Xingdi Eric Yuan

Your coding agent’s code can pass every test and still be exploitable, but users rarely know👾 🤔SFT, RL, or OPD: which teaches security best? 🔥SecureVibe helps vibe coding plan, code, and test for security, +6.9 pts BaxBench, +11.5 unseen CWEs SusVibes, +4.1 SWE-bench Verified

welcome to the 9th annual @stateofai report! ai building better ai, world models, physical ai, geopolitics, cyber defense and 12-month predictions. read it at stateof(dot)ai or watch my editor’s cut here. a few of this year’s biggest findings follow:

4B parameters. ZERO distillation. 61.5% on SWE-bench Verified 🤯 Meet FrogNano 🐸: Qwen3.5-4B post-trained purely with RL on synthetic tasks from TaskPilot. Just 5 iterations × 300 tasks. Who said coding agents have to be huge? 🐸

We'll be spending a lot more time trying to understand the outputs of language models. A few thoughts, tips & tricks: Writing. Something I've had success with: Ask your LLM to explain something in ASD-STE100, it's a controlled language specification originally developed for aerospace maintenance documentation. LLMs well-versed in this language and it comes with heavy constraints on clean writing style that I often find a lot more readable. Sometimes I've tried to soften it a bit e.g. ask for "80% of the way to ASD-STE100" because the spec is quite stringent. But even better: Diagrams / images. Instead of writing, ask your LLM to create a diagram. These can be a lot easier to process, parse, and understand. But even better: Web pages. Ask for output "in HTML" to get a beautiful, interactive webpage. LLMs are getting really good at frontend and can create beautiful experiences, animations, etc. But even better: Explainer videos. The output format I am most bullish on is fully custom / bespoke explainer videos generated on any arbitrary topic. Experiment with things like "Create a 3b1b style video explainer on X. Use my ElevenLabs API key for audio narration". (you'd need an API key for the latter or you can ask your LLM to find you decent free alternatives that use your local compute). This is actually starting to work! In summary: - As LLMs get better, they will do more and more of the legwork autonomously, and a lot more of our work will rise up the abstractions into oversight and understanding. - Luckily, LLMs can help here too because as intelligence and code are increasingly abundant, you can ask for large, custom, discardable software artifacts (e.g. web apps, video explainers) that would have never made sense to create before. Push the boundaries here and you'll be surprised.

Can LMs discover & fix bugs if you don't tell them what went wrong? To proactively maintain a repo, agents need to find problems before users do. SWE-sweep benchmarks this on 100 repos, 22 languages, 4k real bugs (numpy, php interpreter, lean kernel). Top models get <5%.

We trained an AI agent on its own explanations, not its code. It got better at coding. No teacher. No verifier. No RL updates. No extra context at test time. Here's how. Links below. 🧵

Some (late) thoughts on Astra beating Zork: christopherzc.github.io/blog… (TLDR: Astra beat Zork like someone with a walkthrough, not like someone experiencing the game for the first time. Still impressive.)

🤖 How far are coding agents from working like human developers? GPT-6 Astra has made big advances in many areas, including coding. ❓ So, can Astra replace a human developer? Our new benchmark says ❗we’re about 49% of the way there.❗ Developers don’t build apps from written requirements alone. They constantly use references—existing apps, UI/UX mockups, prototypes—to see how things should look and work. Then they build it and check their work against the reference. ✨ Introducing ProgramDistill, a benchmark and synthetic task-generation pipeline for testing coding agents on this workflow at scale.