DEV Community: Creeta

Seedance 2.5 targets 30s 4K — nothing independent confirms it

Creeta — Sat, 27 Jun 2026 16:00:30 +0000

ByteDance says its next video model can produce a continuous 30-second 4K clip from a single prompt. As of late June 2026, no independent source confirms that — and the gap between the announcement and any verifiable artifact is the story.

From 15s to 30s: What ByteDance Says 2.5 Can Do

Seedance 2.5 is ByteDance's announced next-generation AI video model, unveiled on June 23, 2026 at the Volcano Engine FORCE conference in Beijing . The headline claim is native long-form generation: a 30-second single-segment clip from one prompt, double the 15-second ceiling of Seedance 2.0, which removes the manual clip-stitching that continuous storytelling currently requires . ByteDance also claims native 4K output with 10-bit color — generated, it says, not upscaled.

The announced spec sheet goes further than duration and resolution:

50 full-modal reference inputs — images, video, audio, 3D models, and style/text anchors in one generation, versus the documented 3 video clips and 9 images on 2.0 .
Localized semantic editing — change a character's outfit color or scene lighting while preserving camera angle, composition, and actor motion .
3D white-box pre-visualization — turn low-fidelity 3D blockouts into a quick animated preview before committing to a full render .

Treat all of it as vendor-announced. There is no arXiv paper, model card, or independent benchmark for 2.5 as of late June 2026, and the 10-bit color and prompt-adherence numbers trace to secondary reporting, not a disclosed test. The version number itself is a tell. The Information reports ByteDance had planned a 2.1 release and rebranded it 2.5 to signal a generational leap and seize initiative against rivals:

"The company had planned a 2.1 release but rebranded it 2.5 to seize competitive initiative against rivals like OpenAI's Sora and Kuaishou's Kling," per reporting from The Information.

That skip from 2.0 straight to 2.5 is the question worth holding onto: is this an engineering jump big enough to justify the number, or marketing positioning ahead of a still-unreleased beta? The sections below show how to get ready to test it the moment it ships — and exactly what to verify against the official docs before trusting the spec sheet.

Before July: Signing Up on Jimeng and ModelArk

There are two doors into Seedance, and which one you use depends on whether you write prompts or write code. Consumers go through ByteDance's own apps; developers go through its cloud API. Both run on the live 2.0 model today, and both are worth provisioning before the 2.5 beta opens so you are not debugging account setup under launch-day traffic.

The consumer path starts with a Douyin account verified by mobile/SMS. Use that account to authorize a Jimeng (Dreamina) login at jimeng.jianying.com, then go to Generate → Video Generate and pick the Seedance model from the dropdown . The same model is also reachable through CapCut and Doubao. Outside mainland China the friction is real: Jimeng still requires a Douyin account tied to a Chinese phone number, and depending on region a VPN. ZeroLu's community how-to documents the cross-border login and prompting steps .

The developer path is registration on Volcano Engine / BytePlus ModelArk, where text-to-video and image-to-video endpoints are live . As of late June 2026 the only published model identifier is doubao-seedance-2-0-260128 — no 2.5 ID exists yet . The enterprise 2.5 beta is invite-only, so set up both accounts now.

The ModelArk Submission Flow for Seedance 2.0

The submission flow is straightforward once your account is live: authenticate to BytePlus ModelArk, pull your API credentials from the console, and target the only published identifier — doubao-seedance-2-0-260128 . ModelArk exposes text-to-video and image-to-video endpoints with parameters for resolution, duration, and aspect ratio, so you build the request, set duration, and poll for the rendered clip .

Pricing depends on which platform you call. BytePlus ModelArk bills per second in USD; Volcano Engine bills per million tokens in yuan. Budget against both before committing a batch:

Platform	Tier	Rate
BytePlus ModelArk	Standard 480p	$0.092/s
BytePlus ModelArk	Standard 720p	$0.199/s
BytePlus ModelArk	Fast 480p	$0.074/s
BytePlus ModelArk	Fast 720p	$0.161/s
Volcano Engine	Doubao video 2.0, with video input	¥28 / million tokens
Volcano Engine	Doubao video 2.0, no video input	¥46 / million tokens

Rates above are 2.0 figures . Construct the prompt as an ordered chain — subject → action → environment → shot size → camera movement → lighting → timing → style → constraints:

"8s cinematic close-up of a ceramic coffee cup on a rainy cafe table, steam rising, slow dolly-in, warm interior light, shallow depth of field, no text overlays."

Escalate only as the shot demands it:

Text-to-video for a simple shot.
Image-to-video when identity or a product must persist — put identity in the reference image and let the prompt describe only motion and camera, since over-specifying visual identity fights the reference .
Add audio when timing, voice, or sync matters.
Add a video reference when the camera path is hard to describe in text — use short, clean clips.

Respect the duration window: 4–15s on 2.0; submit outside that range and the job is rejected . On 2.5 the window is expected to extend to 30s, but treat that as unconfirmed until official docs update. No 2.5 pricing is published, and native 4K, 10-bit color, 30-second clips, and up to 50 references demand materially more compute than 2.0 Standard — budget for a higher per-second rate and run a fresh cost comparison on day one of general availability .

The Traps: Copyright Overhang, Regional Lock, and 4K Uncertainty

The biggest operational risk with Seedance is legal, not technical. Within days of the 2.0 launch, users generated clips alleged to resemble copyrighted characters and celebrity likenesses, and rights holders moved fast. Disney sent ByteDance a cease-and-desist on February 13, 2026, citing Star Wars, Marvel, and other works . On February 20, 2026 the Motion Picture Association followed with its own cease-and-desist alleging "pervasive and widespread infringement" and demanded written remediation steps by February 27, 2026 . Output filters exist but are not comprehensive, so the liability sits with you, the operator.

Build safe prompt discipline into your pipeline now:

Use generic roles, original characters, owned product photos, and authorized audio/video references.
Avoid named actors, living people, copyrighted characters, franchise names, and protected visual styles you do not have rights to.

Regional access is the second trap. Jimeng/Dreamina requires a mainland Chinese phone number for the Douyin login flow, while BytePlus ModelArk is globally accessible — but verify your account tier limits before wiring it into a production pipeline .

The third trap is cost. With no published 2.5 pricing, establish a real comparator today: submit a baseline 2.0 480p job and a 2.0 720p job on ModelArk, which bills text-to-video per second — Standard $0.092/s at 480p and $0.199/s at 720p . That gives you a measured cost-per-second baseline so you can quantify the premium the moment 2.5 native 4K pricing drops.

Once 2.5 Is Available: What to Confirm

The moment Seedance 2.5 reaches general availability, treat the GA release page as the only canonical source for parameters — not the secondary tech reporting that has carried every spec so far. As of June 2026, Volcano Engine and BytePlus ModelArk still expose only doubao-seedance-2-0-260128, with no 2.5 model ID published . Run a short verification checklist on GA day:

Find the model ID in the ModelArk docs; without it there is no programmatic call to make .
Submit a 30s text-to-video at 4K and diff it against a 2.0 720p job on visible quality and per-second cost — the only way to independently test the native-4K claim against your measured 2.0 baseline.
Confirm the 50-reference multimodal input lands on the API, not just the Jimeng consumer UI; a consumer-only gate would block programmatic pipelines entirely .
Watch for an arXiv technical report. ByteDance published one for 2.0 within weeks of its early-February 2026 release ; until a 2.5 paper exists, every figure stays vendor-announced.

The takeaway is discipline over hype. This snippet, which runs and exits clean, is the posture to keep until the docs catch up:

claims = {
    "subject": "Seedance 2.5",
    "target": "30s 4K",
    "source_type": "vendor / rumor",
    "independent_confirmation": [],
}

print(f"{claims['subject']} targets {claims['target']}.")
if not claims["independent_confirmation"]:
    print("No independent source in this snippet confirms that target.")

Last updated: 2026-06-27. Verify all 2.5 parameters against the official Volcano Engine / BytePlus ModelArk docs once GA endpoints go live.

Frequently asked questions

Is Seedance 2.5 publicly available right now?

No. As of late June 2026, only an enterprise and global beta is live; general availability is targeted for early July 2026 . The working path today is Seedance 2.0 — via the BytePlus ModelArk API for developers, or the Jimeng/Dreamina consumer interface. Official ByteDance product pages still document 2.0, so treat 2.5 as announced, not shipped.

What does BytePlus ModelArk charge for Seedance 2.0?

BytePlus ModelArk bills 2.0 text-to-video per second of output. Standard tier is $0.092/s at 480p and $0.199/s at 720p; the lower-latency Fast variant is $0.074/s at 480p and $0.161/s at 720p . The domestic Volcano Engine platform instead bills in yuan per million tokens. Seedance 2.5 pricing is not yet published; native 4K, 10-bit and 30-second output should be expected to cost more per second.

How do I access Seedance outside China?

Two routes exist. The consumer path, Jimeng/Dreamina at jimeng.jianying.com, requires a Douyin account with a mainland Chinese phone number and may need a VPN depending on region . For developers, the BytePlus ModelArk API is globally accessible without a Douyin login or VPN, which makes it the recommended path for programmatic generation and workflow integration.

What are the copyright risks when prompting Seedance?

They are significant and already litigated. Disney sent ByteDance a cease-and-desist on February 13, 2026 citing Star Wars and Marvel works , and the Motion Picture Association followed on February 20, 2026 alleging widespread infringement . Avoid named actors, living people, copyrighted characters and franchise names. Output filters exist but are not comprehensive guards — the safe workflow uses original characters and owned assets.

What does Seedance 2.5 add over 2.0, and is any of it verified?

Announced changes are a 30-second single-segment clip versus 15s, native 4K 10-bit color versus a 720p maximum, up to 50 reference inputs versus 3 video clips and 9 images, a unified audio-video latent space for native lip-sync, and localized semantic editing . None of it is independently verified: there is no model card, benchmark name, or arXiv paper for 2.5 as of late June 2026 — only the 2.0 technical report is published . Every spec is vendor-announced.

96% of cuBLAS, no `unsafe`: what cuTile Rust proves

Creeta — Fri, 26 Jun 2026 21:46:04 +0000

GPU programming usually asks Rust developers to surrender the borrow checker at the launch boundary: references collapse into raw pointers, and aliasing, synchronization, and stream lifetimes become hand-managed invariants. A new NVIDIA Labs paper argues that trade is unnecessary.

How cuTile Rust Extends the Borrow Discipline to GPU Dispatch

cuTile Rust is a tile-based DSL that carries Rust's ownership and borrowing rules across the host-to-GPU launch boundary — not just through host code. Introduced in "Fearless Concurrency on the GPU" (arXiv:2606.15991), submitted by NVIDIA researchers Melih Elibol, Jared Roesch, Isaac Gelado, Eric Buehler, and Michael Garland , it lets you author the kernel itself in idiomatic, memory-safe Rust rather than wrapping hand-written unsafe CUDA.

The mechanism is type construction, not a runtime lock. Before launch, mutable output tensors are partitioned into provably disjoint tiles; each tile program then receives an exclusive &mut view of its slice, while inputs arrive as shared & references . Because the partitions cannot overlap, the kernel is single-threaded in its semantics and data-race-free by construction, yet still compiles to massively parallel GPU code. As Melih Elibol put it, "each tile program gets an exclusive &mut view of its memory, plus the inputs as shared references" (source: users.rust-lang.org). Explicit unchecked types remain available for local opt-out when you need lower-level control.

The safety story would be academic if it cost throughput, but the reported numbers say otherwise. On an NVIDIA B200, cuTile Rust reaches 7 TB/s on memory-bound element-wise operations and 2 PFlop/s on GEMM — roughly 96% of cuBLAS, and within measurement noise of cuTile Python . End to end, the companion Qwen3 inference engine Grout reaches 171 generated tokens/s for Qwen3-4B on an RTX 5090 and 82 tokens/s for Qwen3-32B on a B200 in batch-1 decode . Those are the authors' own measurements on specific hardware — independent reproduction is not yet established — but they frame the central claim this article unpacks: safe Rust kernels without a measured performance penalty.

sm_80+, Driver ≥610, Rust 1.89: What the Crate Expects

Before any of that lands on your hardware, the crate sets a firm floor. cuTile Rust targets NVIDIA GPUs with compute capability sm_80 or higher — Ampere, Hopper, and Blackwell — which excludes Volta (V100) and earlier . It builds on CUDA 13.3, Rust 1.89+, and Linux, tested on Ubuntu 24.04; Windows and macOS are unsupported, and no AMD/ROCm or Metal backend exists as of June 2026 . CUDA 13.x needs driver ≥580 for minor-version compatibility, and CUDA 13.3 GA corresponds to Linux driver ≥610.43.02 .

Requirement	Minimum
GPU compute capability	sm_80+ (Ampere/Hopper/Blackwell)
CUDA toolkit	13.3
Linux driver	≥610.43.02 (≥580 for 13.x minor-compat)
Rust	1.89+
OS	Linux (Ubuntu 24.04 tested)
Tile IR toolchain	CMake 3.20+, C++17, Python 3.6+

The Tile IR toolchain itself — cuda-tile-translate and tileiras, which compile MLIR-based Tile IR bytecode into cubins — expects CMake 3.20+, C++17, and Python 3.6+ . Confirm your driver and GPU first; everything below assumes the floor is met.

Annotating, Partitioning, and Dispatching a cuTile Rust Crate

Writing a cuTile Rust kernel means declaring a #[cutile::module] block, annotating the function with #[cutile::entry()], and bringing the prelude into scope with use cutile::prelude::*. The macro rewrites that function into a GPU kernel and auto-generates the host-side launcher that partitions tensors — you write no hand-rolled dispatch code . The canonical element-wise add reads like ordinary Rust:

#[cutile::module]
mod kernel {
  #[cutile::entry()]
  fn add<const B: i32>(
    z: &mut Tensor<f32, {[B]}>,  // exclusive write
    x: &Tensor<f32, {[-1]}>,     // shared read
    y: &Tensor<f32, {[-1]}>,     // shared read
  ) {
    let tx = load_tile_like(x, z);
    let ty = load_tile_like(y, z);
    z.store(tx + ty);
  }
}

The signature is the contract. Mutable outputs are typed &mut Tensor<f32, {[B]}>; shared inputs are &Tensor<f32, {[-1]}>. The const-generic shape parameter encodes the tile size at the type level, so the borrow checker sees one exclusive writer and many immutable readers per tile .

On the host the recipe is short: create your tensors, call .partition([128]) on the mutable output before launch, then run kernel::add(z, x, y).sync()? for blocking execution. The generated launcher holds the operands while GPU work is in flight, and ownership of the tensors returns to you only after .sync() completes . Because the partitions are provably disjoint, each tile program is single-threaded in its semantics and data-race-free by construction.

For inference pipelines, cuTile Rust exposes a lazy DeviceOp model. Use .sync() for blocking dispatch, .into_future() (via IntoFuture) for async execution, and .graph() / CudaGraph::scope for CUDA graph capture and replay . The intended pattern builds a reusable layer graph once, borrows temporary buffers mutably inside each recorded op, and releases them after sync. Stream-order capture plus Rust lifetimes make buffer reuse visible to the type system, so ordering is enforced without manual annotation. Kernels JIT-compile through CUDA Tile IR, an MLIR-based intermediate representation, before reaching the GPU .

The safety idea is easy to feel out without a GPU. The illustrative Python below (executed; not the production Rust path) proves each tile's bounds once, then touches memory only through checked ranges — the same "prove disjointness, then trust the slice" shape cuTile Rust enforces at compile time:

from dataclasses import dataclass
from random import Random


@dataclass(frozen=True)
class Tile:
    row: range
    col: range
    red: range

    def proved(self, m: int, n: int, k: int) -> "Tile":
        assert 0 <= self.row.start <= self.row.stop <= m
        assert 0 <= self.col.start <= self.col.stop <= n
        assert 0 <= self.red.start <= self.red.stop <= k
        return self


def tiled_matmul(a, b, block=8):
    m, k, n = len(a), len(a[0]), len(b[0])
    c = [[0.0] * n for _ in range(m)]
    proofs = 0
    for i in range(0, m, block):
        for j in range(0, n, block):
            for p in range(0, k, block):
                t = Tile(range(i, min(i + block, m)),
                         range(j, min(j + block, n)),
                         range(p, min(p + block, k))).proved(m, n, k)
                proofs += 1
                for r in t.row:
                    for q in t.red:
                        arq = a[r][q]
                        for s in t.col:
                            c[r][s] += arq * b[q][s]
    return c, proofs


def plain_matmul(a, b):
    return [[sum(x * y for x, y in zip(row, col)) for col in zip(*b)] for row in a]


rng = Random(0)
size = 24
a = [[rng.random() for _ in range(size)] for _ in range(size)]
b = [[rng.random() for _ in range(size)] for _ in range(size)]
got, proofs = tiled_matmul(a, b)
want = plain_matmul(a, b)
err = max(abs(got[i][j] - want[i][j]) for i in range(size) for j in range(size))

print("cuTile idea in Python: prove tile bounds once, then use only checked ranges.")
print(f"tiles proved: {proofs}; unsafe operations: 0")
print(f"max error vs reference: {err:.2e}")
print("The 96%-of-cuBLAS claim is about Rust/CUDA performance; this shows the safety proof shape.")

Friction to Expect: No AMD, Evolving Macros, Unproven Concurrency

cuTile Rust is NVIDIA/CUDA-only today, and that constraint runs deep. There is no AMD/ROCm path, no Metal backend, and no portable WebGPU fallback — every kernel JIT-compiles through CUDA Tile IR into cubins . The compute-capability floor is hard: sm_80 (Ampere) or newer, paired with CUDA 13.3, Rust 1.89+, and Linux . Any pre-Ampere card is excluded outright.

The surface API is explicitly early-stage. The Tensor<f32, {[B]}> const-generic shape syntax and the #[cutile::module]/#[cutile::entry()] macro forms can change between releases . Pin your dependency in Cargo.lock before this lands in CI; treat API churn as expected, not exceptional.

Be precise about the headline numbers. The 96%-of-cuBLAS GEMM result and 171 tokens/s batch-1 decode for Qwen3-4B on an RTX 5090 are the authors' own measurements on specific hardware, including a B200 . An independent evaluation of the CUDA Tile Python stack reported 52–79% of cuBLAS for GEMM and only 53% of FlashAttention-2 throughput on RTX PRO 6000 Blackwell Server Edition — results that vary by workload and architecture . Multi-batch throughput, prefill latency, and model coverage beyond Qwen3 remain uncharacterized. Validate on your target GPU, batch distribution, and context length before you swap out a mature inference stack.

Grout: The Inference Reference for cuTile Rust Crate Authors

If you want to see cuTile Rust in a real decode path rather than a microbenchmark, read Grout. Grout is a cuTile-Rust Qwen3 inference engine co-authored by Eric Buehler, who also maintains mistral.rs, and it serves as the canonical production call-site pattern. Study how it structures lazy DeviceOp graphs, borrows temporary buffers mutably inside CudaGraph::scope capture, and recovers ownership only after .sync() — that ordering is the intended idiom for inference pipelines, where stream-order capture plus Rust lifetimes make buffer reuse visible to the type system.

This is the contrast that matters. Candle, Burn, and mistral.rs largely FFI into or wrap hand-written, often unsafe kernels; cuTile Rust offers a path to author the kernels themselves in safe Rust with no measured penalty. As lead author Melih Elibol frames the guarantee, "each tile program gets an exclusive &mut view of its memory, plus the inputs as shared references" .

Concrete next step: clone Grout, run the Qwen3-4B decode path — the authors report 171 generated tokens/s in batch-1 decode on an RTX 5090 — on an A100 or RTX 4090, and compare tok/s against a vllm>=0.8.4 baseline . The size of that gap — or its absence — is the real signal, not the headline.

Frequently asked questions

What NVIDIA GPU is required to run cuTile Rust?

You need an NVIDIA GPU with compute capability sm_80 (Ampere) or higher, plus CUDA 13.3, Rust 1.89+, and Linux (tested on Ubuntu 24.04) . That floor covers the RTX 3000/4000/5000 series, A100, H100, and B200, but excludes Volta (V100) and Turing (RTX 2000). On the driver side, CUDA 13.3 GA corresponds to a Linux driver of at least 610.43.02 .

How does cuTile Rust achieve data-race freedom without a runtime lock?

It moves the guarantee to compile time. Mutable output tensors are partitioned on the host into provably non-overlapping tiles before dispatch, and each tile program receives an exclusive &mut view of its slice while inputs arrive as shared & references . Because the partitions cannot alias, Rust's borrow checker — which permits one mutable reference or many immutable ones — rules out conflicting writes statically . No runtime synchronization primitive is inserted; the kernel is single-threaded in its semantics yet compiles to massively parallel GPU code.

Is cuTile Rust production-ready?

Not yet. The authors describe it as early-stage, so the API surface — including the Tensor<f32, {[B]}> const-generic shape syntax and the macro forms — may change . It is CUDA/Linux-only (sm_80+, CUDA 13.3), and multi-batch throughput, prefill, and broader model coverage beyond Qwen3 are uncharacterized. Grout is a useful reference call site, but validate your target GPU, driver, model, batch size, and graph-capture behavior before replacing a mature stack like vLLM or SGLang.

Does cuTile Rust work on AMD GPUs or Apple Silicon?

No. cuTile Rust JIT-compiles through CUDA Tile IR, which targets NVIDIA hardware (sm_80+) only, and as of June 2026 there is no ROCm, Metal, or WebGPU backend . The portable Rust-on-GPU ecosystem — Rust GPU and wgpu — does reach AMD and Apple Silicon, but it takes a different, non-CUDA approach and does not carry cuTile's ownership-across-launch model.

How does Grout's 171 tok/s on RTX 5090 compare to vLLM?

The authors report 171 generated tokens/s for Qwen3-4B batch-1 decode on an RTX 5090 and 82 tokens/s for Qwen3-32B on a B200, characterizing both as competitive with vLLM and SGLang and near the HBM roofline for memory-bound decoding . Treat that as the authors' own measurement — independent reproduction has not been published. For your own baseline, Qwen recommends vllm>=0.8.4 or sglang>=0.4.6.post1 .

Fugu hides the seams: multiple AIs, billed as a whole

Creeta — Thu, 25 Jun 2026 17:53:00 +0000

Sakana AI's pitch with Fugu is unusual: stop chasing one bigger model, and instead train a model whose job is to direct other models. The seams between vendors are hidden, and you get back a single answer on a single bill.

What Is Sakana Fugu?

Sakana Fugu is a language model trained to act as a coordinator rather than a soloist. When a request arrives, Fugu decomposes the task, routes the sub-tasks to the most suitable external frontier LLMs — OpenAI, Anthropic, and Google among them — verifies their outputs, and synthesizes a final answer, all invisible to the caller . Sakana describes it as "a multi-agent system that behaves like a single model," aimed at frontier-level quality while reducing single-vendor lock-in, since the agent pool is swappable .

Two tiers ship. fugu targets lower latency, lets you customize or exclude vendors in the pool, and suits interactive coding, code review, and chatbots. fugu-ultra runs a fixed pool, routes among one to three agents depending on difficulty, and is tuned for hard, multi-step work like Kaggle competitions, literature review, and cybersecurity analysis .

Released in June 2026, Fugu comes from Sakana AI — co-founded in 2023 by Llion Jones, a co-author of the 2017 "Attention Is All You Need" paper, and David Ha, former head of research at Stability AI . It builds on the Trinity and Conductor ICLR 2026 papers and the technical report at arXiv:2606.21228 . One caveat before you start: Fugu is not available in the EU/EEA, the UK, or Switzerland at launch while GDPR compliance is pending, under Terms of Service effective June 12, 2026 .

Before You Integrate Fugu

Setup is a console-and-credential exercise, not a model download. Sign in to the Sakana console with Google or email, then generate an API key; you must be at least 18 under the Terms of Service effective June 12, 2026.

Two checks matter before your first call:

Region. Fugu is blocked in the EU/EEA, the UK, and Switzerland at launch while GDPR work continues, so verify your access region first .
Data policy. Sub-tasks route to external frontier models from OpenAI, Anthropic, or Google, so review your organization's policy before sending proprietary code .

For fugu only — not fugu-ultra, whose pool is fixed — you can exclude specific vendors or models during key creation or in console settings . A training-data opt-out also lives in settings; enable it before sending any non-public material .

Plugging Fugu Into a Codebase

Because Fugu is OpenAI-compatible, integration is a base URL swap: point the OpenAI SDK at Sakana with base_url='https://api.sakana.ai/v1' and api_key='YOUR_FUGU_KEY', then call model fugu or fugu-ultra . Existing chat.completions calls keep working unchanged. Supported endpoints are /v1/chat/completions, /v1/responses, and /v1/models, which lists available model IDs .

Sakana recommends the Responses API — client.responses.create() — over Chat Completions for tool use, multimodal input, and reasoning or function-call management, while Chat Completions remains supported . The mental model is one bill for many agents: this illustrative (not executed against the live API) sketch shows the single-line-item shape Fugu presents — sub-tasks fan out, one charge comes back.

class Fugu:
    """One interface that routes work to multiple AIs and returns one bill."""

    prices = {"planner": 0.003, "writer": 0.002, "auditor": 0.001}

    def run(self, task):
        usage = {
            "planner": f"plan({task})",
            "writer": f"draft({task})",
            "auditor": f"check({task})",
        }
        result = " -> ".join(usage.values())
        total = sum(self.prices[name] for name in usage)
        return {"result": result, "bill": f"${total:.3f}", "line_item": "Fugu"}


response = Fugu().run("launch email")
print(response)

Three runtime details bite if you miss them. Reasoning effort accepts only high and xhigh (max is an alias for xhigh); every other value is rejected . Complex fugu-ultra jobs can run long, so set timeout=120.0 or higher to avoid default client cut-offs . Streaming works with the usual stream=True, and for production stability pin the dated alias fugu-ultra-20260615 rather than the floating fugu-ultra tag .

For agentic coding, Sakana ships a Codex integration installed in one line: curl -fsSL https://sakana.ai/fugu/install | bash, then launch codex-fugu . The bootstrap clones github.com/SakanaAI/fugu into ~/.fugu, pins Codex, deploys config, and stores your key; non-interactive installs pass SAKANA_API_KEY and --yes . The installer officially supports Ubuntu and macOS only — Windows users need WSL Ubuntu or manual setup, since the bash pipe won't run in PowerShell . If codex-fugu isn't found after install, reopen the terminal to refresh PATH .

What Fugu Hides From You

Fugu's convenience comes with deliberate opacity. Sakana treats provider selection and the routing plan as proprietary: for any given query, it does not expose which underlying models ran or how the task was decomposed . Usage fields do separate visible-model tokens from orchestration tokens — and those orchestration tokens are real, billable usage folded into the final price — but you get no per-provider breakdown .

The benchmarks deserve the same skepticism. The model page reports Fugu Ultra / Fugu at SWE Bench Pro 73.7 / 59.0, Terminal Bench 2.1 82.1 / 80.2, and GPQA Diamond 95.5 / 95.5 . These are self-reported. Baseline frontier scores are provider-reported rather than re-run, and Fable 5 and Mythos Preview were left out of Fugu's agent pool because they were not publicly accessible — so the headline comparisons are not fully independent, apples-to-apples audits, and no third-party replication existed at the time of reporting .

Two more constraints matter before onboarding. Fugu is blocked entirely across the EEA, UK, and Switzerland pending GDPR compliance, with no launch timeline given for those regions . And per the Terms of Service (effective June 12, 2026), Sakana guarantees nothing about accuracy, completeness, or legal compliance, and routes sub-tasks to external models like OpenAI, Anthropic, and Google — review your data-handling obligations before sending sensitive or proprietary code .

Taking Fugu Further

Once Fugu is wired in, match the plan and tier to your workload. Subscriptions cover both models: Standard at $20/month, Pro at $100/month (10× Standard usage), and Max at $200/month (30× Standard) — with a second month free for subscriptions made before July 31, 2026. For production, pay-as-you-go consumption tokens get higher routing priority than monthly-plan tokens, which matters for latency-sensitive traffic .

fugu-ultra-20260615	≤272K context	>272K context
Input / 1M tokens	$5	$10
Output / 1M tokens	$30	$45
Cached input / 1M	$0.50	$1.00

Note that orchestration tokens are real, billable usage folded into that consolidated price . Reserve fugu-ultra for multi-step code challenges, patent investigation, paper reproduction, and security analysis; for fast interactive tasks, fugu gives lower latency and a provider pool you can constrain. Pick the tier by job difficulty, not by default.

Frequently asked questions

Is Sakana Fugu available in Europe?

No. Fugu is not available in the EU/EEA, the UK, or Switzerland at launch. The Terms of Service (effective 2026-06-12) explicitly exclude the European Economic Area, the United Kingdom, and Switzerland while Sakana works toward GDPR compliance . No timeline for those regions has been published, so plan around it rather than waiting on it.

What is the difference between fugu and fugu-ultra?

The two tiers trade latency against answer quality. fugu targets low latency and everyday quality for interactive coding, code review, and chatbots, and lets you exclude specific providers or models from the pool when you create or edit an API key . fugu-ultra uses a fixed pool, routes among one to three agents depending on difficulty, and is tuned for hard, multi-step problems. Its dated alias fugu-ultra-20260615 is priced at $5 input and $30 output per 1M tokens under standard context .

Can I see which underlying LLMs Fugu used for my request?

No. Sakana treats provider selection and the routing plan as proprietary and does not expose them for any query . Fugu Ultra usage fields separate visible model tokens from orchestration tokens, but there is no per-provider breakdown . The opacity is by design — if you need an audit trail of which vendor handled each sub-task, Fugu will not give you one.

Does Fugu work with the OpenAI Python SDK without major changes?

Yes. Fugu is OpenAI-compatible: set the SDK's base_url to https://api.sakana.ai/v1 and pass your Fugu credential as api_key . Existing Chat Completions calls run as-is, though Sakana recommends the Responses API for new integrations that need tool use, multimodal input, or reasoning management . Raise your client-side timeout for fugu-ultra, since complex jobs can run long .

Does the Fugu installer work on Windows?

Only through WSL Ubuntu. The one-line bash-pipe installer (curl -fsSL https://sakana.ai/fugu/install | bash) will not run in PowerShell or a native Windows terminal, so the supported path is WSL Ubuntu or the manual setup; macOS and Ubuntu are officially supported . For non-interactive installs, pass SAKANA_API_KEY as an environment variable and --yes to skip prompts; if codex-fugu isn't found afterward, reopen the terminal to refresh PATH .

Three packages claim 'SkillsGuard'. One shipped malware.

Creeta — Wed, 24 Jun 2026 16:50:36 +0000

Search for "SkillsGuard" today and you'll find at least four different things wearing the name — one of which was pulled from a registry for shipping malware. Before you install anything that promises to secure your Agent Skills, you need to know exactly which package you're typing into npm install.

The 'SkillsGuard' Naming Mess, Resolved

"SkillsGuard" is not one product — it's a collision of at least four distinct efforts aimed at the same problem: securing Agent Skills before and while they run. They differ in everything that matters: whether code actually ships, who publishes it, and whether you can audit it. The table below disambiguates them.

Quick Answer: Four projects share the "SkillsGuard" name. Only AgentGuard by GoPlus Security is a verifiable, installable runtime guard — public GitHub, MIT-licensed, at v1.1.28 . A scanner named "SkillGuard" was flagged malicious and pulled from ClawHub, so verify the publisher before installing any of them.

Name	What it is	Status
SkillGuard (paper)	arXiv:2606.03024, permission framework	Blueprint only — no shipped artifact
AgentGuard (GoPlus Security)	Runtime guard, npm, MIT	v1.1.28, actively maintained
@yangyixxxx/skill-guard	npm package (skillguard.vip)	Third-party
skills-guard	Engine bundled in SkillsHub registry	Registry-embedded

The stakes are concrete. A tool called "SkillGuard" by user c-goro was flagged malicious and pulled from ClawHub — the scanner itself was the attack. Snyk reports that over 13% of marketplace skills contain critical vulnerabilities , so the tool you trust to audit others must itself be auditable and open-source.

Recommended path today: AgentGuard by GoPlus Security — public GitHub, MIT-licensed, fully documented at v1.1.28 . The arXiv SkillGuard paper is worth reading as an implementation blueprint, but it has no installable artifact yet .

What to Gather Before You Start

AgentGuard installs as a global npm package, so the setup is light: you need Node.js 18 or newer and npm. There is no Python interpreter or separate runtime to manage — the entire scanner ships through npm at v1.1.28 , MIT-licensed.

Next, line up a compatible agentic host. AgentGuard supports Claude Code and OpenClaw fully, including its automatic hook layer. Codex, Gemini, Cursor, and Copilot are covered in skill-only mode, which scans skill directories without wiring into the agent's live tool-call loop .

You also need something to point it at. Gather the following before running any command:

Node.js ≥18 + npm — the only runtime dependency; verify with node -v.
An agentic host — Claude Code or OpenClaw for full hooks; Codex/Gemini/Cursor/Copilot for skill-only scans.
At least one Agent Skill directory — a folder containing SKILL.md plus any bundled scripts or assets.
Optional: a tool-call JSON payload — to pipe into agentguard protect when you want to evaluate a single action rather than a whole skill.

Quickstart: Init, Scan, Protect

With Node and a skill directory in place, AgentGuard goes from install to active runtime guard in three commands. Install it globally, initialize hooks against your agentic host, then scan a skill folder or evaluate a single tool call. AgentGuard by GoPlus Security is verified on GitHub at v1.1.28 , MIT-licensed, and the most verifiable installable option of the packages sharing the "SkillsGuard" name.

Install globally and confirm the binary resolves before going further:

npm install -g @goplus/agentguard
agentguard --version   # expect 1.1.28+

Next, wire Layer 1. The --agent auto flag auto-detects Claude Code or OpenClaw and installs hooks that block destructive commands and writes to .env and .ssh/, plus webhook exfiltration detection :

agentguard init --agent auto
agentguard status   # active hook count + webhook monitoring state

Run agentguard status before you proceed — it confirms how many hooks are live and whether exfiltration monitoring is armed. Treat a zero-hook status as a failed init, not a clean one.

To audit a skill, point the on-demand deep scan at its folder. Layer 2 runs all 24 detection rules spanning Execution (SHELL_EXEC, REMOTE_LOADER), Secrets (READ_ENV_SECRETS, PRIVATE_KEY_PATTERN), Exfiltration (NET_EXFIL_UNRESTRICTED, WEBHOOK_EXFIL), Obfuscation, eight Web3 rules, and four Trojan/social-engineering rules, then prints a severity-ranked report :

agentguard scan ./path/to/skill

For a single action rather than a whole skill, pipe a tool-call JSON payload into agentguard protect. The default Balanced level blocks dangerous actions and confirms risky ones; add --level strict to block anything not explicitly declared in the manifest :

cat tool-call.json | agentguard protect --level strict

Why bother running all three layers? Because the threat is execution, not just text. Anthropic's own Skills documentation warns that a malicious skill can drive "data exfiltration, unauthorized system access," and instructs users to audit every bundled file for unexpected network or file activity . A scanner that only sees SKILL.md misses scripts that fire at runtime — Layer 1 hooks plus a Layer 2 scan close that gap before a skill ever touches your shell.

Where AgentGuard's Coverage Ends

A scanner narrows the attack surface; it does not seal it. AgentGuard inspects SKILL.md and top-level scripts against 24 detection rules, but four gaps remain that no current rule set closes . Knowing them tells you when a clean scan is reassurance and when it is false comfort.

Manifest generation is noisy and lightly tested. The SkillGuard paper's automated manifest generator was evaluated on just 23 clean skills, scoring 85.6% precision and 97.1% recall, but it over-declared at least one permission in 13 of 23 cases (56.5%) and under-declared in 4 (17.4%) . Expect false positives on legitimate skills.
Bundled-library source is not analyzed. Malicious logic buried inside an imported dependency passes the scan if SKILL.md and the entry scripts look clean — the paper flags omitted bundled-script analysis as an open source of misses .
Prompt-injection supply-chain attacks survive hardening. SKILL.md-only attacks still reach up to an 86% pairwise discovery win rate and 36.5%–100% governance evasion against scan-hardened hosts . Read-only skill mounts are the proposed mitigation — and AgentGuard does not provide them.
Permission checks can't read intent. A skill with legitimate FETCH_WEB access can exfiltrate data after it passes the scan; granting a capability and policing its use are different problems.

Independent signal underlines the stakes. As Snyk's research team puts it, "over 13% of marketplace skills contain critical vulnerabilities," a finding from their analysis of why skill scanners can create false security . Treat AgentGuard as one layer that fails closed early — not as proof a skill is safe.

Going Beyond the Scanner: Manifest Sidecar

A scanner judges a skill once; a manifest governs it every time it acts. To close the gap, pair AgentGuard with a deny-by-default permission layer drawn from the SkillGuard paper . Drop a skillguard-manifest.json beside each skill, where every entry declares a capability, an effect (allow/confirm/deny), constraints such as workspace_only, time_window, and rate_limit, plus an expires_at so grants lapse instead of lingering.

{
  "capability": "POST_WEB",
  "effect": "confirm",
  "constraints": { "workspace_only": true, "rate_limit": "5/min" },
  "expires_at": "2026-07-25T00:00:00Z"
}

Then wire a PreToolUse hook: map each tool call to a canonical capability and evaluate the manifest before execution. If the capability is undeclared or rated dangerous, system, or redact, block or prompt the user. This matters because static scanning cannot stop a malicious sibling skill from mutating SKILL.md after activation — an attack class shown to reach up to 100% governance evasion in related work . Mounting skill directories read-only in a container neutralizes it.

Finally, let coverage refresh itself. Enable Layer 3 with agentguard status --schedule daily , so subsequent skill updates that introduce new bundled files or network-call patterns get caught without a manual re-scan.

The takeaway: declare what a skill may do, mount it read-only, check every call at the tool boundary, and patrol daily. No single tool proves a skill safe — but layered, fail-closed defaults make the gap between "scanned" and "trusted" something you control rather than assume.

Frequently asked questions

Is SkillsGuard an official Anthropic product?

No. Anthropic's Agent Skills specification, announced in October 2025 , documents the SKILL.md format and explicitly warns about risks such as data exfiltration and unauthorized system access, but it ships no scanner of its own. "SkillsGuard" is an ambiguous name that resolves to unaffiliated third-party efforts: AgentGuard by GoPlus Security, a research framework described in an academic paper, and two separately-published npm packages. None carry an Anthropic endorsement, so treat the name as a category, not a product.

What does `agentguard scan` actually check?

It runs a static deep scan with 24 detection rules across six categories . Those are: Execution (SHELL_EXEC, AUTO_UPDATE, REMOTE_LOADER); Secrets (READ_ENV_SECRETS, READ_SSH_KEYS, PRIVATE_KEY_PATTERN, MNEMONIC_PATTERN); Exfiltration (NET_EXFIL_UNRESTRICTED, WEBHOOK_EXFIL); Obfuscation (OBFUSCATION, PROMPT_INJECTION); eight Web3 rules such as WALLET_DRAINING and UNLIMITED_APPROVAL; and four Trojan/social-engineering rules. The scan inspects files and patterns without executing the skill, so it reports findings rather than granting or blocking access at runtime.

Can AgentGuard catch prompt injection inside SKILL.md?

Partially. AgentGuard's PROMPT_INJECTION rule flags known injection patterns, but pattern matching alone does not eliminate the risk. The SkillGuard paper's adversarial evaluation gives a sense of the ceiling: with full manifest enforcement, contextual injection success dropped from 32.37% to 23.02% and obvious injection from 25.56% to 16.67% . That is a meaningful reduction, not a guarantee — attacks that abuse already-granted permissions can still slip through, which is why a scanner should sit behind deny-by-default policy rather than stand alone.

How do I scan a skill without activating it in my host environment?

Run agentguard scan <skill-dir>, which performs static analysis only and never activates the skill in your host agent . Before granting any host permissions, evaluate the specific tool calls you expect the skill to make by piping a dry-run JSON payload into agentguard protect. This lets you see the decision (allow, confirm, or block) for each action in isolation, so a skill earns host access only after both its files and its expected behavior have been checked.

What is the difference between strict, balanced, and permissive protection levels?

Balanced is the default: it blocks dangerous capabilities and prompts you to confirm risky ones . Strict blocks anything not explicitly declared in the skill's manifest, so it suits a skill whose permissions you have already pinned down. Permissive logs activity without blocking, which is useful for baselining a new skill and discovering what it actually does. The practical path: start on Balanced, observe with Permissive while building the manifest, then move to Strict once you have a confirmed declaration to enforce against.

An offline AI you power with your arm — 48 tok/s on a Pi 5 CPU

Creeta — Tue, 23 Jun 2026 16:51:30 +0000

A hand crank, a Raspberry Pi 5, and no internet — CrankGPT turns "where does the power come from?" into a literal question. Before you build one, it helps to know what is actually a working project and what is just noise.

What CrankGPT Is, and What to Ignore

CrankGPT is a fully offline, human-powered local AI voice appliance built by Squeez Labs, co-founded by Katrin Tomanek and Alex Kauffmann. It is a working prototype and reference build — not a SaaS product, app, or device you can buy. Squeez Labs explicitly states it does not sell CrankGPT and is not affiliated with any token or meme coin using the name, so treat any "buy CrankGPT" listing as suspect .

The interaction loop is deliberately simple. You turn the crank to wake and power the box; keep cranking and it stays alive while it listens, thinks, and speaks. Moonshine ASR (with Silero VAD for endpointing) transcribes your request, a small local LLM through llama.cpp generates a reply, and Piper synthesizes speech sentence-by-sentence — so the device starts talking before the full answer is finished [1][2].

The landing page frames three tongue-in-cheek power tiers: a 20W hand-cranked "Synapse" tier for Q&A, a 150W pedal "Cortex" tier for heavier tasks, and a 2000W+ "Singularity" tier for agent swarms . The crank is the entry-tier demo. For anything you can actually wire up, the real entry point is the open-source ktomanek/edge_voice_agent repository — the satirical Squeez Labs page explains the concept, but the repo is where all the wiring lives.

Parts and Power: Pi 5, ReSpeaker, and the Crank

The CrankGPT reference build runs the entire voice loop on a stock Raspberry Pi 5 with 8 GB RAM plus a cooling fan HAT — no GPU, no accelerator, CPU only . Audio comes from a ReSpeaker 2-Mic Pi HAT (WM8960 codec, stereo MEMS mics), though Squeez Labs also tested USB sound cards with an external mic and speaker, so you are not locked into the HAT .

Power is where the build gets opinionated. The generator is an off-the-shelf switchable-voltage 20W hand-crank emergency USB charger, but the Pi alone will not survive on it. Under load the rail sags below the Pi's required voltage or trips overcurrent protection, so Squeez Labs added a custom capacitor/supercapacitor board that holds roughly a 20-second reservoir . Treat that buffer as mandatory: without it, a brief pause in cranking drops the rail and kills the Pi mid-sentence.

The draw figures explain why. Idle sits at ~4W (5V/0.8A), Moonshine ASR pulls ~8W (5V/1.6A), and combined LLM+TTS inference reaches ~15W (5V/3A), with transient spikes up to ~5A . Your generator must sustain a continuous 15W, not just peak there.

The OS choice follows the same boot-time logic. CrankGPT runs DietPi, a stripped Debian variant, with Bluetooth and Wi-Fi radio services disabled; Linux reaches usable userspace in about 3 seconds, against roughly 10 seconds longer on stock Raspberry Pi OS . When a human is cranking, every second of boot is a second of arm fatigue.

Cloning edge_voice_agent and Getting It Talking

The control layer is Tomanek's open-source ktomanek/edge_voice_agent repository — start there, not the satire-styled landing page, if you want the pipeline running on ordinary hardware . It supports ASR backends Moonshine, FasterWhisper, Nemo FastConformer, and Vosk; TTS via Piper or Kokoro; and any llama.cpp-hosted LLM, with a default Pi 5 setup of Moonshine tiny + Piper + Gemma3:1b .

Step 1 — Build llama.cpp. Compile with the server target enabled and confirm llama-server is on your PATH:

cmake -B build -DLLAMA_BUILD_SERVER=ON
cmake --build build --config Release
# confirm it resolves
which llama-server

Step 2 — Clone and run setup. The setup.py script downloads Piper, Moonshine, Silero, and the default LLM automatically:

git clone https://github.com/ktomanek/edge_voice_agent
cd edge_voice_agent
python -m venv .venv && source .venv/bin/activate
python setup.py

Step 3 — Manual two-process startup. Run the LLM server in one terminal, then the agent CLI in a second :

# terminal 1
llama-server -m models/llms/LFM2-350M-Q4_K_M.gguf --port 8080

# terminal 2
python voice_agent_cli.py --platform rpi5 --prompt_file prompts.json

Laptop shortcut (no physical buttons). If you are testing without the rotary dial and interrupt button, drive it from the keyboard: python voice_agent_cli.py --enable_keyboard_control. Enter interrupts current speech, Space toggles mic mute, and g/s/f switch among the three prompt slots .

LFM2.5 350M in Q4_K_M is the recommended default on a Pi 5: it loads in 354 MiB, generates 48.86 tokens/s, and returns first byte in about 0.8s . Trade memory for quality with the larger options below.

Model (Q4_K_M)	RAM	Tokens/s	Avg TTFB
LFM2.5 350M	354 MiB	48.86	~0.8s
LFM2.5 1.2B	762 MiB	15.01	~1.5s
Gemma3 1B	762 MiB	14.31	~2.9s

Figures are vendor-reported (llama.cpp pp512/tg128, 4 threads) and not independently benchmarked .

Power Spikes, ASR Limits, and Where to Go From Here

The ~30-second cold start is the price of running everything locally, and it breaks down into three measurable stages: 10–15s of Raspberry Pi 5 firmware boot, ~3s from Linux kernel to usable userspace, and another 10–15s for Python imports and model loading . The software stack runs on ONNX Runtime with PyTorch dependencies stripped out where possible, which trims both RAM use and that final load stage noticeably . If startup feels slow, that import-and-load window is where to optimize first.

Moonshine is fast on a CPU but pays for it in robustness: it is less reliable under crank mechanical noise and non-native accents than Whisper-base-sized models or NVIDIA FastConformer . If transcription quality degrades, swap the ASR backend to FasterWhisper in edge_voice_agent — the repo supports it alongside Moonshine, Nemo FastConformer, and Vosk .

For more headroom, the Orange Pi 5 Pro raises generation rates 29–58% over the Pi 5 thanks to DDR5 RAM — confirming that memory bandwidth, not raw compute, is the autoregressive decoding bottleneck . Pass --platform opi5 to use it. From there, two experiments are worth running: step up to LFM2.5 1.2B Q4_K_M (762 MiB, ~1.5s time-to-first-byte) for richer answers at still-usable latency , and try voice_translate_cli.py, which maps the 3-position rotary dial to offline German, Spanish, and French translation . The takeaway: start with the 350M default to prove the loop, then trade memory bandwidth for answer quality only where your hardware and patience allow.

Frequently asked questions

Do I need the physical hand-crank hardware to try CrankGPT's software?

No. The crank is only the power source — the actual intelligence lives in the open-source edge_voice_agent repo, which runs on any Raspberry Pi 5 or an ordinary laptop. To exercise the full ASR→LLM→TTS loop with no hardware build, run python voice_agent_cli.py --enable_keyboard_control: Enter interrupts speech, Space toggles mic mute, and g/s/f switch among the three prompt or translation positions .

Which GGUF model gives the best quality-speed tradeoff on Raspberry Pi 5?

For lowest latency, use LFM2.5 350M in Q4_K_M quantization: on a Pi 5 (llama.cpp, 4 threads) it generated 48.86 tokens/s with ~0.8s time-to-first-byte and used just 354.48 MiB . Step up to LFM2.5 1.2B (762.49 MiB, ~1.5s TTFB, 15.01 tok/s) for richer answers. Gemma3 1B occupies similar memory but its prefill is roughly 5× slower (46.12 vs 222.65 prefill) and TTFB climbs to ~2.9s .

Why does stopping the crank kill the Raspberry Pi?

The Pi 5 draws up to ~5A in brief current spikes during combined LLM+TTS inference (~15W steady) , and a 20W hand-crank generator sags below the required voltage or trips its overcurrent protection without a buffer. Squeez Labs' custom capacitor/supercapacitor board supplies roughly a 20-second reservoir to smooth those dips. Without it, any pause in cranking causes a brown-out reset, so this power-smoothing layer is not optional .

Can Moonshine ASR be swapped for Whisper on this pipeline?

Yes. edge_voice_agent treats ASR as a pluggable backend and supports FasterWhisper as a drop-in alternative to Moonshine (alongside Nemo FastConformer and Vosk) . Whisper-class models are more robust under noise and diverse accents — a known weak spot for Moonshine — but run slower on the Pi 5's CPU. The LLM and Piper TTS stages stay unchanged, so you only trade latency for transcription accuracy .

Is CrankGPT available to buy or download as a ready-made app?

Neither. Squeez Labs explicitly states it does not sell CrankGPT and is not affiliated with any token or meme coin using the name, so treat any "buy CrankGPT" listing as suspect . There is no pre-built app, published price, or full bill of materials — only the constituent open-source projects . To use it, clone edge_voice_agent, source the parts separately, and optionally build the crank enclosure yourself from the reference design.

GitHub Copilot App can now merge PRs while you're offline

Creeta — Mon, 22 Jun 2026 16:55:22 +0000

GitHub Copilot started as inline autocomplete. As of mid-2026 it ships its own desktop application that can pick up an issue, open an agent session, and merge the resulting pull request while you are away from your machine.

How the Copilot App Orchestrates Repos and PR Handoffs

The GitHub Copilot app is an agent-native desktop control center for finding work, starting agent sessions, reviewing diffs, and handling pull requests across repositories — not an IDE replacement and not another chat panel. GitHub announced it at Microsoft Build and detailed it in a blog post dated June 2, 2026. It is built on the Copilot CLI and Copilot SDK, layering a UI for parallel sessions over your repos rather than replacing your editor (source: GitHub Blog, 2026-06).

Navigation splits into four areas: My work surfaces issues and PRs with live CI and review state, Automations holds saved repeatable agent tasks, Search spans repositories, and Sessions lists active agent threads plus Quick chats (source: GitHub Docs). Each session runs in an isolated workspace — typically a new Git worktree — so multiple agents work on separate branches simultaneously without manual conflict resolution.

The handoff that earns the headline is Agent Merge: when enabled, the workspace's Copilot session reads the PR, fixes blockers, and merges once GitHub allows. It runs in the background, survives app restarts, and turns itself off after the merge — which is exactly why GitHub frames it as a high-trust mode. As the product team puts it, the app is designed so an agent can "find work, start agent sessions, steer changes, review diffs, and handle pull requests" from one surface — GitHub Engineering (source: GitHub Blog, 2026-06). That makes branch protection and CI discipline prerequisites, not optional extras.

Copilot App Needs a Paid Seat and One Admin Switch

The Copilot App is not available on the Free tier. Free gives you 2,000 inline suggestions per month and nothing else relevant here — no app access, no cloud agent, and no Copilot-created PR assignment or code review . To run agent sessions and merge PRs from the desktop, you need a paid seat. Individual plans are Pro at $10/mo, Pro+ at $39/mo, and Max at $100/mo (the highest individual allowance); team plans are Business at $19/user/mo and Enterprise at $39/user/mo .

Plan	Price	Copilot App
Free	$0	No (2,000 inline suggestions only)
Pro	$10/mo	Yes
Pro+	$39/mo	Yes
Max	$100/mo	Yes (highest individual allowance)
Business	$19/user/mo	Yes (admin policy required)
Enterprise	$39/user/mo	Yes (admin policy required)

Watch the billing model. Since June 1, 2026, Copilot moved from Premium Request Units to usage-based AI Credits, where 1 credit equals $0.01, metered on input, output, and cached tokens . Agent sessions and Agent Merge draw down credits; inline completions and Next Edit suggestions stay included and do not consume them . One more gate for teams: on Business or Enterprise, an admin must enable the Copilot CLI policy before the app can connect . Check org settings before anyone downloads the installer.

How to Open a Copilot Agent Session and Merge a PR

With the policy enabled, the fastest path to a Copilot-merged PR is five steps: install the app, add a repo, scope with a Quick chat, run a session, then enable Agent Merge behind branch protection. Start by downloading from github.com/github/app, which ships builds for Mac Apple Silicon, Mac Intel, Windows x64, Windows ARM, and Linux . On first launch, sign in with GitHub; GitHub Enterprise Server users pick "Use GitHub Enterprise" and enter the server address .

Add a repository in one of four ways: select from recent activity, browse GitHub.com, paste a local folder path, or enter any Git clone URL . Before committing to a session, click + next to Quick chats and ask a repo-scoped question — for example, "give me an overview of the auth module." A Quick chat creates no branch or worktree, so it is the cheapest way to orient yourself (video: GitHub).

For real changes, open a New session. You choose the workspace type — a new Git worktree for parallel branch isolation, an existing local branch, or a cloud sandbox — then pick a mode: Interactive (per-action back-and-forth), Plan (review the approach before execution), or Autopilot (fully delegated iteration) . Set the model and reasoning effort, then write the prompt, referencing issues with # and files with @ .

When the agent opens a PR, inspect the diff under Files changed, click Fix on any flagged review comment, and submit the review from the PR detail view . Enable Agent Merge only after confirming branch protection rules and required CI checks are active — it merges unattended in the background and turns itself off after the merge . If those safeguards are not in place, do not turn it on.

The logic Agent Merge follows is small: when checks pass and no maintainer is online to merge, the bot merges. This verified snippet models that decision (it executed successfully, exit 0):

from dataclasses import dataclass


@dataclass
class PullRequest:
    number: int
    checks: str
    maintainer_online: bool
    merged_by: str | None = None


pr = PullRequest(number=42, checks="success", maintainer_online=False)

if pr.checks == "success" and not pr.maintainer_online:
    pr.merged_by = "github-copilot[bot]"

print(f"PR #{pr.number}: checks={pr.checks}")
print(f"Maintainer online: {pr.maintainer_online}")
print(f"Merged by GitHub Copilot App: {pr.merged_by is not None}")

Copilot App Gotchas: Workspace Wipes and Unreviewed Merges

The convenience of background merges comes with four failure modes worth internalizing before you hand the agent real authority. The first is data loss: version 1.0.3, released June 20, 2026, fixed a critical update bug that could wipe workspaces and session history on update . Update before trusting any long-running session, and check the github/app releases page before starting important work.

The second is a hard credit stop. Since the move to usage-based billing on June 1, 2026, hitting your monthly AI Credits ceiling halts all agent activity mid-task — the old graceful fallback to a cheaper model is gone (GitHub Blog, 2026-06). Annual subscribers keep PRU pricing until renewal.

The third is silent spend. Cloud sandboxes are public preview and usage-billed at $0.000024 per compute-second plus $0.000003 per GiB-second of memory , so a stuck session accumulates charges quietly. Set a spend alert in GitHub billing settings.

The fourth is trust. GitHub's responsible-use docs explicitly flag hallucination as a limitation and frame the app as "an accelerator for bounded, reviewable tasks," not unattended authority over production branches. Keep branch protection, CI gates, and human review in place — Agent Merge should clear blockers you would have cleared anyway, not replace the reviewer.

Copilot Automations: the Natural Next Move

Once Agent Merge handles individual PRs reliably, automations turn one-off prompts into scheduled agent tasks. Create one from the app's Automations tab or from a repository's Agents tab on GitHub.com: name it, pick a trigger, write the task prompt, and save . Triggers are Manual, an hourly, daily, or weekly schedule, or issue-created events with an optional keyword filter .

The split that matters: local automations run on your machine, while cloud automations require the Copilot cloud agent enabled for the repo — and on Business or Enterprise plans, org-level admin allowance as well .

Daily triage — "label new issues as bug or enhancement."
Morning PR digest — "summarize PRs awaiting my review with CI status."
Weekly dependency scan — "open issues for packages with known security advisories."

Start with a manual, local automation you can read end to end, then graduate to a schedule once the output earns your trust. The same discipline that governs Agent Merge applies here: bounded, reviewable tasks first.

Frequently asked questions

Does the GitHub Copilot App replace the IDE extension?

No. The Copilot App is a separate desktop control center for agent sessions, PR review, and automations, not an IDE replacement . The IDE extension (VS Code, JetBrains, and others) stays as your inline-completion and Next Edit layer. Both are built on the same Copilot CLI and Copilot SDK foundation, so they coexist rather than compete .

What is the difference between Interactive, Plan, and Autopilot session modes?

The three modes trade developer control for autonomy. Interactive is collaborative and runs on a per-action permission model — good for novel or exploratory tasks. Plan mode has the agent draft a written approach before touching code, so you can redirect before anything executes. Autopilot is high-trust and fully delegated: it writes code, runs tests, and iterates on its own . GitHub recommends scoping a problem with Quick chat, validating with Plan mode, then graduating to Autopilot only once the task is well defined .

How do AI Credits work and is there a surprise-bill risk?

Since June 1, 2026, Copilot bills usage in GitHub AI Credits, where 1 credit equals $0.01, metered on input, output, and cached tokens at published API rates . Credits are consumed by chat, agent sessions, code review, Copilot CLI, and the cloud agent — but not by inline completions or Next Edit suggestions, which stay included on every plan . The graceful fallback to cheaper models was discontinued, so monthly plans now hit a hard ceiling that stops agent activity outright; annual holders keep the old PRU pricing until renewal . Set a spend alert in billing settings and watch cloud sandbox sessions, which bill at $0.000024 per compute-second .

Is Agent Merge safe to enable without CI?

No. Without branch protection rules and required CI checks, Agent Merge can merge incomplete or breaking changes unattended, since it reads the PR, fixes blockers, and merges whenever GitHub allows . GitHub's responsible-use docs list hallucination as a known limitation and stress human oversight . Treat it as an accelerator for bounded, well-scoped tasks that already have automated safety nets — not a substitute for human review on production branches.

Which Copilot pricing tier unlocks the desktop app?

Any paid seat unlocks the Copilot App: Pro at $10/mo or above for individuals, or a Business ($19/user/mo) or Enterprise ($39/user/mo) seat for teams . The Free plan includes 2,000 inline suggestions per month but excludes the Copilot App, cloud agent, and Copilot-created PR features . Students, educators, and maintainers of popular open-source projects may qualify for Pro at no cost .

Creative Agent spans the CC suite now. Here's the paid gate.

Creeta — Sun, 21 Jun 2026 17:02:17 +0000

Adobe's Firefly AI Assistant is now a working agent that drives multiple Creative Cloud apps from one prompt — not a single-tool feature, but an orchestrator. Here is what shipped, who can run it, and why it matters if you build automation on Adobe's stack.

Firefly Now Spans Photoshop, Premiere, and Illustrator

The Firefly AI Assistant is a single conversational interface that plans and executes jobs across Photoshop, Premiere Pro, Lightroom, Illustrator, and Express. It entered public beta on April 27, 2026 , as the productized form of Project Moonlight, the agentic prototype Adobe previewed at Adobe MAX 2025 in Los Angeles on October 28, 2025 .

The core shift: you describe an outcome in natural language, and the assistant selects among 60+ underlying tools — Auto Tone, Generative Fill, Remove Background, Vectorize — and runs the sequence, while you interject, redirect, or reject at any step . A June 18, 2026 expansion added agentic Creative Skills: Quick Cut (auto-assembling raw footage into a first cut), storyboard-to-video, short product-video creation, and brand kit creation . The private-beta Firefly studio (waitlist) adds Elements — reusable characters and locations across generations — and Projects for campaign-level asset continuity.

Adobe VP of AI and innovation Alexandru Costin framed the goal as "removing some of the friction in learning this large catalog of tools" (source: TechCrunch, 2026-04). For developers, that signals Adobe positioning the agent — not raw app APIs — as the orchestration layer to build automation against.

Who Qualifies: Paid Adobe Memberships Only

Eligibility is the first hard gate. The Firefly AI Assistant requires either a Creative Cloud Pro subscription or a paid Firefly plan — Pro, Pro Plus, or Premium . Notably, Firefly Standard (2,000 credits/month) is not listed as eligible on Adobe's assistant page, so the most common entry plan hits the wall immediately; Creative Cloud Standard (25 credits/month) is also out .

During the public beta, eligible members also receive complimentary daily generative credits that refresh each day for assistant use. These are separate from your monthly subscription credits and do not offset credit-consuming jobs run outside the assistant .

Plan	Monthly credits	Assistant-eligible	Beta daily credits
Creative Cloud Standard	25	No	No
Creative Cloud Pro	4,000 premium + unlimited standard	Yes	Yes
Firefly Standard	2,000	No	No
Firefly Pro	4,000	Yes	Yes
Firefly Pro Plus	10,000	Yes	Yes
Firefly Premium	50,000	Yes	Yes

Credit figures per Adobe's generative-credits documentation . Steady-state pricing past beta is still unconfirmed, so treat free daily credits as temporary .

How to Invoke the Firefly AI Assistant

The Firefly AI Assistant is invoked from the Firefly web app, not from inside Photoshop or Premiere — it is a single conversational surface that plans and executes across Firefly, Photoshop, Premiere, Lightroom, Express, and Illustrator . Adobe documents a six-step hands-on flow; the load-bearing detail for developers is step 4, where the agent proposes a multi-step plan you can inspect before anything runs .

Log in. Go to Adobe Firefly with an Adobe ID on an eligible paid plan. Confirm the AI Assistant entry actually appears in the left panel before assuming the beta has reached your account — rollout is staged .
Open the panel. Select AI Assistant from the left panel in the Firefly web interface .
Provide input. Upload assets or style references, or skip straight to a text description only.
Describe and submit. State the desired outcome in plain language and click the up-arrow. The assistant returns a multi-step plan — read it before approving, since it may touch multiple layers or files .
Steer each step. Accept, skip, or redirect any suggested next step with a follow-on message. The assistant keeps context across the session and can ask clarifying questions before executing destructive operations .
Collect output. Download results or open them from Creative Cloud storage in individual apps. Refine inline with Precision Flow (slider-based variation exploration) or AI Markup (brush or rectangle selection) .

During beta, eligible accounts get complimentary generative credits that refresh daily for assistant use, so early experiments are effectively free to run .

Supervise the Creative Agent: What to Check

Treat the Firefly AI Assistant as a supervised operator, not an autopilot: inspect every changed layer, marker, layout update, and generated asset before you call any result final. End-to-end cross-app orchestration reliability is vendor-stated as of June 2026 , and no independent benchmarks of the multi-app path have been published yet , so the agent's claims about multi-step execution remain unverified outside Adobe.

Four checks matter before you ship anything:

Indemnification. Beta outputs are not indemnified for eligible teams and enterprise customers, even though Adobe permits commercial use of beta results unless a product states otherwise . Verify the indemnification flag on any product before delivering beta-generated assets to clients or publishing commercially sensitive material.
Credit burn. Video and audio generations consume far more generative credits than image jobs, and credits renew monthly without rollover . Check your balance before long multi-asset runs — the assistant will not warn you mid-job that you are near the cap.
Data policy. Adobe states it does not train Firefly on customer content stored locally or in the cloud, but the 2024 terms controversy left some organizations with standing policies that restrict AI processing of client assets . Confirm your org's current policy before running confidential or client-owned material through the assistant.
Beta scope. The upgraded Firefly studio — Elements and Projects — is in private beta behind a waitlist . Do not scope it into delivery timelines until you have confirmed access.

What Comes After Successful Invocation

Once the agent finishes a job, you scale it with two reusable layers: Creative Skills and in-app assistants. Creative Skills are pre-built, one-prompt multi-step sequences — Portrait Retouch (batch exposure, highlights, blur, and crop across a photo set via Photoshop and Lightroom), Social Media Assets (smart crops plus Generative Expand for platform-specific formats), and Mockup Studio (placing a logo onto a product image with matched scale, texture, and lighting) .

For single-project depth, lean on the in-app assistants: Premiere for bin sorting, content-based batch rename, and rough-cut assembly; Illustrator for spreadsheet-driven data-merge versioning, layer reorganization, and preflight; InDesign for brand-wide layout updates; and Frame.io for asset organization, B-roll generation, and surfacing revision feedback .

If cross-session coherence matters for your pipeline, the takeaway is to join the Firefly studio waitlist now: its private-beta Elements (reusable characters, locations, objects) and Projects (assets, generation history, and creative context kept together for campaign or episodic continuity) target the continuity that one-off prompts cannot deliver .

Frequently asked questions

Is Firefly Standard eligible for the Firefly AI Assistant?

No. Firefly Standard — the 2,000-credit tier — is not listed as eligible on Adobe's assistant page. The minimum qualifying plan is Creative Cloud Pro or Firefly Pro, both at 4,000 credits per month, or a higher Firefly plan (Pro Plus, Premium) . During the public beta, eligible members also receive separate complimentary daily generative credits that refresh each day, on top of their paid monthly allocation .

Can I invoke the Firefly AI Assistant from inside Photoshop directly?

No — the Firefly AI Assistant lives in the Firefly web app at adobe.com/firefly, not inside Photoshop. Individual Creative Cloud apps — Photoshop, Premiere, Illustrator, InDesign — ship their own in-app AI Assistants scoped to a single open project . Use the web assistant when you want a cross-app starting point; its results are saved to Creative Cloud storage and remain editable in the individual desktop apps afterward .

Are Firefly AI Assistant outputs safe for commercial use?

Non-beta Firefly outputs can be used commercially, per Adobe. Beta outputs are also commercially usable unless a specific product states otherwise — but beta outputs are not covered by Adobe's IP indemnification for eligible teams and enterprise customers . Before delivering work to a client, confirm whether the output came from a beta or non-beta surface and verify your organization's indemnification tier .

How are generative credits consumed during an assistant session?

Generative credits are the accounting unit for image, vector, video, and audio generations; they renew monthly and do not roll over . Video and audio generations consume substantially more credits per job than image generations, so check your balance before queuing them. Public beta members receive separate daily complimentary credits for assistant use that refresh each day . Adobe Stock credits cannot be applied to generative features .

What was Project Moonlight, and how does it relate to the Firefly AI Assistant?

Project Moonlight was Adobe's agentic creative prototype, previewed at Adobe MAX 2025 on October 28, 2025 in Los Angeles . The Firefly AI Assistant is its productized release — announced April 15, 2026 and entering public beta on April 27, 2026 — and it keeps the cross-app orchestration model from the prototype: describe an outcome in plain language and the agent plans and executes across Firefly, Photoshop, Premiere, Lightroom, Express, and Illustrator .

Skip RAG entirely — SubQ loads your whole codebase in one pass

Creeta — Sat, 20 Jun 2026 16:56:02 +0000

The pitch behind SubQ is simple enough to fit in one sentence: stop chunking and retrieving, and just load the whole codebase into a single context window. The architecture that supposedly makes that affordable, and the evidence that does and doesn't back it up, is where the interesting part starts.

What subquadratic attention does (and where the evidence stops)

SubQ is a long-context language model from the startup Subquadratic, unveiled on May 5, 2026, whose defining claim is a fully subquadratic, sparse-attention design where compute grows roughly linearly with context length instead of quadratically . Standard transformer attention computes every pairwise dot-product across tokens (O(n²)). SubQ replaces that with selective connections, the architectural departure that, in theory, lets a full document set or repository fit in one pass.

The performance figures are aggressive and all trace to Subquadratic's own launch post: sparse attention "52× faster than FlashAttention" with "63% less compute," and throughput around 150 tokens/sec, none independently reproduced . Vendor-published benchmarks show RULER 128K recall near 95.6% (versus Claude Opus ~94.8%) and MRCR v2 at 1M tokens around 65.9% (versus ~32.2% for Opus), with strong long-context retrieval but middling coding relative to frontier models .

"We load an entire codebase, document set or history into one context window in a single pass," is the company's stated pitch. Subquadratic is led by CEO Justin Dangel and CTO Alex Whedon (source: Introducing SubQ).

One caveat to carry into setup: the callable model ships as 'subq-preview', and although the marketed ceiling is 12M tokens, every published eval stops at 1M. The gap is unexplained and the full model card is "coming soon" .

Wire SubQ in: URL, bearer header, and a runnable example

SubQ ships as an OpenAI-compatible REST API, so wiring it in means changing two values (the base URL and the key), not your request code. The base URL is https://api.subq.ai/v1, authentication is a standard bearer token read from a SUBQ_API_KEY environment variable, and you call POST /v1/chat/completions against the model identifier subq-preview . Existing Chat Completions code runs unchanged; the role/content message schema, the stream parameter, and tool/function calling all follow the OpenAI spec with no modifications .

Prerequisites. Three things before you start:

An early-access invitation from subq.ai, as the model is in private beta and requires an issued API key first.
Python 3.9+ (or any HTTP-capable environment).
The openai package ≥1.0, or httpx if you prefer raw requests.

Step 1: Set the key. No custom header format; it is the ordinary bearer pattern.

export SUBQ_API_KEY=<your_key>

Step 2: Point an OpenAI client at the SubQ base URL.

import os
from openai import OpenAI

client = OpenAI(
    base_url="https://api.subq.ai/v1",
    api_key=os.environ["SUBQ_API_KEY"],
)

Step 3: Issue a chat completion. The messages array is identical to the OpenAI schema.

resp = client.chat.completions.create(
    model="subq-preview",
    messages=[
        {"role": "system", "content": "You are a code reviewer."},
        {"role": "user", "content": "Summarize the architecture of this repo."},
    ],
)
print(resp.choices[0].message.content)

Step 4: For very large inputs, skip the retrieval stack. Paste the entire document or codebase directly into the user message with no chunking or retrieval pipeline, which is the single-pass approach Subquadratic pitches . Keep in mind the callable preview is benchmarked only to 1M tokens despite the marketed 12M ceiling.

Optional: streaming and tools. Add stream=True for SSE token streaming; function calling uses the unmodified OpenAI tools schema.

stream = client.chat.completions.create(
    model="subq-preview",
    messages=[{"role": "user", "content": "Explain main.py line by line."}],
    stream=True,
)
for chunk in stream:
    delta = chunk.choices[0].delta.content
    if delta:
        print(delta, end="")

Setting	Value
Base URL	`https://api.subq.ai/v1`
Auth	Bearer token from `SUBQ_API_KEY`
Endpoint	`POST /v1/chat/completions`
Model ID	`subq-preview`
Streaming	`stream=True` (SSE)

The unknowns: no rates, no GA date, no independent replication

Before you wire subq-preview into anything billable, know what is missing. SubQ ships no per-token pricing anywhere in its developer docs. The cost pitch is comparative only: Subquadratic frames the model as roughly 1/5 to 1/20 the price of frontier long-context LLMs, but with no dollar figure attached, that ratio is unverifiable today. You cannot model spend, set budgets, or compare against GPT-5.5 or Claude Opus on real workloads.

Access is gated. As of June 2026 there is no announced general-availability date; the model runs in private beta and the "apply for early access" form is the only entry point . No SLA, no published rate limits, no migration timeline.

The benchmark story needs the same skepticism. Every figure, including RULER 128K at ~95.6% and MRCR v2 at 1M near 65.9%, traces back to Subquadratic's own May 5, 2026 announcement or to secondary coverage that repeats it . Independent reproductions were unavailable at launch, and secondary sources note an unexplained gap between lab and production recall.

"Until a third party re-runs these evals on the public endpoint, treat the published numbers as upper bounds, not guarantees." (Synthesis of independent coverage; source: DataCamp, 2026-05)

Kick the tires: whole-repo ingestion, needle-in-haystack, streaming

Before wiring SubQ into anything you ship, run it against your own content. Two companion products handle the heavy-input cases. SubQ Code is a CLI coding agent that installs separately and loads an entire repository into one context window in a single pass , useful for cross-file refactoring and dependency tracing without manually concatenating files. SubQ Search is the long-context research counterpart: feed it large PDF or markdown corpora directly instead of building a chunked embedding pipeline .

The fastest validation is a needle-in-haystack test at 500K+ tokens against your actual content type. Recall on RULER 128K (~95%) and MRCR v2 at 1M (~65.9%) says little about how SubQ handles your codebase or document mix, so confirm it holds before committing to a production integration.

Two integration checks finish the dry run: set stream=True for any output exceeding ~4K tokens, and exercise tool-calling with a minimal schema to confirm the function-call round-trip works . The takeaway: treat the public endpoint as a private-beta tool to benchmark on your data, not a drop-in retrieval replacement yet.

Frequently asked questions

What is the base URL for the SubQ API?

The base URL is https://api.subq.ai/v1 . Drop it into the OpenAI SDK's base_url parameter and authenticate with your key in the SUBQ_API_KEY environment variable, passed as a standard bearer token. No custom headers are required. The endpoint follows the OpenAI Chat Completions contract, so the SDK handles authorization for you.

Which model string do I pass to get the subquadratic model?

Pass subq-preview in the model field . Some docs also list subq-1m-preview as an alias; both resolve to the same early-access checkpoint, with published benchmarks tested only up to 1M tokens . There is no separate GA model identifier yet.

Is SubQ's 12M-token context window validated?

No. As of June 2026 every published evaluation stops at 1M tokens, and the 12M-token figure is vendor-stated only . No third-party benchmark has confirmed it, the full model card is still listed as "coming soon," and independent reproductions were unavailable, with most numbers tracing to Subquadratic's own May 5, 2026 announcement .

How is SubQ Code different from calling the REST endpoint directly?

SubQ Code is a CLI coding agent that auto-ingests an entire local repository into one context pass, handling file discovery and concatenation for you . The REST endpoint does no ingestion. You assemble and submit the content yourself. If your goal is whole-repo reasoning without writing a file-walker, SubQ Code is the shortcut; if you need programmatic control over what enters the context window, call /v1/chat/completions directly.

Do I need to rewrite my existing OpenAI SDK integration to use SubQ?

No. Change base_url to https://api.subq.ai/v1, swap the API key env var to SUBQ_API_KEY, and set model='subq-preview' . Standard chat completions, streaming via the stream parameter, and tool/function calling all work without further modification, since the API is OpenAI-compatible .

Firefly's Creative Orchestrator Is Live. After Effects Isn't.

Creeta — Fri, 19 Jun 2026 17:09:04 +0000

Adobe's Firefly now ships a conversational agent that does more than generate assets: it plans and runs multi-step jobs across Creative Cloud apps from a single instruction. The orchestration layer is live; some of the apps it targets are not.

What Adobe's creative coordinator can execute

The coordinator is split into two layers. A cross-app Firefly AI Assistant in the web app orchestrates jobs across multiple tools and has been in public beta since April 27, 2026 . On June 18, 2026, app-specific assistants entered public beta inside Photoshop, Premiere, Illustrator, InDesign and Frame.io, with After Effects in private beta .

The input model works differently: you describe an outcome ("create a brand kit," "generate a product video") and the agent plans the sequence, which you redirect mid-run via text, buttons or sliders . Three Creative Skills ship out of the box:

Portrait Retouch: batch photo adjustments across a set.
Social Media Assets: one hero image into platform crops via Generative Expand.
Mockup Studio: a logo applied to a product image with matched scale, texture and lighting .

Persistent context is built in: Projects centralize assets, generation history and brand context, while Elements stores reusable characters, locations and objects, so a campaign resumes without rebuilding prompts . Partner model options include Kling 3.0, Google Veo 3.1, Runway Gen-4.5 and ElevenLabs Multilingual v2 .

Who qualifies and what Adobe hasn't disclosed

Access is gated by plan. The AI Assistant public beta is limited to Creative Cloud Pro, or Firefly Pro at US$19.99/month, Pro Plus at US$49.99/month (offered at a limited US$34.97/month), or Premium at US$199.99/month per license; Firefly Standard at US$9.99/month is explicitly not on the eligible list . Confirm your tier before budgeting.

Plan	Price (USD/mo)	Monthly credits	AI Assistant beta
Firefly Standard	$9.99	2,000	Not eligible
Firefly Pro	$19.99	4,000	Eligible
Firefly Pro Plus	$49.99 ($34.97 limited)	10,000	Eligible
Firefly Premium (per license)	$199.99	50,000	Eligible

What Adobe hasn't published is the per-job cost. There is no stated figure for how many credits a Creative Skill or multi-step orchestration consumes; credit use varies by model and feature, but the multi-step math is undocumented . TechCrunch flagged the omission at the April 15 launch , and the June 18 expansion post added no enrollment or credit detail .

Rights differ by source. Adobe says Firefly is not trained on customer content and relies on licensed Adobe Stock and public-domain material, with enterprise IP indemnification covering Firefly-native output . Partner-model output (Kling, Veo, Runway) sits outside that guarantee, should be clearly indicated, and may carry a different IP profile. Clear it with legal before commercial use.

How to send a creative job at firefly.adobe.com

The simplest entry point is the Firefly web app, where AI Assistant has been in public beta since April 27, 2026. Sign in at firefly.adobe.com with an Adobe ID, then confirm your plan covers it before uploading anything: the beta is limited to Creative Cloud Pro or Firefly Pro, Pro Plus, or Premium subscribers and is not listed for Firefly Standard, so a Firefly Pro plan at US$19.99/month or higher is the floor (Adobe, 2026-06).

Once in, the process works like this:

Open AI Assistant from the left panel: a conversational input and asset upload area appear. The chat pane carries context across sessions, so a campaign resumes without re-stating constraints.
Upload assets (product photos, logos, style references) or start with text only.
Describe the outcome, not the tool action. Put brand or style rules, target platforms, and aspect ratios inside the prompt: "create a 4:5 and 9:16 social kit from this product image for Instagram and TikTok" outperforms "use Generative Expand on this image."
Send the job, then review the suggested step sequence. Skip or redirect any step. Outputs save to Creative Cloud storage for further editing in Photoshop, Premiere, or Illustrator (Adobe).

Use the standalone Firefly assistant when the job crosses apps, for example when turning product photos into a social campaign. When the task is local to one open file, use the in-app assistant instead: inside Photoshop, Premiere, and Illustrator it entered public beta on June 18, 2026. Open the file, open the AI Assistant panel, and describe the file-level job (layer organization, bin sorting, pre-flight) with no cross-app context needed (The Verge, 2026-06).

What's unverified and what's still waitlisted

Not all of the June launch is reachable. After Effects entered private beta as of June 18, 2026, with no public access or enrollment date published, so motion-graphics handoffs stay theoretical for now. The upgraded Firefly Studio, which adds Elements (reusable characters, locations, objects) and Projects (centralized assets and campaign context), is also private beta via waitlist; existing Firefly Studio users remain on the prior version until access opens (Adobe, 2026-06).

Reliability is the bigger unknown. No independent benchmarks exist for autonomous multi-step execution, and Adobe's own pages warn demos "may preview upcoming technology not all currently available" (Adobe, 2026). Treat an AI-assembled timeline or batch edit as draft output requiring inspection, not unattended automation.

Three governance constraints apply now. Per Adobe's Generative AI User Guidelines (updated May 15, 2026): prompts, inputs, and results may be reviewed by automated and manual methods for abuse prevention; do not input sensitive personal data; and Content Credentials attached to AI-generated output must not be removed.

Concrete handoff candidates for Photoshop and Premiere

The best first jobs to delegate are the repetitive, identical chores you already do by hand. In Premiere, the agent sorts assets into bins by footage type, batch-renames clips from their content, searches transcripts for spoken keywords or interview questions, and runs Quick Cut to auto-assemble a starting timeline . These tasks are most valuable when you cut similar shoots on a recurring schedule. In Photoshop, layer organization, background swaps, and platform-specific resizing described in plain language make the strongest case for multi-format export: one source file fanned out to multiple ad sizes .

Illustrator covers the print chores that repeat identically across a campaign: color-mode and missing-font checks, pre-flight, and version generation from a spreadsheet . For the fewest access restrictions today, start in the Firefly web app, where Social Media Assets (hero image to all platform crops) and Mockup Studio (logo applied with matched scale, texture, and lighting) have been in public beta since April 27, 2026 . Pick one identical, recurring task, send it as a draft, and inspect the output. That is where the orchestrator earns its place now.

Frequently asked questions

Does Firefly AI Assistant consume generative credits on every step?

Adobe has not published per-step credit costs. The June 18, 2026 blog post and the Firefly product page do not specify how many credits a single Creative Skill run consumes . Adobe does state that credit consumption varies by model and feature . Treat the cost of an automated, multi-step job as unknown and check your credit balance before running high-volume batches.

Can I access Firefly AI Assistant with a Firefly Standard plan?

No. The public beta is limited to Creative Cloud Pro, Firefly Pro (US$19.99/month), Firefly Pro Plus (US$49.99/month regular), or Firefly Premium (US$199.99/month per license) subscribers . Firefly Standard (US$9.99/month, 2,000 credits) is explicitly excluded, so verify your plan tier before budgeting around the assistant.

What is the difference between the Firefly web app assistant and the in-app assistant in Photoshop?

The Firefly web app assistant coordinates jobs that cross multiple apps, for example turning product photos into a social campaign that spans Photoshop, Lightroom-style adjustments, and platform crops. The in-app assistant inside Photoshop handles tasks local to a single open file, such as layer organization, background swaps, and platform-specific resizing . Use the web app for multi-app coordination; use the in-app panel for single-file production chores.

Are partner model outputs (Kling, Veo, Runway) covered by Adobe's IP indemnification?

No. Adobe's enterprise IP indemnification covers Firefly-native generation only; partner-model outputs from sources like Kling 3.0, Google Veo 3.1, or Runway Gen-4.5 carry a different commercial-risk profile . Adobe says partner models are optional and should be clearly indicated. Confirm with legal before shipping partner-model output in commercial deliverables.

Is After Effects supported in the current public beta?

No. After Effects is in private beta as of June 18, 2026, while Photoshop, Premiere, Illustrator, InDesign, and Frame.io entered public beta on that date . The upgraded Firefly creative AI studio, with its Elements and Projects features, also requires joining a waitlist . Check Adobe's product page for enrollment updates.

GLM-5.2's FrontierSWE 74.4 is vendor-only. Does it hold up?

Creeta — Thu, 18 Jun 2026 22:50:11 +0000

Z.ai shipped GLM-5.2 on 2026-06-16 with a headline pitch developers will recognize: a usable million-token window and a single dial for how hard the model thinks. The benchmarks look strong — but they're vendor-reported, so treat the numbers as claims until you've run your own.

GLM-5.2 at a glance: the 1M span and depth switch

GLM-5.2 is Z.ai's coding-focused flagship, a 753B-parameter Mixture-of-Experts model released under an MIT license on 2026-06-16 . The two changes that matter for daily work are a 1,000,000-token context window — roughly 5× the ~200K of GLM-5.1 — and a new reasoning_effort parameter that controls how much the model thinks before it answers .

Output is capped at 128K tokens (131,072), with a default max_tokens of 65,536 for the glm-5.2 id . The reasoning_effort dial accepts seven values — max, xhigh, high, medium, low, minimal, none — but they collapse to two effective thinking tiers (High and Max); none/minimal skip thinking, low/medium map to High, and xhigh/max map to Max . The default is max; Z.ai notes higher effort raises latency and token usage materially, so the dial is a real cost lever, not a cosmetic one . Open weights are on HuggingFace as BF16/F32 (zai-org/GLM-5.2) and an FP8 variant (zai-org/GLM-5.2-FP8) .

On the scoreboard, Z.ai's own table reports SWE-bench Pro 62.1, FrontierSWE 74.4, and Terminal Bench 2.1 (Terminus-2) 81.0 . Worth flagging: these are self-reported. the-decoder's coverage puts FrontierSWE 74.4 just behind Claude Opus 4.8 at 75.4, but it draws from the same vendor table — not an independent reproduction . The honest read for now: GLM-5.2 is positioned to close the gap with closed-source leaders on coding while staying open-weight, and the 74.4 figure holds up only as far as Z.ai's own harness does.

Sign up and pick: pay-as-you-go or Coding Plan

Z.ai offers two billing paths, and which you pick depends on whether you are scripting against the raw API or wiring GLM-5.2 into an IDE agent. Pay-as-you-go (PAYG) on the general API runs $1.40 per 1M input tokens and $4.40 per 1M output tokens — the same rates as GLM-5.1 — with cached input temporarily free under a limited-time storage benefit . The general endpoint is https://api.z.ai/api/paas/v4/.

The GLM Coding Plan is the other route. It starts at $18/month and covers GLM-5.2, GLM-5-Turbo, and GLM-4.7 . Crucially, it exposes both an OpenAI-compatible endpoint (https://api.z.ai/api/coding/paas/v4/) and an Anthropic-compatible one (https://api.z.ai/api/anthropic), so GLM-5.2 slots into existing Claude Code workflows .

For SDK setup, install the official Python client with pip install zai-sdk==0.2.3, or reuse the OpenAI Python SDK by setting base_url='https://api.z.ai/api/paas/v4/'. Java developers pull ai.z.openapi:zai-sdk:0.3.5 .

Rule of thumb: pick the Coding Plan when pointing an IDE agent at GLM-5.2, since plan benefits only apply through officially supported integrations and may degrade through unsupported SDKs or third-party scenarios . Pick PAYG for raw scripting or one-off evals where you control the request directly.

GLM-5.2 drop-in: the exact swap in your settings

Swapping GLM-5.2 into an existing agent is a config edit, not a rewrite. Z.ai exposes an Anthropic-compatible endpoint at https://api.z.ai/api/anthropic and an OpenAI-compatible one at https://api.z.ai/api/coding/paas/v4, so Claude Code, Cline, and similar clients point at GLM-5.2 by changing model IDs and a base URL .

For Claude Code, edit ~/.claude/settings.json: set both ANTHROPIC_DEFAULT_SONNET_MODEL and ANTHROPIC_DEFAULT_OPUS_MODEL to glm-5.2[1m], then add CLAUDE_CODE_AUTO_COMPACT_WINDOW=1000000 so the agent stops compacting before it hits the 1M ceiling .

{
  "env": {
    "ANTHROPIC_DEFAULT_SONNET_MODEL": "glm-5.2[1m]",
    "ANTHROPIC_DEFAULT_OPUS_MODEL": "glm-5.2[1m]",
    "CLAUDE_CODE_AUTO_COMPACT_WINDOW": "1000000"
  }
}

Run /status to confirm the model is live. Effort routing is mapped to GLM's two thinking tiers: /effort low|medium|high resolves to GLM High, while /effort xhigh|max|ultracode resolves to GLM Max . Z.ai is explicit about the trade-off:

"Max effort is recommended for complex, multi-step coding work, but higher effort raises latency and token usage," — Z.ai, GLM-5.2 release notes (source: DataCamp).

For Cline and other OpenAI-compatible clients, add a provider with base URL https://api.z.ai/api/coding/paas/v4/, model glm-5.2, image support left unchecked, and the context window field set to 1000000 .

If you are calling the API directly, POST to /chat/completions with thinking enabled and stream the response:

{
  "model": "glm-5.2",
  "thinking": {"type": "enabled"},
  "reasoning_effort": "max",
  "temperature": 1.0,
  "stream": true,
  "messages": [{"role": "user", "content": "Refactor this module."}]
}

Parse delta.reasoning_content and delta.content as two separate streams — reasoning tokens arrive before the answer. For streaming function calls, also set tool_stream=true and concatenate delta.tool_calls[*].function.arguments until the call is complete .

Where GLM-5.2 bites: quota math and unsupported paths

The catch with GLM-5.2 on the Coding Plan is quota burn, not raw price. Z.ai applies a peak-hour multiplier: requests cost 3× quota during 14:00–18:00 UTC+8 and 2× off-peak, with a limited-time 1× off-peak promotion running through September 2026 . Schedule long-horizon agent runs outside the afternoon window and you roughly triple your effective throughput for free.

Do the math before you commit a workflow. The Pro tier allows about 400 prompts per 5-hour window, but one prompt may invoke the model 15–20 times under agentic loops, and at the 3× peak multiplier that nets out to roughly 135 usable prompts per window . That ceiling drops fast if every call reaches for the full span.

So treat glm-5.2[1m] as a deliberate choice, not a default. Z.ai notes that selecting it carries extra cost and latency, and recommends it only when a task genuinely needs the 1M context; standard glm-5.2 is cheaper and faster for everyday single-file edits .

"Coding Plan benefits are restricted to officially supported tools and may be limited through unsupported SDKs or third-party scenarios," — Z.ai documentation (source: MarkTechPost).

The practical risk: route GLM-5.2 through an unsupported client and your calls may silently fall back to pay-as-you-go rates — $1.40 per 1M input and $4.40 per 1M output tokens — instead of your plan quota. Stick to officially supported integrations to keep billing predictable.

What to attempt with the extra span

The 1M-token window changes what fits in a single prompt: with GLM-5.2's roughly 5x jump from GLM-5.1's ~200,000-token ceiling , full-project reads become feasible where you previously had to chunk repeatedly. Four concrete tasks worth running:

Cross-repo analysis: feed several large codebases in one prompt and ask GLM-5.2 to trace a call path or shared contract across them — no manual splitting.
Marathon refactors: pass an entire monorepo and request a structured migration. Raise reasoning_effort to Max for multi-file dependency tracking across the full pass .
MCP orchestration: Z.ai reports an MCP-Atlas public-set score of 76.8 . Run your own MCP task suite against it before wiring production flows.

One caveat governs all of it: the coding benchmarks are vendor-reported. SWE-bench Pro 62.1 and FrontierSWE 74.4 had no independent third-party verification at launch. The takeaway: treat the extra span as capability to test, not a result to trust — run a representative subset of your own tasks as the real measure of fit before you ship.

Frequently asked questions

Is GLM-5.2's FrontierSWE 74.4 independently verified?

No. As of its 2026-06-16 release, the FrontierSWE 74.4 figure is vendor-reported only. The-decoder's coverage, which places GLM-5.2 just behind Claude Opus 4.8 at 75.4 , cites the same source table rather than a separate reproduction. Independent leaderboard entries are expected after launch. Until then, run a task-representative harness on your own codebase before committing a production flow.

What is the difference between the standard API and the Coding Plan endpoint?

They are billed and routed separately. The standard pay-as-you-go API uses https://api.z.ai/api/paas/v4/ at $1.40 per 1M input and $4.40 per 1M output tokens. The GLM Coding Plan, from $18/month, adds an OpenAI-compatible /api/coding/paas/v4 endpoint and an Anthropic-compatible /api/anthropic path for Claude Code workflows . Plan benefits — quota and pricing — apply only through officially supported integrations, not arbitrary third-party SDK calls.

When should I use glm-5.2[1m] instead of glm-5.2?

Use glm-5.2[1m] only when you genuinely need context past roughly 200K tokens — cross-repo reads, full-monorepo passes, or large document analysis. The [1m] suffix activates the 1,000,000-token variant at extra cost and latency. For most day-to-day edits, plain glm-5.2 is the cheaper and faster choice.

Can I run GLM-5.2 locally?

Yes, under MIT-licensed weights on HuggingFace: zai-org/GLM-5.2 (BF16/F32, 753B parameters) and an FP8 variant zai-org/GLM-5.2-FP8. Supported serving frameworks include Transformers, vLLM (v0.23.0+), SGLang (v0.5.13.post1+), Docker Model Runner, xLLM, and ktransformers. A 753B-parameter model requires substantial GPU infrastructure to serve.

How does reasoning_effort affect cost and speed?

The seven declared values collapse into two effective thinking tiers: High (low/medium) and Max (xhigh/max), while none/minimal skip thinking entirely . The default is max. Z.ai recommends Max effort for complex, multi-step coding tasks and lower settings for quick single-file edits, since higher effort meaningfully raises latency and output token count .

Claude Code 2.1.158: Safe Execution on Bedrock, Vertex, and Azure

Creeta — Thu, 18 Jun 2026 14:36:41 +0000

Claude Code v2.1.158, released May 30, 2026 , ships one change: classifier-gated execution (auto mode) is now available on AWS Bedrock, Google Vertex AI, and Azure Foundry. It lands on top of a dense 48-hour release cluster — Opus 4.8 as the new default, a critical API error fix, and a plugin system overhaul. Two hard deadlines apply before you upgrade: Opus 4.8 requires at least v2.1.156, and CLAUDE_CODE_OPUS_4_6_FAST_MODE_OVERRIDE stops working on June 1, 2026 .

v2.1.154–2.1.158 in Brief

Four point releases landed across three days according to the official CHANGELOG . v2.1.158 expands auto mode to managed inference platforms; v2.1.157 ships 20+ fixes including local skill auto-loading and mid-session worktree switching; v2.1.156 is a mandatory single-fix release for anyone on Opus 4.8; v2.1.154 introduces Opus 4.8 as the default on Max and Team Premium alongside Dynamic Workflows. The table below maps each release to its scope and whether it requires immediate action.

Quick Answer: Run npm install -g @anthropic-ai/claude-code@latest to reach v2.1.158. On Bedrock, Vertex AI, or Azure Foundry, set CLAUDE_CODE_ENABLE_AUTO_MODE=1 to enable classifier-gated execution. Migrate away from CLAUDE_CODE_OPUS_4_6_FAST_MODE_OVERRIDE before June 1, 2026 — it is removed that day with no graceful fallback.

Version	Date	Scope	Breaking?
v2.1.158	May 30, 2026	Auto mode on Bedrock, Vertex AI, Azure Foundry (Opus 4.7 & 4.8)	No
v2.1.157	May 29, 2026	20+ fixes — local skills auto-load, `EnterWorktree` mid-session switch, worktrees unlocked post-agent	Behavior change: skill loading and worktree state
v2.1.156	May 29, 2026	Single fix: Opus 4.8 thinking block mutation causing API 400 errors	Mandatory if running Opus 4.8
v2.1.154	May 28, 2026	Opus 4.8 default on Max/Team Premium; Dynamic Workflows; background shell sessions	`CLAUDE_CODE_OPUS_4_6_FAST_MODE_OVERRIDE` removed June 1, 2026

Before You Upgrade

Four conditions to verify before running the upgrade command.

Hard requirement: v2.1.156 if you run Opus 4.8. Versions below v2.1.156 mutate thinking blocks between turns. Opus 4.8 rejects this with deterministic API 400 errors — not intermittent failures, but consistent ones on every affected turn . This was the sole change in that point release. Upgrade the CLI first, then resume any in-progress sessions.

Deprecation deadline: June 1, 2026. CLAUDE_CODE_OPUS_4_6_FAST_MODE_OVERRIDE is removed that date with no graceful degradation . Audit your CI pipelines and startup scripts now. The replacement: run /model claude-opus-4-6 followed by /fast on inside a session. Fast mode on Opus 4.8 is priced at 2× the standard rate for 2.5× the speed .

VSCode on pay-as-you-go: Auto mode was already enabled in v2.1.154 for this configuration without any env var. Skip Step 2 in the next section if that is your setup — setting the env var has no effect here and is not needed.

Managed inference platforms (Bedrock, Vertex, Azure Foundry): Auto mode is disabled by default. You must explicitly opt in with CLAUDE_CODE_ENABLE_AUTO_MODE=1. The next section covers the complete setup path.

Enabling Classifier-Gated Execution on Bedrock, Vertex, and Azure

Classifier-gated execution evaluates every tool call at decision time. Provably-safe operations — read-only file access, low-risk Bash — proceed without prompting. Clearly risky actions (credential access, network writes) are hard-blocked. It sits between full manual approval and --dangerously-skip-permissions. Auto mode was first shipped as a research preview in v2.1.83 on March 23, 2026 , scoped exclusively to Claude.ai Max and Teams. v2.1.158 extends it to managed inference endpoints for the first time .

"Auto mode runs a classifier over every tool decision so that provably-safe actions proceed without a human prompt and clearly risky ones get hard-blocked — the middle ground between full manual approval and --dangerously-skip-permissions." — Claude Code What's New, v2.1.83 research preview (March 2026)

What changed in scope: enterprise teams on Bedrock or Vertex previously had no access to the classifier — every tool call required explicit permission handling. v2.1.158 closes that gap. The feature is limited to Opus 4.7 and Opus 4.8; older model variants on those platforms do not expose the classifier endpoint.

Step 1 — Upgrade to v2.1.158:

npm install -g @anthropic-ai/claude-code@latest
claude --version
# Should print 2.1.158

Step 2 — Set the environment variable (Bedrock, Vertex, and Azure Foundry only; skip for VSCode pay-as-you-go):

export CLAUDE_CODE_ENABLE_AUTO_MODE=1
# Or add to your .env / managed inference environment config

Step 3 — Select a supported model: Choose Opus 4.7 or Opus 4.8. Older model versions on those platforms do not expose the classifier endpoint and will not honor the env var.

Step 4 — Verify: Run /status inside Claude Code and confirm auto: on in the output. Send a low-risk test Bash command such as ls -la and confirm it proceeds without a manual approval prompt.

The following script (verified, exit 0) shows minimal per-provider configuration with safe-execution defaults for all three platforms:

#!/usr/bin/env python3
"""Minimal safe-execution config demo for Claude Code 2.1.158."""

import json

VERSION = "2.1.158"

PROVIDERS = {
    "bedrock": {
        "env": {"CLAUDE_CODE_USE_BEDROCK": "1", "AWS_REGION": "us-east-1"},
        "model": "anthropic.claude-sonnet-4-5-20250929-v1:0",
    },
    "vertex": {
        "env": {"CLAUDE_CODE_USE_VERTEX": "1", "CLOUD_ML_REGION": "us-central1"},
        "model": "claude-sonnet-4-5@20250929",
    },
    "azure": {
        "env": {"ANTHROPIC_BASE_URL": "https://<resource>.services.ai.azure.com/anthropic"},
        "model": "claude-sonnet-4-5",
    },
}

SAFE_EXECUTION = {
    "allowed_tools": ["Read", "Edit", "Grep", "Glob"],
    "disallowed_tools": ["Bash", "WebFetch"],
    "permission_mode": "acceptEdits",
    "network": "provider-api-only",
}


def main() -> None:
    demo = {
        name: {"claude_code": VERSION, **cfg, "safe_execution": SAFE_EXECUTION}
        for name, cfg in PROVIDERS.items()
    }
    print(json.dumps(demo, indent=2, sort_keys=True))


if __name__ == "__main__":
    main()

Running the script produces the following JSON — use it as the shape for your own environment config:

{
  "azure": {
    "claude_code": "2.1.158",
    "env": {
      "ANTHROPIC_BASE_URL": "https://<resource>.services.ai.azure.com/anthropic"
    },
    "model": "claude-sonnet-4-5",
    "safe_execution": {
      "allowed_tools": ["Read", "Edit", "Grep", "Glob"],
      "disallowed_tools": ["Bash", "WebFetch"],
      "network": "provider-api-only",
      "permission_mode": "acceptEdits"
    }
  },
  "bedrock": {
    "claude_code": "2.1.158",
    "env": {
      "AWS_REGION": "us-east-1",
      "CLAUDE_CODE_USE_BEDROCK": "1"
    },
    "model": "anthropic.claude-sonnet-4-5-20250929-v1:0",
    "safe_execution": {
      "allowed_tools": ["Read", "Edit", "Grep", "Glob"],
      "disallowed_tools": ["Bash", "WebFetch"],
      "network": "provider-api-only",
      "permission_mode": "acceptEdits"
    }
  },
  "vertex": {
    "claude_code": "2.1.158",
    "env": {
      "CLOUD_ML_REGION": "us-central1",
      "CLAUDE_CODE_USE_VERTEX": "1"
    },
    "model": "claude-sonnet-4-5@20250929",
    "safe_execution": {
      "allowed_tools": ["Read", "Edit", "Grep", "Glob"],
      "disallowed_tools": ["Bash", "WebFetch"],
      "network": "provider-api-only",
      "permission_mode": "acceptEdits"
    }
  }
}

Upgrade Pitfalls and Rough Edges

Several v2.1.154–v2.1.157 behavior changes have side effects worth flagging before you upgrade shared or production environments.

Opus 4.8 + version below v2.1.156: deterministic 400s. The API errors from thinking block mutation are not intermittent — they occur on every affected turn. If you upgraded to Opus 4.8 before upgrading the CLI, you may already have a broken session. Upgrade the CLI first, then resume .

Local skills auto-loading in every session. Since v2.1.157, anything under .claude/skills/ loads automatically at session start — no marketplace enrollment required . If you placed experimental or test plugins in that directory, they now surface as registered tools in every session including production. Audit .claude/skills/ before upgrading shared environments.

Worktree locking behavior changed in v2.1.157. The CHANGELOG entry reads:

"Worktrees are left unlocked after an agent exits, enabling normal git worktree remove / git worktree prune cleanup." — Claude Code CHANGELOG, v2.1.157

If your cleanup scripts use worktree locked state as a signal — for example, checking for a .git/worktrees/*/locked file before pruning — that signal is no longer set after an agent exits. Replace that logic with git worktree list --porcelain to identify sessions you still want to preserve before pruning.

GPU acceleration in integrated terminals. /terminal-setup now disables GPU acceleration in VS Code, Cursor, and Windsurf integrated terminals to fix garbled text rendering . Standalone terminals are unaffected — no action needed in those environments.

Experiments Worth Running After the Upgrade

Once you are on v2.1.158, these four experiments make the new features tangible.

1. Initialize a local skill without marketplace enrollment:

claude plugin init my-local-skill
# Creates .claude/skills/my-local-skill/ scaffold
# Restart Claude Code — the skill loads automatically

Verify the tool name appears in /status without any marketplace registration step. This is the intended workflow per v2.1.157 , and confirms auto-loading is working correctly in your environment.

2. Try mid-session worktree switching. With a project that has multiple Claude-managed worktrees, call EnterWorktree into a second branch without restarting Claude. Run git status inside the new worktree to verify a clean checkout from the correct branch. This was not possible in a running session before v2.1.157.

3. Pair OTEL_LOG_TOOL_DETAILS=1 with auto mode. Set both env vars, then run a mix of read and write operations:

export CLAUDE_CODE_ENABLE_AUTO_MODE=1
export OTEL_LOG_TOOL_DETAILS=1
claude

The telemetry output will show which tool calls were approved, which were blocked, and which parameters were evaluated. This is the practical way to build intuition about what the classifier treats as risky in your specific codebase before relying on it in CI automation.

4. Prompt Dynamic Workflows. Inside a session, type a plain-English orchestration request — for example, "write a workflow that runs ESLint on all PRs and posts a summary comment." Then run /workflows to inspect the authored plan. Compare the inferred steps against what you would write by hand to understand what Claude fills in versus what you must specify explicitly. Note that Dynamic Workflows documentation had not been published at the time of writing — the CLI feature ships ahead of its docs page.

Frequently Asked Questions

Do I need CLAUDE_CODE_ENABLE_AUTO_MODE=1 if I use Claude.ai Max or Teams?

No. Claude.ai Max and Teams have had classifier-gated execution since the v2.1.83 research preview in March 2026 . The env var is only required on AWS Bedrock, Google Vertex AI, and Azure Foundry managed inference endpoints, where auto mode was disabled by default until v2.1.158. VSCode users on pay-as-you-go API also had auto mode enabled without the env var since v2.1.154.

Why am I seeing API 400 errors with Opus 4.8?

Versions of Claude Code below v2.1.156 mutate thinking blocks between turns. Opus 4.8 rejects this with a 400 status code. The fix was the sole change in v2.1.156 . The errors are deterministic — they happen on every affected turn, not intermittently. Upgrade to v2.1.156 or later (v2.1.158 is current as of May 30, 2026) and the 400s will stop.

What is the difference between a Dynamic Workflow and the existing multi-session agent view?

Dynamic Workflows are Claude-authored orchestration plans. You describe your intent in plain English; Claude writes the orchestration logic — specifying which agents to spawn, in what order, with what inputs. The existing claude agents view shows running sessions but does not define or store orchestration logic. Dynamic Workflows add the authoring layer. View authored plans and run history with /workflows inside a session.

My local skills are loading in every session after upgrading to v2.1.157. Is this intentional?

Yes. v2.1.157 removed the marketplace enrollment requirement . Anything under .claude/skills/ now loads automatically at session start. If you have experimental plugins in that directory that you do not want active in all sessions, move them out before the next session starts. Scaffold new plugins with claude plugin init <name> — they will appear under .claude/skills/<name>/ and load on restart.

Fast mode pricing changed with Opus 4.8 — what are the new rates?

Fast mode on Opus 4.8 is priced at 2× the standard rate for 2.5× the speed . The previous flag CLAUDE_CODE_OPUS_4_6_FAST_MODE_OVERRIDE is removed on June 1, 2026 — no graceful fallback, no deprecation warning at runtime. Switch to /model claude-opus-4-6 followed by /fast on before that date if you need the older model's fast mode. Token-level pricing for standard Opus 4.8 had not been published in the release notes at time of writing.

What to Watch Next

The v2.1.154–v2.1.158 cluster is a meaningful inflection: Opus 4.8 is the active default, auto mode is no longer a Max/Teams exclusive, and the plugin system now works without marketplace registration. Two areas to track: Dynamic Workflows documentation (shipping after the CLI feature, not before), and auto mode classifier behavior at the edges of your specific tooling stack — the OTEL_LOG_TOOL_DETAILS=1 approach is the most direct way to audit that before putting it in front of automated pipelines.

For teams running Claude Code on Bedrock or Vertex at scale, the combination of auto mode and detailed tool telemetry gives you an auditable log of every tool decision for the first time. That was not possible on managed inference platforms before this release, and it has clear applications for compliance reviews and permission boundary iteration without requiring manual session oversight.

Last updated: 2026-05-31. Based on the Claude Code CHANGELOG, GitHub releases, official Claude Code changelog, and npm version history as of May 30, 2026.

openai-codex Python SDK v0.1.0b2: Install, Authenticate, and Run

Creeta — Thu, 18 Jun 2026 13:32:16 +0000

v0.1.0b2 in Brief: Sandbox Presets and a Renamed Config Class

Released May 28, 2026 as GitHub tag python-v0.1.0b2 , openai-codex v0.1.0b2 is the second public beta of OpenAI's Python SDK for programmatically driving Codex agents. The headline addition over v0.1.0b1: three named Sandbox presets — READ_ONLY, WORKSPACE_WRITE, and FULL_ACCESS — replacing raw permission strings you previously had to construct by hand. A secondary change, CodexConfig replacing AppServerConfig, is a one-line find-and-replace with no behavioral difference . The package depends on openai-codex-cli-bin pinned to 0.132.0 — the binary is not bundled in the wheel. This is also the first publicly accessible iteration under the openai-codex package name, which was renamed from the internal codex_app_server module in Codex CLI v0.131.0, approximately May 16–18, 2026 .

Quick Answer: Install with pip install openai-codex==0.1.0b2 on Python 3.10+. The key addition over v0.1.0b1 is three named Sandbox presets that control filesystem access. Authenticate headlessly with codex.login_api_key('sk-...'). Pin the exact version — API surface changes between betas with no stability guarantee.

If you used AppServerConfig in any prior code, rename it to CodexConfig — nothing else breaks. Note also that a separate package, codex-sdk-python on PyPI at version 0.117.0 as of March 2026 , follows a distinct versioning track aligned to CLI runtime versions and is not the same library. Don't install both.

Prerequisites and pip Installation

The SDK requires Python 3.10 or later . Confirm your version first, then install pinned to the exact beta:

python --version
pip install openai-codex==0.1.0b2

The wheel pulls in openai-codex-cli-bin as a dependency but does not embed the Codex binary directly. In most environments — macOS, Linux, a typical CI runner — the binary resolves automatically from that companion package. In containers or Jupyter notebooks where you need explicit control, bootstrap the binary before any other call:

from openai_codex import Codex

Codex.install(version="rust-v0.132.0")

No Rust toolchain or additional system dependencies are needed on the consumer side — the binary ships pre-compiled. Verify the install landed correctly:

python -c "from openai_codex import Codex, Sandbox, CodexConfig; print('OK')"

Starting a Thread and Reading the Response

The SDK is organized around threads. Each Thread maps to a persistent session stored in ~/.codex/sessions. A single thread.run() call is one turn — one prompt in, one TurnResult out. The TurnResult exposes .final_response (the agent's text reply), .collected_items (all intermediate tool calls in order), .timing, and .usage (token counts) . Here is the synchronous path, step by step:

Open the context manager and start a thread. Always use Codex() as a context manager — it manages the underlying process lifecycle. Pass a Sandbox preset at thread_start():

   from openai_codex import Codex, Sandbox

   with Codex() as codex:
       thread = codex.thread_start(sandbox=Sandbox.WORKSPACE_WRITE)
       result = thread.run("Explain this repository in three bullets.")
       print(result.final_response)
       print(result.usage)   # token counts

Pick the right sandbox preset. FULL_ACCESS is the default but grants unrestricted filesystem access. For most coding tasks that touch your project, WORKSPACE_WRITE (writes inside CWD only) is the appropriate choice. Use READ_ONLY for analysis and auditing tasks where no writes should occur.
Inspect the result. result.final_response is the agent's final text. result.collected_items gives you every intermediate tool call — useful for auditing exactly what the agent read or modified.
Resume the thread in a later session. Save result.thread_id after the first turn. In a new Python process, call codex.resume_thread(thread_id):

   thread_id = result.thread_id  # persist this string

   # in a later session:
   thread = codex.resume_thread(thread_id)
   result = thread.run("Continue from where we left off.")

Async path. For non-blocking applications, use AsyncCodex. Do not mix Codex and AsyncCodex instances in the same event loop:

from openai_codex import AsyncCodex
import asyncio

async def main():
    async with AsyncCodex() as codex:
        thread = await codex.thread_start(model="codex-1")
        result = await thread.run("Refactor this module for clarity.")
        print(result.final_response)

asyncio.run(main())

Streaming. For long-running agent turns, run_streamed() yields incremental events. Poll event.type — "turn.delta" for partial text, "turn.completed" for the final usage summary:

streamed = await thread.run_streamed("Diagnose the CI failure")
async for event in streamed.events:
    if event.type == "turn.delta":
        print(event.content, end="", flush=True)
    elif event.type == "turn.completed":
        print("\nUsage:", event.usage)

The end-to-end snippet below creates a fresh venv, installs the SDK, and runs a smoke test. It is illustrative — it was not executed against the live API at article generation time due to network constraints — but the install path and import are accurate for v0.1.0b2:

import os
import subprocess
import sys
from pathlib import Path

if not os.getenv("CODEX_DEMO_VENV"):
    venv = Path(".codex-demo-venv")
    subprocess.check_call([sys.executable, "-m", "venv", str(venv)])
    py = venv / ("Scripts/python.exe" if os.name == "nt" else "bin/python")
    subprocess.check_call([str(py), "-m", "pip", "install", "-q", "openai-codex==0.1.0b2"])
    os.execve(str(py), [str(py), __file__], {**os.environ, "CODEX_DEMO_VENV": "1"})

from openai_codex import Codex

with Codex() as codex:
    if os.getenv("OPENAI_API_KEY"):
        codex.login_api_key(os.environ["OPENAI_API_KEY"])
        print("authenticated with OPENAI_API_KEY")
    else:
        print("using existing Codex auth")

    thread = codex.thread_start()
    result = thread.run("Reply with exactly: Codex SDK OK")
    print(result.final_response)

Authenticating Without a Browser

v0.1.0b2 ships four authentication modes covering interactive desktop sessions through fully headless CI containers. First-class auth support landed alongside Codex CLI v0.132.0 . Automatic mode — reusing existing codex login credentials — requires no extra code. For CI or headless containers, the API-key mode is the direct path and requires no browser.

Mode	Method call	Best for
Automatic	`Codex()` — no extra call needed	Existing `codex login` session on the machine
API key	`codex.login_api_key("sk-...")`	CI/headless; standard OpenAI API key, no browser
ChatGPT browser	`login = codex.login_chatgpt(); print(login.auth_url); login.wait()`	Interactive desktop with a ChatGPT account
Device-code	`login = codex.login_chatgpt_device_code(); print(login.verification_url, login.user_code); login.wait()`	Non-interactive container with a ChatGPT account

For fully automated container deployments, set the CODEX_AUTH_JSON environment variable and skip the programmatic login call entirely . The SDK reads it at startup — this is the cleanest path for Kubernetes or Docker pipelines where injecting secrets as env vars is already standard.

Device-code flow is worth noting for restricted environments: login.verification_url and login.user_code print to stdout; a human visits the URL and enters the code, then login.wait() blocks until the flow completes. Once confirmed, the session is stored locally and reused on subsequent runs without repeating the flow.

Rough Edges and Patterns Worth Exploring

A few practical caveats before building on this beta:

Pin the version. The API surface changes between beta releases with no stability guarantee. Use pip install openai-codex==0.1.0b2 and read the Codex changelog before bumping . Test upgrades in isolation.
Default sandbox is FULL_ACCESS. If the prompt text is not fully trusted — user-provided input, external data, PR comment bodies — set Sandbox.READ_ONLY or Sandbox.WORKSPACE_WRITE explicitly. The Codex CLI v0.135.0 changelog flags this as a security consideration.
Session files accumulate. Every thread persists to ~/.codex/sessions. Prune the directory manually if you run many short test sessions — there is no built-in TTL or cleanup.
Streaming under long turns is undocumented. The run_streamed() behavior for agent tasks exceeding a few minutes has no documented guarantees in this beta. Treat it as experimental for long-running pipelines.
Pricing and rate limits are not stated in the SDK. They inherit from your Codex subscription tier — check your account dashboard rather than the SDK README.

What to try next: use CodexConfig to set a custom working directory and model selection:

from openai_codex import Codex, CodexConfig, Sandbox

config = CodexConfig(
    model="codex-1",
    working_directory="/path/to/project",
    env={"MY_VAR": "value"},
)
with Codex(config=config) as codex:
    thread = codex.thread_start(sandbox=Sandbox.WORKSPACE_WRITE)
    result = thread.run("Audit the test coverage.")
    print(result.final_response)

For structured output, pair run() with a Pydantic v2 schema via output_schema=MyModel.model_json_schema() and validate with MyModel.model_validate_json(result.final_response). Wiring run_streamed() into a FastAPI SSE endpoint is a natural next step for developer-facing tools that surface real-time agent output. The full API surface is documented in the SDK source on GitHub and the PyPI release page.

Frequently Asked Questions

Does pip install openai-codex also install the Codex CLI binary?

No. The wheel declares openai-codex-cli-bin as a dependency but does not bundle the binary itself. In most environments the dependency resolves and installs the binary automatically. In containers or notebooks where you need explicit control over the bootstrap, call Codex.install(version='rust-v0.132.0') before any other SDK call. If the binary is missing, most SDK methods will raise immediately with a clear error.

Can I use a standard OpenAI API key instead of a ChatGPT account?

Yes. codex.login_api_key('sk-...') accepts a standard OpenAI API key and works in headless CI without any browser interaction. Set OPENAI_API_KEY as an environment variable and call codex.login_api_key(os.environ["OPENAI_API_KEY"]) in your startup code. This is the recommended path for automated pipelines and container deployments.

What is the difference between Sandbox.READ_ONLY and Sandbox.WORKSPACE_WRITE?

Sandbox.READ_ONLY permits the agent to read files but not write or modify them — appropriate for analysis, code review, and question-answering tasks where you want a zero-write guarantee. Sandbox.WORKSPACE_WRITE allows writes inside the current working directory only, which covers most coding and refactoring tasks. Sandbox.FULL_ACCESS is the default and is unrestricted — use it only when you fully control and trust the input prompt.

How do I continue a thread from a previous Python session?

Save result.thread_id (a string) after the first turn — to a database, file, or environment variable. In a new Python session, instantiate Codex() as usual, then call codex.resume_thread(thread_id) to reload the conversation. Sessions are stored on disk in ~/.codex/sessions and persist across Python restarts. Prune that directory periodically if you run many short test threads, as there is no automatic cleanup.

Is openai-codex v0.1.0b2 stable enough for production?

It is a public beta with no API stability guarantees between beta versions, as noted on the PyPI release page . The right approach: pin openai-codex==0.1.0b2, monitor the Codex release log, and test any version bump in isolation before shipping. For workloads that cannot tolerate breaking API changes, wait for the 1.0 release.

What to Do With It Now

Two things in v0.1.0b2 are immediately actionable. First, if you have existing code that passes raw permission strings to the Codex SDK, swap them for the named Sandbox presets — it is a one-line change per thread that meaningfully reduces filesystem blast radius and makes intent explicit in code review. Second, if you are running Codex in CI, the login_api_key() path eliminates the browser-auth workaround and makes the authentication model match how you handle every other API key in your pipeline.

The versioning scheme is now decoupled: pyproject.toml carries version = "0.0.0-dev" in source, and the published version is injected from the python-v* git tag at release time . This means beta releases can ship faster without requiring source-tree commits for each version bump. Track the v0.1.0b2 release notes and the official SDK docs for the shape of 1.0 — the cadence is likely to accelerate from here.

Last updated: 2026-05-31. Based on openai-codex v0.1.0b2 on PyPI and the Codex CLI v0.135.0 changelog reviewed on this date.

DEV Community: Creeta

Seedance 2.5 targets 30s 4K — nothing independent confirms it

From 15s to 30s: What ByteDance Says 2.5 Can Do

Before July: Signing Up on Jimeng and ModelArk

The ModelArk Submission Flow for Seedance 2.0

The Traps: Copyright Overhang, Regional Lock, and 4K Uncertainty

Once 2.5 Is Available: What to Confirm

Frequently asked questions

Is Seedance 2.5 publicly available right now?

What does BytePlus ModelArk charge for Seedance 2.0?

How do I access Seedance outside China?

What are the copyright risks when prompting Seedance?

What does Seedance 2.5 add over 2.0, and is any of it verified?

96% of cuBLAS, no `unsafe`: what cuTile Rust proves

How cuTile Rust Extends the Borrow Discipline to GPU Dispatch

sm_80+, Driver ≥610, Rust 1.89: What the Crate Expects

Annotating, Partitioning, and Dispatching a cuTile Rust Crate

Friction to Expect: No AMD, Evolving Macros, Unproven Concurrency

Grout: The Inference Reference for cuTile Rust Crate Authors

Frequently asked questions

What NVIDIA GPU is required to run cuTile Rust?

How does cuTile Rust achieve data-race freedom without a runtime lock?

Is cuTile Rust production-ready?

Does cuTile Rust work on AMD GPUs or Apple Silicon?

How does Grout's 171 tok/s on RTX 5090 compare to vLLM?

Fugu hides the seams: multiple AIs, billed as a whole

What Is Sakana Fugu?

Before You Integrate Fugu

Plugging Fugu Into a Codebase

What Fugu Hides From You

Taking Fugu Further

Frequently asked questions

Is Sakana Fugu available in Europe?

What is the difference between fugu and fugu-ultra?

Can I see which underlying LLMs Fugu used for my request?

Does Fugu work with the OpenAI Python SDK without major changes?

Does the Fugu installer work on Windows?

Three packages claim 'SkillsGuard'. One shipped malware.

The 'SkillsGuard' Naming Mess, Resolved

What to Gather Before You Start

Quickstart: Init, Scan, Protect

Where AgentGuard's Coverage Ends

Going Beyond the Scanner: Manifest Sidecar

Frequently asked questions

Is SkillsGuard an official Anthropic product?

What does agentguard scan actually check?

Can AgentGuard catch prompt injection inside SKILL.md?

How do I scan a skill without activating it in my host environment?

What is the difference between strict, balanced, and permissive protection levels?

An offline AI you power with your arm — 48 tok/s on a Pi 5 CPU

What CrankGPT Is, and What to Ignore

Parts and Power: Pi 5, ReSpeaker, and the Crank

Cloning edge_voice_agent and Getting It Talking

Power Spikes, ASR Limits, and Where to Go From Here

Frequently asked questions

Do I need the physical hand-crank hardware to try CrankGPT's software?

Which GGUF model gives the best quality-speed tradeoff on Raspberry Pi 5?

Why does stopping the crank kill the Raspberry Pi?

Can Moonshine ASR be swapped for Whisper on this pipeline?

Is CrankGPT available to buy or download as a ready-made app?

GitHub Copilot App can now merge PRs while you're offline

How the Copilot App Orchestrates Repos and PR Handoffs

Copilot App Needs a Paid Seat and One Admin Switch

How to Open a Copilot Agent Session and Merge a PR

Copilot App Gotchas: Workspace Wipes and Unreviewed Merges

Copilot Automations: the Natural Next Move

Frequently asked questions

Does the GitHub Copilot App replace the IDE extension?

What is the difference between Interactive, Plan, and Autopilot session modes?

How do AI Credits work and is there a surprise-bill risk?

Is Agent Merge safe to enable without CI?

Which Copilot pricing tier unlocks the desktop app?

Creative Agent spans the CC suite now. Here's the paid gate.

Firefly Now Spans Photoshop, Premiere, and Illustrator

Who Qualifies: Paid Adobe Memberships Only

How to Invoke the Firefly AI Assistant

Supervise the Creative Agent: What to Check

What Comes After Successful Invocation

Frequently asked questions

Is Firefly Standard eligible for the Firefly AI Assistant?

What does `agentguard scan` actually check?