Darcy

Builder of — short, hands-on tutorials for new AI tools. Hacker News & arXiv hot picks turned into 7-minute read

[Darcy @darcy_7minai]

llm-d 1.0 is out. Put a prefix-cache-aware router in front of vLLM on Kubernetes: Helm install, Kustomize overlay, a 10-request test that proves routing works, peakPrefillThroughput calibration, and the 0.x upgrade traps.

https://t.co/RgEbzs2dpl

[Darcy @darcy_7minai]

NVIDIA's Nemotron 3.5 Bolt E4B runs locally in ~3-5GB VRAM (NVIDIA's numbers). Our guide: llama.cpp + DFlash drafter setup, thinking/conversational switches, tool calls, and why `ollama run nemotron-3.5-bolt` pulls the 25GB model instead.

https://t.co/IEmGyXhcra

[Darcy @darcy_7minai]

Kimi K3.1 Pro is live on the Kimi API: model kimi-k3.1-pro, 1M context, $2/$10 per 1M tokens (cheaper than K3). It always thinks, so set reasoning_effort or you get max.

First call, Codex + Claude Code setup, rate tiers and fixes:
https://t.co/cE6ZnJ0xWo

[Darcy @darcy_7minai]

Kling 4.0 API is now open to all fal customers. Heads up: every endpoint defaults to 1080p ($0.235/s vs $0.157/s at 720p).

Our guide: text/image/reference/edit endpoints, multi-shot prompts, cost math, queue + webhooks, common 422s.

https://t.co/2MCrxlGwXw

[Darcy @darcy_7minai]

TanStack AI 1.0 is out, but upgrading from 0.x isn't just a version bump: threadId is now required, body became forwardedProps, the ai-*-ui packages are gone, and the codemod renames keys but not values.

Tested step-by-step guide:
https://t.co/JTb4fSlGeM

[Darcy @darcy_7minai]

MiniMax M3.1 Flash weights are public: 428B total, 23B active. Self-hosting needs 4x Blackwell/MI355X or 8x H200. Our guide covers the vLLM and SGLang launch commands, the license terms and the startup errors to expect.
https://t.co/nqHCurtnEE

[Darcy @darcy_7minai]

Replit's Monitoring Agent can investigate production alerts, attempt a validated fix and, only if you allow it, republish your app.

Which of its 3 switches to turn on, safe defaults, alert emails and cost limits:
https://t.co/MeKD941477

[Darcy @darcy_7minai]

OpenAI's Decisions API is GA: typed answers (probability, choice or score) from gpt-6-luna at $0.10/1M input tokens, no output charge, up to 400 questions per request.

Step-by-step guide: first call, thresholds, caching, common errors:
https://t.co/SWxnR6RVCF

[Darcy @darcy_7minai]

NVIDIA's OpenShell lets you run a coding agent with zero network access by default, scoped API keys it never sees, and per-request approval. Step-by-step: install 0.1.5, write a read-only rule, run OpenCode safely.

https://t.co/3SB7jZgPoD

[Darcy @darcy_7minai]

Symantec caught an agent that hunts open LLM endpoints and runs attacks on the owner's compute, for up to 100,000 steps.

How to lock down Ollama, vLLM and llama-server (and why vLLM's --api-key alone leaves /invocations open):
https://t.co/fxY0oWDjsU

[Darcy @darcy_7minai]

Self-hosting GitLab? CVE-2026-110264 is a CVSS 10 unauthenticated RCE that hits every CE/EE version back to 7.0. Upgrade to 19.5.1, 19.4.3, 19.3.6 or a backport release. Here's how to check your version, patch it, and grep your logs for attempts:
https://t.co/4zh0Xk0G02

[Darcy @darcy_7minai]

On Railway? It says an attacker may have read and decrypted customer env vars. Builds are paused. Revoke keys at the provider first, then stage new values with `railway variable set --stdin --skip-deploys`.

https://t.co/0uWCjXznKo

[Darcy @darcy_7minai]

Recursive's Flint is a 40B MoE coding model with ~2.5B active params, under Apache 2.0. Here's how to run it locally with Ollama, rec on M4/M5 Macs, or llama.cpp on NVIDIA, and plug it into OpenCode, Pi or Codex:
https://t.co/3T34KOZrox

[Darcy @darcy_7minai]

Mistral Large 4 (1.05T params, 52B active, 1M context) is in API preview. Our step-by-step guide covers reasoning_effort, parsing thinking chunks, tool calls, schema-locked JSON, prompt caching at 10% input cost, and 50%-off batch jobs.
https://t.co/Z0ZXUhIVdX

[Darcy @darcy_7minai]

Claude Security now rescans your repos as code changes and marks findings fixed when the fix ships (Enterprise beta). Not on Enterprise? The claude-security plugin runs the scan in Claude Code and writes SARIF + reviewed patches.

Setup guide: https://t.co/1pC8tF9sPi

[Darcy @darcy_7minai]

PHP2Shell: two critical PHP engine bugs (CVE-2026-109618/109619) allow unauthenticated RCE, whatever app runs on top. Fixed in PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35.

How to find the PHP that serves your site, run OpenAI's checker, patch, and stopgaps:
https://t.co/uw49B82kqm

[Darcy @darcy_7minai]

litellm 1.107.0 on PyPI and Docker shipped a credential stealer that runs on every Python start, even if you never import it. Pin 1.106.2, check site-packages for cook.pth and https://t.co/GrCG2HAHkT, and rotate your keys.

https://t.co/FXkHqR9Vba

[Darcy @darcy_7minai]

OpenAI's official CLI (v1.39) puts the whole API in one `openai` binary. Our guide: install, safe key setup, Responses, file uploads, Batches you can wait on and download, an offline tokenizer, and the --format json change that can break scripts.
https://t.co/smxqrEuSHN

[Darcy @darcy_7minai]

Perplexity Computer can now run fully local on Apple silicon Macs: model, agent and file processing stay on device. Ships with Qwen 3.6 or PPLX Pro, 36 GB+ memory recommended, for Pro/Max/Enterprise.

What it covers vs Hybrid Compute:
https://t.co/ZWbPZ6Y3FE

[Darcy @darcy_7minai]

Hugging Face's AnyLanguageModel 1.0 lets Swift apps keep Apple's Foundation Models API and swap in MLX, llama.cpp GGUF, Ollama or hosted models by changing one line. Setup, traits, tools, and the 1.0 breaking changes:
https://t.co/rY1mA6kIq0