Welcome back. China's Moonshot just dropped the full open weights for Kimi K3. Frontier intelligence is now available to every dev — or is it? With 2.8 trillion parameters, most developers would need a small fortune to deploy it on their local setup at home. But that doesn’t mean devs don’t have a plan to put it to use.

Moonshot drops Kimi K3’s open-weights that undercut frontier rivals: The Chinese AI lab just released the full weights for Kimi K3, a massive 2.8-trillion-parameter model with native visual understanding and a 1M-token context window. But at that size, most devs won't be able to run it locally. Instead, they expect providers to serve it cheap and fast, then distill it into smaller models that actually run on consumer GPUs. Still tempted? See what it takes.

Microsoft's first cyber model secures code on a budget: The software giant just debuted MAI-Cyber-1-Flash within MDASH, a multi-agent harness designed to find and fix vulnerabilities across complex codebases. The company claims it hits 96% on CyberGym, beating out Gemini, GPT, and Mythos at half the cost. The model handles routine scans on its own and only escalates the toughest 10% of tasks, finally making always-on code security affordable enough to actually use. Get early access.

Anthropic's CEO responds to open-weights ban allegations: The AI lab's CEO says Anthropic has "never advocated" banning open-weights models. This clarification comes after more than 130 companies signed a letter opposing those kinds of restrictions. Now, Dario Amodei wants to shift the focus. He's calling for tighter chip export controls and mandatory safety testing for any powerful model, whether it's open or closed. You can read his full essay here.

Claude Code, Cursor, Codex. The output ceiling is insane. But "fix the bug" gets you slop. Detailed context gets you shipping code.

The problem: typing out file references, edge cases, and architecture context 40 times a day is exhausting. So you cut corners. Your agent gets lazy input.

Wispr Flow lets you speak full prompts with syntax-aware dictation. camelCase, snake_case, file names all preserved. Auto-tags files in Cursor and Windsurf.

Used by engineers at OpenAI, Vercel, and Clay. Works on Mac, Windows, iPhone, and Android.

Better prompts in. Better code out. Try Free

Anthropic’s security team recently shared a story that should put every engineering team on alert: One of their security agents asked another Claude instance to deploy a fix it wasn't authorized to push on its own. Luckily, a human reviewer caught it before it could ship. This incident confirms that you can't secure an agent by constraining its instructions. You can constrain its access and actions, including its access to other agents.

Security scales with Code. Engineers at Anthropic now ship 8x more code per quarter than they did in 2021, and Claude writes roughly 80% of it. So security becomes an important part, and it should scale with every stage of the software lifecycle.

Deputy CISO Jason Clinton shared a high level overview of how Anthropic is managing it:

The playbook is public. Clinton's full post goes deeper on each stage, including how new AI reviewers earn trust before their approvals count. Read it, pick one stage, and pilot it in the next sprint.

How to fine-tune any AI model locally: You're going to learn how to locally fine-tune LLMs with Unsloth Studio. This tutorial walks through picking the best base model for your gear, building your own training data, and kicking off the fine-tuning. Finally, it shows how to compare your results and export the custom model.

Atomic Agent: A local-first AI that manages your browser and files. It uses high-speed local models to run commands and remember context securely on your machine. 

How to reduce token spend: Using AI agents for complex workflows is a huge drain on time and tokens. This guide shows you how to swap LLM-driven coordination for deterministic code. It'll cut your token usage by 8x and slice execution time in half. 

Codex ships with OpenAI models, and pointing it at another provider means an xAI API key and pay-as-you-go billing. AI engineer and educator, Alvaro Cintas, shared a setup to route Grok 4.5 through Codex.

You just use an X Premium subscription as your credential instead. The tool is called opencodex. It’s a local proxy that translates the API into whatever the model speaks.

Install it and OAuth into xAI with your X account. Then you can inject it right into Codex:

P.S. Get 50+ AI coding hacks for Claude Code, Cursor, and Codex here.

Anthropic just dropped a certification for devs building with Claude Code. Pass the proctored exam, and the credentials are yours to keep.

Grow customers & revenue: Join companies like Google, IBM, and Datadog. Showcase your product to our 300K+ engineers and 150K+ followers on socials. Get in touch.

You can also reply directly to this email if you have suggestions, feedback, or questions.

Until next time — The Code team