Top-end coding models just jumped again with Fable 5 showing up inside Copilot, but everything is shifting to strict metered pricing.
At the same time, local LLMs got fast enough to be practical while the security blast radius across npm, FFmpeg, WordPress, proxies, and agents expanded sharply.
Key Events
/Anthropic released Claude Fable 5, the first public Mythos-class model, which scored 91/100 on a Senior Engineer benchmark.
/GitHub switched Copilot to metered billing, with some developers losing months of credits in a single day.
/Google and Unsloth shipped Gemma 4 QAT checkpoints for all model sizes, targeting about 3× lower memory use on consumer hardware.
/An AI agent disclosed 21 zero-day vulnerabilities in FFmpeg, including a network-reachable remote code execution flaw.
/The Miasma and IronWorm campaigns infected 36 npm packages and can execute malicious code on clone or install.
Report
Claude Fable 5 just became the strongest public coding model, and it’s already showing up inside tools you probably use. At the same time, AI infra is swinging hard toward metered pricing and DIY local stacks, while your security surface keeps expanding.
fable 5 and copilot billing
Anthropic’s Claude Fable 5 is now the top public coding model, scoring 91/100 on a Senior Engineer benchmark and taking the #1 spot on real-world engineering evals like FrontierCode.
It’s already rolling into GitHub Copilot, giving Copilot long-horizon, autonomous-style code generation instead of just autocomplete.
GitHub simultaneously flipped Copilot to metered billing, and developers report burning through months of pre-purchased credits in a day. Fable 5 itself is in a promo phase now but will move to usage credits priced at about $10 in and $50 out per million tokens, with session limits on top.
Other buyers are also capping spend—Uber set a $1.5k/month ceiling for AI tools—and middleware like ActionFence and local budget circuit breakers are emerging just to keep agents from overrunning budgets.
local llms: gemma 4, qat, mtp, dflash
Google’s Gemma 4 12B is a multimodal model (text, image, audio, video) with a 256k context that runs on laptops with 16GB RAM and is Apache-2.0, so it can live inside on-prem stacks.
QAT variants of Gemma 4 target roughly 3× lower memory use, fit in about 1GB on mobile formats, and hit around 120 tokens/s on a 12GB GPU when combined with aggressive quantization.
MTP support in llama.cpp and GGUF weights from Unsloth give another 1.2–1.8× generation speedup on Gemma 4, while DFlash plus KV-cache compression is showing 3–6× latency cuts and over 1000 tokens/s on Qwen and Xiaomi’s 1T-parameter MiMo-V2.5-Pro.
The catch: users see mixed accuracy from Gemma 4 QAT (especially MoE), MTP-related output issues on some Qwen models, CUDA OOM on single GPUs, gaps in MLX quantized builds, and hardware-specific performance cliffs.
agents, auth, and json schemas
Traffic from AI agents has reportedly passed human traffic online, and vendors are marketing OSes like Ubuntu 26.04 explicitly for the agentic era.
Salesforce is standardizing an agent registration protocol, while WorkOS’s auth.md lets services expose machine-readable auth details so agents can onboard themselves.
Real deployments still say auth is the brittle part: agents get stuck in email-verification loops, lose sessions, and need watchdog agents just to keep API sessions alive.
Developers are pushing for rich metadata about auth boundaries and retries and often end up centralizing auth across microservices to stop fragile, cross-service edge cases.
At the same time, systems like Ideogram 4 that require strict JSON prompts show that structured contracts can stabilize agent behavior, but local LLMs and structured output parsers still emit or accept invalid JSON often enough to silently corrupt downstream data.
home-lab stacks vs azure reality
On the run-it-yourself side, people are happily hosting 20+ services via Docker Compose behind Traefik with automatic Let’s Encrypt, on top of Proxmox and TrueNAS boxes with ZFS, iSCSI, and dedup.
WireGuard is the default tunnel into these setups, used even to lock down local LLM servers so nothing is exposed directly to the internet.
The same threads show Proxmox and TrueNAS as RAM-hungry and complex, and clustering or backup strategies trip up newcomers despite the flexibility.
Meanwhile on Azure, users are hitting capacity walls that require talking to account reps to get GPUs or certain regions, and Microsoft temporarily shut down Azure Functions GitHub Actions after yet another compromise.
Kubernetes, Terraform, and Ansible remain the skills companies ask for, so a lot of people are learning K3s clusters with Cilium and ArgoCD in homelabs while still running actual workloads on simpler Docker+VPS setups.
toolchain security is on fire
An AI agent turned up 21 zero-day bugs in FFmpeg, including a network-reachable RCE in a library that underpins a huge share of media processing.
At the same time, the Miasma worm executes on git clone by abusing config files like npm’s, IronWorm has already compromised 36 npm packages, and a related campaign is planting backdoors in Claude Code workflows to steal npm credentials.
Hackers are actively exploiting a critical RCE in the Everest Forms Pro WordPress plugin (CVE-2026-3300) to take over sites, and plugin vulnerabilities remain a common compromise path.
Reverse proxies aren’t safe by default either: both Nginx and Traefik need patching for the HTTP/2 bomb issue, which can take down unpatched stacks.
Even the AI glue layer is fragile, with studies suggesting 80–90% of MCP setups are vulnerable to bad tool calls or missing scoping, and VS Code now delaying extension auto-updates by two hours specifically to blunt extension supply-chain attacks.
What This Means
Model quality is no longer the bottleneck; the real constraints are metered access, local infra quirks, and a much larger, leakier security and auth surface.
On Watch
/Microsoft’s new MAI-Code-1-Flash 5B coding model scores 51% on SWE-Bench Pro and is exposed via Azure, creating a mid-tier alternative between local models and Mythos-class tools.
/Cloudflare’s acquisition of the Vite core team (VoidZero) is raising questions about the future direction and sponsorship model of the increasingly popular Vite build tool.
/Rumors that Microsoft may acquire Unsloth, combined with mixed user reports on Gemma 4 QAT quality, could reshape who controls the open-source quantization/QAT ecosystem.
Interesting
/AI coding tools like Copilot reportedly increase coding activity by approximately 180%, but this effect diminishes significantly for actual shipped products.
/WASM is seen as a more efficient alternative to traditional containerization for running untrusted code, minimizing overhead.
/The Ladybird Browser has banned public pulls due to security concerns regarding AI-generated code, highlighting the risks associated with AI in development.
/Microsoft's new MAI models include a 5B coding model that achieved 51% on SWE-Bench Pro, indicating a shift in production cost dynamics.
/UUID v7 is gaining traction as it offers a balance between uniqueness and performance, potentially mitigating issues of traditional UUIDs.
We processed 10,000+ comments and posts to generate this report.
AI-generated content. Verify critical information independently.
/Anthropic released Claude Fable 5, the first public Mythos-class model, which scored 91/100 on a Senior Engineer benchmark.
/GitHub switched Copilot to metered billing, with some developers losing months of credits in a single day.
/Google and Unsloth shipped Gemma 4 QAT checkpoints for all model sizes, targeting about 3× lower memory use on consumer hardware.
/An AI agent disclosed 21 zero-day vulnerabilities in FFmpeg, including a network-reachable remote code execution flaw.
/The Miasma and IronWorm campaigns infected 36 npm packages and can execute malicious code on clone or install.
On Watch
/Microsoft’s new MAI-Code-1-Flash 5B coding model scores 51% on SWE-Bench Pro and is exposed via Azure, creating a mid-tier alternative between local models and Mythos-class tools.
/Cloudflare’s acquisition of the Vite core team (VoidZero) is raising questions about the future direction and sponsorship model of the increasingly popular Vite build tool.
/Rumors that Microsoft may acquire Unsloth, combined with mixed user reports on Gemma 4 QAT quality, could reshape who controls the open-source quantization/QAT ecosystem.
Interesting
/AI coding tools like Copilot reportedly increase coding activity by approximately 180%, but this effect diminishes significantly for actual shipped products.
/WASM is seen as a more efficient alternative to traditional containerization for running untrusted code, minimizing overhead.
/The Ladybird Browser has banned public pulls due to security concerns regarding AI-generated code, highlighting the risks associated with AI in development.
/Microsoft's new MAI models include a 5B coding model that achieved 51% on SWE-Bench Pro, indicating a shift in production cost dynamics.
/UUID v7 is gaining traction as it offers a balance between uniqueness and performance, potentially mitigating issues of traditional UUIDs.