AI Tools Daily

GitHub's Project HydraFusion research preview lets Copilot CLI dynamically route each coding task through a single model, a cheap-first "cascade," or a draft-and-critique pair of models — landing within 1.5 points of top-tier quality at up to 67% lower cost on published benchmarks. Plus: Claude Code splits a release across gateway pricing pass-through for enterprises and a new `claude plugin eval` command for scoring plugins before you ship them, and GitHub Copilot code review starts resolving its own comments. Hosts: Alex & Jules. New episodes daily.

OpenAI's GPT-6 Astra becomes the first model to cross OpenAI's "Critical" cybersecurity capability threshold, while Google's new Gemini 3.8 Flash Cyber reportedly out-patches bigger models on real Chrome vulnerabilities — Alex breaks down fine-tuning and why smaller, specialized models can beat general-purpose giants at narrow tasks. Plus: GitHub Copilot's October 2nd model deprecation deadline and new content-exclusion protections for agentic workflows. Hosts: Alex & Jules. New episodes daily.

A newly disclosed class of bugs called GitSpawn lets a malicious .git/config silently run code through Claude Code, Cursor, Codex, goose, and other AI coding agents — before you've approved anything. We break down why agent "sandboxes" don't cover this, what to check today, plus Anthropic's new domain allowlisting for agent web tools and GPT-6 Astra becoming Codex's default model. Hosts: Alex & Jules. New episodes daily.

OpenAI ships GPT-6 Astra — the first model it designates as hitting the "Critical" cybersecurity threshold — while Google's Fairwind and Anthropic's Cyber Verification Program put every lab's cyber-capable model behind a different vetting gate. Plus Claude Code 2.1.260 lands a /diff panel, 1M-context auto-compact, two nasty permission-rule security fixes, and a Fable 5.1 caching bug that was quietly inflating agent bills. Alex explains what a preparedness framework actually is, and breaks down prompt caching — the biggest lever on your API bill that nobody looks at. Hosts: Alex & Jules. New episodes daily.

Anthropic launched Claude Fable 5.1 and Mythos 5.1 with a 1M context window, cache reads at a quarter of the old price, and three breaking changes — forced tool use now returns a 400, thinking blocks are bound to your conversation history, and every word carries a statistical watermark. Alex explains what `tool_choice` actually does, why always-on thinking makes forced tool calls a bad idea, and how statistical text watermarking works without hiding a single character. Plus IBM's Granite 4.2 reasoning models land under Apache 2.0 with a thinking switch. Hosts: Alex & Jules. New episodes daily.

Anthropic's Model Hardware Standard puts robot arms and lab instruments behind one standardized driver — we break down what a driver actually is and why standardizing an interface turns N-times-M integrations into N-plus-M. Then NIST's new paper on agent identity, why static API keys are house keys and short-lived scoped credentials are hotel keycards, McKinsey's finding that 32% of orgs have skipped buying software they could build with coding agents, plus quick hits on Claude Code 2.1.252 and Cursor's SCM-free cloud agents. Hosts: Alex & Jules. New episodes daily.

Alex and Jules break down back-to-back Claude Code security releases — including a symlink race-condition fix — and what it means that app-level permissions aren't the same as a real sandbox. Plus: OpenAI cuts Cursor's model access after the SpaceX acquisition (deadline November 12), and a hype-check on the mystery "Ox Alpha" model that overstated its coding benchmark by nearly 20 points. Hosts: Alex & Jules. New episodes daily.

Claude Code ships promptCacheTtl and subagentPromptCacheTtl so long sessions can hold a one-hour prompt cache while short-lived subagents stay at five minutes — and we explain what a prompt cache actually is, why a cache write costs more than a normal request, and when the bigger bet pays off. Plus Claude Code and Antigravity CLI independently narrow over-broad permission wildcards on the same day, Gemini CLI ships a release where most merged PRs were written by an agent working the backlog, and Antigravity adds voice dictation over SSH plus a fix for silent file corruption on non-ASCII code. Hosts: Alex & Jules. New episodes daily.

Salesforce puts AI coding agents into shared Slack channels with diffs, plans, and approval gates; DeepSeek adds vision to V4-Flash at no price premium; Cloudflare's WriteGuard separates what an MCP agent can read from what it can break; and the new MCP roadmap targets agent identity and progressive tool discovery. Along the way we explain how an image becomes tokens, and why a hundred connected tools costs you context before you've asked a single question. Hosts: Alex & Jules. New episodes daily.

Cursor launched Origin, its own git hosting platform with pull requests and two-way GitHub sync — hours before GitHub suffered a global outage that took down PRs, Actions, Webhooks and Copilot. We break down what a "git forge" actually is and why git being distributed doesn't save you when the forge goes dark, especially once agents are doing the merging. Plus Claude Code 2.1.234 auto-resumes sessions when your usage limit resets. Hosts: Alex & Jules. New episodes daily.