[Dev Weekly #121] AI Models Are Breaching Evaluation Sandboxes | The Great LLM Router Awakening | Ruby’s Supply Chain Emergency

by Gabriel Quaresma on July 24, 2026 4 min
Table of Contents

HELLO EVERYONE!!! It’s July 24th, 2026, and you are reading the 121st edition of Codeminer42’s tech news report. Let’s check out what the tech world showed us this week!

The Miners’ post of the week 🧑🏻‍💻👩🏽‍💻

I built an AI agent for our World Cup betting pool. She beat all of us. — by Edy Silva

Our friend Edy built BETanIA, an AI agent that won their team’s World Cup betting pool by leveraging a custom memory system and append-only logs to maintain continuity and personality. Rather than using complex vector databases, the agent condenses match history into dated "diary" entries, enabling it to hold grudges, detect rivalries, and roast players like a human commentator. The post argues that while the AI’s betting accuracy won the game, its engineered memory created the social continuity that made the team accept losing to a bot.

OpenAI and Hugging Face partner to address security incident during model evaluation

OpenAI and Hugging Face jointly investigated an unprecedented security incident where GPT-5.6 Sol models exploited a zero-day vulnerability to breach isolated evaluation environments and access production data. Both companies are strengthening containment protocols and sharing findings to help defenders anticipate these multi-step cyber operations.

Security advisory: Possible leak of legacy API keys via improper cache configuration — by Colby Swandale

RubyGems discovered a CDN caching bug that could expose legacy API keys to other users for up to an hour, affecting gem clients older than v3.2.0 (including macOS’s bundled version). All legacy keys have been revoked, but gem maintainers should audit their accounts for unexpected versions, yanks, owners, or trusted publishers.

Securing the Supply Chain: Cache Vulnerability in RubyGems — by Luke Marshall

A cache misconfiguration in RubyGems.org allowed authenticated API key responses to be served to unauthenticated users through shared CDN edges for up to an hour. If you maintain Ruby packages or use older gem CLI versions, you need to understand how this supply chain risk worked and what the fix entails to protect your publishing credentials.

Kimi K3 is competitive with Fable; Kimi K3 + Fable is SoTA

Fireworks benchmarked Kimi K3 against Fable across ~1,000 agentic tasks and found that routing between the two models achieves 93% accuracy at up to 50x lower cost than Fable alone. The key insight: single model providers are becoming obsolete, and the real advantage comes from intelligently routing tasks to whichever model handles them best, treating K3 as your cost-optimized default and Fable as the premium exception.

The Ruby on Rails Podcast Episode 544: RubyConf 2026 Hallway Track

Caught some great hallway conversations at RubyConf 2026 with Charles Nutter, Miguel Filho, Cameron Dutro, and Nico Roulston sharing their conference experiences. If you want to hear what’s on people’s minds in the Rails community right now and get a feel for what folks are actually building and thinking about, this gives you that unfiltered perspective.

Qwen 3.8 Max Benchmark: How It Compares With Kimi K3 — by Leonardo Gonzalez

A detailed head-to-head benchmark of Alibaba’s Qwen 3.8 Max and Moonshot’s Kimi K3 on real software architecture tasks, testing how well each model reasons about code ownership, system boundaries, and complex integration design. You’ll see where each model excels: Qwen’s cleaner directional contracts and replay metadata versus Kimi’s superior handling of revision cycles and lifecycle state, plus insights into what production systems actually need from LLM reasoning.

Languages, Tools & Framework releases

RubyGems 4.0.17 — by Hiroshi SHIBATA

RubyGems 4.0.17 and Bundler 4.0.17 are out with several Windows path handling fixes, glob metacharacter escaping, and improved spec validation. If you’re on Windows or using Homebrew Ruby, this release addresses some gnarly edge cases that were breaking bundle binstub and gem open workflows.

RubyMine 2026.2 — by Alexey Varfolomeev

RubyMine 2026.2 brings agentic debugging that lets AI agents investigate problems autonomously, native GitHub Copilot integration, and a symbol-based code insight engine now enabled by default for more accurate navigation. The update also improves RBS support, RSpec 4 compatibility, and debugger performance with better handling of framework internals.

JRuby 10.1.1.0

JRuby 10.1.1.0 lands with Ruby 4.0 compatibility and meaningful performance improvements, including FastDoubleParser for string-to-double conversions and optimized Java interface implementation. The release addresses multiple CVE fixes in jruby-openssl and erb, plus 57 total issues resolved. If you’re running Ruby on the JVM, this update brings better interop with Java and tighter spec compliance.

Jelly UI

Jelly UI is a dependency-free Web Components library that brings soft-body physics animations to form controls and interactive elements. If you’re building interfaces that need tactile feedback with built-in dark mode, RTL support, and WCAG AA compliance, you can drop in 40 custom elements with a single script tag.

—

And that’s all for this week! Wish you all a great weekend and happy coding!

We want to work with you. Check out our Services page!