A research team turns a video model into a game that runs at 60 frames a second on one graphics card. Claude's API gets its first new version in three years, and mods let you rewire the agent itself.
The short version
Game devMatrix-Game 4.0 runs a playable world from a video model on one RTX 5090: a small engine keeps the rules, the model paints the pixels.
Software and AIClaude API version 2026-10-21 turns temperature, top_p and top_k into errors. New SDK majors send it by default.
Software and AIClaude Code mods are small TypeScript or JavaScript functions that can watch, change or replace what the agent does and shows.
Game devFlax Engine 1.13 draws 5,000 animated characters in about 4 ms; Fuse Games shows how a 75-person core ships with outside teams.
Software and AICoding agents back up before a risky change only 15.2% of the time, a new benchmark finds. Today's Try this adds a hook that does it for them.
Game dev Lesson
A video model you can play
Researchers made a video-generating AI behave like a game: a small engine tracks the rules and the state, and the AI only draws each frame, fast enough to play on one gaming PC.
ContextVideo models generate moving pictures from text or images. Until now, turning one into a game meant laggy, forgetful worlds that ran on rented data-centre hardware.
Matrix-Game 4.0, from SkyworkAI and several universities, splits a game into three jobs. A lightweight game engine holds the rules and the state (where you are, what you hit). A coding agent writes and edits those rules when you ask in plain words, like "add a shield that breaks at its durability limit". A video model looks at a rough proxy render from the engine and paints the final frame.
Because the model never has to remember the world, it can be small and fast. The authors report 60 frames a second at 480p on a single RTX 5090, with 112 ms from key press to frame, against 0.5 to 10 seconds for earlier systems that mostly needed data-centre GPUs. The renderer was trained on about 1,712 hours of clips captured from Unreal Engine 5 scenes.
It is still a prototype: four scenes, low resolution, and every number comes from the authors. The weights and code are public, so you can check it yourself on a 16 to 24 GB card.
112 mskey press to frame on one RTX 5090 (authors' figure)
Technical details
Reported throughput: 83 FPS single-step steady state with 18.2 GiB peak memory on an RTX 5090, about 67 FPS on an RTX 5080 (12.8 GiB) and 58 FPS on an RTX 5070 Ti (10.9 GiB). Against the team's own previous version, frame rate rose from 4.5 to 83.4 and latency fell from 1,110 ms to 112 ms. The authors note that the other systems measured latency in different ways.
Training data: 114,334 paired clips (proxy frame plus final frame) from four Unreal Engine 5 scenes, about 1,712 hours. The video model runs in one or two denoising steps per frame, which is where most of the speed comes from.
Why it mattersIt shows a practical split for AI-rendered games: keep gameplay deterministic in code you can test, and let the model handle only the look. That is the same boundary any team adding AI to a game would want.
For youTrained on UE5 captures and driven by an engine that owns the rules: this is the shape a neural renderer would take next to your gameplay plugins. Worth a weekend test on a 24 GB card to see the proxy-to-frame quality for an action RPG camera.
video model
An AI model that generates a sequence of video frames from a prompt, an image or earlier frames.
proxy render
A quick, rough image of the scene (simple shapes and colours) that tells the AI what should be where.
weights
The learned numbers that make up a trained AI model; releasing them lets anyone run it.
480p
A low video resolution, 480 pixels tall, about the quality of an old DVD.
A breaking API version, mods, memory that writes itself and a poisoned package.
Software and AI Do this
Claude's API gets a new version, and temperature is now an error
ContextAPI versions let a provider change behaviour without breaking old code: each request says which version of the rules it expects.
Anthropic released the first new version of the Claude API since 2023. Some settings that older code sends on every request now make the request fail, and the new SDKs switch to it by default.
Version 2026-10-21 replaces 2023-06-01. Nothing changes until you upgrade your SDK or set the header yourself; then these requests start failing.
2023-06-01
2026-10-21
temperature, top_p, top_k
Accepted on every model
400 error, even at the default value
Document in an assistant message
Accepted
400 error; send documents in user messages
Citations on user text
Accepted
400 error; citations stay fine on assistant text
Python SDK
1.x
2.0.0 sends the new version
TypeScript SDK
0.x
1.0.0 sends the new version
SDK licence
MIT
Apache 2.0
Before bumping SDK majors, search your code for temperature. On models that still honour a low temperature, such as Sonnet 4.6, removing it changes output, and no setting replaces it; the guide says to keep such requests on the old version.
Technical details
Without the sampling parameters a request uses the defaults, including temperature 1.0. Claude 4.7 and later models already accept only the defaults, so they sample as before. Other SDK majors: C# 13.0.0, Go 2.0.0, Java 3.0.0, PHP 1.0.0, Ruby 2.0.0, and the ant CLI 2.0.0 (its Go install path gains /v2).
Also in the migration: Text Completions are removed from several SDKs, the TypeScript and Ruby tool runners drop client-side compaction in favour of server-side compaction, SDKs send API keys as Authorization: Bearer, and Admin API fields are renamed (roles to role_ids, group_id to rbac_group_id). Claude Code 2.1.307 adds /claude-api api-version to move a codebase over.
Why it mattersAny app that pinned a low temperature for consistent output will either start failing or quietly change behaviour on the next dependency update. Check it before a routine upgrade does it for you.
For youGrep your Node SaaS backends for temperature before Dependabot proposes @anthropic-ai/sdk 1.0.0, then run /claude-api api-version in one repo first and diff the result.
temperature
A setting that controls how random a model's word choices are; lower means more predictable answers.
SDK
Software development kit: the official library you install to call a service from your code.
400 error
The HTTP reply a server sends when it rejects a request as malformed.
Mods turn the coding agent's own interface into something you can program
Claude Code now takes mods: small programs that run inside the agent, see what happens (a prompt, a tool call, the screen being drawn) and can change it, and Claude can write them for you from a description.
Hooks already let you run a script before or after the agent acts. Mods go further: they are TypeScript or JavaScript functions that can watch an event, change what you see, or replace the default handling entirely. Anthropic ships six built in, including one that adds a side agent to warn you before you discard uncommitted work.
Dan McAteer's write-up calls it flipping the harness: instead of only shaping what the agent does to the machine, you shape what it shows the human. His own supervisor mod fired on 99 of 111 turns, which he admits is noisy. Mods are not sandboxed and run with your permissions, so treat one like any other code you install.
Why it mattersThe agent's interface is becoming as customisable as an editor. Team rules that live in a wiki today (warn before force-push, show test status) can become a mod everyone runs.
For youYour hooks and routines already live at this layer. A you-should-know style mod that flags uncommitted plugin work before a worktree exit is a natural first one to try.
harness
The program around an AI model that feeds it context, runs its tools and shows its output.
hooks
Scripts the agent runs automatically at fixed moments, such as before every command.
sandboxed
Run inside a walled-off space that limits what the code can touch.
An agent that writes itself short rules from past runs gets 10 to 15 points better
IBM had a model read an agent's past attempts and boil them down into short rules, then pasted the rules into the agent's instructions. Without any retraining, it passed more customer-service tests.
Share of held-out tasks passed in all four tries (Pass^4) on the tau2-bench customer-service benchmark, before and after adding learned rules.
Retail, GPT-4.157.5 % tasks
Retail, + rules67.5 % tasks
Airline, GPT-4.135 % tasks
Airline, + rules45 % tasks
Airline, GPT-5.555 % tasks
Airline, 5.5 + rules70 % tasks
Vendor-reported by IBM Research. Small test sets (40 retail and 20 airline tasks). Each rule carries a support count (how many runs it came from), and filtering weak rules mattered.
Why it mattersIt is the same idea as a project instructions file, measured. Keeping a rule only when several runs agree on it is a cheap trick any team can copy.
For youTry a support threshold on the lessons your routines write to their notebooks: keep a lesson only once it shows up twice.
benchmark
A fixed set of tasks used to compare how well different systems perform.
support count
How many separate runs produced the same rule; more support means more trust.
A bad release of LiteLLM, a popular library that routes requests to many AI providers, stole passwords and keys from every machine that installed it, even if the code never imported it.
October 21, UTC, from SafeDep's analysis. Clean versions: 1.106.2 and the 1.107.0 release candidates.
Attacker overrides branch protection and edits the release workflow.
A build runs from a lookalike repository.
Seven malicious 1.107.0 wheels reach PyPI.
Malicious Docker images follow, including the latest tag.
PyPI removes 1.107.0.
Docker tags are pointed back to clean images.
Technical details
The payload shipped as cook.pth, which Python runs at every interpreter start, plus a sitecustomize.py backdoor that re-ran the stealer hourly. One added line in the package config copied the payload into the wheels while the source on GitHub looked clean. Targets included coding-agent tokens, provider keys stored in the LiteLLM proxy database, cloud and CI secrets, and SSH keys.
Why it mattersAn AI gateway concentrates every provider key in one place, which makes it a prize. Pin versions, and remember that a .pth file runs whether you import the package or not.
For youIf any Python tooling in your agent setup pulls litellm, check for cook.pth in site-packages and rotate provider keys if 1.107.0 was ever installed.
PyPI
The public registry where Python packages are published and installed from.
wheels
Pre-built Python package files that pip installs directly.
A survey of 520 tech leaders finds most companies use several AI model providers, and the hardest part to move is everything built around the model.
25%use five or more model providers
53%say tool integrations are hardest to move
Teams with five or more providers built their own MCP or internal integrations 76% of the time, against 42% for teams with one or two. The survey is by Stacklok, which sells agent tooling.
Why it mattersThe model is the replaceable part. Integrations, workflows and evals are what you will carry from one provider to the next, so build them to be portable.
For youSupports keeping your skills, hooks and MCP servers provider-neutral where it costs little.
MCP
Model Context Protocol: a standard way to plug tools and data into AI apps.
Small releases that change daily work: a safety log in Claude Code, expiring GitHub CLI logins, a database that formats its answers for agents, and cheaper monorepo deploys.
Show the details
Each one is a setting or habit to change, not a headline.
A new claude_code.safety_event OpenTelemetry event fires each time a permission rule, auto mode, a hook or the sandbox stops or prompts a tool call. Checkout hooks now time out after 30 minutes (--checkout-hook-timeout-min).
Public preview: gh auth login --expiring (gh 2.103.0+) stores a short-lived token plus a rotating refresh token. Scripts that save gh auth token once will break; call it each time.
The CLI detects coding agents and switches to compact Markdown, flags truncated results and returns errors as JSON. In TPC-H tests that cut what the model had to read by 59%. Files written by 2.0 cannot be read by older versions.
Builds skipped because a package did not change no longer count against deployment limits. On by default for new monorepo projects; existing ones opt in under Build and Deployment.
Why it mattersShort-lived credentials and logged safety decisions are becoming defaults for agent setups; adopting them early is cheaper than retrofitting after an incident.
For youExport safety_event from your routines to see how often guardrails fire, and switch gh in long-running automations to call gh auth token per use before expiring logins become the default.
OpenTelemetry
An open standard for sending logs, metrics and traces from software to a monitoring tool.
monorepo
One repository that holds several projects or packages together.
Cheap crowds, outside teams, a new store ruling and a 2D trick.
Game dev Release
Flax Engine 1.13
An open-source, Unreal-like engine scripted in C# and C++, now on .NET 10.
Flax, a small engine that works a lot like Unreal but uses C#, released a version that renders crowds of animated characters cheaply and adds better lighting and culling.
The headline is instancing for animated models: the team shows 5,000 Mixamo characters at 60 frames a second on an RTX 2080 Ti, all animated with shadows and motion blur, inside about 4 ms. The release also adds specular reflections to its probe-based global illumination, occlusion culling, soft shadows, FSR 4 upscaling and local split-screen.
Crowd
5,000 animated characters, about 4 ms (vendor-reported, RTX 2080 Ti)
GI reflections
About 50,000 probes, 49 MB VRAM, 0.5 to 0.9 ms on the demo level
Runtime
.NET 10 and C# 14, shown running on Nintendo Switch
Why it mattersA small engine publishing a frame-time budget for crowds gives everyone a number to test their own engine against.
For youA benchmark target for your own crowd work: measure ms per 1,000 skinned characters in UE5 with Unreal Insights and compare.
instancing
Drawing many copies of the same model in one go, so the graphics card does the repeated work cheaply.
global illumination
Lighting that includes light bouncing off surfaces, not only light straight from lamps.
occlusion culling
Skipping objects hidden behind others so the GPU never draws them.
RPG Maker fakes HD-2D with flat tiles and a heightmap
The next RPG Maker turns ordinary 2D map tiles into blocks in a 3D space seen from a fixed camera, so you get the diorama look of games like Octopath Traveler without learning 3D.
RPG Maker U2U's P2D (perspective 2D) maps stack standard tiles into 3D, use a black-and-white heightmap to raise the ground, and add depth of field, fog, cloud shadows and four times of day. It was built in Unity but ships as a standalone app, and its plugins are written in Luau, the Lua dialect Roblox uses. A free P2D map editor demo is on Steam until November 16.
Over 100 ready-made P2D maps ship with it.
Old JavaScript plugins from earlier versions do not carry over.
No release date or price yet.
Why it mattersThe trick is cheap and transferable: a fixed camera, a heightmap and post-processing turn 2D assets into a 3D-looking world.
For youA quick look for a browser game in three.js: tile sprites on a heightmapped plane, a fixed tilted camera and depth of field.
HD-2D
A visual style that places pixel-art sprites in a lit 3D diorama, made popular by Octopath Traveler.
heightmap
A greyscale image where brighter pixels mean higher ground.
Luau
A fast, typed version of the Lua scripting language, developed by Roblox.
How a 75-person studio shipped a game with about 1,100 credits
Fuse Games built Star Wars: Galactic Racer with a small core team and several rings of outside help, each with its own rules for how closely it works with the studio.
Fuse's CEO describes four rings, from closest to furthest.
Core studioAbout 75 people who own the game
Co-developersJoin stand-ups and Slack, work as part of the team
External developersOwn whole features, like photo mode, with their own cross-discipline team
Outsourcing partnersDeliver assets against a brief, little day-to-day contact
Source: Game Developer interview with Fuse Games CEO Matt Webster. MobyGames lists about 1,100 credited roles.
Why it mattersThe external-feature ring only works when a feature can be specified cleanly and dropped in, which is a strong argument for modular game code.
For youThis is your Fab customer's workflow from the other side: a clearly bounded feature, built outside, integrated in. Use the photo-mode example in plugin marketing.
co-developers
Outside studios that work inside your team's daily routine rather than delivering finished parts.
An Australian court told Apple to allow other app stores and payment options on iPhones in Australia, and to stop charging fees on purchases made through rival stores. Apple says it will appeal.
Epic Games v Apple in the Federal Court of Australia, as reported by Capital Brief.
The court finds Apple and Google misused their market power.
Remedies: open iOS distribution and payments in Australia, including direct downloads; no fees on third-party store purchases.
Epic says Fortnite returns to the App Store.
Apple plans to seek a stay and appeal.
Why it mattersAnother country joins the list where mobile games can sell outside the platform store. An appeal is likely, so treat it as direction, not a plan.
For youAdd Australia to the list of markets to watch for direct payments in your mobile and Flutter apps; do not build for it until the appeal settles.
stay
A court order that pauses another order while an appeal is heard.
An API version is a label each request carries to say which set of rules it expects. The provider can change the rules for new versions while old requests keep working exactly as before.
Think of it like thisLike a recipe card stamped with its edition: the kitchen cooks the 2023 card the 2023 way, even after the 2026 card drops an ingredient.
Claude's API reads the anthropic-version header on every request. A request that says 2023-06-01 gets the old behaviour; one that says 2026-10-21 gets the new rules, where sending temperature is an error.
You rarely set the header yourself. Each SDK release sends a fixed version, so the switch happens when you upgrade the SDK's major version. That is why a routine dependency bump can change how your app behaves: read the migration guide before you merge it.
Your codeCalls the SDK
installs
SDK versionPython 2.0.0 sets the header
sends
Version headeranthropic-version: 2026-10-21
selects
API rulesThe server applies that version's rules
The SDK you install decides the version; the version decides the rules.
header
A labelled line of extra information sent along with every web request.
major version
The first number in a version like 2.0.0; a change there signals breaking changes.
Try this today
Software and AI20 minutesFor practitioners
Make your coding agent snapshot your work before risky commands
A ten-line hook saves a restorable copy of your changes whenever the agent is about to delete, move or reset files, so a bad command costs you nothing.
You needClaude Code, a git repository, and jq installed.
Save the hook script
Put the script below in .claude/hooks/backup-first.sh and make it executable with chmod +x. It only acts when the command starts with rm, mv or a destructive git command, and always exits 0 so it never blocks.
Register it
Add the PreToolUse entry below to .claude/settings.json, matching the Bash tool.
Test it on purpose
Edit a file without committing, then ask the agent to delete it with rm.
Restore
List snapshots with git for-each-ref refs/backups and bring one back with git stash apply <hash>.
You know it worked whenAfter the test, git for-each-ref refs/backups lists a snapshot, and git stash apply brings back your uncommitted edit. Untracked files are not captured by git stash create, so commit or add them first.
For youAdd it to the repos where your long-running routines work unattended, and widen the pattern to Supabase migration commands with a pg_dump first.
PreToolUse
The hook event that runs just before Claude Code executes a tool, such as a shell command.
git stash create
A git command that saves your uncommitted changes as a commit without touching your files.
Sparks
What is catching on right now, and the idea worth borrowing from each.
212 points and 90 comments on Hacker News (October 19); open source on GitHub, alpha.
Each level becomes a small model anchored to a real table in Apple Vision Pro. Walk around it with a controller, or scale it up and stand inside; rooms appear as you discover them.
Borrow thisPresent a level as a physical object first. The pipeline is a decompiled game's logic plus a new renderer, so the game plays the same while the camera becomes the room.
For youThe diorama view would make a striking showcase mode for a level-design or world-tools plugin, even on a flat screen.
Forked the day after Battle Drones was released under Apache 2.0; 343 commits adding 16 units, 10 buildings, 6 maps and a walking mech.
Panache swaps the drones for a French Belle Epoque army with new models, music and missions, while the rules stay the same.
Borrow thisKeep the simulation separate from the rendering. Battle Drones runs a deterministic TypeScript simulation apart from its three.js view, which is why a full reskin took a day.
For youThe same split argues for keeping your browser games' rules in plain TypeScript, so new themes or ports are a rendering job.
26 favourites and 8 boosts on a first post from a new homebrew account (October 21).
Water flow in a homebrew N64 game uses Manning's equation from river engineering, calm in summer and rushing in storms, modelled on a real backyard creek.
Borrow thisManning's equation gives flow speed from slope, channel roughness and depth. It is cheap enough for 1996 hardware and needs no fluid solver.
For youA believable, cheap river-flow model for a world-tools plugin: drive water speed and foam from terrain slope instead of simulation.
Covered by MIT Technology Review on October 19; the paper got 3 points on Hacker News, so few have seen it.
Thirteen agents with no task, a memory file and a rock to throw spent 30 hours each: one invented basketball, another juggled 50 catches, called it too easy and made the rules harder.
Borrow thisAn open world plus a memory file is a cheap harness for agent playtesting. Agents with island history did better on a later task, and deleting memory lines hurt.
For youA pattern for overnight NPC or playtest bots: give them a persistent notes file and see what behaviours they settle into.
71 points and 51 comments on Show HN (October 20); 300 cards added after feedback.
You and an AI see the same picture and question; the model answers in about a quarter of a second and gets 70 to 80% right, its maker says.
Borrow thisA head-to-head race makes a model benchmark playable. Rank on accuracy before speed: commenters found fast, wrong players could still climb.
For youA quick format for a browser mini-game that doubles as a demo for any model you ship.
Research from the front line, in plain words: what it solves, how, and what you could do with it.
Software and AIPreprintarXiv preprint
Coding agents almost never back up before a risky change; intercepting their commands fixes it for pennies.
Back Up Before You Regret: Measuring Backup Awareness and Automating Backup in Coding AgentsXu Li, Simon Yu, Minzhou Pan et al. (Northeastern, UC Berkeley, University of Chicago, UIUC)
Agents upgrade packages, edit configs and change files outside the repo without saving what was there, so a later "I need the old version back" has no answer.
The idea
RegretBench: 205 multi-turn tasks built from real regret moments people posted online. BackUpper: a plug-in that inspects every tool call before it runs and applies one of four tiers: rewrite the command, pair it with a backup command, take a snapshot, or hand hard cases to a backup subagent.
The result
Agents finished 86.1% of tasks but backed up only 15.2% of the time. A skill telling them to back up reached 81.4% at $0.344 a task; BackUpper covered every regret moment at $0.014 a task. Restored state matched the original 92.2% of the time, against 33.8% for recovery after the fact.
Use it
Back up in the harness, not in the prompt: a pre-command hook is cheaper and more reliable than asking the model to remember. Today's Try this is the snapshot tier in ten lines.
For youYour unattended routines are exactly the setting where nobody is there to say "wait"; put the backup in a hook.
Sprite tools only fill in the frame between two drawings. Animators also need to extend an animation forwards or backwards, and diffusion models give a different answer each run.
The idea
Three small networks, one each for previous, middle and next frame, trained on 280 curated sprite triplets. They handle transparency properly and refine motion at several scales in one deterministic pass. Each model is about 206 MB.
The result
On 42 test triplets, error (FLIP, lower is better) was 0.258 for the middle frame against 0.313 for RIFE, a common interpolation model, and 0.449 for classic optical flow. Previous and next frames scored 0.265 and 0.271. The test set is small and the dataset is not released.
Use it
For 2D games: extend a walk or attack cycle from two keyframes locally, and get the same frame on every run so artists can touch it up.
For youWorth a test on pixel-art cycles for a web or mobile game before paying for a cloud animation service.
Finding and fixing vulnerabilities one at a time does not scale, and every piece of code an attacker can reach without logging in multiplies the bugs nobody has found yet.
The idea
Three passes with a fresh context each: code reachable in the default configuration that nothing needs; option combinations that silently weaken a security control; and complex code that runs before authentication. A proposed gate is accepted only if the project's tests give identical results.
The result
Across 25 open-source projects (over 5M lines), it flagged 493 issues. 162 risky option combinations were accepted without warning, and 94 of them silently disabled a control. In OpenSSH, about 4,500 lines of experimental code were reachable before login; the fix removed about a fifth of pre-login reachable code. Anthropic-reported, with no baseline.
Use it
Run the three questions as separate fresh-context prompts on one service you run, and only accept changes that leave your test results unchanged.
For youA useful pre-launch pass on a Supabase-backed SaaS: what can an unauthenticated request reach in the default config?
