OpenCode's model list now includes glm-5.3-flash-free and beam-free (select them as opencode/<id>), both priced at zero for input, output, and cached tokens with no end date announced; the paid GLM 5.3 Flash stays at $0.15/$0.50 per 1M tokens. The GLM provider keeps no data, while Beam Free retains prompts for 30 days for safety and is blocked in some countries, including China and Russia.
As of Oct 16, Cursor cloud agents can produce interactive canvases as part of their work, shareable with your team by link, and a beta Environments API lets you create and manage the cloud environments agents run in from code. Those environments now hold up to 300 repositories, and large ones load 5x faster…
As of Oct 16, any API customer can describe a voice in text via POST /v1/audio/voices or the voice Playground (free to create, up to 100 per org) and use it in gpt live 1 sessions at normal session rates; these voices don't work with TTS, Realtime, or Chat Completions. GPT Live also gains nine natural German, French, Hindi, Japanese, and Korean voices…
As of Oct 16, adding https://mcp.teable.ai/mcp to an MCP client (for example claude mcp add transport http teable https://mcp.teable.ai/mcp ) lets agents list projects, inspect tables and fields, query and edit records, and discover APIs within your existing permissions, approved once in the browser instead of with a personal access token. Self hosted instances expose it at /mcp , and Settings → MCP lists connected clients so you can revoke them…
As of Oct 16, GitHub Enterprise Cloud repos with Code Security can enforce an enterprise wide dependency license policy through a ruleset condition, Require license compliance results before merging , which annotates and blocks PRs that add noncompliant dependencies. A new API endpoint checks whether packages comply, so coding agents can avoid suggesting dependencies that break the org's license rules…
VulnCheck says Archon 0.2.13 through 0.11.1 (including the current release) binds its /api/ control API to 0.0.0.0 with no auth by default, so anyone on the network can message the coding agent, which runs with bypassPermissions , and run commands as the Archon user. No fix is listed yet; set HOST=127.0.0.1 , or set both DATABASE URL and BETTER AUTH SECRET to turn on the auth gate…
Spotted something we missed? Start a thread.
