Privacy

Today’s digest is about making AI development tools operational: faster training loops, better local inference, auditable agents, private protocol spaces, and release discipline for LLM tooling.

LinkedIn turns out to be probing browsers for 6,278 named extensions and shipping the result back encrypted on every request. Mozilla files a sharp ‘harmful’ standards position against Chrome’s Prompt API. A Shai-Hulud-themed npm/PyPI supply-chain campaign lands inside PyTorch Lightning. Docker GA’s an in-CLI AI agent (Gordon). .NET MAUI finally walks away from the Mono runtime. Belgium reverses its nuclear-decommissioning policy as data-center load forecasts blow past 2030 grid plans. Rivian ships a real ‘kill all telemetry’ switch. Armin Ronacher pushes back on AI-rewritten GitHub issues. Meta-theme: trust boundaries — between sites and your browser, between AI and your codebase, between AI-rewritten text and your bug tracker — are being redrawn in public this week.

Rivian documents a one-click switch that fully severs the vehicle from the internet. LinkedIn is found probing 6,278 browser extensions and shipping an encrypted fingerprint with every request. honker.dev packs durable queues, streams, pub/sub, and cron into a single SQLite file. A Shai-Hulud-themed malicious dependency lands inside PyTorch Lightning — the AI training supply chain just took a direct hit. V2EX has parallel threads on shaky Chinese token plans and engineers paying out of pocket to use Claude at work. Google ships Managed Agent API and Antigravity 2.0 as the post-I/O second wave. SpaceX’s S-1 reveals a $1.25B/month compute deal with Anthropic. Mozilla formally opposes Chrome’s built-in Prompt API. Today’s thread — the defaults for privacy, supply-chain trust, and compute economics are all being rewritten at once.

Rivian quietly ships a real off-switch for vehicle telemetry. The Shai-Hulud worm lands in PyTorch Lightning. Mozilla tells Chrome to slow down on the Prompt API. Simon Willison summarizes six months of LLM motion in five minutes. Anthropic buys Stainless. A 400-line shell script wants to be your coding agent. Today’s throughline is consolidation - of telemetry control, of supply chain attacks, and of the agent stack itself.

Claude Code is reportedly refusing requests or up-charging when commits mention ‘OpenClaw’ — 865 points on HN and counting. Shai-Hulud lands in PyTorch Lightning. Simon Willison digs into Anthropic’s Colossus-1 lease and the new ‘Elon can yank the compute’ supply-chain risk. Bun migrates from Zig to Rust in a week with Claude. Zed 1.0 ships. V2EX has the bug-reintroduction complaint we’ve all been thinking. Plus Rivian’s hard-off privacy switch, durable queues inside SQLite, and Daniel Lemire on beating binary search.

Google quietly broke reCAPTCHA for de-googled Android, a viral ‘I went back to AWS’ postmortem hits 732 points, Bun’s Rust rewrite crosses 99.8% test compat, Timothy Gowers walks through using ChatGPT 5.5 Pro on real math, and the EU calls VPNs a loophole to be closed. Plus Simon Willison’s piece on the WebRTC voice-AI problem and a fresh io_uring zcrx LPE.

Google quietly broke reCAPTCHA for de-googled Android, a viral ‘I went back to AWS’ postmortem hits 732 points, Bun’s Rust rewrite crosses 99.8% test compat, Timothy Gowers walks through using ChatGPT 5.5 Pro on real math, and the EU calls VPNs a loophole to be closed. Plus Simon Willison’s piece on the WebRTC voice-AI problem and a fresh io_uring zcrx LPE.

Simon Willison breaks down what the xAI/Anthropic Colossus deal actually means, HN argues agents need control flow not more prompts, AI slop debate hits the front page again, Anthropic ships a finance-agents stack, Google DeepMind publishes AlphaEvolve impact, and Chrome quietly retracts its on-device AI privacy claim.