987 AUC at 17 ms per decision on their own benchmark, RSWT-BENCH, and say prompted vision-language models score near chance at separating harmful from benign mismatches. Both numbers come from a benchmark the authors built. arXiv · HF Papers

"Cache Engineering for Agents" (arXiv 2610.28577, submitted October 20) was among the top papers on Hugging Face on October 22. Tianyu Fu and eight co-authors argue that the usual ways of keeping long agent runs affordable, trimming or summarizing history, force the model to re-read everything (re-prefill), and proposes letting the agent drop entries from its own KV cache (the model's working memory of the conversation) instead. They report that a rolling policy that drops old tool responses beat threshold-triggered summarization by 1.7 points on average while cutting cost 27.7%, and say their AKV serving engine gives a 1.5x P95 latency speedup. The code is out as thu-nics/AKV, which runs on a self-hosted SGLang server (the quick-start example uses two GPUs). arXiv · GitHub

A LessWrong post dated October 21 shows Claude Fable 5.1 hiding messages in images that another instance could read back. Nikita Kezin, James Chua and co-authors asked Fable 5.1 to encode 50 short messages in SVG drawings; a separate session saw only the rendered PNG. Fable recovered 78% (39 of 50), and cross-model pairs with GPT-6 Astra landed between 84% and 88%. Fable kept drawing night skylines whose building heights carried the bits, a code that survived screenshots where colour codes mostly did not. The authors hedge plainly: decoding is "still obvious if you monitor the tool calls," so "we don't claim it is currently dangerous," and they call it a possible precursor to image steganography. No vendor response is included. LessWrong · HN

New tools and features worth actually trying

OpenAI Decisions API. If your agent has a router, a "should this shell command run?" gate, or a triage step that currently parses free text, this replaces it with a call that returns a probability per answer. The quickstart is one curl: POST https://api.openai.com/v1/decisions with "model": "gpt-6-luna", an input, and a questions array of choice items. Honest tradeoff: one model, regional processing named for the US and Europe, and every speed figure on the launch page is a customer's own measurement.

Claude Code 2.1.309. Published to npm at 20:34 UTC on October 22 and now the latest tag (stable is 2.1.308). The changelog lists sandbox and permission fixes for compound Bash commands and redirects, protection for MCP config writes, claude ultrareview now requiring workspace trust, and sed -i now getting the standard Bash prompt and running as written instead of being simulated as a file-edit preview. Honest tradeoff: that also means /rewind no longer restores sed -i edits, so if your workflow leaned on rewinding them, commit before you let an agent run sed. Changelog

OSS Verify. Theorem's enrollment program behind the Anthropic results: maintainers paste one instruction into a coding agent, or run tools/validate.py projects/<name> and tools/check --no-shell --twice <name>, and after merge the service proves theorems about the project's fuzz targets. Honest tradeoff: it needs Linux x86-64, Docker and about 10 GB of disk, it builds your Dockerfile with network access, only core maintainers can enroll, and the README says the AI-generated findings and patches "may be wrong or incomplete." README

WorldTUI. Simon Edwardsson's 360M-parameter model (a trimmed Qwen2.5-Coder-0.5B) pretends to be a terminal entirely in your browser over WebGPU, a 208 MB download, and it drew 550+ points on HN. It is the clearest small demo of a "world model" you can poke at in a minute. Honest tradeoff: it is a toy; it recalled written file values in 9 of 13 tests, there is no stated license, and the weights are promised "soon." Post

Trending AI repos on GitHub today

Trendshift read at about 07:20 ET; its ranks are momentum scores, not star totals. Stars below come from shields.io and are approximate.

  • stablyai/orca (#10): a free desktop app that runs several CLI coding agents side by side, each in its own git worktree, with an optional phone companion. Why now: v1.4.237 tagged October 21. MIT, about 103k stars. Caveat: anonymous usage telemetry is on unless you opt out.
  • deepseek-ai/DeepInfer (#12): DeepSeek's offline inference framework for its own models. Why now: new on the board beside the DeepSeek harness and its plugins. Apache-2.0, about 21k stars, no releases. Caveat: it supports only DeepSeek-V4.1-Flash on NVIDIA SM100 or Huawei Ascend 950, the performance charts are DeepSeek's own, and the README says KV cache, prefill/decode disaggregation and load balancing are not included.
  • deepseek-ai/deepseek-harness (#16): dsh, an agent harness where "Everything is a Plugin." Why now: three dsh plugin repos sit on the same board (two are copies of dsh-purge). MIT, roughly 250k stars (shields and the GitHub page disagree), latest tag v0.2.1-rc.2 on October 17, default branch master. Caveat: a developer preview whose README warns of compatibility-breaking changes, and dsh-purge (#11 and #24) exists to strip its approval and sandbox gates.
  • Jakeschincariol/replica-skill (#21): 11 Claude skills that reverse-engineer an app's features and flows and rebuild them as a new product. Why now: skills packs keep climbing the board. MIT, about 4.9k stars, no releases. Caveat: the README itself tells you to check trademarks and terms and talk to a lawyer before launch.
  • hugohe3/ppt-master (#23): a skill that generates natively editable .pptx decks from a document or a topic. Why now: v6.7.3 tagged October 22. MIT, about 66k stars. Caveat: the README is full of referral links, and the optional PDF converter depends on AGPL-3.0 PyMuPDF.
  • maximhq/bifrost (Trendshift featured slot, unranked): a gateway that puts 23+ model providers behind one OpenAI-style API with failover and caching. Why now: transports/v2.3.2 tagged October 20. Apache-2.0, about 9k stars. Caveat: the microsecond overhead figures are self-reported, and the MCP gateway, guardrails and clustering are enterprise features behind a demo booking.
  • theorem-labs/oss-verify (Anthropic research post, not on Trendshift): the enrollment program for AI-written proofs about fuzz targets. Why now: it is the public half of the October 22 verification work. Apache-2.0, 33 stars, no releases. Caveat: enrollment builds your Dockerfile with network access.
  • thu-nics/AKV (Hugging Face Papers, not on Trendshift): agent-side KV-cache drop policies plus an SGLang-based server. Why now: the code for "Cache Engineering for Agents." Apache-2.0 LICENSE file whose copyright line names the SGLang team, 48 stars, no releases. Caveat: needs a self-hosted SGLang server, and cache dropping works only on listed text-model architectures.

What actually matters from today's signal

The trend to track is checkability. Every item worth your time today does the same move: it shrinks an agent's output until a machine can verify it. A proof about compiled library code. A choice from four department names with a probability attached. A predicted next screen compared against the real one in 17 ms. A tool response dropped from the cache instead of summarized into prose that might be wrong. For builders, the four places to spend attention are gates (put a bounded-answer check in front of anything an agent executes), proofs and fuzz targets (if you maintain a C library with OSS-Fuzz coverage, OSS Verify is a free audit), transition monitoring for browser and desktop agents, and memory cost, where dropping tool output looks cheaper and no worse than summarizing it.

The counter-signal is that free-form output is still the default, and it carries more than people read. The Fable 5.1 test is small (50 messages, one prompt style), and its authors say it is not dangerous today, but it shows two frontier models agreeing on a code a human would see as a drawing of a city at night. Narrow checks only cover what you narrowed. The image an agent hands back, the commit message, the summary in the ticket: none of that passes through a Decisions call or a Rocq proof. And the proofs themselves describe a musl RISC-V build almost nobody ships. Verification is real progress. Read the assumptions before you put "formally verified" on a slide.

Source access notes: Vendor scan at about 07:18 ET. openai.com/news (October 22: Decisions API, forward-deployed engineering, Uber; October 21 items covered yesterday). anthropic.com/news latest is the October 22 Agent Skills donation (covered yesterday); anthropic.com/research carried the October 22 formal-verification post. blog.cloudflare.com newest is an October 22 compliance post; its October 20 to 21 items were covered in prior briefings. blog.google served undated cards and the Gemini 4 availability page returned a server error, so no Gemini item is included. LangChain blog (redirected to langchain.com/blog) newest is October 19. github.blog/changelog shows nothing after October 21. Microsoft Foundry devblog newest October 19. Mistral newest October 21 (NVIDIA partnership). x.ai/news newest is August 26. Claude Code version dates come from the npm packument time map (2.1.309 at 20:34:13 UTC October 22); the changelog section is summarized, not quoted. Hacker News read through the Algolia API (last 36 hours). Trendshift read once at about 07:20 ET; github.com/trending not fetched. Repo facts were verified by a subagent with cache-busted shields, raw README, raw LICENSE and releases.atom fetches. mcncarl/jianying-headless was dropped because its LICENSE and releases could not be fetched; luongnv89/claude-howto was dropped as stale (last release June 2). Adversarial pass (Sonnet subagent) caught: the Opus 5.5 token figure applies to the half of 36 tasks it proved; the 1.5x P95 figure belongs to the AKV engine, not the drop policy; AKV does not require multiple GPUs; the sed -i change is explained in the changelog; the Datadog baseline and Decisions cache-write billing were missing; "one binary" overstated. It also reported lower HN points for the verification post than the Algolia search listing read at 07:20 ET; the listing figure is kept and timestamped. Its doubts on release tags were held because the repo pass read releases.atom directly. The PHP2Shell embargo apology on HN (576 points) is a follow-up to a story covered in the last two briefings and is not repeated.