Anthropic acquires SDK-generation company Stainless. PyTorch Lightning hit by Shai-Hulud-family malware — AI training is now a supply-chain target. Mozilla rejects Chrome’s Prompt API push. Plus Bun’s six-day Rust rewrite, Red Hat’s no-EOL RHEL, and HN’s Claude-Code OpenClaw screenshots.
Weekend edition. Browser politics meet AI plumbing again — Mozilla files a hard ’no’ on Chrome’s Prompt API (the one that lets pages call into a browser-bundled LLM), 564 points on HN. Shai-Hulud-style supply chain attack lands in PyTorch Lightning; AI training pipelines are now in the same threat model as npm. Two Japanese-source items: VS Code ships Agent window for parallel coding agents, Node.js 26 enables Temporal by default. From the Chinese dev community: ‘Gemini got worse this week’ and ‘AI coding is more exhausting than the old way’ — both early signals that the cost side of the AI coding ledger is finally being talked about.
Three threads this morning. (1) The platform layer is paying down years of debt at once: VS Code 1.108 ships a preview ‘Agent window’ for running multiple coding agents side-by-side, the long-running Bun rewrite-in-Rust PR finally lands on main, Node.js 26 turns on Temporal by default, and Mojo 1.0 hits Beta. (2) Security and privacy are pushing back hard: HN’s #1 story (442 pts) is an owner physically removing the DCM and GPS from a 2024 RAV4 hybrid, #2 is a public stack-overflow PoC against Nginx, and the V2EX thread of the day is a manager discovering coworkers resold the company’s LLM gateway key. (3) Skills as an interface have a real day in the sun: obra/superpowers cracks the GitHub trending top 5, and a Zenn write-up of Claude Code vs Codex playing Othello with identical Skills (final: 56-8) is making the rounds.
Google quietly broke reCAPTCHA for de-googled Android, a viral ‘I went back to AWS’ postmortem hits 732 points, Bun’s Rust rewrite crosses 99.8% test compat, Timothy Gowers walks through using ChatGPT 5.5 Pro on real math, and the EU calls VPNs a loophole to be closed. Plus Simon Willison’s piece on the WebRTC voice-AI problem and a fresh io_uring zcrx LPE.
Google quietly broke reCAPTCHA for de-googled Android, a viral ‘I went back to AWS’ postmortem hits 732 points, Bun’s Rust rewrite crosses 99.8% test compat, Timothy Gowers walks through using ChatGPT 5.5 Pro on real math, and the EU calls VPNs a loophole to be closed. Plus Simon Willison’s piece on the WebRTC voice-AI problem and a fresh io_uring zcrx LPE.
GameStop bids $55.5B for eBay, Microsoft Edge keeps all passwords in process memory in plain text, an ‘I’m worried about Bun’ post lands the same week as the Zig→Rust commit, OpenAI walks through low-latency voice infra, GitHub has another incident, and the EU mandates removable phone batteries from 2027.