Sunday's brief is three things you can act on before Monday. If you maintain an open-source project, the first one is free security work. If you run a pile of subagents, the third one might let you delete some of them.
No sponsored or affiliate links in this digest — the links below are sources only.
Story I
Anthropic's OSS Scanner audits open-source projects for free, and logged 77 critical findings in 11 days
OSS Scanner runs Anthropic's strongest models against enrolled open-source codebases inside an offline VM and emails maintainers a reproducer, an explanation and often a candidate patch. Anthropic covers the cost. In the first 11 days it accepted 114 of about 650 applications and logged 77 critical and 803 high model-rated findings. Reports skip human review, so expect some noise: Anthropic's pentesters found 85 of 97 sampled findings met its disclosure bar. One early catch was a High-severity use-after-free in curl, fixed in 8.23.0.
Link: github.com/anthropics/oss-scanner
Try it now
If you're a core maintainer: fork anthropics/oss-scanner, add projects/<your-project>/project.yaml from the template with repo, primary_contact and a Dockerfile that builds everything so the audit can run offline, then open a PR. Run tools/validate.py and build the Dockerfile locally first. Everyone else: run curl --version and upgrade if you're on 8.12.0 through 8.22.0.
Story II
NVIDIA's Nemotron 3.5 Bolt E4B is an open agent model that used 3.1 to 4.3 GB of VRAM in NVIDIA's tests
Bolt is Gemma 4 E4B post-trained by NVIDIA with reinforcement learning only, tuned for multi-turn tool calls and short, speech-ready replies. NVIDIA says it led 15 of 21 benchmarks against similar-size models in its own harness, with IHEval at 84.8. It trails Qwen3.5-4B badly on Tau2-Bench, 55.1 to 75.1. On an RTX 5070 the quantized build hit 133.4 tokens/s. Weights, data and recipe are open under OpenMDW-1.1.
Link: ollama.com/library/nemotron-3.5-bolt
Try it now
Pull the small tag, not latest (that one is 25GB): ollama run nemotron-3.5-bolt:e4b. Then point a coding agent at it with ollama launch claude --model nemotron-3.5-bolt, which the Ollama page lists, and give it one tool-heavy task you already know the answer to. Check whether it calls the right tool before trusting it with more.
Story III
Anthropic's single-agent-loop-kit measures whether your subagents should fold into one agent, then does it one at a time
Anthropic published guidance arguing that one agent loading skills and tools on demand often beats a router plus specialists now that models handle complexity alone. It cites a single-agent setup running about twice as fast, and tool selection degrading past roughly 30 to 50 tool definitions. The companion kit ships a Claude Code skill that audits your system, scores it on an eval, and folds subagents one at a time. It also warns that one test fold cut latency but broke a working handoff.
Link: github.com/anthropics/single-agent-loop-kit
Try it now
Free dry run, no API key: git clone https://github.com/anthropics/single-agent-loop-kit && cd single-agent-loop-kit/examples/support-desk && KIT_MODEL=fake python3 evals/run_eval.py --variant smoke. On your own repo: cp -r single-agent-loop-kit/skill <your repo>/.claude/skills/single-agent-loop, open Claude Code there and say "Run the single-agent-loop skill." It stops before any paid run.
— The Vibe Gate news desk. We read the firehose so you can keep building.