Microsoft Build 2026 floods the feed: seven first-party AI models, MXC sandboxes for agents, WSL containers, and GNU coreutils ported to Windows. A 1-click VSCode bug let attackers steal GitHub tokens. Anthropic doubles down on partners and ships a year of cyber-threat data.
OpenAI’s frontier models and Codex land on AWS. Rolldown 1.0 ships and Vite 8.0 picks it up as the default bundler. Alphabet raises $80B for AI infrastructure. Anthropic widens Project Glasswing the day after filing S-1.
Anthropic closes a $65B Series H at $965B post-money and ships Opus 4.8. SQLite-as-workflow-engine and the MCP-is-dead thesis dominate HN. AWS Kiro Web, .NET MAUI on CoreCLR, and a Zig build system rewrite round out the day.
Anthropic ships Opus 4.8 and closes a $65B Series H on the same day. DBOS argues Postgres is enough for durable workflows. SQLite quietly added an AGENTS.md for the agents pointed at it.
Cloudflare productizes its internal SRE stack as Flagship, taking dead aim at Datadog and PagerDuty. A clear-eyed essay on where pure next-token prediction stops working makes the front page. A different post argues the famous ’engineer who can say no’ was just a ZIRP-era artifact. V2EX is debating whether domestic Chinese code agents can actually replace Cursor, and whether Qwen3.7-Coder really beat GLM5.1. Publickey reports .NET MAUI is finally migrating from Mono to CoreCLR, and VS Code shipped an Agent window for multi-AI workflows. Wildcards: Anthropic publishes the first Glasswing consortium results, Google ships Gemini 3.5 Flash straight to GA, and xAI’s Grok Build enters beta with parallel sub-agents.
Rivian documents a one-click switch that fully severs the vehicle from the internet. LinkedIn is found probing 6,278 browser extensions and shipping an encrypted fingerprint with every request. honker.dev packs durable queues, streams, pub/sub, and cron into a single SQLite file. A Shai-Hulud-themed malicious dependency lands inside PyTorch Lightning — the AI training supply chain just took a direct hit. V2EX has parallel threads on shaky Chinese token plans and engineers paying out of pocket to use Claude at work. Google ships Managed Agent API and Antigravity 2.0 as the post-I/O second wave. SpaceX’s S-1 reveals a $1.25B/month compute deal with Anthropic. Mozilla formally opposes Chrome’s built-in Prompt API. Today’s thread — the defaults for privacy, supply-chain trust, and compute economics are all being rewritten at once.
HBM eats into consumer memory wafers — cheap smartphones are about to get pricier. Opus 4.7 can reconstruct your real identity from writing style alone. Daniel Lemire shows how to beat binary search on modern CPUs. Zenn trending is dominated by Claude token-saving tactics and Vibe-Coding supply-chain attacks. Anthropic publishes Project Glasswing’s first six-month report. cPanel has an actively exploited bug. Today’s thread — AI is forcing a recalibration of every yardstick we use, from price tags to privacy defaults to engineering KPIs.
Simon Willison compresses six months of LLM history into a five-minute PyCon talk; a Shai-Hulud-style supply chain attack lands inside PyTorch Lightning; Mozilla formally opposes Chrome’s Prompt API; Anthropic absorbs Stainless to own the SDK pipeline and signs KPMG’s 276k workforce. Coding agents are now boring infrastructure — and the second-order problems are arriving on schedule.
Anthropic acquires SDK-generation company Stainless. PyTorch Lightning hit by Shai-Hulud-family malware — AI training is now a supply-chain target. Mozilla rejects Chrome’s Prompt API push. Plus Bun’s six-day Rust rewrite, Red Hat’s no-EOL RHEL, and HN’s Claude-Code OpenClaw screenshots.
honker.dev squeezes durable queues, streams, pub/sub, and cron into a single SQLite file. Simon Willison ships datasette-llm-limits to turn LLM bills into a first-class governance object. CopyFail re-opens the disclosure-ethics debate, and Belgium and Rivian both walk back things the industry treated as settled.
LinkedIn fingerprints 6,278 browser extensions, PyTorch Lightning gets a Shai-Hulud supply-chain hit, Anthropic ties up $200M with the Gates Foundation, and Mozilla draws a line against Chrome’s Prompt API.
Weekend edition. Browser politics meet AI plumbing again — Mozilla files a hard ’no’ on Chrome’s Prompt API (the one that lets pages call into a browser-bundled LLM), 564 points on HN. Shai-Hulud-style supply chain attack lands in PyTorch Lightning; AI training pipelines are now in the same threat model as npm. Two Japanese-source items: VS Code ships Agent window for parallel coding agents, Node.js 26 enables Temporal by default. From the Chinese dev community: ‘Gemini got worse this week’ and ‘AI coding is more exhausting than the old way’ — both early signals that the cost side of the AI coding ledger is finally being talked about.
Mozilla draws a hard line on Chrome’s Prompt API, Mozilla itself uses Claude Mythos to fix 423 Firefox security bugs in a single month, LinkedIn is caught fingerprinting browser extensions on every request, Shai-Hulud lands in PyTorch Lightning, and Anthropic teams up with Blackstone, Hellman & Friedman, and Goldman to spin up an enterprise AI services company. Meanwhile V2EX is having a Claude-Code-fatigue moment.
Google quietly broke reCAPTCHA for de-googled Android, a viral ‘I went back to AWS’ postmortem hits 732 points, Bun’s Rust rewrite crosses 99.8% test compat, Timothy Gowers walks through using ChatGPT 5.5 Pro on real math, and the EU calls VPNs a loophole to be closed. Plus Simon Willison’s piece on the WebRTC voice-AI problem and a fresh io_uring zcrx LPE.
Google quietly broke reCAPTCHA for de-googled Android, a viral ‘I went back to AWS’ postmortem hits 732 points, Bun’s Rust rewrite crosses 99.8% test compat, Timothy Gowers walks through using ChatGPT 5.5 Pro on real math, and the EU calls VPNs a loophole to be closed. Plus Simon Willison’s piece on the WebRTC voice-AI problem and a fresh io_uring zcrx LPE.
Simon Willison breaks down what the xAI/Anthropic Colossus deal actually means, HN argues agents need control flow not more prompts, AI slop debate hits the front page again, Anthropic ships a finance-agents stack, Google DeepMind publishes AlphaEvolve impact, and Chrome quietly retracts its on-device AI privacy claim.
Cloudflare lets agents create accounts, buy domains, and deploy on their own; Anthropic raises Claude limits and signs a SpaceX compute deal; Valve open-sources Steam Controller CADs under CC; AWS Middle East UAE region still months from full recovery.
A telling Thursday on HN. Zed 1.0 lands with the day’s highest score (1319 pts, HN #2) — but the #1 slot belongs to a GitHub issue inside anthropics/claude-code: a config file called HERMES.md, an internal A/B experiment, double-charged a customer ~$200 and Anthropic refused the refund (836 pts). HN #13 ‘We need a federation of forges’ (488 pts) keeps yesterday’s Ghostty-leaving-GitHub thread burning. AI: Mistral Medium 3.5 ships remote agents (HN #24). Security double feature: Copy Fail / CVE-2026-31431 (HN #3) and Ramp’s Sheets AI exfiltrating financials via prompt injection (HN #9). Japan’s Zenn delivers two strong Claude Code field reports — LayerX’s ‘ccgate’ auto-approves 97% of permission prompts; Finatext warns against handing Google accounts to AI agents. China’s V2EX is consumed by Xiaomi’s MiMo Token Plan.
A loaded Wednesday. HN #1 is Mitchell Hashimoto pulling Ghostty off GitHub (1097 pts). Same day: Warp goes open-source (HN #4 + #18), and HN #25 — ‘GitHub Actions is the weakest link’ — closes the trifecta. CVE-2026-3854: Wiz publishes a GitHub RCE breakdown (HN #9). Business: Stratechery interviews Sam Altman and AWS CEO Matt Garman together — OpenAI models are coming to Amazon Bedrock (HN #3). Japan beat: TypeScript 7.0 Beta (10× faster, Go-rewritten compiler) and Google Cloud’s local-installable Spanner Omni preview. China beat: V2EX threads on Codex outpacing Claude Code in reputation, and an open-source multi-IM agent project openbee.
Three forces collide in a single 24-hour window: capital concentration (Google reportedly plans up to $40B into Anthropic), a loud quality backlash (a ‘why I cancelled Claude’ post tops HN with 695 points), and an open-weights counter-punch (DeepSeek v4 hits 1,757 points). GPT-5.5 also reaches the API. Plus: Matz’s Ruby AOT compiler, and a quiet note on overthinking.