Tencent ships Hy4, Copilot lands in Xcode's built-in assistant, Claude plugins connect at login

Hy4 is the flagship language model from Tencent's Hunyuan team. It builds on the August preview (a mixture-of-experts model, meaning only part of it runs for each token, with 770B total and 49B active parameters and a 1M-token context) with more pre-training and post-training. This release adds image understanding and computer use for the first time. It can mix command-line and graphical interfaces, and Tencent says it trained specifically on professional software such as Blender and CAD. You can call it as tencent/hy4 on Tencent Cloud and OpenRouter.

Few models with promised open weights handle both vision and computer use. Pricing matches the preview, and OpenRouter lists it at $0.417 input and $1.251 output per million tokensVendor claim with a 50% discount applied. Tencent says its own search evals show the hallucination rate falling from 15.76% to 5.45%Vendor claim, and its GameDev score rising 19.1%Vendor claim. That makes it worth trying as a cheap engine for document, finance, or game-development agents.

You can now pick GitHub Copilot inside Xcode's own coding assistant. Install Xcode 27.3 beta, then connect your Copilot account under Xcode > Settings > Intelligence. Every Copilot plan works. The existing GitHub Copilot for Xcode extension stays available, so you can use whichever setup suits you.

Swift and iOS developers can now use the Copilot seat their company already pays for in Apple's native chat and editing flow without installing an extension. It ships in the same 27.3 beta as the Siri AI developer preview we covered yesterday, another sign that Apple's developer tools are opening up to outside AI. If your team already has Copilot licenses, you can try it today without a new contract.

When a Team or Enterprise admin picks "Claude-issued" as a connector's identity source, Claude sends the MCP server a signed identity assertion under an issuer URL unique to that organization. Once an admin of the connected service registers that URL as a trusted issuer, members are connected the first time they use the plugin, with no sign-in page or consent screen. Users are matched by email, so no identity provider or SSO is required. On the server side, the token endpoint has to accept the JWT bearer grant (RFC 7523).

It removes the most tedious part of rolling plugins out across a company: making every person go through their own OAuth login. If you build an MCP server, enabling the urn:ietf:params:oauth:grant-type:jwt-bearer grant and adding a per-workspace issuer setting gives you a connector that works out of the box for Claude's enterprise customers. Claude only checks organization membership, though, not SSO or MFA, so get your security team to review it.