Qwen3.8 Max led the agentic index by 0.1 points for a few hours before a version bump moved every score. Plus: the Opus 5 prose revolt, two measurements of how review fails, and the skills wave.
The most-upvoted AI story of the day says Qwen3.8 Max just took the agentic crown from Claude Opus 5. It did — by 0.1 points, for a few hours, until a benchmark version bump moved every score on the chart. The timeline is better than the ranking. Meanwhile r/ClaudeAI's top thread is a revolt against how Opus 5 writes, a 40,000-run experiment puts a number on how badly humans review their agent's commands, and the skills wave still owns GitHub trending. The daily pulse of AI coding tools — what shipped, what matters, what's next.
In this issue
•
Qwen's agentic lead lasted hours; Opus 5 tops it 59.2
•
r/ClaudeAI says Opus 5 writes docs nobody can read
•
Humans missed 1 in 3 threats approving agent commands
•
54% of AI-written security patches failed or added flaws
•
DeepSeek warns of a big price rise in its own docs
•
Trending is all skills, and installs were the trust signal
The leaderboard everyone quoted today #
Qwen3.8 Max led the agentic index by 0.1 for hours — then a version bump moved every score
Yesterday's biggest story on Hacker News and r/LocalLLaMA said Qwen3.8 Max had taken the top spot on Artificial Analysis' Agentic Index. It had — by 0.1 points, briefly. Archived snapshots pin the timeline. August 5: Opus 5 leads at 55.3, Qwen3.8 Max not yet evaluated. August 6 morning: Qwen3.8 Max debuts at 55.4. Same day, Artificial Analysis ships Intelligence Index v4.1.1, re-versioning τ³-Banking (half the agentic score) and upgrading graders; the live chart now reads Opus 5 59.2, Qwen3.8 Max 58.4. The “best overall model” framing was never right either: the Agentic Index averages two benchmarks, and the nine-benchmark Intelligence Index has Opus 5 first at 63 with Qwen3.8 Max outside the top ten. A 0.1-point lead on a sub-index was the day's top story. Check the chart's date before repeating its rank.
[Qwen 3.8 Max now ranked as best overall model ahead of Opus 5 by Artificial Analysis agentic index]
by[u/anderspitman]in[LocalLLaMA]
What developers are saying about the model they just got #
r/ClaudeAI's top thread says Opus 5 writes docs nobody can read
The thread asks how to stop Opus 5 writing documentation. The sub's bot summary after 80 comments reports consensus: verbose, jargon-heavy, ignoring CLAUDE.md, skills and memories. The top reply names the vocabulary — “load bearing”, “seam”, “blast radius”, “surface”. The fixes: plan with Fable, delegate code to Sonnet 5; enforce ASD-STE100 simplified technical English; add a stop-hook rejecting those words. We banned this register in our style rules yesterday. It's real. If your docs run on Opus 5, add that hook.
[Opus 5 is literally useless for documentation]
by[u/Sneaky_Tangerine]in[ClaudeAI]
Reviewing what your agent writes and runs #
Humans missed 1 in 3 threats in a 40,000-run agent-approval game
Scale X ran a browser game where you approve agent commands. Across 40,000 runs, mean accuracy was 66.3%. Miss rates split by type: 11.7% for destructive commands like rm -rf /, but 33.4% for exfiltration and 35.0% for reading ~/.aws/credentials. Most-approved threat: npm run analyze at 64.7%, since the danger is whatever package.json points at. The author's caveat: 34% of commands shown were threats, under time pressure. That's not a real day. Assume your approval step catches only the loud attacks.
Off-by-1 Labs found 53.9% of AI-written security patches failed or added flaws
Off-by-1 Labs at 1Password had ChatGPT-5.5 and Opus 4.8 generate 6,080 patches for six recently disclosed vulnerabilities, including a Gemini CLI remote-code-execution bug and a Chrome use-after-free. Only 26.0% fully fixed the flaw without changing behavior. 20.1% fixed it but changed behavior. 53.9% failed, introduced a new vulnerability, or both. A third of the successful patches were narrow input checks, not root-cause fixes, so the bug returns if the code becomes reachable elsewhere. Never merge a model's security patch unread.
What it costs #
DeepSeek warns of a “significant” price increase in its own pricing docs
DeepSeek's pricing page now carries a line the coverage paraphrased: “We plan to raise the overall pricing for DeepSeek API services in the near future, with a significant increase expected.” There's no number and no date. The specific plan is “subject to official notice.” So price what you have today: deepseek-v4-flash runs $0.14 per million input tokens on a cache miss and $0.28 output, deepseek-v4-pro $0.435 and $0.87. If DeepSeek's floor is what your cost model rests on, re-run the numbers this week.
5 trending AI coding tools right now (and the problem no list mentions) #
Everyone's top-of-trending is the same word: skills
Open GitHub trending any day this week and it's wall-to-wall agent skills — packaged instruction sets your coding agent loads on demand. The big three:
-
obra/superpowers (268K⭐) — the skills framework the others orbit. “Often copied, never beaten” per its fans; “does out-of-the-box Fable make it obsolete?” per its skeptics. That argument is itself a sign it won.
-
mattpocock/skills (208K⭐) — “Skills for Real Engineers,” straight from Pocock's own .agents directory. Six months old.
-
addyosmani/agent-skills (83K⭐) — production-grade skills from Chrome's engineering leadership, trending daily as of this morning. Google itself is now on the board: google/skills (16K⭐, “Agent Skills for Google products and technologies”) is trending today. When the platform vendors start shipping into an ecosystem, the ecosystem stops being a hobby.
The long tail is where it gets interesting
- The niche skill packs — this week's daily/weekly lists include book-to-skill (turn any technical-book PDF into a skill, 18K⭐), reverse-skill (authorized-pentest skill router, 20K⭐), and i-have-adhd (18K⭐) — a skill whose whole job is stopping your agent from burying the answer. When the long tail gets this specific, an ecosystem has arrived.
The non-skills entry
- antirez/ds4 (21K⭐) — Salvatore Sanfilippo's from-scratch local inference engine for DeepSeek 4 Flash (Metal/CUDA/ROCm). The Redis author writing a bare-metal engine for last week's hottest open model is the most “2026” sentence available.
Bubbling under: cloudflare/computer (“give your agent a computer,” 5.2K⭐ and still climbing), code-review-graph (local-first code intelligence for MCP — the plug standard AI coding agents use — 29K⭐).
The npm scoreboard
Weekly downloads, week ending Aug 6: @openai/codex 16.4M · @anthropic-ai/claude-code 11.4M · opencode-ai 2.2M. Codex still leads by about 5M. But Claude Code grew faster last week, 11.2% against Codex's 6.4%, and the gap narrowed slightly. One week is not a trend; check it again next Friday.
And here's what none of the “top tools” posts mention
Yesterday at Black Hat, Zenity Labs disclosed a credential-stealing campaign that ran through Vercel's skills.sh marketplace — a typosquatted skill family (fake Paperclip / Browser Use skills) that amassed 1.7M aggregate installs (their caveat: installs, not unique users).
The mechanism is the story: the skills were clean copies of legitimate skills while they accumulated installs — then the content behind them was swapped to make agents download and run attacker code, harvesting SSH keys, cloud creds, git tokens, and CI configs. A time-of-check/time-of-use hole in how marketplaces vet.
Read that against the list above: every trending roundup — including this one — ranks by stars and installs. The install count was the trust signal being gamed. Vercel and GitHub pulled everything within 12 hours of notification; more than 30% of the other dangerous skills Zenity found abuse Claude Code or OpenClaw as malware droppers (per Zenity's press release; the campaign write-up doesn't carry that stat); one reinstalls itself if deleted. And the detail the full report adds: PyPI caught this same actor's packages twice, each within about 2 hours — the skills marketplace let the trojanized family trend for about 3 weeks.
Trend responsibly.
Also worth your time #
• A Fable 5 agent with a domain and a $90 budget it can't spend without approval — it named itself Cairn and keeps a blog. r/ClaudeAI, 231 points.
• A reported hidden “instantaneous” rate limit beyond the 5-hour and weekly ones — unverified, actionable if it holds up. r/ClaudeAI.
• vLLM's serving stack ported to C++20 — a 66 MiB binary, no Python at inference, output checked token-for-token. r/LocalLLaMA, 287 points.
• “Software development with AI is starting to feel like cooking steak” — the essay behind a 404-comment Hacker News thread.
Know someone who'd want this in their inbox? Forward it — that's how this grows. And if we got something wrong, or you think we buried the real story today, hit reply. A person reads every one.
The New Way is human-curated — a person picks every story. The summaries are written with AI (Claude) and reviewed before we hit send.