The Pulse, Monday 26 October 2026
Kimi K3.1 Pro hit OpenRouter with open weights incoming, MCP gained long-running Tasks at Anthropic, and Python shipped three interpreter releases. iPhone and Samsung TV both got remote shells this weekend — security researchers are having fun.
Models
MoonshotAI: Kimi K3.1 Pro
Moonshot's flagship open-weight multimodal reasoning model landed on OpenRouter with a 1M context window, $2/$10 per million tokens, and full weights releasing November 4.
Open weights mean we can host it ourselves for client work with strict data residency — especially useful for Pipeline's nonprofits. The 1M window makes it viable for long call transcripts and legislative research that hit EverRaise and Mackinac's limits.
Claude MCP Tasks and Elicitations
Anthropic added MCP Tasks: plugins can now accept long-running jobs from Claude and report back when done, plus Elicitations for structured mid-task user input.
Turns our MCP servers into async workers — a deep research task or a multi-step deploy can now run while Claude handles other work. The elicitation hook solves the approval-gate problem we hit with client data changes.
Research
Benchmarks Are Surprisingly Compaction-Friendly
Long-horizon agents lose task constraints and reasoning history when compacting context windows, yet benchmarks remain solvable. The paper shows compaction is less lossy than expected for standard tasks, but exposes silent degradation for others.
We built context compaction into Hermes and this shows where it quietly fails — when implicit constraints or earlier reasoning matter more than the benchmark reveals. The paper's failure modes are a checklist for Botterfly's memory management.
SPECMEM: Accelerating Agentic Tool Calling via Live Memory Management
Speculative decoding for tool-calling agents, using retrieved past calls as drafts. Cuts tool-call latency without changing output.
Every tool call we make in Hermes is decoded autoregressively — this hits latency for repeated EverRaise voice agent flows. If we can pre-draft common calls from memory, we shave seconds off the response time users feel.
Reimagining Enterprise RAG for Multi-Agent Systems
A seven-agent pipeline reverse-engineered 241 repos into behavioral logic artifacts — scope, journeys, rules — that agents act on. The claim: enterprises need behavior, not documentation.
Our RAG for SalesKick and Pipeline pulls docs; this argues we should extract the actual rules and flows the system enforces. If we pre-process client repos this way, agents ground their suggestions in what the code does, not what a stale README says.
What Open-Source Projects Tell Their Coding Agents: A Census of AGENTS.md and CLAUDE.md
A census of GitHub's AGENTS.md and CLAUDE.md files across thirteen languages and thousands of repos, documenting what projects actually tell coding agents.
We maintain AGENTS.md in every repo Botterfly touches. This census shows what conventions are spreading and what instructions work — useful calibration when we write the next one.
Releases
Python 3.13.18
Interpreter release on October 25.
SalesKick, Pipeline, and our own services run on 3.13 — patch releases often include security fixes or runtime stability improvements we want.
Python 3.12.16
Interpreter release on October 25.
Several client projects are still on 3.12 and need patches before we migrate them.
Python 3.11.18
Interpreter release on October 25.
Legacy client scripts and older containerized environments still pin 3.11 — keeping them patched is operational hygiene.
Langfuse v4.70.0
Public API added Topics endpoints, AI gateway now shows per-tool setup, and Cmd+K can jump to prompts and datasets. Also batch evaluation runBatchEvaluation MCP tool.
We use Langfuse for tracing SalesKick's call grading and Pipeline's retrieval steps — the Topics API lets us programmatically group and query by theme, and the MCP tool means we can kick off eval runs from Hermes directly.
Next.js v16.4.3
LTS backport fixing extensionless Google font URLs, app-page runtime loading, and OpenTelemetry trace grouping.
Chrysalis and client dashboards run Next.js — the OpenTelemetry fix keeps our request traces coherent, which matters when debugging prod issues.
Hacker News
Today, we hacked what we'd set out to hack: the iPhone
A remote shell on an iPhone, documented in a blog post that hit the front page. 1,106 points, 717 comments.
Security proof-of-concept that matters if any of our client apps touch mobile — though mostly a reminder that no platform is truly locked down when researchers dedicate the effort.
We should be more ambitious with the software we build
Dan Luu arguing that software ambition has shrunk and we should aim higher. 761 points, 698 comments.
Worth knowing, though not directly actionable — the essay resonates with how we frame client work, where the constraint is usually speed and pragmatism, not ambition.
Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more
Remote code execution vulnerability in Brotli decoders across Node.js, Python, and other runtimes. 393 points, 211 comments.
If any of our services accept user-uploaded compressed data, this is the vulnerability to patch immediately — Brotli is common in web transport and file handling.
People on X
Nous Research teaser
Nous posted a wordless link with 4,841 likes. Context unclear without following the URL.
Nous ships Hermes models and tooling we use daily — when they post with this much traction, it is usually a model or feature drop.
OpenAI + Azure Cosmos DB storage architecture
OpenAI's DevRel shared how they hit 12× better global read latency for 1.2 billion ChatGPT users with Azure Cosmos DB.
Relevant if we ever need to scale SalesKick's call storage or Pipeline's retrieval globally — the Cosmos DB integration pattern is a known path to sub-50ms reads.
Sebastian Raschka's reasoning-from-scratch series
The complete video series on building reasoning models from scratch is now up.
Raschka writes approachable deep dives — useful if we need to explain reasoning models to a client or debug one ourselves.