Welcome back. Frontier labs like OpenAI and Anthropic have been accidentally leaving the door wide open for model distillation. German researchers just uncovered security flaws in the OpenAI and Claude APIs that allow their internal reasoning to be cloned into smaller models. ML researcher argues that this is quietly being exploited by Chinese labs to bridge the gap.

Also: How Cursor turned agents into better engineers, how to fix your colleagues who don’t read PRs, and a refined prompt to manage your Claude Code token usage.

SpaceXAI ships AI coworkers that never log off: Elon Musk's lab just dropped Grok Bot in early beta. It's a team of AI coworkers that can sign into your tools, operate them directly, and deliver finished work. These always-on agents can log into apps like Gmail and Salesforce to handle multi-step workflows for you. They also coordinate behind the scenes, handing off tasks to one another just like a human team. Try it here.

New flaw in OpenAI and Anthropic APIs explains how they could be distilled: Security researchers found a vulnerability across OpenAI, Anthropic, and Google APIs. Models from these labs hide their reasoning in encrypted blocks, but new research shows that attackers can pass these blocks to a weaker model and have it print the reasoning in plain text. This allows competitors to steal proprietary reasoning to train cheaper clones and enables model distillation. These same blocks could also leak API keys and passwords, carry hidden malicious instructions, or even expose unsafe thoughts that the model had buried.

Nvidia unveils an open model on a budget: The chip maker just dropped Nemotron 3.5 Lightning, a 30B open model that only uses 3B parameters at a time. It’s designed to handle the routine steps in long agentic workflows and is efficient enough to run on a single GPU. Along with the model, Nvidia also released NeMo Switchyard, an open-source router that automatically sends tasks to the most suitable model. The company claims Lightning can deliver speeds up to 4x faster than similar models. More details on the weights here.

Tracking AI spend is fairly easy, but understanding why it costs what it does (and what the actual ROI is), is a challenge for most teams.

If you want to cut costs and gain value, read Datadog’s latest AI ROI guide. Inside you’ll learn:

Download the guide at no cost.

The mark is shipping. Anthropic confirmed this week that Claude models have started to weave a watermark into generated text, including code. It applies across Claude Code, the API, and deployments through AWS, Google Cloud, and Microsoft Foundry worldwide. The move quickly drew pushback from devs online. Senior software engineer Nick Dobos summed up the concern perfectly: he doesn't want invisible information in his codebase that he cannot control. 

The AI lab holds the power. Anthropic has gone public with the policy, but they haven't released the inspection tools yet. This imbalance is exactly what's putting developers on edge. Their main concerns are: 

The EU did not ask for this. While Anthropic frames the move as part of its EU AI Act compliance, it’s worth noting that the European Commission's guidelines exempt source code from the marking requirement. The AI lab’s policy marks all generated text, with no exception for code. This means production code can now carry underlying data that its own developers can't even inspect. 

Where to dig in. This walkthrough breaks down how Claude's text watermarks actually work, while Anthropic's official policy page outlines what’s covered now and what ships later. 

P.S. Devs have already turned to the Watermarks-Remover GitHub repo to remove Claude’s watermarks from their content.

AI writes more code than ever. Reviewing it shouldn’t mean going through files in alphabetical order. 

CodeRabbit Change Stack turns any PR into a layered walkthrough - overview page, timeline view, semantic diff and agentic chat - so you understand the real change behind your code. 

Free in early access. Review your next PR with CodeRabbit Change Stack Today

7 Codex skills to use daily (by an engineering leader at Oracle): You'll learn how to streamline your workflow using seven essential Codex skills. This tutorial covers managing skills across AI coding agents, creating clear technical specs, and breaking work into GitHub issues. You'll also learn to generate visual docs, clarify vague prompts, automate pull request reviews, and draft architecture design docs.

OpenRouter for agent tools: This tool simplifies how AI agents access data. Instead of managing multiple accounts, you can use a single URL and token to access over 2,600 different services.

The 14-step roadmap from prompter to loop designer: Developers often burn time manually prompting coding agents, which kills productivity on repetitive tasks that a machine could easily check. This guide walks you through how to automate that workflow by building structured agentic loops with built-in verification and persistent state files.

Codex, Claude Code, and Cursor tend to degrade over time, and the problem usually isn't the model itself. It's often due to old skills, MCPs, and instruction files piling up in the workspace and creating silent conflicts.

This AI developer just shared a prompt that lets the agent audit its own configuration for you. 

P.S. Get 50+ AI coding hacks for Claude Code, Cursor, and Codex here.

Check out these 4 terminal tools a senior engineer relies on daily and see if they can help streamline your own workflow. 

Grow customers & revenue: Join companies like Google, IBM, and Datadog. Showcase your product to our 300K+ engineers and 150K+ followers on socials. Get in touch.

You can also reply directly to this email if you have suggestions, feedback, or questions.

Until next time — The Code team