Claude moves into the wet lab, and Cloudflare open-sources its bug-hunting skill

Anthropic’s life-sciences team says it ran research partnerships over several months with six drug developers — BigHat Biosciences, Bristol Myers Squibb, Divergence Labs, Enveda, Generate Biomedicines and The Column Group — and started its own discovery efforts. The work is mostly preclinical. Reported results include Claude Code helping propose CAR‑T designs for solid tumours (one about 70% shorter than the standard version), roughly 35,000 antibody designs generated in about a month for Divergence, and 1,010 variants tested over about ten weeks for BigHat.

Why it matters now: the most concrete number is the unglamorous one — at Enveda, Claude reviewed 1,061 pages of manufacturing documents, caught all 11 issues human reviewers found plus seven they missed, and cut review time 89% (from 25+ hours to under three). Agents are being judged on lab and regulatory throughput, not benchmarks. Treat the results as vendor-reported and preclinical; the post also notes Anthropic acquired Mithril Medicine, with human trials not expected before late 2028.

The skill turns a coding agent into a six-phase auditor: reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification and reporting. Every finding is tagged confirmed, needs_validation or rejected and checked against a JSON schema. Cloudflare describes it as the seed of its own vulnerability-discovery harness; it installs with npx skills add and ships hunting classes for memory safety, AI/LLM, supply chain and cloud.

Why it matters now: the interesting design choice is refusing to execute target code without an OS-enforced sandbox — unverified leads stay needs_validation. Cloudflare also reports that repeated runs find roughly twice what a single run does, a useful warning that one-shot agent audits undercount. The repo is trending hard on GitHub.

A free plugin that audits technical SEO, E‑E‑A‑T content quality, Schema.org markup and AI-search readiness, finishing with a prioritised action plan; the README puts a full audit at 10–15 minutes. It installs through /plugin marketplace add, with optional Google API integrations whose keys stay local.

Why it matters now: it is a clean example of the plugin marketplace becoming a distribution channel for vertical products. Note the cost model — five agents run on Opus, so a full audit draws noticeably more of a plan than a one-page check.

The repo is little more than a guideline file, also shipped as a plugin and Cursor rules, built on four principles: think before coding, simplicity first, surgical changes, and goal-driven execution with verifiable success criteria. Its README admits the bias toward caution over speed and that trivial edits may not need it.

Why it matters now: behavioural instructions are now shareable, installable artefacts — and their popularity says developers feel the same failure modes (over-abstraction, drive-by refactors) regardless of model. One caveat: the install commands point at a different owner than the page shows, so check provenance before installing.

Built on LangGraph, it mirrors a trading desk: fundamentals, sentiment, news and technical analysts, bullish and bearish researchers who debate, a trader, and a risk team whose portfolio manager approves or rejects. The v0.7.1 release (October) covers decision scoring, filing-date handling and fixes to portfolios, prices and SEC statements. It supports OpenAI, Anthropic, Google, Ollama and OpenAI-compatible endpoints.

Why it matters now: the as-filed SEC data and a run_backtest harness address look-ahead bias, the first thing that sinks LLM trading demos. The project itself states it is for research only and that results vary between runs — read it that way.

A zero-dependency C++ CLI that doubles as an MCP server, aimed at answering “what breaks if I change this?” for coding agents. It is listed among the most recently updated MCP-server repositories on GitHub and sits around 2.5k stars.

Why it matters now: agents fail on blast radius more than on syntax. A single static binary with no runtime dependencies is an easy thing for enterprises to approve, which is exactly what Red Hat’s name signals.

An open-source social-media scheduler exposed through MCP or a REST API so an agent can queue and publish posts. Around 758 stars on its GitHub listing.

Why it matters now: it is a small, representative case of SaaS categories being rebuilt agent-first. A companion repo, flaghand, tackles the obvious follow-up by having agents draft posts that only publish after a passkey approval.