GLM-5.2 Goes Local, Eagle3 Lands in llama.cpp, and Malicious Skills Hit the Wild

Today's findings

1. #1 Eagle3 Speculative Decoding for Qwen 3.5/3.6 Ships in llama.cpp b9723tool

   Add --spec-type draft-eagle3 with a PRISM Eagle3 draft model and Qwen 3.5/3.6 decodes significantly faster at no quality cost.

   llama.cpp b9723 · Eagle3

   Eagle3 draft speeds up Qwen 3.5/3.6 decode at no quality cost

   1.5–2×

   throughput on the same hardware

   identical output quality

   b9723

   mainline build — no custom compile

   --spec-type draft-eagle3

   pair with a PRISM Eagle3 draft GGUF

   Qwen-tuned

   draft matched to the Qwen architecture

   Speculative decoding: a matched draft model proposes tokens the main model verifies.

   Why it matters: Speculative decoding with a well-matched draft model delivers 1.5–2× throughput on the same hardware with identical output quality. Eagle3 is specifically tuned for the Qwen architecture and now ships in mainline llama.cpp—no custom builds required.

   How to apply: Pull llama.cpp build b9723 or later. Download a PRISM Eagle3 draft GGUF (e.g. wimmmm/Ex0bit-Qwen3.6-27B-PRISM-EAGLE3-GGUF from Hugging Face). Launch llama-server with your main Qwen3.6 GGUF plus --spec-type draft-eagle3 --model-draft path-to-draft. Benchmark tok/s against your current MTP baseline to validate the gain on your hardware.

   llama.cpplocal-llminferencequantization

   Read more: The Eagle(3) has landed (for Qwen) · spec: support eagle3 for qwen3.5 & 3.6 by ruixiang63 · Pull Request #24593 · ggml-org/llama.cpp

2. #2 GLM-5.2 is the New Top Open-Weights Model and Now Runs Locally via llama.cpp and Unslothtool

   GLM-5.2 (744B) tops the Artificial Analysis Intelligence Index and the new AA Briefcase agentic benchmark, and can now run on a 256 GB Mac or a 4x3090 rig via GGUF quants.

   GLM-5.2 (744B)

   Quantized to 238 GB — 82% accuracy retained

   Full FP16

   • 1.51 TB

   → ~82% accuracy retained

   2-bit GGUF

   • 238 GB

   Runs on 4x3090 + 192 GB DDR5 at 7.3 tok/s, or 256 GB Mac via mmap

   Why it matters: GLM-5.2 beats Qwen 3.6 and all other open-weights models on general intelligence and agentic task benchmarks. The Unsloth 2-bit quant shrinks it from 1.51 TB to 238 GB retaining ~82% accuracy—a meaningful capability jump that now fits on attainable multi-GPU hardware or a high-RAM Mac.

   How to apply: Pull pipenetwork/GLM-5.2-REAP50-Q2_K-GGUF (238 GB) from Hugging Face or use Unsloth Studio for guided setup. On a 4x3090 + 192 GB DDR5 rig, route attention to GPU and expert layers to CPU RAM via llama.cpp expert offload flags—expect ~7.3 tok/s decode. For a 256 GB Mac, mmap from local SSD works with slower prompt processing. Compare against your current Qwen 3.6 27B baseline on your actual workload before committing.

   local-llmquantizationllama.cppopen-weights

   Read more: GLM-5.2 is the new leading open weights model on the Artificial Analysis Intelligence Index · GLM-5.2 can now run locally in llama.cpp and Unsloth Studio. · GLM-5.2 (744B, 2-bit) at 7.3 tok/s on 4×3090 + 192GB — and why IQ1_M wasn't any faster · GLM-5.2-REAP50-GGUF · New Agentic Benchmark Out: Claude Fable and GLM 5.2 Top Their Cohorts

3. #3 76 Credential-Stealing Payloads Confirmed in Public Claude Skill Repos — Free Scanner Availabletip

   Snyk's ToxicSkills audit found 76 malicious payloads embedded in publicly indexed Claude skills; audit every third-party skill before installing.

   Security Advisory

   critical

   76 Credential-Stealing Payloads Found in Public Claude Skill Repos

   76

   malicious payloads confirmed

   71+

   repos hosting them

   affected scopeClaude Code & Co-Work skills with agent-level permissions

   critical severity — badge colour grades the risk

   Run the free community scanner before installing any third-party skill.

   Why it matters: Skills installed into Claude Code or Co-Work run with agent-level permissions. A credential-stealing skill can silently exfiltrate API keys, environment variables, and session tokens during normal tool use. This is confirmed—76 payloads live across 71+ repos—not a theoretical risk.

   How to apply: Run the free community scanner (linked in item 16983) against all skills currently installed from GitHub. Read the full source of any skill before future installs, especially ones touching file I/O or network calls. Prefer skills from authors whose broader repos you can audit. Until the Skills ecosystem has a verification layer, treat third-party skills with the same skepticism as unreviewed npm packages.

   securityagentsmcp

   Read more: There's a confirmed wave of malicious Claude skills out there — made a free scanner

4. #4 Probe-and-Refine Tuning Makes AGENTS.md Actually Work for Coding Agentspaper

   How you generate your repo guidance file is the decisive variable—iterating synthetic bug probes and patching AGENTS.md beats any static hand-written version.

   Method

   Probe-and-Refine Loop Makes AGENTS.md Work

   1

   Generate Probes

   20–50 synthetic bugs

   2

   Run Agent

   on each probe

   3

   Diagnose Failures

   record recurring classes

   4

   Edit AGENTS.md

   address gaps

   Iterate

   One loop takes hours, not days. No model retraining needed.

   Why it matters: Recent studies disagreed on whether AGENTS.md helps or hurts coding agents. This paper resolves the debate: static docs underperform, but an iteratively probed-and-patched guidance file consistently improves agent performance. The method is cheap to run and does not require retraining anything.

   How to apply: Generate 20–50 synthetic bug probes representative of your codebase's failure modes—wrong fix patterns, missed test paths, bad import assumptions. Run your coding agent on each probe and record recurring failure classes. Edit AGENTS.md to address each diagnosed gap. Repeat after significant codebase changes. One loop takes hours not days.

   agentscodefine-tuning

   Read more: Probe-and-Refine Tuning of Repository Guidance for Coding Agents · Probe-and-Refine Tuning of Repository Guidance for Coding Agents

5. #5 cocoindex-code: Continuously Fresh AST-Aware Semantic Index for Coding Agentsrepo

   Apache 2.0 library that builds a live AST-based semantic index over your codebase so agents find the right function instead of scanning raw files.

   Why it matters: Coding agents waste context and hallucinate references when forced to grep raw source. cocoindex-code parses your codebase into a continuously updated index of functions and classes, then answers agent queries with structurally precise chunks—reducing irrelevant context and improving retrieval accuracy.

   How to apply: pip install cocoindex-code (or clone github.com/cocoindex-io/cocoindex-code). Point it at your project root; it parses and indexes via AST. Configure your coding agent to query the index via MCP or its local API before opening files. Incremental updates keep the index fresh on each file save—no manual rebuild step needed.

   agentscoderag

   Read more: ast-based semantic index for coding agents

6. #6 librarian-press: Pretrain and SFT Your Own 1B LLM from a Single JSON Config for Under $100repo

   Open-source pip-installable framework that takes cleaned text files and one JSON config all the way through tokenizer training, pretraining, and SFT.

   librarian-press

   Train a 1B LLM from a Single Config for Under $100

   Open-source pip-installable framework. Runs on a single A100 spot instance.

   Why it matters: Building a custom small language model previously required assembling a fragile pipeline of scripts. librarian-press wraps the full GPT-architecture pretraining pipeline—BPE tokenizer, RoPE, RMSNorm, SFT—behind a single config. A 1B-param model costs under $100 on cloud spot instances and gives you a domain-tuned baseline for specialized tasks.

   How to apply: pip install librarian-press. Prepare cleaned Parquet or .txt files with your domain text. Write a JSON config specifying model size, tokenizer settings, and SFT dataset paths. Run on a single A100 spot instance (or equivalent). The framework handles sequence packing into uint16 shards and the training loop end-to-end.

   fine-tuninglocal-llmtrainingopen-source

   Read more: Built a framework to pretrain + SFT your own LLM from one JSON config — 1B params for under $100 on spot instances

7. #7 QUEST-35B: Open-Source Deep Research Agent Trained on 32 H100s with Everything Releasedrepo

   Ohio State NLP released a fully open 35B deep research agent—weights, training code, and 8K synthetic samples all public.

   Open-Source Deep Research Agent

   QUEST-35B

   QUEST-35B

   model 32 H100s

   Ohio State NLP

   WeightsTraining Code8K Synthetic Samples

   runPull from Ohio State NLP release

   First fully open-source deep research agent for multi-step web research.

   Why it matters: Deep research agents have been proprietary. QUEST-35B is the first fully open-source model trained specifically for multi-step web research, enabling fine-tuning on domain-specific research tasks without building the pipeline from scratch.

   How to apply: Pull QUEST-35B weights from the Ohio State NLP release (linked in item 16967). Run with llama.cpp or vLLM at Q4 quantization on a 2xA100 or equivalent setup. For domain adaptation, use the released synthetic sample generation pipeline with your own document corpus and fine-tune with LoRA on top of the base weights.

   agentsopen-sourceresearchfine-tuning

   Read more: Researchers trained a Deep Research agent with 32 H100s and open-sourced everything

8. #8 aimee: Local Model-Agnostic Proxy for Claude Code and Any OpenAI/Anthropic Coding Toolrepo

   Open-source local proxy that routes Claude Code or any coding tool to any model—Ollama, Claude API, or others—with per-turn switching and shared memory.

   Why it matters: Teams running Claude Code for some tasks and cheaper local models for others currently manage separate tool configurations. aimee sits as a unified local layer translating both OpenAI and Anthropic API formats, enabling you to route expensive reasoning tasks to Opus and routine edits to a local Ollama model with memory and config persisting across providers.

   How to apply: Clone github.com/RakuenSoftware/aimee. Configure your Claude Code or Codex to point its API base URL at the aimee local endpoint. Define routing rules mapping task types to models—architecture decisions to Opus, boilerplate to local Qwen. Memory and context persist when you switch providers or tools.

   agentsmcplocal-llmcost

   Read more: aimee, a local layer that makes any AI coding tool model-agnostic, cheaper, and safer, and learns as your whole team uses it

9. #9 Context Rot Is Costing You More Than You Think — Edit Prompts, Don't Append Correctionstip

   Every correction message re-reads the entire conversation, so a 30-message correction chain costs the compounding sum of all prior turns—edit the original prompt instead.

   Cost-Saving Tip

   Edit Prompts, Don't Append Corrections

   Append Corrections

   • Re-reads entire conversation each time
   • $2.51 of $2.95 API call is re-reads
   • Fills context window quickly
   • Degrades model performance late in session

   vs

   Edit Original Prompt

   • No re-read overhead
   • One-time edit, no compounding
   • Efficient context usage
   • Maintains model quality

   Edit the last user message instead of appending corrections.

   Use /compact regularly in Claude Code to reset context.

   Why it matters: A reported $2.95 API call had $2.51 in input re-reads alone. Claude Code's strictly serial MCP behavior means each tool round-trip also re-reads full context. Understanding this changes how you structure sessions: fewer correction messages and regular /compact directly translate to lower cost and better model performance late in a session.

   How to apply: Edit the last user message instead of appending correction messages. Use /compact regularly in Claude Code sessions. For long coding sessions, start fresh sub-conversations for unrelated tasks rather than appending. Use a context-window gauge plugin (see item 17042) to monitor fill percentage and know when to compact before quality degrades.

   claudecostagents

   Read more: Follow-up: "it got dumber" is usually context rot, not the model — what I got wrong + 5 fixes · The single most costly mistake everyone's burning tokens on · $2.95 API call? $2.51 was re-reading stuff already in the window. · this tool lets you know when your session is going dumb.

10. #10 MCP Zero-Touch OAuth Now Available for Enterprise Deploymentstool

    The MCP protocol announced enterprise-managed auth that eliminates manual token issuance for MCP server connections in corporate SSO environments.

    Why it matters: Manual OAuth token management has been the main friction point for deploying MCP servers at enterprise scale. Zero-touch enterprise-managed auth means an organization's existing IdP can automatically issue tokens to MCP-connected agents without per-user manual steps, unblocking internal rollouts.

    How to apply: Review the specification at the MCP blog post (item 18225). If your MCP servers are exposed to multiple internal users, configure enterprise-managed auth by pointing the MCP auth server at your IdP. Test end-to-end with Claude Code's MCP client to verify token issuance and scope before rolling out to the team.

    mcpsecurityagents

    Read more: Zero-Touch OAuth for MCP

11. #11 LedgerAgent: Explicit Structured State Prevents Stale-Fact Failures in Tool-Calling Agentspaper

    Maintaining a separate structured ledger of task state—updated each turn—cuts the two commonest tool-calling agent failures: acting on stale facts and missing required info.

    Tool-Calling Agent Failure Reduction

    LedgerAgent vs Standard Agent

    vs

    Standard Agent (raw prompt)

    LedgerAgent (structured ledger)

    Stale-fact errors

    High

    Low

    Missing-info errors

    High

    Low

    Standard Agent (raw prompt) wins the row LedgerAgent (structured ledger) wins the row

    Explicit ledger updates each turn prevent state reconstruction errors.

    Why it matters: Standard agents reconstruct task state from the raw prompt every turn, so a fact mentioned 20 turns ago can silently be overwritten by later observations. LedgerAgent keeps an explicit typed ledger; policy checks consult the ledger rather than unstructured context, significantly reducing stale-fact and missing-info errors in multi-turn customer-service and tool-use scenarios.

    How to apply: In your agent loop, maintain a separate dict or typed dataclass as the task ledger. After each tool return or user turn, update the ledger explicitly. Before the next tool call, validate required fields against the ledger rather than relying on the model to recall from context. This pattern is framework-agnostic and applies to raw Anthropic API, LangChain, or Claude Code sub-agents.

    agentsarchitecture

    Read more: LedgerAgent: Structured State for Policy-Adherent Tool-Calling Agents · LedgerAgent: Structured State for Policy-Adherent Tool-Calling Agents

12. #12 Large Benign Context Silently Weakens LLM Alignment Guardrails in Open-Source Modelstip

    Empirical study shows bulk benign text in the context window shifts latent-space trajectories enough to bypass post-training alignment constraints—no adversarial instructions needed.

    Why it matters: This is a zero-jailbreak prompt-injection vector active in open-source models today. Teams using RAG, document processing, or long-context agentic pipelines are potentially exposed: the attack surface is any workflow that stuffs large documents into a single context window before a sensitive downstream call.

    How to apply: Test your pipeline by prepending large benign text blocks before known-blocked requests and checking whether guardrails hold on your local model. Chunk large document contexts into smaller segments rather than using one monolithic context window. For agentic pipelines, apply output filtering as a mandatory second layer rather than relying solely on in-context alignment. The study used open-source models; cloud-hosted Anthropic models have additional server-side filters but local deployments do not.

    securitypromptingagentslocal-llm

    Read more: Why Long Prompts Dilute System Instructions