The Stack

Software, APIs, and things you can use

SPIFFE agent tokens can still be replayed — WIMSE wrote the fix

The Stack

SPIFFE agent tokens can still be replayed — WIMSE wrote the fix

The boring layer of the agent stack just got an upgrade nobody has installed yet: the identity standard most agent frameworks lean on turns out to hand out credentials that work in whoever's holding them. SPIFFE — the de facto standard for giving an AI agent a machine identity — issues bearer tokens, and a bearer token authenticates possession, not the person who was issued it. A Kenneth Buchi piece on HackerNoon lays out the gap: once a workload gets its short-lived credential through the SPIF

Tencent open-sources AuK, a 1.5B model that edits speech like text

The Stack

Tencent open-sources AuK, a 1.5B model that edits speech like text

A quiet morning in the open-weights scene, and two releases that both point the same way: the tooling around voice AI is getting strong enough, and cheap enough, that the community no longer needs a closed API to use it. Tencent open-sourced AuK, a 1.5B-parameter foundation model for speech generation and editing, alongside AuK-Flash, a distilled variant that produces audio in four inference steps. The weights, code and technical report went public under the MIT license, with the paper posted t

Plain LRU beat three smarter KV-cache policies on 68k real agent requests

The Stack

Plain LRU beat three smarter KV-cache policies on 68k real agent requests

An independent simulation just landed a null result on one of inference's busiest research corners. Plus: construction robotics is paying off — inside factories, not on job sites. A reproduction of the fast-growing "LRU is wrong for agents" KV-cache literature could not beat plain LRU on any real trace. Cross-request prefix caching — reusing key-value blocks that were already computed so a coding agent's fiftieth turn costs a fraction of its first — is evicted with LRU by default in vLLM, SGLan

Open Source Radar — September 12: agents with a day job

The Stack

Open Source Radar — September 12: agents with a day job

Today's board is short on general-purpose coding agents and long on specialists: tools that pick one job — research, competition math, trading, sales — and build the whole pipeline around it. Four picks and a caution from the daily trending list. MathModelAgent (Python, 4,979 stars) — Hand it a mathematical modeling problem and it returns a submission-ready paper: model selection, solver code, figures, and the full write-up. The project grew out of China's enormous student modeling-contest scen

AI 101 — What is tool calling?

The Stack

AI 101 — What is tool calling?

Tool calling — also called function calling — is a language model's ability to say "I need this specific external action run, with these exact arguments" instead of answering from memory. The model does not run anything. It writes a structured request in a format your code agreed to in advance, and your code does the doing. That one handshake is what turns a chatbot into software that can book, query, calculate, and file. Why it matters right now Every agent story you read this month rests on

Minitap says Google's Artemis shipped its code with the credit stripped

The Stack

Minitap says Google's Artemis shipped its code with the credit stripped

Google's Pixel test team open-sourced an Android automation agent this week. The team it was built on top of says the authorship trail was rewritten before anyone saw it. Minitap says Google's Artemis contains its code, and that the names of the people who wrote it were removed. Minitap published mobile-use in August 2025 under Apache 2.0 — an agent that drives real Android and iOS apps, 2,821 GitHub stars, and the reference implementation behind a clutch of mobile-agent papers. On September 11

Cognition's Devin leans on GPT-6 Astra to test its own work

The Stack

Cognition's Devin leans on GPT-6 Astra to test its own work

Cognition has wired GPT-6 Astra into Devin across its whole product line — the cloud agent, the CLI, and the desktop app — and the pitch is not more code, it's evidence: Devin now tests its own work and shows you the proof instead of asking you to review the diff. The company behind the best-known autonomous software engineer laid out the integration in a customer story OpenAI published Friday. Co-founder Walden Yan's summary is blunt: what Astra improves is Devin's ability to "test and prove th

ElevenLabs' Music v2.5 ships with lossless downloads on the free plan

The Stack

ElevenLabs' Music v2.5 ships with lossless downloads on the free plan

ElevenLabs released Music v2.5, calling it the best version of its music generation model yet — and paired the model upgrade with a rights change that matters as much as the sound. Every track made in ElevenMusic can now be downloaded losslessly and kept, with five downloads a day on the Free plan and 400 per month on Pro, and the company says the rights to what you make attach the moment you create a track, surviving cancellation or a plan downgrade. ElevenLabs shipped Music v2.5 today, and th

OpenAI's training opt-out has a reasoning-token-shaped hole

The Stack

OpenAI's training opt-out has a reasoning-token-shaped hole

Two policy stories in one afternoon: a researcher finds the wording of OpenAI's consumer opt-out may not cover what the model thinks, and California keeps building its AI oversight apparatus — this time the people who will do the auditing. The guarantee ChatGPT's paid users opt into may stop short of the hidden reasoning that contains everything they typed. Shashwat Goel, a researcher who read OpenAI's consumer terms line by line, found that the opt-out protects "Input" and "Output" — and since

OpenAI ends $1-a-year government pilot for 50%-off usage billing

The Stack

OpenAI ends $1-a-year government pilot for 50%-off usage billing

OpenAI's $1-a-year experiment in government is over. A new 27-month OneGov agreement announced by the General Services Administration replaces the $1-per-agency pilot with token-based, pay-for-what-you-use pricing at a 50% discount, starting October 1 — one day after the current deal expires. There is no platform fee, no minimum order, and no spend commitment, and the discount reaches federal, state, local and tribal agencies. The shift comes as roughly 3.5 million federal employees hold AI tool

Tesla's Cybercab launched on a certification NHTSA never approved

The Stack

Tesla's Cybercab launched on a certification NHTSA never approved

Every automaker in America vouches for its own vehicles. Tesla just found out what happens when the vouching gets creative — and a regulator that likes autonomous vehicles anyway starts reading the fine print. The probe is about paperwork, not driving When Tesla put its first Cybercabs on Austin's streets on September 3, it did so without a federal exemption, without a waiver, and without steering wheel, pedals, or sideview mirrors — three features the Federal Motor Vehicle Safety Standards r

Cybercab's week goes from weird to worse as NHTSA's probe deepens

The Stack

Cybercab's week goes from weird to worse as NHTSA's probe deepens

Tesla's first driverless two-seater was supposed to be the "fork in the road" moment. Instead, riders are filming it stopped in traffic and federal investigators are asking whether it was ever street-legal to begin with. Riders are filming Tesla's Cybercab stopping in the middle of busy roads, sometimes without ever pulling to the curb — and the videos are landing one week into the vehicle's commercial debut. The Rundown rounded up several of the awkward drop-offs, where the two-seater halts pa