Tech Radar - 2026-10-13 18:00

Priority Today

OpenCode 2.0 turns the coding agent into a shared background service and makes Code Mode the default for every MCP server

Anomaly formally released OpenCode 2.0 on October 12, making it the project's main release three months after the public beta. A single auto-started local service now backs the terminal, web and desktop clients, the server API was rewritten, and the new @opencode/client and @opencode/sdk let scripts and other applications drive the same engine.

Why it matters: Code Mode is now the default path for every MCP server. @opencode/codemode is a small JavaScript interpreter that turns MCP servers and OpenAPI endpoints into functions the model composes in one script, so many servers can be connected without their tool definitions flooding every request; the tradeoff is that the model has to write working code, and a server opts out with codemode: false. What changed: A shared service, background subagents and background shell commands, more than 80 features rebuilt as hot-reloadable plugins, and an embeddable SDK; three breaking areas, the v1 plugin API, the old server API, and tui.json moving to cli.json. For me: Upgrade from 1.x with opencode upgrade --major; automatic updates no longer run, so the upgrade is manual. Re-check any v1 plugin or script against the old server API before relying on it, and note the launch note publishes no benchmarks.

Tags: #topic/ai-coding #entity/opencode #technology/agent-orchestration #technology/mcp #event/agent-release #relevance/developer #relevance/ai-workflow #learning/understand

Sources:

Hugging Face ended the monthly Inference Providers credit it gave every free account

Hugging Face's Inference Providers pricing docs list Free Users' monthly credit as "None" as of October 7, and a staff member confirmed on the forums that the $0.10 monthly credit was removed after "constant abuse by account farms". Free accounts must now buy credits to use Inference Providers, while PRO ($9 per month) and Team or Enterprise seats still include $2.00 a month.

Why it matters: Many tutorials, notebooks and CI jobs assume a free token plus a monthly credit; that path now needs a card or a PRO subscription, so anything built on the free tier will stop. What changed: A free tier's $0.10 per month became "None". The credits that remain on paid plans are now general-purpose compute credits usable across Inference Providers, Endpoints, Spaces and Jobs, not only routed inference. For me: If you rely on the free Hugging Face router, buy credits or move to PRO, and re-check any script or CI job that quietly assumed the free monthly credit.

Tags: #topic/ai-economics #entity/huggingface #technology/llm-api #event/pricing-change #relevance/free-access #relevance/developer #learning/awareness

Sources:

AWS moved Bedrock AgentCore short-term memory to per-gigabyte billing

On October 12 AWS announced that short-term memory in Amazon Bedrock AgentCore is billed on data agents ingest, retrieve and store instead of a flat rate per event, with rates of $1.00 per GB ingested, $0.20 per GB retrieved and $0.10 per GB-month stored, effective October 6. Ingestion and retrieval are billed per event with a 12 KB minimum and a 64 KB maximum billable size, and storage uses each event's actual size; long-term memory pricing is unchanged.

Why it matters: The old model charged $0.25 per 1,000 new events whatever each event carried, so agents that write many small events get cheaper while agents that store large transcripts or tool outputs can get more expensive. What changed: A flat per-event rate became three per-gigabyte meters, with the 12 KB floor meaning a stream of tiny events is still billed at the floor, not at its real size. For me: If you run agents on AgentCore, recompute from events per month, average event size and read-back rate, and revisit each memory's time to live, since a shorter TTL lowers the storage charge.

Tags: #topic/ai-economics #topic/devops #entity/aws #technology/agent-memory #event/pricing-change #relevance/devops #learning/understand

Sources:

sandboxed.sh through 1.3.0 lets agent-run code read and write the host filesystem via nsenter

CVE-2026-109569, published October 12 at CVSS 9.3, covers sandboxed.sh through 1.3.0: it invokes nsenter without --root, so code running inside a container workspace resolves absolute paths against the host filesystem and can read or modify host files. The advisory says exploitation requires code execution inside a workspace and no public exploit is known, and the fix is an upstream commit that is not tied to a confirmed tagged release.

Why it matters: The point of an agent sandbox is to contain untrusted or agent-generated code; a missing --root turns the isolation boundary into a suggestion for exactly the workload the tool exists to hold. What changed: An insecure-default hardening flaw (CWE-1188) tracked as a critical container escape, with the patch in commit 4ab42e91 and no independently confirmed patched version at publication. For me: If you run sandboxed.sh to contain agent code, do not run untrusted code until you deploy a build at or past that commit, and consider dropping CAP_SYS_ADMIN and blocking nsenter via seccomp as a stopgap.

Tags: #topic/security #topic/ai-agents #entity/sandboxed-sh #technology/agent-security #technology/containerization #event/security-issue #relevance/developer #learning/understand

Sources:

AI Coding and Agents

LightOn's ColGrep-Agent-2B moved code search off the frontier model and cut Claude Code tokens by 34%

LightOn released ColGrep-Agent-2B on October 12, an Apache-2.0, 2-billion-parameter code-search agent that runs locally, searches a repository with ColGrep multi-vector retrieval, reads promising files and returns file paths and line ranges to a frontier coding agent. In LightOn's own test with Claude Code on Sonnet 5.5, across 52 code-search questions on 13 repositories unseen in training, delegating search cut API tokens 34% and cache-aware cost 40% versus grep, at 80.8% versus 83.3% accuracy, a gap the authors call not statistically significant.

Why it matters: A coding agent's token cost is dominated by exploratory search turns that resend a growing context; offloading search to a small local model lets the expensive model spend its context on planning and patches instead of grep. What changed: Savings grew with repository size, 19% below 50k lines and 40% above 150k, at the cost of speed, 21.6s versus 13.0s per question, and no API key or Python is required; installers and hooks exist for Claude Code, Codex and OpenCode. For me: Worth wiring in if you run a frontier coding agent on large repositories and pay per token; treat the numbers as LightOn's protocol on search questions, not end-to-end coding results.

Tags: #topic/ai-coding #topic/open-source #entity/lighton #technology/embedding #event/model-release #relevance/developer #relevance/ai-workflow #learning/hands-on

Sources:

Codex CLI has started a persistent, self-updating background daemon by default

Since Codex CLI 0.157.0, opening an interactive session starts a background daemon, codex app-server --managed-daemon, with no TTY that copies roughly 374 MB of platform packages per version and runs an updater that checks shortly after start and then hourly. A September 25 GitHub issue reached the Hacker News front page on October 12, where an OpenAI engineer wrote that the update subsystem "seems like an oversight" he intends to fix; users report stacked old versions up to about 12 GB, and the off switch codex features disable daemon_auto_start is undocumented in the repo.

Why it matters: A terminal coding agent that leaves a reparented daemon and an hourly auto-updater running by default is a behavior and disk-use change users did not ask for, and the updater can restart the backend mid-task. What changed: A default background service appeared in a tool whose docs describe no such thing, and the maintainer acknowledged the updater defect without committing to making the daemon opt-in. For me: Run ps aux | grep managed-daemon and count folders under ~/.codex/packages/app-server-daemon/releases/; disable it with codex features disable daemon_auto_start if you do not want it.

Tags: #topic/ai-coding #entity/codex #event/tool-release #relevance/developer #learning/awareness

Sources:

Agent Capability

GenON released Hunmin-397B-A17B-CUA, a Qwen-based computer-use model tuned by low-rank capability transfer

GenON published Hunmin-397B-A17B-CUA, an open vision-language MoE built on Qwen3.5-397B-A17B (397B total, about 17B active) and tuned for desktop and browser tasks by transferring a low-rank slice of a specialized Qwen-CUA checkpoint's weight difference instead of fine-tuning from data. The authors report improving OSWorld (360-task) from the base's 48.2 to 70.5 and WindowsAgentArena from 41.8 to 50.9, while staying within about 2 points of the base on the Korean benchmarks they tracked; Qwen-CUA still leads on long-horizon execution, 77.1 versus 70.5 on OSWorld.

Why it matters: It is a concrete, documented recipe for adding one capability, GUI grounding and computer use, to a large open base without eroding the rest, and the idea of transferring a truncated weight delta rather than a full fine-tune generalizes beyond this model. What changed: Open weights for a 397B computer-use model with a technical report; all scores are the authors' own under their evaluation setup, which caps visual history at 5 frames. For me: Relevant if you self-host large computer-use models; the merged BF16 checkpoint is roughly 740 GB, so treat it as a research reference until an independent harness reproduces the numbers.

Tags: #topic/ai-agents #topic/ai-models #entity/genon #technology/computer-use #event/model-release #relevance/ai-workflow #learning/understand

Sources:

Models and Capabilities

OpenBMB released MiniCPM-V 4.7 35B-A3B, an Apache-2.0 MoE vision model aimed at phones

OpenBMB published MiniCPM-V 4.7 35B-A3B on October 12 with a full model card and an Apache-2.0 license, calling it the first MoE model in the MiniCPM-V line: 35.2B total parameters with 256 experts and 8 active per token, a 262,144-token maximum position, and single-image, multi-image and video understanding. The card claims 13+ tokens per second decoding on an iPhone 17 Pro Max using Lookahead Expert Scheduling plus layer-wise quantization and DSpark speculative sampling.

Why it matters: It packages an on-device story around an open Apache-2.0 multimodal model, with iOS, Android and HarmonyOS deployment and day-0 support claimed for Rockchip, Houmo, Intel, AMD and Arm chips, which matters where you cannot call a hosted model. What changed: The repository went from a bare 70 GB weights folder with no README to a documented release with a license and quantized variants, GGUF, BNB, AWQ, GPTQ and FP8, in about an hour on October 12; the weights themselves are unchanged. For me: The full-precision weights are large, so use a quantized variant for local testing; the speed and "lossless" claims are OpenBMB's own and had not been independently reproduced at release.

Tags: #topic/ai-models #entity/openbmb #technology/inference #technology/quantization #event/model-release #relevance/self-hosting #relevance/discovery #learning/awareness

Sources:

Technically Impressive

Janas, a dependency-free C engine, streams MoE experts from an SSD to run an 80B model on a 32 GB laptop

Janas-LLM, a GPL-3.0 inference engine written in C with no dependencies beyond libc, runs mixture-of-experts models larger than RAM by keeping weights on an NVMe SSD and reading only the experts each token needs, caching the frequently used ones. Its author reports running Qwen3-Next-80B-A3B, a 48.4 GB file, on a 32 GB laptop at 24 tokens per second versus llama.cpp's 2.8, or 37 tokens per second with a speculative draft, and asks other testers to send janas-bench reports because all measurements come from one Intel Core Ultra 9 185H laptop.

Why it matters: It reframes the local-inference memory wall as an I/O problem; for sparse MoE models a fast SSD becomes a memory tier, which is the difference between not running an 80B model and running it. What changed: A one-author C project that reports beating llama.cpp on 13 models in Q4_K_M by reading experts with O_DIRECT and io_uring and skipping lightly weighted experts that would need a disk read; the README calls it "an experiment, not a product" and the API changes weekly. For me: Interesting to watch rather than deploy; it is aggressive with memory and disk and can push a desktop into swap, but janas-bench lets you reproduce the numbers on your own machine.

Tags: #topic/ai-models #topic/self-hosting #entity/janas #technology/inference #event/open-source-release #relevance/self-hosting #relevance/developer #learning/understand

Sources:

Tag Index

topic

#topic/ai-agents #topic/ai-coding #topic/ai-economics #topic/ai-models #topic/devops #topic/open-source #topic/security #topic/self-hosting

entity

#entity/aws #entity/codex #entity/genon #entity/huggingface #entity/janas #entity/lighton #entity/openbmb #entity/opencode #entity/sandboxed-sh

technology

#technology/agent-memory #technology/agent-orchestration #technology/agent-security #technology/computer-use #technology/containerization #technology/embedding #technology/inference #technology/llm-api #technology/mcp #technology/quantization

event

#event/agent-release #event/model-release #event/open-source-release #event/pricing-change #event/security-issue #event/tool-release

relevance

#relevance/ai-workflow #relevance/developer #relevance/devops #relevance/discovery #relevance/free-access #relevance/self-hosting

learning

#learning/awareness #learning/hands-on #learning/understand