← All news

AI News Briefing — Revolut cuts AI coding costs by self-hosting GLM

#self-hosting #open-weights #security

Revolut says making self-hosted GLM its default cuts AI coding inference costs about 90% for 2,000 engineers. Tencent releases its Hy4 flagship, and coding agents keep installing archived MCP reference servers.

Model releases

  • [2026-11-04] Tencent released the full Hy4, a 770B-parameter model and the first in its Hy line to read images and charts. Tencent’s own blog has it beating GLM-5.3 and DeepSeek-V4.1-Flash on every task it tested and trading wins with Kimi K3.1 Pro; a lighter Hy4 Flash is promised. Tencent calls it open-weight, but only the August preview (Apache 2.0) is on Hugging Face so far. (source, official)

    Until the 770B weights are actually downloadable, nobody outside Tencent can check the benchmark wins or see which licence the full model ships under.

Self-hosting & compute

  • [2026-11-03] Revolut says self-hosting cuts its AI coding inference costs by roughly 90%. About 2,000 engineers now default to GLM-5.3 on 56 Nvidia B200s, seven eight-GPU nodes, after starting on GLM-5.1 at about $0.30 per million tokens, a tenth of what Codex or Claude Code cost it. Revolut reports time to first token under 3 seconds at around 256K context and about 200 tokens a second. A router sends vision requests to Gemini or GPT models, since GLM is text-only, and frontier tools stay in use for some work. The figures come from a talk at AI Engineer New York. (source)

    Fifty-six B200s are out of reach for most teams. The routing split is not: text goes to a cheap self-hosted default, vision and some harder work to hosted models.

Coding agents

  • [2026-11-03] GitHub Copilot now runs as an agent inside JetBrains Air over the Agent Client Protocol, on an existing Copilot plan. Local tasks need the Air plugin; cloud tasks run in a fresh container per task through Air Teams and bill to Copilot, not JetBrains AI credits. Air’s analytics don’t count Copilot usage, and admins can’t set Copilot spending limits there. (official, official)

    Air users get Copilot without a second subscription, but the usage and spend for those sessions show up only on GitHub’s side.

    For Engineering Managers / Tech Leads: A team piloting Air’s cloud tasks will see that spend on the Copilot bill alone, with no Copilot limit settable inside Air and no Copilot numbers in Air’s analytics, so the pilot’s budget has to be tracked from Copilot’s own reporting.

  • [2026-11-03] DeepSeek published dsh-superagent, an MIT-licensed prototype of a coding agent that takes requests from GitHub or Feishu, works each one in its own session and replies with a pull request. A web panel lists what needs a person. DeepSeek labels it a research prototype, not a product, and says it differs from its internal version. (official)

    Its web panel of items waiting on a person is the part worth reading: that is where human review sits in an agent whose only output is a pull request.

MCP

  • [2026-11-02] Glow Labs found coding agents installing the archived @modelcontextprotocol reference servers, mostly by recalling package names from training data rather than at a user’s request. It reported four high-severity flaws, including prompt-injectable code execution in the Puppeteer server; maintainers closed the report because the repository is archived, so no fix is coming. The deprecated packages have passed 17.3 million npm downloads since July 2025, and npm’s deprecation warning doesn’t block installs. (source)

    With no fix coming, protection has to come from limiting which packages an agent may install, since npm’s warning won’t stop it.

Agent frameworks & platforms

  • [2026-11-03] LangSmith’s bring-your-own-cloud deployment now runs on Azure and Google Cloud in beta, alongside generally available AWS. LangChain keeps the control plane; traces, evals, prompts, agent deployments and secrets stay in the customer’s account and region. The Google Cloud control plane sits in the US, and trace migration works on AWS only for now. (official)

    Teams choosing Google Cloud for data-residency reasons should note that its control plane is in the US even when traces stay in their own region.

AI-assisted SDLC

  • [2026-11-02] GitHub Actions will block pull_request_target by default in public repositories from December 2, a month later than first planned, with two-hour brownouts on November 9 and 16 at 16:00 UTC. The trigger runs with the base repository’s secrets, which is how fork code ends up stealing them. Workflows that need it must be allowed in an Actions event policy. (official)

    November 9 and 16 are free rehearsals: any workflow that fails during a brownout is one that will fail for good in December.

    For Platform / DevOps Engineers: Search every public repository’s .github/workflows for pull_request_target before November 9, and for each hit decide whether it earns an entry in an Actions event policy or should be retired.

AI cost tracking & telemetry

  • [2026-11-03] Google tested routing a 50-task coding benchmark through a cheap classifier that sends each task to Flash-Lite first and escalates only flagged ones. The router solved all 50, as Gemini Flash on low thinking did, at lower cost and latency. A regex-and-length heuristic scored 93.8% on its tuning set but 70.6% on unseen tasks. Capping output at 300 tokens broke 7 of 25 hard tasks. (official)

    A heuristic that slides from 93.8% to 70.6% on unseen tasks is a warning to score any router on held-out work before trusting its savings.

  • [2026-11-03] The Copilot usage API now separates bring-your-own-key and enterprise custom-model traffic from Copilot-hosted usage, with new per-user and aggregate fields such as totals_by_local_byok and is_custom_enterprise_model. Local counts come from client telemetry, so they run low when telemetry is off, and there is no backfill. (official)

    Dashboards built on these fields will undercount local BYOK use wherever developers have telemetry off, and earlier months stay blended.

  • [2026-11-03] Grafana Alloy’s OTel engine, an OpenTelemetry Collector distribution that reads standard Collector YAML with no Alloy syntax, reached public preview in Alloy v1.21.0. It runs as alloy otel --config=config.yaml and deploys through the Helm chart or the OpenTelemetry Operator. (official)

    Existing Collector configs run unchanged, so trying it costs a deploy rather than a rewrite.

Practice & craft

  • [2026-11-03] Google Cloud’s rules for testing agent skills start with a check most teams skip: when a skill shows no gain, the agent usually never loaded it, because only the frontmatter is read at the start. Its open-source skill-reach lints descriptions and flags overlapping triggers before any container runs. Then it compares paired runs with and without the skill over three repetitions, off developer laptops, and deletes skills that add nothing. (official)

    A skill that never loads still spends context on its frontmatter in every session and gives nothing back.

    For Software Developers: Three skills whose descriptions all mention running tests are the case skill-reach is built for: its overlap check flags them before any container starts, and the paired runs show which one is worth keeping.

Research worth reading

  • [2026-11-03] AllenAI’s StateBench tests how well models track values that change across long documents. Frontier models, Claude Opus 5.5 and GPT-6 Sol among them, handle simple reassignment but fall to 13% or lower on the longest swap-style problems. Trained from scratch, Gated DeltaNet and hybrid models generalized far beyond training length where transformers didn’t. The same problem scores differently depending on how it is phrased. (official)

    Because phrasing alone moves the score, one prompt template is not enough to judge a model’s state tracking; try several wordings of the same problem.

Teaching & learning

  • [2026-11-03] Google will switch its AI tools off by default for K-12 students next year, leaving administrators to turn them on. A school that blocks AI loses Google Search as well, because Google says the two are too integrated to separate. Google announced it alongside Guided Learning, a Gemini mode built to explain rather than hand over answers. (source)

    For a district, blocking AI and keeping Google Search are now an either-or choice.

Watch list

  • Kimi K3.1 Pro weights: due today; no K3.1 repository on Moonshot’s Hugging Face page this morning.

  • Hy4 full weights: Tencent calls the release open-weight; only the preview is downloadable so far.

    Weights for the 770B model on Hugging Face, with a licence attached, would turn Tencent’s open-weight claim into something teams can test.

  • ChatGPT–Codex shared allowance: still no start date or numbers.

  • Gemini 4 Carbon general access: still limited to cyber defenders and partners; no date.