Today is about the infrastructure around developers: Cloudflare buying VoidZero, Claude Opus 4.8 leaning into long-running agent work, Simon Willison packaging safer agent editing and WASM sandboxes, plus practical signals from Azure Linux, vector search, and developer security.
Pyodide moved into a Service Worker runs full ASGI apps in the browser. OpenBSD ships a clean openrsync. AWS Interconnect goes free up to 500 Mbps cross-cloud. markitdown and VoxCPM2 dominate GitHub Trending.
AWS pushes Kiro into the browser, Docker ships Gordon. Vicki Boykis on why engineers should be more tired than the model. Simon Willison argues Anthropic and OpenAI have crossed product-market fit, with corroborating evidence from V2EX consumer bills.
Anthropic ships Opus 4.8 and closes a $65B Series H on the same day. DBOS argues Postgres is enough for durable workflows. SQLite quietly added an AGENTS.md for the agents pointed at it.
Anthropic acquires SDK-generation company Stainless. PyTorch Lightning hit by Shai-Hulud-family malware — AI training is now a supply-chain target. Mozilla rejects Chrome’s Prompt API push. Plus Bun’s six-day Rust rewrite, Red Hat’s no-EOL RHEL, and HN’s Claude-Code OpenClaw screenshots.
LinkedIn fingerprints 6,278 browser extensions, PyTorch Lightning gets a Shai-Hulud supply-chain hit, Anthropic ties up $200M with the Gates Foundation, and Mozilla draws a line against Chrome’s Prompt API.
Weekend edition. Browser politics meet AI plumbing again — Mozilla files a hard ’no’ on Chrome’s Prompt API (the one that lets pages call into a browser-bundled LLM), 564 points on HN. Shai-Hulud-style supply chain attack lands in PyTorch Lightning; AI training pipelines are now in the same threat model as npm. Two Japanese-source items: VS Code ships Agent window for parallel coding agents, Node.js 26 enables Temporal by default. From the Chinese dev community: ‘Gemini got worse this week’ and ‘AI coding is more exhausting than the old way’ — both early signals that the cost side of the AI coding ledger is finally being talked about.
Three threads this morning. (1) The platform layer is paying down years of debt at once: VS Code 1.108 ships a preview ‘Agent window’ for running multiple coding agents side-by-side, the long-running Bun rewrite-in-Rust PR finally lands on main, Node.js 26 turns on Temporal by default, and Mojo 1.0 hits Beta. (2) Security and privacy are pushing back hard: HN’s #1 story (442 pts) is an owner physically removing the DCM and GPS from a 2024 RAV4 hybrid, #2 is a public stack-overflow PoC against Nginx, and the V2EX thread of the day is a manager discovering coworkers resold the company’s LLM gateway key. (3) Skills as an interface have a real day in the sun: obra/superpowers cracks the GitHub trending top 5, and a Zenn write-up of Claude Code vs Codex playing Othello with identical Skills (final: 56-8) is making the rounds.
HN’s top three slots are all AI trust stories: Claude Code allegedly refusing or upcharging requests when commits mention ‘OpenClaw’ (865 pts); PyTorch Lightning hit by a Shai-Hulud-themed supply-chain attack (299 pts); Rivian shipping a real, vehicle-wide kill switch for cloud telemetry (331 pts). V2EX threads document a Gemini quality regression and a clean mihomo-via-Tailscale exit-node recipe. Publickey covers Node.js 26 enabling Temporal by default and Mojo reaching 1.0 Beta. Simon Willison ships a CSP allow-list iframe experiment and quotes Boris Mann’s deadpan: ‘11 AI agents’ is as meaningful as ‘11 browser tabs.’ On GitHub Trending, obra/superpowers — a packaging convention for Claude Code skills — keeps climbing.
LinkedIn probes 6,278 browser extensions and ships the encrypted result on every request — 299 points on HN. Mozilla files a formal ‘opposed’ on Chrome’s Prompt API push, opening the browser-AI standards war in earnest. Simon Willison reads GitLab’s Act 2 layoff post as the SaaS survival script for the agentic era. Zenn’s #1 today asks why some engineers viscerally hate software design principles. Publickey reports Claude Platform on AWS shipping GA. V2EX has parallel threads on the explosion of AI API resellers and on AI coding being more exhausting than writing it yourself. Plus CopyFail not getting disclosed to Gentoo, a 400-line shell coding-agent harness, and a Game Boy emulator in F#.
LinkedIn probes 6,278 browser extensions and ships the encrypted result on every request — 299 points on HN. Mozilla files a formal ‘opposed’ on Chrome’s Prompt API push, opening the browser-AI standards war in earnest. Simon Willison reads GitLab’s Act 2 layoff post as the SaaS survival script for the agentic era. Zenn’s #1 today asks why some engineers viscerally hate software design principles. Publickey reports Claude Platform on AWS shipping GA. V2EX has parallel threads on the explosion of AI API resellers and on AI coding being more exhausting than writing it yourself. Plus CopyFail not getting disclosed to Gentoo, a 400-line shell coding-agent harness, and a Game Boy emulator in F#.
Claude Code is reportedly refusing requests or up-charging when commits mention ‘OpenClaw’ — 865 points on HN and counting. Shai-Hulud lands in PyTorch Lightning. Simon Willison digs into Anthropic’s Colossus-1 lease and the new ‘Elon can yank the compute’ supply-chain risk. Bun migrates from Zig to Rust in a week with Claude. Zed 1.0 ships. V2EX has the bug-reintroduction complaint we’ve all been thinking. Plus Rivian’s hard-off privacy switch, durable queues inside SQLite, and Daniel Lemire on beating binary search.
Mozilla draws a hard line on Chrome’s Prompt API, Mozilla itself uses Claude Mythos to fix 423 Firefox security bugs in a single month, LinkedIn is caught fingerprinting browser extensions on every request, Shai-Hulud lands in PyTorch Lightning, and Anthropic teams up with Blackstone, Hellman & Friedman, and Goldman to spin up an enterprise AI services company. Meanwhile V2EX is having a Claude-Code-fatigue moment.
Louis Rossmann picks up the legal tab for the OrcaSlicer dev Bambu Lab is suing, NYT documents how Meta’s AI push is grinding employees down, Debian commits to reproducible packages as a release requirement, Zed ships a theme builder, a fresh FreeBSD execve LPE drops, and Simon Willison highlights Andrew Quinn’s case for reinventing four wheels — but not a thousand.
Louis Rossmann picks up the legal tab for the OrcaSlicer dev Bambu Lab is suing, NYT documents how Meta’s AI push is grinding employees down, Debian commits to reproducible packages as a release requirement, Zed ships a theme builder, a fresh FreeBSD execve LPE drops, and Simon Willison highlights Andrew Quinn’s case for reinventing four wheels — but not a thousand.
Google quietly broke reCAPTCHA for de-googled Android, a viral ‘I went back to AWS’ postmortem hits 732 points, Bun’s Rust rewrite crosses 99.8% test compat, Timothy Gowers walks through using ChatGPT 5.5 Pro on real math, and the EU calls VPNs a loophole to be closed. Plus Simon Willison’s piece on the WebRTC voice-AI problem and a fresh io_uring zcrx LPE.
Google quietly broke reCAPTCHA for de-googled Android, a viral ‘I went back to AWS’ postmortem hits 732 points, Bun’s Rust rewrite crosses 99.8% test compat, Timothy Gowers walks through using ChatGPT 5.5 Pro on real math, and the EU calls VPNs a loophole to be closed. Plus Simon Willison’s piece on the WebRTC voice-AI problem and a fresh io_uring zcrx LPE.
Simon Willison breaks down what the xAI/Anthropic Colossus deal actually means, HN argues agents need control flow not more prompts, AI slop debate hits the front page again, Anthropic ships a finance-agents stack, Google DeepMind publishes AlphaEvolve impact, and Chrome quietly retracts its on-device AI privacy claim.
Simon Willison admits vibe coding and agentic engineering are collapsing into one thing, Anthropic ships Claude Opus 4.7, DeepSeek V4 Pro is 75% off through May 31, AWS’s Middle East UAE region needs months more to recover, and TypeScript 7.0 Beta lands with the Go-rewritten compiler.