GitHub Copilot cuts AI coding costs

Hi there, this is your daily ☕️ Devshot.

In today's Devshot:

🤖 GitHub Copilot cuts AI coding costs

🔒 Gemini Flash gains security focus

🧠 Meta's Muse Spark 1.3 undercuts rivals

🔧 Coder hosts Cursor tool calls on-prem

⚡ pnpm 12 rewritten in Rust

Plus: 🎁 6 other news you might like, 🧰 6 tools, and 📚 5 papers.

🤖 GitHub Copilot cuts AI coding costs LINK

GitHub Copilot became cheaper to run after four independent tweaks to its agent harness, cutting token-related costs without measurable quality regressions across Copilot CLI, the Copilot app, and code review, which share the same underlying pipeline.

Removing unused line-number prefixes from file reads dropped model-inference cost about 3% per user, while selectively compressing repetitive build, test, and lint noise, keeping `git diff` and search results intact, shaved costs with no drop in task success.

Halving the `task`-tool prompt via a meta-prompting loop cut ~1,300 tokens per turn for roughly 2.9% lower cost per active hour, and batching background-completion results into existing tool-result format saved another ~2.3% in AI Credits.

🔒 Gemini Flash gains security focus LINK

Google released Gemini 3.8 Flash in two variants, a general agentic-workflow model and a security-focused Gemini 3.8 Flash Cyber aimed at vulnerability discovery and patching, marking its third Flash release in six weeks.

Gemini 3.8 Flash hit 73.7% on the DeepSWE v1.1 engineering benchmark, just under Claude Opus 5, and launches at introductory pricing of $0.75 per million input tokens and $3.75 per million output, later doubling.

Gemini 3.8 Flash Cyber, gated behind a new Fairwind Program for governments and infrastructure operators, scored 86.2% finding C/C++ flaws, hit 71% real-world vulnerability discovery, and generated 2.6x more correct Chrome patches than larger commercial models.

🧠 Meta's Muse Spark 1.3 undercuts rivals LINK

Meta shipped Muse Spark 1.3 through Muse Code and the Meta Model API, pricing it below rivals at the same performance level while posting solid agentic gains that still trail the leaders.

Pricing holds at $1.25 and $4.25 per million input and output tokens, or $0.55 per index task, versus $0.94-$1.23 for competitors scoring 59+, though that's up from version 1.2's $0.40.

The xhigh tier scores 61 on the Intelligence Index and leads only on τ³-Banking at 47%, while the compute-heavy max tier hits 62 but stays mid-pack on science tests and awaits safety testing before release.

🔧 Coder hosts Cursor tool calls on-prem LINK

Coder unveiled Agent Relay, a self-hosted execution layer that runs Cursor's cloud agents inside a customer's own infrastructure, launching in private preview with SpaceXAI as the first design partner.

Only tool calls execute on the customer's machines, while Cursor still handles the agent loop, inference and planning, and Coder offers air-gapped deployment for environments where no external access is acceptable.

Coder targets banks, defence agencies and government institutions, but because Cursor keeps running inference it stays an ICT third-party provider under Europe's DORA rules, so the contractual and audit paperwork remains in force.

⚡ pnpm 12 rewritten in Rust LINK

pnpm 12 has landed as a native Rust rewrite, replacing the previous TypeScript and Node.js implementation while keeping pnpm 11's commands, flags, settings, lockfile format, and layout unchanged to avoid a broad migration.

Install times dropped sharply in benchmarks, with a warm cached repeat install falling from 472ms to 15ms, and Socket's test of Vercel's 1,670-package Turborepo showing median reductions of 64% to 90% across six scenarios.

The most likely CI-breaking change is a removed setting, plus Git dependencies now resolving through canonical HTTPS URLs; peer resolution runs two to three times faster in cycle-heavy workspaces while using about 25% less memory.

Other news you might like

• Kubernetes v1.37: Scale Workloads to Zero with HorizontalPodAutoscalerLINK

• Perplexity may have a way to run LLMs on consumer hardware: How it worksLINK

• Laid-Off Developers Create AI Model to Replace CEOs and Other ExecutivesLINK

• Vercel built a feedback loop that treats agent instructions like softwareLINK

• OpenAI Details GPT-Live’s Architecture for Continuous Stateful Voice InteractionLINK

• Swiggy Uses 350+ Features and Multi-Task MLP to Predict Customer Lifetime ValueLINK

🧰 Trending tools

Sim: build and deploy AI agents via a visual or code workspace, with 1,000+ integrations and support for all major LLM providers.LINK

Prefactor: an evaluation layer that scores agent runs in real time, catching quality regressions and drift before they hit production users.LINK

Dograh: open-source voice agent platform with a visual flow builder, telephony, human transfer, and self-hosted QA monitoring across 30+ model integrationsLINK

Zro: routes coding requests to open-source models like GLM-5.2, DeepSeek V4 Flash, and Kimi K3 through one endpoint without storing your dataLINK

ditto.site: converts any public URL into clean Next.js or Vite code, deterministically extracting components, design tokens, fonts, and hover states via a free API.LINK

Replay QA: records browser sessions with full devtools access and turns them into shareable bug reports, giving AI-built apps QA coverage without writing test suites.LINK

📚 Trending papers & reports

Bitcoin validator audit trail shows how one developer's twelve blockchain-checking programs logged every correctness claim in a tamper-proof evidence database, revealing which tests passed and which gaps remained rather than relying on polished demos.LINK

Firmware bug fixing extends automatic patch-writing tools, once limited to chip design, to the low-level boot code shipping in real devices, catching all known cases of four security flaws including Spectre with no missed vulnerabilities.LINK

Prompt engineering in software teams should be treated like real engineering with standards, testing, and version tracking, argues a research agenda aimed at replacing today's ad hoc AI instructions with systematic, auditable practices.LINK

Farm software security gets its first hard look across 66 open-source agriculture projects, finding they appear riskier than other software mainly because they are smaller and less mature, not because farming needs special protections.LINK

Python startup lag costs command-line tools and serverless apps hundreds of milliseconds per launch, with a new opt-in "load-only-when-needed" mode nearly eliminating it but breaking 8 of 414 top packages.LINK

See you tomorrow for a new dose of ☕️ Devshot!