Hemmingway-1: open 27B beats GPT-6 Astra at everyday writing
Apache-2.0 weights and GGUF quants are already up, so you can run it tonight — plus a security sweep across Gemini CLI, Codex, and Claude Code.
Copy markdown
Writes the note you've been putting off
Altworld's Hemmingway-1 is a 27B fine-tune of Qwen3.8-27B aimed squarely at everyday writing — messages, emails, the awkward colleague note. On its own CommunicationBench it beats GPT-6 Astra by 50 points and sits 26 points clear of the next model on human-likeness; on the independent EQ-Bench 4 it lands third.
Apache-2.0, 262K context — ship it in your product
The weights are Apache-2.0, so commercial use is fine, and context runs to 262K tokens. Serve it in one line — `vllm serve Altworld/Hemmingway-1 --max-model-len 262144` — and wire a real 'draft this' button into your app with no per-token API bill.
GGUF quants are already up — run it tonight
Community quants (bartowski, plus MTP builds) hit the Hub within hours, so it runs on a single consumer GPU or a Mac today. Its creative-storytelling score is 504 points above the base Qwen3.8-27B if you want it for more than email.
Gemini CLI ships a security-only release
Gemini CLI v0.60.0 is pure hardening: RFC 9207 issuer checks on OAuth, stricter web-fetch validation, macOS Seatbelt isolation, and an NTFS short-name mitigation. Worth the update if you point it at untrusted repos.
Codex gates MCP calls behind Touch ID
Codex CLI v0.155.0 adds Touch ID verification for MCP requests on supported Macs and pulls AWS creds from configured commands for Bedrock; v0.155.1 turns reasoning summaries off by default to stop provider rejections.
Claude Code adds per-command domain allowlists
Claude Code v2.1.270-271 let you set `allowed_domains` per sandboxed Bash/PowerShell command and add `omitClaudeMd` for custom subagents — tighter egress control when an agent runs shell you don't fully trust.