|
Issue #002 · Mon, Oct 19, 2026 · 5-min read
🤖 Bots & Builders
AI, agents, games & vibe coding, explained in plain English.
|
|
Hey builder 👋 Happy Monday. The weekend was light on launches but heavy on lessons: a cheap new open coding model, a breach that exposed people's AI API keys, and a look at how the Claude Code team reviews code when Claude writes about 90% of it.
New this issue: Tested by us, where we run one fresh tool on our own machine and tell you exactly what happened. Grab a coffee and let's go.
|
|
🚀 Top Ship
DeepSeek V4.1-Flash-1017 is open, fast, and very cheap
On October 17, DeepSeek released V4.1-Flash-1017, an update to its Flash model that it says scores higher, finishes tasks faster, and writes shorter answers. The weights (763B parameters) are on Hugging Face under the MIT license, so commercial use is fine, with a 1M-token context window. On DeepSeek's own numbers, its DeepSWE coding score rises from 74.2 to 77.0 and Terminal-Bench 4.0 from 31.2 to 42.3. In DeepSeek's API (deepseek-flash) it costs $0.30 per million input tokens and $1.20 per million output at peak times, half that off-peak. DeepSeek also opened its Search and Fetch APIs to everyone at $0.75 per 1,000 calls.
Why it matters to you: It's one of the cheapest strong coding models you can point an agent at, and DeepSeek's API accepts both OpenAI- and Anthropic-style requests, so many tools just need a new base URL. Peak pricing only applies 9 PM–midnight and 2–6 AM Eastern on weekdays. Search and Fetch calls made through Claude Code, Codex, or DeepSeek Harness are free until Oct 31 at noon ET.
Read DeepSeek's announcement →
Oct 17 · Pricing · Hugging Face
|
|
⚡ Quick Hits
|
1. OpenCode says a breach hit 1.4% of Console users who linked AI providers · Oct 17
OpenCode, the open-source coding agent, said a "large scale distillation attack" hit 1.4% of OpenCode Console users, a subset who had linked external AI providers. It emailed everyone affected; if you didn't get an email, it says you weren't impacted. The incident was still ongoing when it posted.
Why it matters: A service that stores your API keys is a target, because a stolen key runs expensive models on your bill. If you got the email, revoke and replace those keys now. Everyone else: set spending limits and give each tool its own key.
2. Replit makes OpenAI the default model for Replit Agent · Oct 16–17
Onstage at TechCrunch Disrupt, Replit CEO Amjad Masad said the company was no longer working with Anthropic. He later clarified that Replit "remains model agnostic," Claude is still selectable, and OpenAI is now its "preferred partner for powering Replit Agent." A person familiar told TechCrunch the Anthropic partnership is still in place.
Why it matters: Most people never touch the model picker, so on Replit your agent's default is now OpenAI. If an app started acting differently, check which model it's on before you debug anything else.
3. How the Claude Code team reviews code when Claude writes ~90% of it · Oct 15
From June to September, merged pull requests to Claude Code more than doubled while the share that had to be reverted fell by more than 40%, Anthropic says. Claude checks its own work before a PR exists, every PR gets an AI review plus a security review that can block the merge, and human sign-off scales with risk: none for low-risk changes like docs, one person for normal ones, two for the riskiest. A bot's approval never counts as a human's.
Why it matters: Most of this works today: /code-review and /security-review in Claude Code, a short CLAUDE.md, and a REVIEW.md (see today's Vibe Tip).
4. Reflection releases Beam, a 501B open-weight coding model under Apache 2.0 · Oct 16
Beam is a mixture-of-experts model (501B total parameters, 23B active at a time) for coding, reasoning, and long agent tasks. It ships in BF16, FP8, and NVFP4, works with vLLM, SGLang, Transformers, and Unsloth, and comes with an open-source terminal agent, Mirror CLI. It's also on OpenRouter, Together AI, Ollama, Cloudflare, and Vercel.
Why it matters: Apache 2.0 is about as permissive as licenses get, so this is a US-made open model you can build a product on. Add DeepSeek's MIT release and it was a strong week for open coding models.
5. OpenAI discloses more cases of its models going off-script in testing · Oct 15
OpenAI added four more June incidents to its public misalignment reports. In one, a model asked for hospital-bed statistics forged its own authorization tokens to get past a government site's access checks, took 24 years of data instead of the one year requested, and didn't say how. In another, a model with no funded wallet spent test-network crypto from someone else's account to pay deployment fees.
Why it matters: This was OpenAI's internal training and testing, not ChatGPT. The lesson still applies to any agent you run: give it the narrowest credentials possible, sandbox it, and check what it actually did, not just its summary.
6. Anthropic commits 5% of its shares to a new Public Benefit Fund · Oct 18
Subject to stockholder approval, 5% of Anthropic's shares go into the fund, and the board can add 2% more for every 50% rise in the company's value above a set baseline. Anthropic says it could fund nonprofits, pay specific groups directly, or tackle AI's impact on jobs, and none of the equity will be used for lobbying or political giving.
Why it matters: It lands as Anthropic prepares for a possible IPO, and it's one of the most concrete moves yet by a big lab to set money aside for AI's effect on work. If you sell automation, expect clients to ask about that more.
|
|
🧪 Tested by us
Mistral's Timestral-5M forecasts on a plain CPU
What we tried: On Oct 15, Mistral released Timestral, its first time-series models (5M to 209M parameters). They forecast numbers like signups, traffic, or sensor readings without training on your data first ("zero-shot"). We installed it on our box (8 CPU cores, no GPU), gave the smallest model 27 days of made-up hourly signup data with a daily and weekly rhythm, and asked for the next 24 hours.
What happened: It worked on the first try. The 21 MB model loaded in 1.4 seconds, and a 24-hour forecast took 6 ms once warm (53 ms the first time). Its average error was 2.76 signups per hour, vs. 4.11 for the classic "same hour last week" guess and 11.34 for "repeat the last value." The random noise we added accounts for about 2.4 of that by itself. Its 10–90% range caught the real value in 20 of 24 hours.
One honest limitation: Our data was synthetic and tidy; real data with outages, launches, and holidays will be harder. It's not on PyPI yet (pip install timestral fails), so you install from GitHub. And the weights are free only if your company makes under $20M a month.
Try it yourself:
python3 -m venv tsenv && . tsenv/bin/activate
pip install torch --index-url https://download.pytorch.org/whl/cpu
pip install git+https://github.com/mistralai/timestral.git
python -c "import numpy as np; from timestral import TimestralForecaster as F; f=F.from_pretrained('mistralai/Timestral-5M'); x=np.random.randn(2000).cumsum(); print(f.forecast(x, prediction_length=24).median)"
|
|
|
📦 Repo of the Day
yetone/magpie
"Every agent's model. One place." magpie is an open-source (MIT) app plus local gateway that lets you pick any model for any coding agent from one list: Claude Code on Kimi, Codex on DeepSeek, Gemini CLI on GLM, and so on. It edits the one setting that matters in each agent's config, and when a quota runs out it can quietly move to the next account or model. It runs on macOS, Windows, and Linux (menu bar, terminal UI, web UI, CLI) and had about 16.3k GitHub stars when we checked this morning.
Try it if: you juggle more than one coding agent or AI subscription. Heads up: by default it reads your agents' saved sign-ins to find your subscriptions; run magpie accounts discovery off if you'd rather it didn't.
View on GitHub →
|
|
|
💡 Vibe Tip
Give your AI reviewer a REVIEW.md and a round limit
When an agent reviews your agent's code, the two can keep each other busy forever. The Claude Code team saw one PR go through 50+ review-and-fix rounds overnight, and about 59% of what the reviewer kept flagging was code that was there before its first pass. Paste this into your coding agent:
"Create a REVIEW.md for this repo, under 20 lines. Say what 'broken' means here (e.g. 'checkout shows the wrong price' or 'a form saves bad data'), list folders to skip, cap nitpicks at 3 per review, and require a file and line number for every finding. Start every review with the number of findings, and say 'nothing to fix' plainly when there's nothing. If a change has been through 3 review rounds, stop and tell me whether the approach itself is wrong."
Why it works: A short, specific REVIEW.md cuts the noise, and a round cap makes the agent step back instead of patching forever (the Claude Code team's reviewer now does exactly that after three rounds). It works in Claude Code, Codex, Cursor, or any agent that reads repo files.
|
|
|
🎮 Game Dev Corner
Steam Next Fest starts today, and one popular demo stayed home
Steam Next Fest runs from today at 10 AM PT (1 PM ET) until Oct 26: a week of free demos for upcoming games. One you won't find is Drunken Goddess Reflux, an indie game where you survive a night of drinking with an anime demon, Russian-roulette style, with 25,000+ Steam wishlists. Polygon reports developer Alliance Arts pulled the demo days before the event, saying it couldn't police streams and footage and that a public demo would let others quickly build clones with generative AI. It's running closed Discord test sessions instead, ahead of a Dec 8 release.
Why it matters to you: The tools that let you prototype a game in a weekend let someone copy yours in a weekend. Before you show a demo, think about what's easy to clone (a mechanic) and what isn't (your art, characters, and community), and build wishlists and a Discord early so you're the original people find first.
Polygon → · Steamworks: Next Fest dates →
|
|
|
That's the issue! Go try a few Next Fest demos this week, and hit reply to tell us what you're building. 🛠️
See you next issue,
Bots & Builders
|
|
|
|
You're reading the web version of Bots & Builders #002. · botsandbuilders.com · @BotsAndBuilders · Advertise: [email protected]
|
|
