iCreatAI News
Back to main site
Skip to content
Only Papers#Coding
Nov 13Fri
  1. Hacker News AI65

    Fossil versions: a fingerprint of AI-written code in 250k NPM packages

    A random sample of 250,000 npm packages found that the share of new packages whose first-release manifests pin mostly round, already-superseded versions (x.0.0) rose from 1–2.4% in every half-year from 2019 to early 2024 to 13.7% (95% CI 13.1–14.4) in the first half of 2026, falling to 7.6% in the second half of 2026. Median pin age at birth rose from about 155 days in 2021–2023 to 451 days in Q2 2026, and the share of packages born with essentially all pins on the newest release fell from about 28% to about 10%. The author argues the timing, the specific versions and how package managers work point to manifests written from a language model's memory rather than by running an install, while noting the data cannot prove who or what wrote any single package.

  2. Microsoft Research22

    Microsoft Research Focus – Edition #98

    This edition of Microsoft Research Focus covers AI-powered universal translation, the resolution of the 31-year-old KLS conjecture in high-dimensional geometry, and a new approach to making AI coding agents faster and more efficient. It also highlights a research intern's journey at Microsoft Research Asia – Tokyo and the Latent Core Tokenizer, which produces more linguistically meaningful tokens across 104 languages.

  3. Hacker News AI58

    How much of GitHub's most-starred AI tooling is written by coding agents?

    An analysis of 324,088 commits across 52 of GitHub's most-starred AI-tooling repositories found that the median repo had 16.9% AI-signed commits in its last 180 days of activity, with 21 of 52 at 25% or more, and that AI share showed no detectable link to stars (Spearman ρ = -0.05, p = 0.72). At day 180, these repos labeled 2.0 times as many commits as fixes (34.1% vs 17.3%), had lower churn (1.92x vs 3.77x) and kept more written code (67.1% vs 41.7%) than 12 pre-Copilot projects, but the gaps are concentrated in the 31 projects started in 2025 or later, so the sample cannot separate AI use from recency. Of 24 repos publishing a benchmark harness with committed results, 15 measure whether the tool does its job, and several publish numbers that went against them.

Nov 10Tue
  1. Hacker News AI58

    Do AI coding agents care about SemVer or is it something for humans only?

    Microsoft ran two Vally experiments with GitHub Copilot CLI (nearly 1,000 runs) and found that some models, notably Claude Sonnet 5.5 and Claude Haiku 5.5, checked upgrades less often when the version label was a patch than when it was a major release, even with byte-identical code. Three models (Claude Opus 5.5, GPT-6.1 Sol, GPT-6.1 Terra) checked every update regardless of label, and all four merges that left main broken came with a patch or minor label. The author recommends keeping SemVer honest, enforcing CI on every dependency branch, and treating the version number as a hidden variable when evaluating agents.

Nov 9Mon
  1. Hacker News AI58

    Ginux: A New Kernel Runs Linux Userspace, Made via Human-Directed AI Engineering

    This report presents Human-Directed Agentic Engineering (HDAE), a method combining human-defined architecture, constraints, milestones, acceptance criteria and stopping points with an autonomous implementation, execution, diagnosis and revision loop, using Ginux as its case study. Over eleven days, one persistent coding-agent task produced an independent Rust-first x86-64 kernel that boots through UEFI, implements its own core OS mechanisms and a Linux compatibility layer, runs selected unmodified Alpine Linux programs, and boots a Rocky Linux 10 userspace with systemd through multi-user.target. Ginux remains a research prototype with narrow compatibility and hardware coverage, no independent security audit, and no claim to production readiness or equivalence with Linux.

Nov 8Sun
  1. The Decoder71

    AI coding agents still need human cleanup on nearly three out of four tasks in a real-world test

    Researchers from Alibaba and several Asian universities built Co-Design Bench, a coding-agent benchmark drawn from real user change requests, some requiring image, audio, video, or document input. GPT-6 Astra, the best of ten models tested, met about 70 percent of a task's requirements on average but fully solved only 26.4 percent of tasks, and all models scored worse when tasks combined three or four types of changes. A separate test found the harness shapes results as much as the model, with Qwen3.8-27B scoring 75 or 56 percent on larger overhauls depending on the environment.

Nov 7Sat
  1. Hacker News AI40

    AI Source Code Analysis Detection Evasion Techniques

    The post describes a C-to-C transformation that hides a planted stack buffer overflow from four frontier AI models (Nemotron 3.5 Super VL 120B, DeepSeek V4.1 Flash, OpenAI GPT-5.5, Anthropic Claude Sonnet 5.5) using Karma Pro, combining an enum/preprocessor divergence (an enum constant the compiler sees as 9 but the preprocessor evaluates as 0 in an #if directive) with branchless MBA clamping that implements min(n, 9) via sign-bit masking instead of a ternary. It also reports that models sometimes hedged that a buffer "can be" too small without computing the capacity, and that a safe twin differing by one line (#if M0 + 4 >= 4) confirms the concealment rests on the preprocessor divergence plus the clamp's opacity.

  2. Hacker News AI33

    Pleasedonotescape.com: A dataset of sandboxes for AI coding agents

    The dataset lives at github.com/pjlsergeant/ai-sandboxes, where every claim traces to a primary source and pull requests to correct or add entries are welcome. It was built by the same person behind byre, described as a comfortable, constrained container box for coding agents. The post suggests byre may be the right amount of fence if the tools on the page feel like overkill for day-to-day use.

Nov 6Fri
  1. Microsoft Research58

    Formally verifying agent-written full-stack web apps with PDD Kit

    GitHub Next describes PDD Kit, a toolkit for Proof-Driven Development that turns a developer's intent into a formal specification in Verus, proves the agent's code meets that spec for every input, and falls back to tests where proofs cannot reach. The team applied it to Pet Store, a roughly 5,000-line Rust full-stack app, formally verifying its login logic while the developer reviewed the intent rather than reading generated code line by line. PDD Kit labels each result as either formal verification or empirical evidence and asks developers to sign off on each trusted component.

Nov 5Thu
  1. Hacker News AI38

    WebsiteBench: Can AI Agents Rebuild Websites Through Browser Exploration?

    WebsiteBench is a benchmark in which agents explore a production-level website through a browser and must reverse-engineer a full-stack version matching its appearance and behavior as closely as possible. The repository provides quickstart instructions using uv, Docker, and the harbor run command to evaluate single tasks from local-tasks/ or all tasks, with results written to jobs/. Code is licensed under Apache-2.0, while task data and reference content retain their applicable licenses.

  2. Hacker News AI65

    We measured the impact of AI on 46 OSS repos (200k commits, 16M lines)

    Kerno's first-edition report analyzes 201,576 commits across 46 open-source projects from October 2024 to October 2026 and finds new code carries 8.1 decision points per 100 lines after AI adoption, up from 5.2, with complexity growth shifting from −0.4% to +3.1% a month. Each engineer ships 71% more production code per week, while AI-marked commits are revisited 43% more often than other commits and are 17% more likely to add a hard-to-test function. Claude signs 69% of AI-marked commits, which are 54% bigger than unmarked commits, and on the current trend complexity per 100 new lines would rise another 42% by late 2028.

Nov 3Tue
  1. Hacker News AI40

    An Endless Stream of AI Slop: The Burden of AI-Assisted Software Development

    This arXiv paper qualitatively analyzes 1,154 Reddit and Hacker News posts to build a 15-code codebook on how developers perceive and respond to "AI slop" in software development, organized into Review Friction, Quality Degradation, and Forces and Consequences. The authors frame AI slop as a tragedy of the commons, where individual productivity gains externalize costs onto reviewers, maintainers, and the broader community. They report developers' concerns and proposed mitigation strategies, with implications for tool developers, team leads, and educators.

Nov 2Mon
  1. Hacker News AI76

    Rocky Linux Creator Built a New 'Not Linux' Kernel in 11 Days Using AI

    Gregory M. Kurtzer, creator of Rocky Linux, developed Ginux, a Rust-first x86-64 kernel and OS prototype that boots via UEFI without a Linux host kernel and runs unmodified Linux userspace inside kernel-native domains, including Rocky Linux 10 systemd reaching multi-user.target. The project was built over eleven days by one persistent OpenAI Codex task using GPT-5.6 Sol, producing roughly 139,000 retained lines of implementation and test code under a method called Human-Directed Agentic Engineering. Ginux is explicitly experimental, with incomplete Linux ABI coverage, device support, and security validation, and is not intended as a production replacement for Linux.

    Why it matters: It documents a notable experiment in AI-assisted kernel development and is candid about the resulting system's limits.

Oct 31Sat
  1. Hacker News AI72

    How the built-in browsers in five AI coding tools broke basic browser rules

    Forever Security's EMBRACE research, published October 29, 2026, reports that the embedded browsers in Cursor, the GitHub Copilot app, Codex, VS Code and Claude Desktop each broke one of three rules a normal browser keeps: Cursor let any web page send text into the agent's composer, Codex, VS Code and Claude Desktop let a local HTML file read files outside the project, and the Copilot app let a page fake its own address bar. Cursor was patched October 1 and the Copilot app in 1.1.29 on October 13, while Codex and VS Code were unpatched as of October 29 and Claude Desktop's fix status is unclear. The write-up includes a grep command for triage indicators and advises turning off auto-run in Cursor and not opening untrusted projects' HTML in the built-in previews.

Oct 30Fri
  1. The Decoder88

    Open-weight model GLM 5.3 built full Firefox exploit chains with zero human input in under 48 hours

    Epoch AI researchers report that the Chinese open-weight model GLM 5.3 autonomously exploited the "patch gap" across six Firefox versions released between September 17 and October 26, building full exploit chains in as little as 12 hours at roughly $1,000 in API fees per successful attack, with no safety guardrails triggered by Z.ai or other API providers. The model independently rediscovered a previously unknown vulnerability to bypass Firefox's sandbox and read local files, which Mozilla patched in Firefox 159.0 on October 27, 2026; the same setup against Chrome cost about $100,000 without producing an equivalent exploit. The researchers warn the patch gap affects browsers, mobile operating systems and router firmware industry-wide, and that offensive capability is diffusing beyond any single gatekeeper's control as open-weight models improve.

    Why it matters: It documents a concrete, low-cost autonomous exploit against a browser used by over 200 million people, making the patch-gap risk tangible for defenders and vendors.

  2. Microsoft Research22

    Microsoft Research Focus – Edition #97

    This edition of Microsoft Research Focus, hosted by Sowbhagya Suresh, highlights recent Microsoft research including ForkPilot, a self-improving agentic framework that reduces AI processing demands by up to 59%, and CABRA, a framework showing that understanding unfamiliar codebases remains a major obstacle for coding agents. It also covers TeleTune for learning agent skills from activity logs, findings that common Copilot uses may mask differences across industries, a Shiksha Copilot study in Indian schools, the Probabilistic Bias Correction framework for extended-range weather forecasting, and the public preview of the BioEmu2 biomolecular model.

Oct 29Thu
  1. Replit Blog60

    ViBench 2.0: A Benchmark for Long-Horizon Software Building

    Replit releases ViBench 2.0, a long-horizon software development benchmark in which an agent builds a product from an empty project and then adds up to eighteen features on top of its own code, spanning seventeen products, 241 feature requests and 544 test plans. In Fireworks' official runs, GPT-6.1 Sol leads with a pass@1 of 65%, followed by GPT-6 Astra at 60% and Opus 5.5 at 49%, and no open-weight model passes a full build. Eight of the products are public on GitHub in the Harbor format, and results can be rerun from release v2.0.6 on the OpenHands-based harness.

    Why it matters: It offers concrete pass rates, costs and failure modes for frontier models on multi-feature product building, with a public, rerunnable harness.

  2. Hacker News AI60

    Agent Scrum: Running a team of AI coding agents in two-hour sprints

    Over 38 days, a fleet of AI coding agents ran 324 two-hour sprints on a real product backlog, with 79% of committed stories reaching done inside the sprint in the 90 sprints run by a dedicated scrum-team agent and ceremony taking under five minutes per sprint. The paper describes Agent Scrum, which keeps Scrum's core devices (time-boxed sprints, committed sprint backlogs, story points, velocity, a Definition of Done and retrospectives) but changes their scale and constraints, with capacity coming from model rate limits and cost measured as token velocity. It reports that the slowest stage was not writing code (median approval-to-merge time equalled median build time) and that compounding was weakest, with 119 of 159 retrospective actions still open.

Oct 28Wed
  1. Artificial Analysis Articles60

    Announcing Artificial Analysis Intelligence Index v5

    Artificial Analysis released Intelligence Index v5, its biggest upgrade since v4, adding FrontierCode 2.0 and Terminal-Bench-Science and upgrading HLE-Diamond, AA-Omniscience v1.1 and CritPt v2, with 60% of the Index now based on private test sets or held-out answers. Claude Opus 5.5 (max) leads at 58, ahead of GPT-6 Astra (max, 57) and GPT-6.1 Sol (max, 55), while the open weights gap widens from 3 points to 12. It also launched the Progress Index v1, which tracks model capability over time on one continuous scale.

    Why it matters: It details a major benchmark revision and new leaderboard results, useful for readers tracking how frontier and open-weight models are measured.

  2. Hacker News AI38

    Do Guardrails Make AI Coding Agents Better? What 270 Runs Showed

    An experiment of 270 unattended coding-agent runs across three models and seven tasks found that instruction files and pre-commit gates did not raise first-pass rates, with 267 of 270 runs passing hidden tests at first "done." Guardrails showed up instead in what runs left behind: on four later tasks, 9 of 60 gated runs left a defect versus 15 of 60 ungated, a gap too small to call. The author notes limits including five runs per cell, one small codebase, and self-written tasks and harness, and publishes the run records and a reproduction script in a companion repository.

  3. Meta Engineering36

    Python Typing Survey 2026: AI Tools and the Shifting Checker Landscape

    The 2026 Python Typing Survey, with 1,794 responses, found type hint use stable across three years (85.5% in 2026) while checker selection shifted sharply, with 49.9% of respondents selecting two or more checkers and speed cited by 56.5% as the top reason for choosing one. Missing type information in third-party libraries was the leading difficulty at 65.1%, and AI tools wrote type hints for 42.5% of 1,517 respondents, with 24.4% saying an AI coding tool invoked their checker.

Oct 24Sat
  1. The Decoder66

    Fancy harnesses make coding agents more expensive but not better, study finds

    A study by Liu and Han ran five models through Claude Code, OpenCode and mini-SWE-agent and found that swapping harnesses shifts SWE-bench Verified results about as much as simply rerunning the same setup, with differences of two to five solved tasks per model. The only measurable harness effect was a deficit for OpenCode, while Claude Code's roughly 16,600-token system prompt and tool descriptions made a single task cost up to three times more than the leanest harness. The authors conclude a harness buys fewer ways to lose a task and a bill, not pass rate, and recommend publishing a rerun of the same setup alongside every harness comparison.

Oct 23Fri
  1. The Decoder78

    Anthropic's Claude now writes code and proves it safe automatically

    Anthropic's Frontier Red Team, working with partner Theorem, used Claude to generate roughly 180 million lines of mathematical proof code in a few weeks, verifying existing software from 123 open-source libraries in Google's OSS-Fuzz project by translating crash tests into mathematical problems and analyzing compiled machine code, with the Rocq program automatically checking the proofs. The researchers say Claude found hundreds of bugs, including as many security bugs in one week in a widely used PDF reader as are typically reported for that software in a year, and caught a logical error undetected for over a decade. Anthropic notes the proofs hold only under strict conditions—a specific processor architecture, single-threaded programs, and inputs under 64 MB—and that compute costs are steep, with individual proofs running up hundreds of millions of tokens.

    Why it matters: It offers a concrete look at AI-assisted formal verification, including its demonstrated bug-finding results and the practical limits Anthropic itself acknowledges.

Oct 5Mon
  1. GitHub Blog · AI & ML61

    ReviewBench: An open benchmark for AI code review

    GitHub introduces ReviewBench, an open benchmark for AI code review built from analysis of 103.9 million GitHub pull requests, containing 219 public pull requests across 19 languages with a multi-source golden set labeled for severity and category. It reports grounded and augmented precision, recall, and F1 metrics, uses Claude Sonnet 5 as the LLM grader under a published rubric, and had its ground-truth findings independently re-labeled by senior engineers with 96.6% agreement. GitHub says ReviewBench's offline predictions for a Copilot code review multi-model ensemble matched a later A/B test, which showed an 8.0% rise in addressed rate, 13.6% in recall, 61% in comment volume, and an 8.0% drop in cost per review.

    Why it matters: It offers a concrete, reproducible methodology and public dataset for comparing AI code reviewers, plus evidence on how offline scores tracked a production experiment.