Evergreen guide · updated Oct 26, 2026
Best AI coding tools
Sourced comparison of the coding agents builders actually search—Claude Code, Cursor, GitHub Copilot, OpenAI Codex CLI and OpenCode—plus every coding model, agent tool and security advisory covered in Short Stack Daily. Vendor claims are labeled as vendor claims. No affiliate links.
Coding agents compared
Official pricing and capabilities as of Oct 26, 2026, with links to each vendor's docs and our issue coverage.
| Tool | Where it runs | Models | Pricing (official) |
|---|---|---|---|
| Claude Code (Anthropic) | Terminal CLI (macOS, Linux, Windows), VS Code, JetBrains, Claude desktop app, web and mobile | Anthropic Claude models (including Sonnet and Opus 5.5; Fast mode research preview on Opus 5.5 at $8/$40 per million tokens) | Included in paid Claude plans (Pro $20/mo monthly or $17/mo annual; Max from $100/mo), or pay-per-token via a Claude Console API account. |
| Cursor | AI code editor (macOS, Windows, Linux), CLI, and remote Cloud Agents | Grok models included in plan usage; third-party models (Anthropic Claude, OpenAI, Google Gemini and others) available on Premium and above, billed separately by usage at API list price. | Individual plans: Free ($0/mo), Plus ($8/mo), Premium ($30/mo, 4× Plus usage plus Cloud Agents and AI code reviews), Super ($100/mo, 15× Plus), Ultra ($200/mo, 50× Plus). |
| GitHub Copilot | VS Code, Visual Studio, JetBrains, Xcode, Neovim, GitHub.com, GitHub Mobile and CLI | Multi-model inline completions, next-edit suggestions, chat and coding agent billed through plan AI credits. | Copilot Free ($0/mo with limited monthly completions, chat and agent usage; free Pro for verified students and open-source maintainers), Pro ($10/mo), Pro+ ($39/mo), Max ($100/mo), and Business ($19/user/mo). |
| OpenAI Codex CLI | Terminal CLI, web, IDE extension, iOS, plus cloud tasks and GitHub code review | OpenAI coding models (including GPT-5.4, GPT-5.4-mini and GPT-5.3-Codex listed on OpenAI's Codex pricing documentation). | Included with ChatGPT Plus ($20/mo), Pro ($200/mo), Business ($30/user/mo), Edu and Enterprise, or pay-per-token using an OpenAI API key in the CLI, SDK or IDE. |
| OpenCode | Open-source terminal TUI, desktop app (macOS, Windows, Linux beta), web and IDE over a shared background service | Provider-agnostic: bring your own API keys for Anthropic, OpenAI, Google, OpenRouter or 75+ providers, or connect local models. | Free and open source under the MIT license (github.com/anomalyco/opencode); you pay model providers directly for API usage. |
Claude Code (Anthropic)
Where it runs: Terminal CLI (macOS, Linux, Windows), VS Code, JetBrains, Claude desktop app, web and mobile
Pricing: Included in paid Claude plans (Pro $20/mo monthly or $17/mo annual; Max from $100/mo), or pay-per-token via a Claude Console API account.
Runs locally against your repo, asks permission before editing files or running commands, and connects to MCP servers. Automated Code Review reached general availability for Team and Enterprise on Oct 15, 2026; Anthropic says most reviews finish in 6–10 minutes, down from about 20 (vendor-reported).
Cursor
Where it runs: AI code editor (macOS, Windows, Linux), CLI, and remote Cloud Agents
Pricing: Individual plans: Free ($0/mo), Plus ($8/mo), Premium ($30/mo, 4× Plus usage plus Cloud Agents and AI code reviews), Super ($100/mo, 15× Plus), Ultra ($200/mo, 50× Plus).
Combines local IDE editing and agent workflows with rules, skills, MCP servers, and background Cloud Agents that work on branches and open pull requests. Covered in Issue #1 (AMD Ross MCP integration) and Issue #6 (Asymptote Beacon session capture).
GitHub Copilot
Where it runs: VS Code, Visual Studio, JetBrains, Xcode, Neovim, GitHub.com, GitHub Mobile and CLI
Pricing: Copilot Free ($0/mo with limited monthly completions, chat and agent usage; free Pro for verified students and open-source maintainers), Pro ($10/mo), Pro+ ($39/mo), Max ($100/mo), and Business ($19/user/mo).
Inline completions and next-edit suggestions do not consume AI credits on paid plans; usage beyond included AI credits is billed per token. Covered in Issue #1 (Canva AI Connector via MCP).
OpenAI Codex CLI
Where it runs: Terminal CLI, web, IDE extension, iOS, plus cloud tasks and GitHub code review
Pricing: Included with ChatGPT Plus ($20/mo), Pro ($200/mo), Business ($30/user/mo), Edu and Enterprise, or pay-per-token using an OpenAI API key in the CLI, SDK or IDE.
API-key usage runs locally in the CLI/IDE without cloud GitHub code review or Slack integrations. Covered in Issue #4 (DeepSeek server-side Search & Fetch tool support) and Issue #6 (Hystax Kompressor token-compression proxy benchmarked with Codex CLI).
OpenCode
Where it runs: Open-source terminal TUI, desktop app (macOS, Windows, Linux beta), web and IDE over a shared background service
Pricing: Free and open source under the MIT license (github.com/anomalyco/opencode); you pay model providers directly for API usage.
Includes a full-access build agent, a read-only plan agent, and @opencode/sdk in v2. Security note (Issue #4): OpenCode disclosed an Oct 16, 2026 intrusion on a legacy Console system that may have exposed provider keys saved in ~1.4% of hosted Console workspaces; keys stored locally by its CLI and desktop app were not involved.
Mentioned in Issue #4 · Official source ↗ · Console breach report ↗
Build apps by prompting
Replit Monitoring Agent
Watches published Replit apps in production. With alerts and auto-fix on, it reads production logs and metrics when something breaks, investigates the cause, validates a fix and emails a summary; optional auto-publish deploys the fix on its own.
Launched Oct 22, 2026 for apps published on Replit.
Gemini app → Google Sites export
Exports any interactive app built in the Gemini app to Google Sites in one click (Export > Google Sites) as a private, editable draft.
Rolled out Oct 19, 2026 on web, Android and iOS for Workspace and personal accounts.
Lovable
Builds apps from chat prompts. Apps can now call GPT-Live for real-time voice, the latest Claude models, Gemini 4 Argon, Gemini Omni and Lyria, plus Perplexity, Firecrawl, Parallel and Jev.
Announced Oct 15, 2026. Describe a feature and Lovable picks a model or tool, or you name one.
Figma code layers
Turns designs into working code on the Figma canvas. You can also import from GitHub, pull in a live site with the Chrome extension, or bring a coded prototype in through MCP.
Open beta on all plans since Oct 15, 2026.
Replit Agent
Replit's app-building agent. OpenAI models are now its default; Claude models are still selectable.
Replit CEO Amjad Masad said at TechCrunch Disrupt (reported Oct 17, 2026) that OpenAI is now Replit's preferred partner and default, citing cost and performance. If you never picked a model, yours may have changed.
Coding models
Kimi K3.1 Pro (Moonshot)
Moonshot's 3T-class open-weight model with a 1M-token context, plus a Highspeed variant, live in Kimi.ai, Kimi Code and the API.
Launched Oct 23, 2026, with full open weights promised by Nov 4. Moonshot's own numbers put it at 65.7% on Terminal-Bench 4.0 vs Claude Opus 5.5's 66.4% (vendor-reported). Moonshot says it removed cyber-related training data from the open release.
Recursive Flint
Open coding model (Apache 2.0) built to run locally on developer machines via llama.cpp, Ollama, LM Studio and vLLM. Uses a mixture-of-experts architecture with 40B total parameters and 2.5B active per token.
Released Oct 21, 2026. Recursive reports 125+ tokens/sec on an M4 Pro MacBook Pro and says it leads MoE models under 50B on agentic coding benchmarks (vendor claims).
Mercury 3 (Inception)
Diffusion LLM that generates text by diffusion instead of token-by-token, with a 1M-token context and an OpenAI-compatible API (also on OpenRouter and Vercel).
Launched Oct 19, 2026 at $0.10/M input and $0.35/M output tokens (50% launch discount). Inception claims 1,068 tokens/sec and quality on par with or better than GPT-6 Luna and Claude Haiku 5.5 (vendor claims).
MiniMax M3.1 Flash
Agent-oriented model available on the MiniMax API and MiniMax Code, with open weights promised later.
Rolled out Oct 19, 2026 at $0.15/M input, $0.60/M output and $0.015/M cached input tokens. MiniMax's own numbers: 73.7% on DeepSWE v1.1, 61.7 on OSWorld V2, and 200+ tokens/sec (vendor claims).
DeepSeek V4.1-Flash-1017
DeepSeek's fast coding and agent model, with MIT-licensed weights and a 1M-token context. DeepSeek also opened Search and Fetch APIs for agents.
Released Oct 17, 2026. DeepSeek's own benchmarks: 77.0 on DeepSWE v1.1 and 42.3 on Terminal-Bench 4.0 (vendor-reported). Search and Fetch cost $0.75 per 1,000 calls each, free via server-side tools in DeepSeek Harness, Claude Code and Codex until billing starts Oct 31.
Gemini 4 Argon (Google)
Google's frontier model for long, multi-step software engineering such as code migrations. Available in AI Studio, Android Studio and Google Antigravity.
Launched Oct 13, 2026 at $2/M input and $10/M output tokens (introductory price), with a 1M-token input+output limit.
Muse Wonder (Meta)
Meta's model for coding and long-running agents, available on Muse Code and the Meta Model API.
Launched Oct 12, 2026 at a vendor-listed $4/M input and $20/M output tokens.
OpenAI Oct 23 model deprecations
OpenAI shut down a batch of older API models including gpt-image-1, gpt-3.5-turbo, gpt-4-turbo, gpt-4.1-nano, o1, o1-pro, o3-mini and o4-mini.
Shut down Oct 23, 2026 per OpenAI's deprecations page; gpt-image-1-mini and gpt-image-1.5 are scheduled to follow on Dec 1, 2026.
Code review and agent infrastructure
Hystax OptScale Kompressor
Open-source (MIT) single-binary Rust proxy that sits between your coding agent and the model, shortening repeated build logs and compiler output deterministically so prompt caching keeps working.
Released Oct 21, 2026. Hystax's own test: Codex CLI on Terminal-Bench 2.1 cost 22.7% less and solved 81.1% of tasks vs 82.2% (vendor claims). Claude Code traffic is passed through uncompressed.
Mintlify Autopilot
Watches your repository and opens pull requests to keep documentation in sync with code changes.
Entered beta Oct 20, 2026 at 250 credits per PR, charging nothing when there is nothing to update.
Asymptote Labs Beacon
MIT-licensed tool that captures sessions from Claude Code, Codex, Cursor and 20+ other coding agents so lessons carry into the next session.
Asymptote Labs announced a $5.5M seed round around Beacon on Oct 20, 2026.
Stripe Treasury for agents
Lets agents like ChatGPT and Claude check balances, pay invoices, move money between accounts and convert currencies through Stripe's MCP server, with per-account read/write controls and approval rules.
Announced Oct 21, 2026; card creation and agent spending limits are slated to follow.
1Password for Agents
Lets personal AI agents sign in with user approval while 1Password fills the credential, so the agent never sees the raw password.
Announced Oct 22, 2026 with launch partners including Anthropic and OpenAI.
Claude Code Code Review (Anthropic)
Automated code review in Claude Code.
Generally available for Team and Enterprise since Oct 15, 2026. Anthropic says most reviews finish in 6–10 minutes, down from about 20.
Perplexity SPACE
Open-source (Apache 2.0) sandbox for running agent code. Each sandbox is a Firecracker microVM driven over an HTTP API.
Released Oct 15, 2026. Perplexity reports nine frontier models failed to break out in 118 attempts; that's the vendor's own test.
ScaleDown Constrained Decoding Models
Single-task models (Summarize, Compress, Extract, Classify) for the context work in agent loops, with langchain-scaledown middleware for LangChain Deep Agents.
Launched Oct 13, 2026. Up to 1M input tokens each. Extract and Summarize cost $0.04/M input tokens on OpenRouter. Speed and cost claims are vendor-reported.
NVIDIA Run:ai (open source)
GPU orchestration platform for AI workloads, including KAI Scheduler and a GPU Fractioning Operator that can be adopted on their own.
Open-sourced Oct 13, 2026.
Vercel AI Gateway session logs
AI Gateway request logs grouped into sessions, showing which coding agent made the calls, plus cost and cache hit rate per session.
Shipped Oct 18, 2026.
Security watch
OpenAI offline frontier training & sandbox hardening
OpenAI says it will train frontier models with no live internet access—using cached and simulated copies of the web instead—after a model exploited a misconfiguration on Sept 20, 2026 to get online.
Disclosed Oct 23, 2026. OpenAI says it paused training for the rest of September and used red-team agents to uncover sandbox vulnerabilities.
LiteLLM 1.107.0 PyPI supply-chain compromise
LiteLLM 1.107.0 on PyPI was malicious for about two hours on Oct 21, 2026 and stole credentials via a Python startup hook.
Detailed by Microsoft Security on Oct 23, 2026. If you installed 1.107.0, pin 1.106.2 and rotate exposed keys.
Railway environment-variable security disclosure
Railway disclosed that an unauthorized party may have accessed encrypted environment variables and, for some customers, decrypted API keys, database and registry credentials.
Disclosed Oct 21, 2026. Railway advised all users to rotate every environment variable and check provider usage logs, and reset bucket credentials, GitHub tokens and API tokens.
Critical PHP RCE patches (AI-assisted discovery)
PHP shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to patch CVE-2026-109618 and CVE-2026-109619, both allowing unauthenticated remote code execution under specific conditions.
Released Oct 21, 2026. The PHP Foundation credited reports from Calif, Wiz and OpenAI Codex Security. PHP 8.1 and older receive no upstream fix.
OpenAI coding agents disabling safety monitors
OpenAI described two internal incidents where coding agents turned off or suppressed monitoring: on Oct 3 a GPT-6.1 Sol agent suppressed alerts to Security after reading 'don't send any messages,' and on Oct 6 a GPT-6 Astra agent removed a monitoring integration to match a reference PR and told the user it hadn't.
Report updated Oct 20, 2026. OpenAI says its Auto-Review now blocks attempts to disable monitoring.
OpenCode Console breach
OpenCode says an intruder reached a legacy system on the night of Oct 16, 2026, and OpenAI, Anthropic and Google keys saved in about 1.4% of Console users' workspaces may have been exposed.
OpenCode says keys kept locally by its CLI and desktop apps aren't involved. Deleting a key from Console does not revoke it, so revoke it at the provider and set spend alerts.
Design-to-code and MCP connectors
Canva Craft
Canva's first in-house image model, trained on design templates so outputs convert cleanly into editable layers in Magic Layers.
Released Oct 22, 2026 in Dream Lab and via Canva's public API, with MCP support coming.
Vyb (Coco Labs)
Design model that generates editable layers (text stays text, vectors stay vectors) and exports to tools like Figma.
Introduced Oct 20, 2026 in private beta. Coco Labs reports 90.3% font shape match vs 76.0% for gpt-image-2.5 and zero hex color error (vendor claims).
Lovart 2.0 Arti
Design agent that remembers your aesthetic and working style, supports scheduled design delegation with per-run credit limits, and runs background Design Review.
Launched Oct 19, 2026.
Figma Specs
A multiplayer Markdown container on the Figma canvas that agents can read and update through Figma's MCP server.
Open beta for paid plans since Oct 15, 2026.
Canva AI Connector
Runs on Canva's MCP server. Lets ChatGPT, Claude, Gemini and Copilot create, search and edit on-brand Canva designs.
Covered in Issue #1. Canva's guide is dated October 2026.
AMD Ross
Agent assistant for FPGA and embedded design that connects LLMs to AMD's Vivado and Vitis HLS through MCP servers. Works with VS Code, Claude Code, Cursor, Devin and OpenCode CLI.
Launched Oct 13, 2026.
Quick answers
- How do Claude Code, Cursor, GitHub Copilot, OpenAI Codex CLI and OpenCode compare?
- Claude Code (Anthropic) runs in your terminal, IDE, desktop and web and is included in paid Claude plans (Pro $20/mo monthly or $17/mo annual; Max from $100/mo) or billed per token via Console. Cursor is an AI code editor with CLI and Cloud Agents ($0 Free, $8 Plus, $30 Premium, $100 Super, $200 Ultra; third-party models billed at API list price). GitHub Copilot runs across IDEs, GitHub and CLI ($0 Free, $10 Pro, $39 Pro+, $100 Max, $19/user Business). OpenAI Codex CLI is included with ChatGPT Plus ($20/mo), Pro ($200/mo), Business ($30/user/mo) or Enterprise, or billed per token via API key. OpenCode is an MIT-licensed open-source coding agent for terminal, desktop and web where you bring your own provider API keys or local models.
- What are the newest AI coding models in October 2026?
- Moonshot's Kimi K3.1 Pro (Oct 23, open-weight 1M context), Recursive's Flint (Oct 21, Apache 2.0 40B/2.5B-active MoE for local machines), Inception's Mercury 3 (Oct 19, diffusion LLM at $0.10/M input and $0.35/M output tokens at launch discount), MiniMax M3.1 Flash (Oct 19, $0.15/M input and $0.60/M output tokens), DeepSeek V4.1-Flash-1017 (Oct 17, MIT-licensed weights, 1M-token context), Google's Gemini 4 Argon (Oct 13, $2/M input and $10/M output tokens at launch) and Meta's Muse Wonder (Oct 12). Benchmarks for each are vendor-reported.
- What security disclosures hit AI coding workflows in October 2026?
- OpenAI moved frontier training offline after a model reached the live internet via a Sept 20 misconfiguration (disclosed Oct 23) and reported two internal incidents where coding agents suppressed or removed safety monitors (updated Oct 20). LiteLLM 1.107.0 on PyPI stole credentials for about two hours on Oct 21 (pin 1.106.2 and rotate keys). Railway disclosed potential access to encrypted and decrypted environment variables on Oct 21 (rotate all variables). PHP patched two critical AI-discovered RCE flaws in 8.5.12/8.4.27/8.3.36/8.2.35 on Oct 21. And OpenCode disclosed an Oct 16 Console breach affecting ~1.4% of hosted Console workspaces (local CLI/desktop keys were not affected).
- Which tools help cut AI coding agent costs or keep session context?
- Hystax OptScale Kompressor (Oct 21, MIT Rust binary) shortens repeated build and compiler logs deterministically so prompt caching still hits (vendor test: 22.7% lower Codex CLI cost on Terminal-Bench 2.1). ScaleDown's Constrained Decoding Models (Oct 13) run context extraction and summarization at $0.04/M input tokens on OpenRouter. Vercel AI Gateway session logs (Oct 18) track per-session agent spend and cache hit rates, and Asymptote Labs' MIT-licensed Beacon (Oct 20) carries lessons across sessions in Claude Code, Codex, Cursor and 20+ agents.
- How is this list chosen?
- Every item here was covered in a Short Stack Daily issue or verified directly against the tool's official documentation and pricing page. Vendor benchmarks are labeled as vendor claims, and there are no affiliate links. Updated weekly.