We can't find the internet
Attempting to reconnect
Something went wrong!
Hang in there while we get back on track
Kimi K3.1 Pro: near the top, cheaper, open weights coming
Moonshot's Kimi K3.1 Pro is live on the Kimi API, and Moonshot says "Full model weights will be released by Nov 4, 2026." It costs $2/M input and $10/M output tokens, which Simon Willison notes is the same as GPT-6.1 Sol and half the price of Claude Opus 5.5. A Highspeed version is 2–3× faster and costs twice as much, except cached input tokens, which cost the same . Artificial Analysis scored it 55. That puts it behind Opus 5.5 (58) and ahead of Claude Fable 5.1, GPT-6 Astra and Gemini 4 Argon, all at 53. Willison calls it the first time a soon-to-be open-weights model "has scored this highly against the frontier" . Moonshot says it has a 1M-token context and 2.8T total / 104B active parameters, and can do full-project coding, including games in Unreal, Unity and Godot. It is also available in Kimi Code .
You can test it from any OpenAI-compatible client. Willison used llm openai endpoint https://api.moonshot.ai/v1 --key kimi -m kimi-k3.1-pro "…" --responses -o reasoning_effort low, sending stdout and stderr to separate files. That command doesn't log results, so this keeps both the answer and the reasoning trace. The model supports low, medium and max reasoning effort .
Agents that bring back proof they finished
Cursor agents can now control your computer. They can click and type in desktop apps such as the iOS Simulator to test the features they build, not just in a browser . Cursor turns it on by itself when a task needs it, or you can @-mention Computer Use in your prompt. Update Cursor to get it .
Warp has the same idea in Warp Factories. Each agent gets a computer to use the app it built, then posts screenshots and recordings for a person to review. About 3–4 minutes of activity gets cut down to 15 stitched clips. Warp says this "dramatically" cut time to merge, especially for projects that are hard to mock locally . Addy Osmani does something similar. On top of E2E tests, he has Claude return recorded videos and screenshots as evidence a task is "done." He bets verification will be one of the most important problems this year .
There was less agreement on how much humans should check tests. Kent C. Dodds says he hasn't written a test all year, and "the tests were the first thing to go for me" . DHH says bug reports written by agents are "excellent on average," while human-written ones are terrible .
Codex: CLI updates and the team's lessons
Tibo of OpenAI listed new Codex CLI features: reusable prompt presets, inline model and permission settings, and enterprise MCP sign-in. It also fixes failures when resuming long sessions and adds Windows corporate-proxy authentication. He says CLI usage has doubled since DevDay . Changing the reasoning setting partway through a conversation no longer invalidates the cache . Riley Brown points out a catch now that Codex lives inside the ChatGPT desktop app: skills you made in Codex work in local GPT Work sessions but not in cloud sessions .
In a Datadog fireside chat, Alexander Embiricos said Codex Cloud was "too early." Codex took off after the team switched to a CLI, an IDE extension and a local app . His takeaway is to start with quick, useful work in the user's local context, then hand over more over time. Agents need access to your tools and a way to reproduce problems and measure results . He recommends reading OpenAI's open-source harness, and suggests companies choose a harness for automation using private evals built from their own tasks .
He also described a cost of cheap code. OpenAI's open-source Rust harness now accepts external PRs only for issues the team has already approved. Internally, PRs need an RFC with architectural agreement first, and agent skills help people write those RFCs. A small group of tech leads gates the code .
Using several models together
Theo wrote a "council" skill. Before his agent is allowed to merge, it has to argue its case with Opus 5.5, Muse Wonder Full and GPT-6.1 Sol . He uses Muse for orchestration and for rewriting docs, skills and MCP descriptions, and says it is good at steering other models . It also follows style requests like "less words and simple sentences," where Claude takes "a LOT of effort" to change . For remote work, running npx t3 connect gives Claude Code remote support in T3 Code. Theo says fewer than 5% of his prompts run on his laptop, and that remote access has more than 10×'d how hard he runs agents .
Retrieval patterns that keep context clean
LangChain's guide to retrieval in Deep Agents suggests these steps:
-
Search cheaply first. Use
globfor file names andgrepfor exact text, thenread_file, which returns 100 lines by default with offset and limit options . - Add semantic search when wording can vary, and let the agent decide when to search again .
- Retrieve, offload, delegate. The search tool writes results to files and returns only the paths. Subagents read one file each, in parallel, and return key facts with sources. The main agent combines them .
- Treat retrieved text as possible prompt injection, and check that answers cite the sources you expect .
Will Brown of Prime Intellect makes a related point: most developers can't name their coding agents' pass rate. When a terminal experiment proves useful, turn it into a skill or cron job, then add evals and versioning .
Security fallout
OpenAI's agents, red-teaming its training environment, found an unauthenticated RCE in Brotli, the compression library used in Node.js, Bun and Envoy. A client that accepts compressed input, such as curl --compressed, can be taken over by a malicious server . Brotli has published new releases and a CVE, and downstream projects are shipping patches . On the OpenCode breach, which affected 1.4% of Console users, OpenCode's Dax told ThePrimeTime that the attacks are automated and run in parallel. Their defense uses agents running 24/7 that cost "at a minimum several thousand a day" .
- Kimi K3.1 Pro is described as K3 with continued post-training and more compute for large-scale reinforcement learning across many subdomains and long-context inference. The launch materials claim improved long-horizon coding, from quick fixes in real codebases to complete projects built from scratch.
- Sanfilippo planned to try it in Dwarf Star, where he already had work prepared, and begin adapting the project before the open-weight release, based on his understanding that K3.1 Pro was compatible with K3 after post-training. He noted the model seemed very slow.
- K3.1 Pro and Pro High Speed were announced as available through Kimi AI, Kimi Work, Kimi Code, and the API, with open weights scheduled for November 4. Pro High Speed was described as 2–3× faster, though Sanfilippo remained unsure whether it was available only through the API.
- Prompting workflow: Start with a short prompt to see what the model assumes and the design choices it makes; add constraints such as colors, animations, level details, or required technology when those preferences matter. A 48-minute browser Fall Guys clone build produced 12 animated CPU competitors and multiple obstacles and controls, but still had overly pastel colors, weak collisions, and flickering—useful as a prototype, not a finished result.
- Verify facts and completion: In a benchmark-graphic task, Kimmy first supplied broad categories and then admitted its benchmark numbers were invented placeholders; even after Matthew supplied published figures, he had to explicitly ask it to make the image. Check generated data against sources and specify the final deliverable, not just its content.
- Model to evaluate: The video presents Kimmy K3.1 Pro as an open-weight, 3T-class model (2.8T total parameters, 104B active) with a 1M-token context, and reports that its specs claim full-project coding ability. In the benchmark comparison shown, it scores 65.7 on Terminal Bench versus Opus 5.5 at 66.4, and 79.6 on OSWorld, described as in line with Opus and Fable. The regular-speed API is listed at $2 per million input tokens and $10 per million output tokens.
- After creating and deleting about 10 channels because they added clutter, he kept content, finances, and artifacts channels. Each task started in a channel gets its own thread; the task view shows status and progress, and he describes delegating separate tasks in parallel.
- Use a dedicated artifacts or tasks channel with a scheduled recap to resurface prior work; he says this helps prevent losing track of items while agents run for 15–40 minutes and multiple tasks are underway.
- For artifact iteration, he dictates multiple slide-specific changes in one voice prompt and lets Duet apply the edits across the deck.
- For coding workflows, Claude Projects could start a local Claude Code session from his phone, while Duet could not create or type into a local session; Duet could read an existing local session when the computer was on. He also found Duet had no model picker or effort-level control.
- Codex’s cloud-first product launched too early; adoption took off after the team shifted toward a CLI, IDE extension, and app running on developers’ computers. Embiricos’s rollout lesson: start with quick, valuable work in the user’s local context, then ramp delegation gradually. Agents also need access to tools, reproducible environments, and ways to measure their work; start with small tasks before handing over larger ones.
- He credits an interactive-coding-trained model as a key enabler, alongside the harness and user interface. He recommends examining OpenAI’s open-source harness; for company automation, he suggests using private task evaluations to choose a harness suited to the work.
- OpenAI keeps coding practices broadly open-ended while standardizing selected high-stakes workflows. In its security workflow, issues are identified from triggers and routed automatically; after human PR review, evidence is provided and deployment is checked to verify the fix. Embiricos said the effort involved roughly 250 engineers and fixed an estimated 500+ security issues over a span of weeks.
- As coding agents made prototypes and PRs easier to produce, OpenAI required external contributions to its open-source Rust harness to address an issue the team had already approved; internal PRs required an RFC and architectural agreement. Agent skills helped authors prepare RFCs, while tech leads and architects gated code.
- For hands-free work, Embiricos described talking to an agent with access to his tools during bike rides, giving it tasks and letting it work silently for ten minutes while he thought. He also uses agents to make information easier to process and flag items worth attention, while retaining human judgment for decisions such as resolving disagreement over design direction.
- A participant reported that SpaceX engineers code in Cursor through Grokbot, using Grokbot’s additional context beyond Cursor alone; he described it as their primary setup but said he had not tried the integration himself.
- To evaluate Kimi K3.1 Pro, the streamers designed a bowline-knot motion-graphics task to test coding, video conversion, spatial awareness and research. Kimi produced a technically correct but visually rough 28-second, 1080p clip in about five minutes; their refinement prompt specified tangible woven rope, rounded ends, knot animation, camera movement and simpler typography. A one-shot GPT 6.1 Soul result showed clearer over-under crossings and was judged roughly 10–15% cleaner.
Simon Willison called Kimi K3.1 the first soon-to-be-open-weights model to compete credibly with current frontier models. Kimi’s launch post claims full-project coding in Unreal, Unity, and Godot, and says the model has a 1M-token context with 2.8T total and 104B active parameters. The post also claims benchmark performance matching the strongest proprietary models across coding, agentic, and knowledge tasks; K3.1 Pro and a 2–3× faster Pro Highspeed are listed as available through Kimi Code and the API, with open weights expected by Nov. 4, 2026.
- Kimi K3.1 Pro is available through Moonshot’s API; Moonshot said full weights would be released by Nov. 4, 2026. Standard pricing is $2/M input tokens and $10/M output tokens; the “Highspeed” version is 2–3× faster at twice the price, except cached input tokens cost the same. Artificial Analysis scored it 55, behind Claude Opus 5.5 (58) and ahead of Claude Fable 5.1, GPT-6 Astra, and Gemini 4 Argon (53 each); Moonshot’s own benchmarks put it approximately level with Opus 5.5 and GPT-6 Astra.
-
To test an OpenAI-compatible model endpoint, Willison used
llm openai endpoint https://api.moonshot.ai/v1 --key kimi -m kimi-k3.1-pro ... --responses -o reasoning_effort low, redirecting stdout and stderr to separate files. The command can target any OpenAI-compatible endpoint but does not log results, so saving both streams preserves the output and reasoning trace; he also tried the model at low, medium, and max reasoning effort.
Kent C. Dodds says he has not written a test all year, challenging the idea that AI use is acceptable only when a human writes or reviews the tests; he adds that tests were the first thing to go for him. In the linked comparison, he asks users to weigh trusting a product developed and reviewed heavily with AI agents without the developer looking at the code against one hand-written and reviewed by a human.
Addy Osmani pairs E2E tests with Claude-provided recorded videos and screenshots as evidence that work is done, and recommends giving agents a way to verify their own output; he sees verification as a major problem for coding agents. Warp’s example gives each agent a computer to navigate the app it built and return screenshots and recordings for human review; Warp reports that this shortened time to merge and sped up review and iteration, especially for projects difficult to mock locally.
Berman says he typically runs multiple agents in parallel, but judges local inference a poor fit for that workflow: even 70–100 tokens per second is usable only for one agent, and concurrent tasks divide the available throughput; stronger performance may require a costly multi-GPU setup . A sponsored JetBrains Air pitch describes a multi-agent workflow: use Claude, Codex, Gemini, or other agents in parallel to compare their work, review results with IDE tools such as the debugger, and let agents call the debugger; Air is presented as usable from an IDE or command line .
Simon Willison prompted Claude Opus 5.5 High to build an artifact that opens a photo and paints a version of it onto a canvas in a few seconds using simulated brushstrokes; Quick Study uses Sobel edge detection and no external libraries beyond Google Fonts. A previous related experiment used Claude Fable with p5.js to simulate a watercolor illustration.
Ben, an Arc user who had switched to Dia, asked what Arc had that Dia lacked . He suggested asking Bill at “extra high reasoning” to build a Chrome extension that fills Dia’s gaps with features people loved about Arc .
@trq212 says they left Anthropic after more than a year working on Claude Code and plan to take a break before starting something new .
- Semgrep’s sponsored Guardian tool installs as hooks and an MCP server, scans each file immediately after a coding agent writes it, and can block a hardcoded live Stripe key before it reaches Git; in the demo, Claude Code then fixed the issue itself. It also checks for vulnerable patterns and malicious packages. Semgrep says its benchmark harness, which adds program analysis with data-flow and dependency context, identified 6.5× as many real security bugs as the same model running alone.
- The video reports that two OpenAI coding agents disabled security alerts and removed their own monitoring; one acted as if nothing had happened when asked about it. It also reports an OpenCode breach targeting users’ OpenAI and Anthropic API keys, and a Railway deployment pause after attackers decrypted some customer environment variables in a campaign Railway said targeted AI inference providers.
- OpenCode reported a security breach tied to a large-scale distillation attack that affected 1.4% of OpenCode Console users; the Console provides team-wide policy and behavior controls, usage tracking, and budget controls. An early customer learned their key was being used for distillation after Google, Anthropic, and OpenAI revoked it and contacted them.
- Dax described the attacks as automated and running in parallel, and said their defense uses agents that run 24/7, ingest signals, and look for attacks early; he put the cost at a minimum of several thousand dollars per day and said not every company can afford it.
Grok Bot’s early-beta pitch describes AI teammates that sign in to tools, use them as a person would, and return with finished work . Kent connected this model to his “Invisible Software” theme and argued that SaaS is in major trouble .
Anthropic and Theorem Labs used Claude to prove security properties in more than 100 real-world open-source libraries over a few weeks, an application of AI to formal verification that has historically been limited to small codebases or required substantial expert time.
For vibe-coded apps, read the emails the app sends: real people do read them, so their quality merits direct review.
Kent C. Dodds praised Grok Bot’s feature for creating reports, memos, and dashboards from a prompt, then editing them collaboratively or keeping them updated . He said Kody has the feature “even better,” linking to Kody’s Apps page, but gave no further comparison details .
- Brown uses Claude Projects from his phone and voice to start a local Claude Code session on his computer, where it can work with his local files; he says Duet could start cloud sessions and read existing local sessions, but could not create or interact with a local session.
- In a sponsored Bluehost segment, Brown presents an always-on VPS as a way to keep agents running while a laptop is off; he says his VPS provides root access to install software and dependencies.