trending.md — Dense Trending Signals

1. Alibaba open-sources Qwen3.8-2.4T-A95B — its first Qwen-Max-class flagship with 2.4T parameters

• Velocity: ▮▮▮ trending
• Source: Hugging Face · 2.4T params · ~1d ago
• Tags: alibaba qwen open-weights moe llm

Alibaba's Qwen team released open weights for Qwen3.8-2.4T-A95B — the first time a Qwen-Max-class (flagship) model has been fully open-sourced. It's a fine-grained Mixture-of-Experts with 2.4 trillion total parameters (~95B active), 512 experts per layer (10 routed + 1 shared), a hybrid Gated-DeltaNet + Gated-Attention architecture, and multi-token-prediction training. Native context is 262K tokens, extensible to ~1M; the open build is text-only with thinking forced on. Self-reported benchmarks: Terminal-Bench 2.1 at 86.6, PaperBench 93.0, GPQA Diamond 92.6, SWE-bench Pro 67.7. Weights (~4.9TB BF16) land on Hugging Face and ModelScope under a custom Qwen3.8-Max license.

Why it matters: This closes the open-vs-closed gap at the very top of the capability curve — a downloadable Qwen-Max-class model shifts fine-tuning and self-hosting economics for teams that previously could only call Alibaba's API, and extends 2026's pattern of Chinese labs shipping frontier-scale open weights while US labs ship smaller, faster models.

Text-only · thinking cannot be disabled · deployable via vLLM/SGLang/TokenSpeed, or on a full NVIDIA GB300 NVL72 rack at 4,000+ tok/s per GPU in FP8.

🔗 Hugging Face · 🔗 NVIDIA Technical Blog

2. DeepSeek open-sources Harness — an "everything is a plugin" agent framework to rival Claude Code

• Velocity: ▮▮▮ trending
• Source: GitHub · 38.9k stars · ~18h ago
• Tags: deepseek agents plugin-architecture typescript cli

DeepSeek released the developer preview of DeepSeek Harness (v0.1, MIT), a coding-and-office agent framework built on the Cordis plugin system. Models, tools, skills, sessions, sandboxes, storage, scheduling, and UI are all composable plugins — developers extend or replace capabilities at the configuration layer without touching the harness core. Four run modes ship (Standard, PTC programmatic tool-calling, Minimal, and Create), with append-only session logs and a Trajectory view supporting resume, fork, retrieve, and replay. Run it via npx @deepseek-ai/dsh web.

Why it matters: DeepSeek is extending its "cheap frontier models" play into the harness layer, directly targeting OpenAI Codex and Claude Code. "Everything is a plugin" also mirrors 2026's broader shift toward composable agent runtimes instead of monolithic CLIs — and DeepSeek is open-sourcing the whole stack.

Developer preview — compatibility-breaking changes expected · 12k+ commits · plugin discovery via the dsh-plugin topic.

🔗 deepseek-ai/deepseek-harness · 🔗 DoNews

3. CVE-2026-72898 — CVSS 10.0 SQL injection in Metabase under active exploitation; CISA deadline today

• Velocity: ▮▮▮ trending
• Source: Bishop Fox · CVSS 10.0 · ~3d ago
• Tags: cve sql-injection metabase kev cvss-10

An unauthenticated SQL injection (CVSS 10.0) in Metabase's POST /api/session/reset_password endpoint lets any remote attacker inject arbitrary SQL into the application database and seize full admin control — including the standing credentials Metabase holds to every connected warehouse (Snowflake, BigQuery, Databricks, etc.). Metabase disclosed it as a zero-day on Aug 6 with active exploitation confirmed; CISA added it to the Known Exploited Vulnerabilities catalog on Aug 11 with a federal remediation deadline of Aug 14 (today). Fixed in branch releases (x.58.24+, x.59.21+, x.60.17+, x.61.11+, x.62.9+, x.63.5+); temporary workaround is blocking the password-reset endpoint.

Why it matters: A BI tool holding live credentials to production data stores is the ideal pivot point — one injected query can cascade into every connected database. With ~2,500 internet-exposed instances and public PoCs circulating, unpatched self-hosted deployments are a sitting target, and patching alone doesn't remediate prior compromise.

Affects self-hosted x.58–x.63 branches; versions below x.58 unaffected · Metabase Cloud already patched.

🔗 Bishop Fox · 🔗 CISA KEV

4. Cline ships Kanban — a local multi-agent scheduler where every card runs in its own git worktree

• Velocity: ▮▮ rising
• Source: GitHub · 1.3k stars · ~1d ago
• Tags: cline multi-agent worktree orchestration cli

Cline released Kanban (Apache 2.0, research preview), a local web board that runs CLI coding agents in parallel against one repo. Each task card spins up an ephemeral git worktree — sharing git-ignored files like node_modules via symlinks — so agents work side-by-side without merge conflicts. Cards can be linked into dependency chains, and combined with auto-commit/auto-PR toggles they form autonomous pipelines; a built-in review loop sends inline diff comments back to the agent. It auto-detects your installed CLI agent (Cline, Claude Code, Codex, OpenCode) and runs fully local via npx kanban.

Why it matters: Worktree-per-task is becoming the standard isolation primitive for parallel agent orchestration (Cline CLI v3.0.3 also added a --worktree flag). Kanban turns that primitive into a point-and-click control plane for a fleet of coding agents on a single codebase.

Research preview — uses experimental CLI-agent features like bypassing permissions and runtime hooks for more autonomy.

🔗 cline/kanban · 🔗 Cline Docs

5. Ponytail — the "laziest senior dev" agent skill — corrects its own benchmark after a challenge

• Velocity: ▮▮ rising
• Source: GitHub · 82k stars · ~1d ago
• Tags: agent-skills yagni benchmark claude-code codegen

Ponytail (github.com/DietrichGebert/ponytail) injects a seven-rung "decision ladder" into coding agents — check whether the thing needs to exist, already exists, or is a stdlib/native one-liner before writing the minimum that works ("the best code is the code you never wrote"). Its original "80–94% code reduction" claim drew a challenge from Scott Logic's Colin Eberhardt, who showed a bare "Follow YAGNI principles" prompt beat it on that benchmark. The author rebuilt the benchmark against a fair agentic baseline — headless Claude Code editing a real FastAPI/React repo across twelve feature tickets — and publicly revised the claim to ~54% less code on average, ~20% lower cost, ~27% faster execution.

Why it matters: Beyond one skill, this is a template for the whole agent-skills category, which is proliferating with no evaluation standard. Ponytail's response — a public behavioral test framework and reproducible benchmark — sets the expectation that a skill proves its claims rather than asserting them.

The author flagged the earlier figure as "a per-task ceiling misreported as an average" — Eberhardt called the correction "really happy."

🔗 DietrichGebert/ponytail · 🔗 InfoQ

6. CVE-2026-63077 — unauthenticated RCE in JetBrains TeamCity's agent polling protocol, exploited in the wild

• Velocity: ▮▮ rising
• Source: Rapid7 · CVSS 9.8 · ~1w ago
• Tags: cve teamcity ci-cd rce kev

A CVSS 9.8 unauthenticated remote code execution in JetBrains TeamCity On-Premises, rooted in unsafe deserialization in the build-agent polling protocol — which shares a network interface with the main web UI, so any internet-facing server is directly reachable. An attacker registers a temporary agent, submits a serialized XStream gadget chain to the agent command endpoint, drops a polyglot SQL/JSP webshell, and executes OS commands. Disclosed July 27 and added to CISA's KEV catalog Aug 5 after exploitation began; Rapid7 released a PoC and mass-exploitation tooling has since circulated. Fixed in 2025.11.7 and 2026.1.3, or via a patch plugin for 2017.1+.

Why it matters: TeamCity fronts source repos, CI secrets, and deploy pipelines — RCE there is a supply-chain-grade foothold. Censys observed ~4,500 exposed instances with only ~450 confirmed patched, making this a persistent soft target for CI/CD compromise.

Attack chain: register agent → XStream deserialization → HSQLDB SCRIPT writes a JSP webshell → anonymous GET executes Runtime.exec().

🔗 Censys · 🔗 Rapid7 PoC (sfewer-r7)

7. Turso runs unmodified Doom as a SQL query — SQLite's VDBE as "the LLVM of databases"

• Velocity: ▮ steady
• Source: Turso Blog · PoC demo · ~1d ago
• Tags: sqlite rust bytecode database llvm

Turso — the team rewriting SQLite in Rust (Limbo) — got unmodified Doom running as a VDBE bytecode program. A custom LLVM backend (vdbecc) compiles C → LLVM IR → SQLite bytecode; the entire C address space is one BLOB in a single row (loads/stores via BlobRead/BlobWrite), and the framebuffer streams out as one long-running query — SELECT * FROM doom. Controls are bind parameters ("Doom's input handler is a WHERE clause"), and saving the game is saving the database. A differential test confirmed the framebuffer is byte-for-byte identical to a native clang build.

Why it matters: It's a proof that SQLite's bytecode VM is a viable compilation target for arbitrary programs, not just SQL — positioning the rewrite as a shared substrate other databases can be built on, starting with a reimagined Postgres.

No register allocation needed — the VDBE register file is unbounded, so each SSA value gets its own permanent register.

🔗 Turso Blog · 🔗 tursodatabase/limbo

8. LoopX — an open control plane that keeps long-running AI agent teams on durable state

• Velocity: ▮ steady
• Source: GitHub · 4.6k stars · ~1w ago
• Tags: agents control-plane kanban state-kernel python

LoopX (MIT) is a provider-neutral "state kernel" for long-running agent teams: it keeps objectives, typed todos, claims/leases, evidence logs, quota-aware auto-wake, and verifiable handoffs stable while Codex, Claude Code, or Cursor execute bounded turns. It is explicitly not a runtime — it answers "may the loop continue?" and projects into a Kanban (e.g. a Lark/Feishu adapter) that is never the source of truth. State is local-first in a .loopx/ directory with no dependencies beyond the Python standard library; dangerous permissions and production writes stay human-gated. Maintained by a ByteDance engineer with English + Chinese docs and courses.

Why it matters: As agent runs stretch from minutes to days, the missing layer is durable state and human gates across turns — not another runtime. LoopX's "board is a projection, kernel is truth" model is a clean answer to agent drift on multi-day, multi-agent work.

🔗 huangruiteng/loopx · 🔗 Moclaw Blog

9. HL-Gauss PPO — swapping the critic's scalar head for a categorical predictor (COLM 2026)

• Velocity: ▮ steady
• Source: arXiv · COLM 2026 · ~2d ago
• Tags: reinforcement-learning ppo rlvr research arxiv

"Start Classifying: Categorical Critics for LLM Reinforcement Learning" (arXiv 2608.02181, accepted at COLM 2026) replaces the scalar MSE critic in PPO with a categorical predictor trained against Gaussian-smoothed HL-Gauss targets, decoded back to a scalar so the actor update stays unchanged — a drop-in critic swap. On RL with verifiable rewards, where rewards are sparse and binary and small value errors distort the advantages PPO relies on, HL-Gauss PPO consistently beats strong PPO and DAPO baselines across math reasoning, tool-augmented math, and Search-R1 on Qwen2.5/Qwen3 backbones, with better calibration and lower-variance advantages.

Why it matters: RLVR is the engine behind frontier reasoning models, and its critic is the weakest calibrated component. A critic head that improves stability and calibration with zero actor changes is a cheap, transferable win for post-training pipelines.

🔗 arXiv · 🔗 ZhijianZhou/HL-guass-ppo

10. CVE-2026-73240 — CVSS 9.8 git argument injection in Apache Allura enables unauthenticated RCE

• Velocity: ▮ steady
• Source: IONIX · CVSS 9.8 · ~1d ago
• Tags: cve apache git rce command-injection

A critical argument-injection flaw (CWE-88, CVSS 9.8) in Apache Allura — the forge software behind SourceForge — passes attacker-controlled input into underlying git command invocations without sanitization, letting unauthenticated remote attackers inject arguments and run arbitrary commands with the host's privileges. All versions before 1.19.1 are affected; upgrading to 1.19.1 (plus the documented configuration and database migration steps) is required.

Why it matters: Git argument injection is a recurring, high-blast-radius bug class in any forge or SCM tool that shells out to git. For self-hosted Allura deployments, this is a full-compromise RCE with no authentication required — patch immediately.

🔗 IONIX · 🔗 NVD