惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

宝玉的分享
宝玉的分享
T
The Blog of Author Tim Ferriss
Y
Y Combinator Blog
Apple Machine Learning Research
Apple Machine Learning Research
Last Week in AI
Last Week in AI
Recorded Future
Recorded Future
博客园 - 司徒正美
V
Vulnerabilities – Threatpost
月光博客
月光博客
C
CXSECURITY Database RSS Feed - CXSecurity.com
D
Darknet – Hacking Tools, Hacker News & Cyber Security
CTFtime.org: upcoming CTF events
CTFtime.org: upcoming CTF events
Microsoft Azure Blog
Microsoft Azure Blog
cs.AI updates on arXiv.org
cs.AI updates on arXiv.org
W
WeLiveSecurity
Jina AI
Jina AI
Exploit-DB.com RSS Feed
Exploit-DB.com RSS Feed
Hacker News: Ask HN
Hacker News: Ask HN
S
Security Affairs
V
Visual Studio Blog
Schneier on Security
Schneier on Security
T
Tailwind CSS Blog
Martin Fowler
Martin Fowler
V2EX - 技术
V2EX - 技术
博客园 - Franky
S
Secure Thoughts
Blog — PlanetScale
Blog — PlanetScale
G
GRAHAM CLULEY
D
DataBreaches.Net
O
OpenAI News
Forbes - Security
Forbes - Security
云风的 BLOG
云风的 BLOG
Google Online Security Blog
Google Online Security Blog
博客园 - 三生石上(FineUI控件)
T
Tor Project blog
T
Tenable Blog
Latest news
Latest news
N
News and Events Feed by Topic
博客园_首页
Simon Willison's Weblog
Simon Willison's Weblog
C
Cybersecurity and Infrastructure Security Agency CISA
美团技术团队
T
The Exploit Database - CXSecurity.com
K
Kaspersky official blog
B
Blog
阮一峰的网络日志
阮一峰的网络日志
T
Threat Research - Cisco Blogs
SecWiki News
SecWiki News
PCI Perspectives
PCI Perspectives
GbyAI
GbyAI

DEV Community

Authentication Security Deep Dive: From Brute Force to Salted Hashing (With Java Examples) Why AI Systems Don’t Fail — They Drift Spilling beans for how i learn for exam😁"Reinforcement Learning Cheat Sheet" I Replaced Chrome with Safari for AI Browser Automation. Here's What Broke (and What Finally Worked) How Python Borrows Other People's Work The $40 Architecture: Processing 1 Billion API Requests with 99.99% Uptime Vibe Coding: A Workflow Guide (From Zero to SaaS) Most webhook security guides protect the wrong side. The scary part is delivery. Headless CMS for TanStack Start: Build a Blog with Cosmic EU Age Verification App "Hacked in 2 Minutes" — What Actually Happened Comfy Cloud’s delete function does not actually remove files Running AI Models on GPU Cloud Servers: A Beginner Guide Event-driven media intelligence with AWS Step Functions and Bedrock I scored 500 AI prompts across 8 quality dimensions — here's what broke How to Call Google Gemini API from Next.js (Free Tier, No Backend Needed) The Portal Protocol: Reclaiming Human Connection in the Age of AI How to Fix Your Team's Scattered Knowledge Problem With a Self-Hosted Forum Intro to tc Cloud Functors: A Graph-First Mental Model for the Modern Cloud Designing Multi-Tenant Backends With Both Ownership and Team Access I Built a Neumorphic CSS Library with 77+ Components — Here's What I Learned PostgreSQL Performance Optimization: Why Connection Pooling Is Critical at Scale Cómo construí un SaaS multi-rubro para gestionar expensas en Argentina con FastAPI + Vue 3 🚀 I Built an Ethical Hacking Scanner Tool – Open Source Project I Replaced /usage and /context in Claude Code With a Single Statusline A Pythonic Way to Handle Emails (IMAP/SMTP) with Auto-Discovery and AI-Ready Design I Collected 8.9 Million Polymarket Price Points — Here's What I Found About How Markets Really Move EcoTrack AI — Carbon Footprint Tracker & Dashboard Everyone's Using AI. No One Agrees How. 5 self-hosted ebook managers worth trying in 2026 Building Your First AI Agent with LangChain: From Chatbot to Autonomous Assistant Common SOC 2 Failures (Real World) Stop Vibe-Checking Your AI App: A Practical Guide to Evals How to Use SonarQube and SonarScanner Locally to Level Up Your Code Quality Your Next To-Do App Is Dead — I Replaced Mine with an OpenClaw AI Sign a Nostr event in 60 lines of Python using coincurve — no nostr-sdk, no nbxplorer, no rust toolchain ITGC Audit Explained Like You’re in Big 4 Patch Tuesday abril 2026: Microsoft parcha 163 vulnerabilidades y un zero-day en SharePoint Stop scraping everything: a better way to track competitor price changes Listing on MCPize + the Official MCP Registry while routing payments OUTSIDE the marketplace — how I kept 100% of my x402 revenue Building an AI-Powered Risk Intelligence System Using Serverless Architecture Why We Ripped Function Overloading Out of Our AI Toolchain Testing AI-Generated Code: How to Actually Know If It Works SaaS Churn Is Killing Your Business. Here Is What to Do About It (Without a Support Team) The Speed of AI Is No Longer Linear - And Self-Improving Models Are Why How to Implement RBAC for MCP Tools: A Practical Guide for Engineering Teams From Standard Quote to Persuasive Proposal: AI Automation for Arborists I built a CLI that scaffolds complete multi-tenant SaaS apps Axios CVE-2025–62718: The Silent SSRF Bug That Could Be Hiding in Your Node.js App Right Now The dashboard that ended our friendship Data Pipelines Explained Simply (and How to Build Them with Python) The Hidden Cost of AI Systems Nobody Talks About. undefined vs undeclared, and how typeof behaves Switching from file-based jobs to NATS/Kafka in Rust without changing code io_uring Adventures: Rust Servers That Love Syscalls Why Agentic AI is Killing the Traditional Database The POUR principles of web accessibility for developers and designers Quantum Neural Network 3D — A Deep Dive into Interactive WebGL Visualization How To Install Caveman In Codex On macOS And Windows Automation Pipeline Reliability: Why Your Workflow Breaks When Nobody Is Watching I Built an 'Open World' AI Coding Agent — It Works From ANY Folder From Freelancing to Product: A Tech Service Company's SaaS Transformation China's AI Giants: Adding Tencent Hunyuan & ByteDance Doubao to AI University (74 Providers) On the Vibe Coders and Their Lies clerk: Auto-Summarize Your Claude Code Sessions AI Weekly — 2026/04/10–04/17 | The Model Lockdown Is Here, but the Toolchain Is the Real Battleground AI 週報 — 2026/04/10–2026/04/17 模型封鎖潮來了,但工具鏈才是真戰場 Maybe this is how Open-Source apps are born... 🚀 Fine-Tune LLMs with LoRA and QLoRA: 2026 Guide tRPC v11 + Next.js App Router: End-to-End Type Safety Without the Boilerplate ShadCN UI in 2026: Why I Stopped Installing Component Libraries and Started Owning My Components SaaS Billing in React Server Components: Stripe + Supabase Without a Single `useEffect` Join our DEV Weekend Challenge — $1,000 in Prizes Across TEN winners! Submissions Due April 20 at 6:59 AM UTC. Implementing FSRS Spaced Repetition in Flutter + Supabase — Adding Memory Science to an AI Learning App "I Texted My Localhost From the Train — Claude Code Fixed the Bug Before I Got Home" I Built a Sales Prep AI and It Went Deeper Than Expected Design to Code #2: One JSON, Eleven Outputs Solving the 100M-Row Problem: A Summary Table Pattern for High-Volume Push Notification Logs Flutter Web With Wasm: What Actually Changes For Developers I Built 50 Royalty-Free Soundtracks for My Side Project in a Weekend Using AI Music Generation The Vibe Coding Security Checklist: 7 Things to Check Before You Ship Stop Letting Googlebot Guess Fix Your React App's SEO Right Desconstruindo o Streaming do LinkedIn: Como Criar um Engine de Extração de Vídeo de Alta Performance com HLS e FFmpeg (EDA Part-1) EDA (Exploratory Data Analysis) Explained With Real Life — Why Looking at Your Data Is the Most Important Step in Machine Learning Brand Relationship Management at Scale: Our 4-Touch Outreach System for 200+ Brands Why String.fromEnvironment() Might Return an Empty String in Dart JGuardrails 1.0.0 — Hardening Java LLM Apps Against Jailbreaks, Toxicity, and Prompt Injection Plan and Schedule a Full Week of Threads Content From One Claude Conversation Coding Cat Oran Ep3, Five Tables Changed Everything Updated: BFF Pattern I'm done watching freelancers get buried by 200 proposals. So I'm building the alternative. This is my first post BFS Algorithm in Java Step by Step Tutorial with Examples Tracking LLM Pricing Monthly: An Open Dataset for 22 AI Models How We Measure Content ROI on a Comparison Site: Revenue Attribution Without Perfect Data Introducing Nova AI Ops: The AI-Native Operating System for SRE Teams I built a free desktop video downloader for Windows — Grabbit How Talkie OCR Helps Vision-Impaired & Dyslexic Users Read the World Around Them VRCFaceTracking安装和iPhone面捕配置教程,有bug Even CrowdStrike Can't See Your Agents The Automation Gold Rush: What n8n Workflows and Claude Are Opening Up for Developers Right Now
Step 3.7 Flash is a drop-in — except for one endpoint detail
Creeta · 2026-06-18 · via DEV Community

Creeta

Step 3.7 Flash shipped on May 29, 2026 as a structural upgrade to 3.5 Flash: same OpenAI-compatible SDK, new vision encoder, new runtime escalation, and a compute-control flag you can set per request. The migration from 3.5 is two environment variables. One of them has to be exactly right — or every call returns a silent 401.

What 3.7 brings that 3.5 didn't

Step 3.7 Flash adds three net-new capabilities over 3.5 Flash: a native 1.8B-parameter ViT encoder that injects image representations directly into the language backbone without a separate model call , an automatic Advisor Mode that routes failure-prone subtasks to a larger model at runtime, and a reasoning_effort parameter (low / medium / high) as a first-class API flag rather than a prompt-engineering convention. The production-relevance number is variance: 3.5 Flash scores ranged from 43% to 73% across different harnesses ; 3.7 narrows that to 64.5–71.5% , which matters more for production scheduling than the raw score improvement.

Quick Answer: Step 3.7 Flash is an OpenAI-SDK-compatible model — model string step-3.7-flash, base URL https://api.stepfun.ai/v1 (global) or https://api.stepfun.com/v1 (China region). New over 3.5: native vision input, automatic Advisor Mode escalation, and a reasoning_effort flag. The only breaking change from 3.5: base URL must match your account region exactly, or you get a 401 with no error body.

The architecture is a 198B sparse MoE model with roughly 11B parameters active per forward pass — dense-10B compute cost at much larger capacity. SWE-Bench Pro improved to 56.3% from 51.3% ; Terminal-Bench 2.1 improved to 59.5% from 53.4% , suggesting the planning and shell-operation gains that matter for coding agents are consistent across benchmarks.

Advisor Mode carries the headline cost claim from StepFun's internal harness: 97% of Claude Opus 4.6's coding performance at $0.19 vs. $1.76 per task . That's a vendor figure on a first-party SWE-Bench Verified run — treat it as directional until independent replication appears.

Capability Step 3.5 Flash Step 3.7 Flash
Vision input External model call Native 1.8B ViT encoder
SWE-Bench Pro 51.3% 56.3%
Benchmark spread 43–73% 64.5–71.5%
reasoning_effort flag Not available low / medium / high
Advisor Mode No Automatic (runtime)
Context window 256k tokens

Before you send a request

Two environment variables and the correct regional URL are all that's required. The URL is the part that fails silently — verify it before writing any code.

Account region and base URL. StepFun runs two separate API domains that share no authentication state:

  • Global account — register at platform.stepfun.ai; set STEP_BASE_URL=https://api.stepfun.ai/v1
  • China-region account — register at platform.stepfun.com; set STEP_BASE_URL=https://api.stepfun.com/v1

Export both before running any code:

export STEP_API_KEY="sk-..."
export STEP_BASE_URL="https://api.stepfun.ai/v1"   # global account
# China-region: export STEP_BASE_URL="https://api.stepfun.com/v1"

OpenRouter alternative. If you want to skip a StepFun account or consolidate all model routing behind a single proxy, OpenRouter lists Step 3.7 Flash under model ID stepfun/step-3.7-flash. Set base URL to https://openrouter.ai/api/v1 and use your existing OpenRouter key. No StepFun registration required.

NVIDIA NIM. For enterprise GPU inference, NVIDIA's NIM containerized endpoint runs Step 3.7 Flash on Hopper-class GPUs at up to 600 tokens/second , exposes the same OpenAI-compatible interface at http://0.0.0.0:8000/v1, and supports NeMo-based fine-tuning. Requires an NVIDIA enterprise license.

Python dependency: pip install openai. No StepFun-specific SDK or plugin needed.

Chat, image, and effort level: runnable examples

All four steps below use the standard openai Python client without modification. The only constructor differences from a standard OpenAI call are api_key and base_url.

Step 1 — Basic call. The SDK call structure is identical for any OpenAI-compatible Flash endpoint. The snippet below is illustrative (not executed in this context) and demonstrates the structural pattern — the same shape applies to Step 3.7 Flash by substituting your StepFun credentials:

import os
from openai import OpenAI

# Flash is otherwise OpenAI-compatible; the endpoint needs Google's /openai/ path.
client = OpenAI(
    api_key=os.environ["GEMINI_API_KEY"],
    base_url="https://generativelanguage.googleapis.com/v1beta/openai/",
)

response = client.chat.completions.create(
    model="gemini-2.5-flash",
    messages=[{"role": "user", "content": "Say hello in five words."}],
)

print(response.choices[0].message.content)

For Step 3.7 Flash, substitute your StepFun credentials in the constructor and set the model string to step-3.7-flash:

import os
from openai import OpenAI

client = OpenAI(
    api_key=os.environ["STEP_API_KEY"],
    base_url=os.environ["STEP_BASE_URL"],   # https://api.stepfun.ai/v1
)

completion = client.chat.completions.create(
    model="step-3.7-flash",
    messages=[{"role": "user", "content": "Explain the actor model of concurrency."}],
)
print(completion.choices[0].message.content)

Step 2 — reasoning_effort. Pass the parameter directly to create() . Use high for complex code review or multi-step planning; use low for extraction, summarization, or rewriting where latency matters more than depth; omit it entirely to default to medium for general-purpose tasks. If you later switch base models, test the parameter explicitly — it may be accepted without error but silently ignored on models that don't support it:

completion = client.chat.completions.create(
    model="step-3.7-flash",
    reasoning_effort="high",   # low | medium | high
    messages=[{"role": "user", "content": "Review this code for race conditions: ..."}],
)

Step 3 — Image input. Replace the string content with a content array. Add a text dict and an image_url dict — identical shape to GPT-4o vision calls. The native 1.8B ViT encoder handles the image directly in the language backbone without routing to an external vision model:

completion = client.chat.completions.create(
    model="step-3.7-flash",
    messages=[{
        "role": "user",
        "content": [
            {"type": "text", "text": "List the interactive elements in this UI screenshot."},
            {"type": "image_url", "image_url": {"url": "https://example.com/screenshot.png"}}
        ]
    }]
)

Step 4 — Advisor Mode. No parameter required. When the model detects high failure probability on a subtask — repeated errors, complex architectural reasoning — it automatically routes that subtask to a larger model at runtime without any caller intervention. To confirm escalation occurred in a given turn, inspect the response's usage or metadata fields; unexpectedly high per-step token counts relative to your base-model baseline are a reliable indicator. There is no flag in the current public API to force or suppress escalation.

Where it breaks and why

Most Step 3.7 Flash failures trace to one of four predictable sources. None produce descriptive error bodies — you have to know what to check.

  • 401 from the wrong domain. The single most common integration failure. STEP_BASE_URL must match your account's registration domain exactly: global keys work only against api.stepfun.ai/v1; China-region keys work only against api.stepfun.com/v1. The 401 response body is empty — no hint about the actual cause. Check the env var before investigating anything else.
  • reasoning_effort silently ignored. If the model string has a typo or uses an undocumented alias, the parameter may be accepted with HTTP 200 but have no effect. The only confirmed model string is step-3.7-flash exactly — no version aliases are currently documented in the official API reference . Verify the string before debugging effort-parameter behavior.
  • Single-run benchmark scores are noise. The 7-percentage-point spread (64.5–71.5%) means one eval run can look 7 points better or worse than the actual baseline. Run at least 5 passes on your task distribution before making a production decision based on a benchmark number.
  • Advisor Mode cost figures are first-party only. The $0.19 vs. $1.76 per-task comparison against Claude Opus 4.6 comes from StepFun's own SWE-Bench Verified harness. No independent replication has been published as of May 29, 2026. Don't anchor infrastructure cost projections to this number until third-party results exist.

What to explore once it's working

Once the basic call runs, four experiments will give you grounded data on whether Step 3.7 Flash fits your actual workload rather than StepFun's harness.

  • Measure reasoning_effort tradeoffs on your own task distribution. Run a representative sample at low, medium, and high, and record latency, cost, and quality score for each tier. The optimal setting is workload-specific — the vendor benchmarks don't answer this for your data.
  • Test native ViT grounding on layout-sensitive tasks. Send a UI screenshot or a chart alongside a structured extraction prompt. The native 1.8B ViT encoder should outperform a tool-chained vision call on tasks where spatial layout matters — form parsing, diagram annotation, UI diffing. Measure it on your actual data; this is a testable, falsifiable claim.
  • Instrument Advisor Mode over a 10+ step agentic loop. Log per-step costs across a full run and compare total cost against a single-model baseline at reasoning_effort=high. The auto-escalation cost delta is invisible on a single call; it becomes meaningful at the loop level.
  • Head-to-head against DeepSeek V4 Flash on your eval set. ClawEval-1.1 shows a 9-point tool-calling robustness gap: 67.1% for Step 3.7 vs. 57.8% for DeepSeek V4 Flash . Domain-specific results vary considerably — run the comparison on your own task set before committing to either model for production tool-calling workloads.

Frequently Asked Questions

Why does my Step 3.7 Flash request return a 401 error?

Endpoint region mismatch. Keys issued from platform.stepfun.ai (global) only authenticate against api.stepfun.ai/v1. Keys from the China-region platform only work with api.stepfun.com/v1. The 401 response body is empty — there is no hint in the error itself about the cause. Fix: confirm STEP_BASE_URL exactly matches the domain where you registered your account before investigating anything else in your request chain.

Is Step 3.7 Flash a true drop-in for the OpenAI API?

Structurally yes. The same openai Python client, the same messages array shape, and the same image_url content format all carry over without modification. Three things differ from a plain OpenAI call: the model string (step-3.7-flash instead of a GPT variant), the base URL (your regional StepFun endpoint), and reasoning_effort semantics — OpenAI's o-series uses it as a reasoning-chain depth hint, while Step 3.7 Flash uses it as a direct compute-allocation tier that controls inference cost and speed.

Do I have to configure Advisor Mode, or is it automatic?

Automatic. No API parameter enables, disables, or triggers it. The model identifies subtasks it predicts will fail — recovering from repeated errors, deep architectural planning steps — and routes them to a larger model at runtime without any caller-side configuration. StepFun's own SWE-Bench Verified harness reports this blended approach reaches 97% of Claude Opus 4.6's coding performance at $0.19 vs. $1.76 per task . Independent replication of that figure has not been published as of the time of writing.

Can I use Step 3.7 Flash for video as well as images?

The ViT architecture is described as video-capable in StepFun's materials, but video input via the public API should be verified against current platform API documentation before building on it. Static image_url objects in the messages content array are confirmed working today via the native encoder. Don't assume video parity from the architecture description alone — check the current API reference first.

How does Step 3.7 Flash compare in price to similar models?

Input tokens cost $0.20/M tokens (cache miss) and $0.04/M tokens (cache hit); output is $1.15/M tokens as of May 2026 . For agentic workflows, the more meaningful unit is per-task cost: StepFun claims $0.19 per task with Advisor Mode enabled vs. $1.76 for Claude Opus 4.6 alone . Compare to DeepSeek V4 Flash and similar sparse-MoE models at the task level rather than the token level — actual token consumption per task varies widely with prompt length, context reuse, and workflow structure.

The one endpoint detail that's not a drop-in

The migration from Step 3.5 Flash is mechanical: one model string, one env var, and you get vision input, Advisor Mode, and reasoning_effort without any other code changes. The SDK, the message shape, and the image format are identical to what you already use.

The only non-drop-in detail is the regional base URL. It produces a silent 401, it has no descriptive error, and it catches most developers on first integration. Set STEP_BASE_URL to match the domain where you registered, confirm the model string is exactly step-3.7-flash, and the rest of the call works as written. Track independent benchmark results as they emerge at Benchable and monitor API parameter additions via the official GitHub repository as the API stabilizes.

Last updated: 2026-06-01. Reflects Step 3.7 Flash as released May 29, 2026 . Benchmark claims are vendor-reported unless otherwise noted; Advisor Mode cost figures are from StepFun's internal harness and have not been independently replicated as of this date.