smolvm clears sandbox tests, LFM2.5 keeps 97% at 4-bit, Willison vs METR

Sources

smolmachines / smolvm as a sandbox for untrusted Python & JavaScript simonwillison.net

Research: smolmachines / smolvm as a sandbox for untrusted Python & JavaScript I tasked Claude Fable 5 running in Claude Code for web with the following research task: Put https://smolmachines.com through its paces as a fast secure sandbox. Explore what it would take to use this to run untrusted Python and JavaScript code in a way that is limited in what RAM and CPU time it can take up (protection against “while true”) with no network access and filesystem access only to designated files Goal i…

LFM2.5 Q4_0 Checkpoints from Quantization-Aware Distillation huggingface.co

Conceptual integrity and counting lines of code simonwillison.net

Last week I recorded an episode of the Talking Postgres podcast with Claire Giordano on the subject of “How AI is changing software development”. We had a really great conversation. Here are a couple of my highlights from a lightly edited transcript (prompt to Claude: “very minor edits to remove disfluencies”). This is the latest version of an argument I’ve been trying to build about why sometimes it does make sense to talk about lines of code as an indicator of productivity with coding agents,…

Quoting Jeremy Morrell simonwillison.net

Jeremy Morrell argues web apps should ship a solid core and let users extend it with LLM-authored add-ons. Modern browser sandbox primitives handle the security boundary, while LLMs slash authoring cost — reopening a design space that died with the plugin era.

References

mywrittenword.com — smolvm vs E2B comparison mywrittenword.com

Cold boot times typically range between 200ms and 500ms depending on the host environment… significantly faster than the 500ms–2s range often seen with standard Docker containers on macOS.

Hacker News Show HN thread (item 47808268) news.ycombinator.com

Critics on Hacker News raised concerns about the installation method — specifically the use of ‘piping to bash’ for the install script — and noted bugs in the CLI’s handling of terminal backspaces and network symbols on ARM64 macOS.

Celesto.ai smolvm security docs docs.celesto.ai

SmolVM currently supports mounting entire directories only, rather than individual files… mounting a host directory at the default /workspace path will override the internal storage-disk workspace entirely, which can lead to data loss or configuration conflicts.

Blaxel — Best cloud sandboxes for AI agents 2026 blaxel.ai

Daytona leads in raw speed with optimized configurations hitting sub-90ms startup times, while E2B follows closely with a measured 150ms to 717ms create time… Modal typically shows higher cold start latencies of roughly 2.4 seconds.

GitHub issue — KVM availability on GitHub Actions runners github.com

GitHub does not provide a Service Level Agreement (SLA) for general KVM usage, effectively treating it as an ‘as-is’ feature that could be restricted without notice… ARM-based runners and macOS runners remain significant gaps in support.

Northflank — Firecracker vs gVisor northflank.com

Firecracker’s memory overhead is remarkably low, often cited at ~5 MiB per instance… gVisor’s Sentry process requires between 50 MiB and 100 MiB per sandbox… syscall interception slowing heavy file and network operations by 20% to 40% or more.

Liquid AI blog (QAD post) liquid.ai

QAD distills a high-precision teacher directly into a 4-bit student, using a tempered, decoupled Top-K knowledge distillation objective that minimizes KL divergence between teacher and student distributions.

Kaitchup Substack — Unsloth’s QAT writeup kaitchup.substack.com

A naive conversion of the Gemma QAT checkpoint yielded only ~70% top-1 accuracy; Unsloth Dynamic optimization pushed it to 85.6%, a +15.6 point recovery over the base QAT release.

NVIDIA developer blog — QAT/NVFP4 developer.nvidia.com

Quantization-aware training with distillation recovers over 90% of baseline accuracy at 4-bit, outperforming both PTQ and vanilla QAT in stability for complex multi-stage models.

arXiv 2505.23786 — ‘Mind the Gap’ GGUF backdoor arxiv.org

A model can be trained to appear benign in FP16 but exhibit malicious behavior only after quantization to GGUF; the quantization error provides enough mathematical flexibility to hide triggers activated by Q4_0 rounding.

Kaitchup Substack — weekly roundup kaitchup.substack.com

K-quants like Q4_K_M can outperform native QAT checkpoints because they preserve sensitive layers (embeddings, early attention) at higher precision, whereas uniform 4-bit QAT can struggle with long-context coherence.

HuggingFace LFM2.5-350M-GGUF repo / LocalLLaMA discussion huggingface.co

The QAD GGUF was released as a static quant with no importance matrix, and independent testers reported the 2.6B struggled with complex tool calls, occasionally becoming confused about working directories or system prompts.

r/ExperiencedDevs summarizing METR 2025 RCT reddit.com

developers using AI actually saw a 19% increase in task completion time compared to those working manually… they had predicted AI would save them 24% of their time

GitClear ‘Coding on Copilot’ report gitclear.com

the prevalence of duplicated code blocks rose nearly eightfold in 2024, while refactoring activity dropped to historic lows

Swarmia productivity impact study swarmia.com

median batch size roughly doubled (growing 97.5% to 109%) between Q1 2025 and Q1 2026 as agentic AI adoption became mainstream

DevOps.com on DORA 2025 report devops.com

a 25% increase in AI use was linked to a 7.2% decline in delivery stability… roughly one-third of developers do not trust the code generated by AI

Votee.ai ‘The Mythical Agent-Minute’ votee.ai

as projects reach approximately 100,000 lines of code, AI agents begin ‘chasing their own tails’ because they struggle to navigate the intricate logic of existing systems

dev.to ‘50 days of Claude Code’ journal dev.to

running four agents simultaneously… is ‘mentally exhausting,’ often leaving him ‘wiped out’ by noon