Supply-Chain

LinkedIn turns out to be probing browsers for 6,278 named extensions and shipping the result back encrypted on every request. Mozilla files a sharp ‘harmful’ standards position against Chrome’s Prompt API. A Shai-Hulud-themed npm/PyPI supply-chain campaign lands inside PyTorch Lightning. Docker GA’s an in-CLI AI agent (Gordon). .NET MAUI finally walks away from the Mono runtime. Belgium reverses its nuclear-decommissioning policy as data-center load forecasts blow past 2030 grid plans. Rivian ships a real ‘kill all telemetry’ switch. Armin Ronacher pushes back on AI-rewritten GitHub issues. Meta-theme: trust boundaries — between sites and your browser, between AI and your codebase, between AI-rewritten text and your bug tracker — are being redrawn in public this week.

Rivian documents a one-click switch that fully severs the vehicle from the internet. LinkedIn is found probing 6,278 browser extensions and shipping an encrypted fingerprint with every request. honker.dev packs durable queues, streams, pub/sub, and cron into a single SQLite file. A Shai-Hulud-themed malicious dependency lands inside PyTorch Lightning — the AI training supply chain just took a direct hit. V2EX has parallel threads on shaky Chinese token plans and engineers paying out of pocket to use Claude at work. Google ships Managed Agent API and Antigravity 2.0 as the post-I/O second wave. SpaceX’s S-1 reveals a $1.25B/month compute deal with Anthropic. Mozilla formally opposes Chrome’s built-in Prompt API. Today’s thread — the defaults for privacy, supply-chain trust, and compute economics are all being rewritten at once.

HBM eats into consumer memory wafers — cheap smartphones are about to get pricier. Opus 4.7 can reconstruct your real identity from writing style alone. Daniel Lemire shows how to beat binary search on modern CPUs. Zenn trending is dominated by Claude token-saving tactics and Vibe-Coding supply-chain attacks. Anthropic publishes Project Glasswing’s first six-month report. cPanel has an actively exploited bug. Today’s thread — AI is forcing a recalibration of every yardstick we use, from price tags to privacy defaults to engineering KPIs.

Rivian quietly ships a real off-switch for vehicle telemetry. The Shai-Hulud worm lands in PyTorch Lightning. Mozilla tells Chrome to slow down on the Prompt API. Simon Willison summarizes six months of LLM motion in five minutes. Anthropic buys Stainless. A 400-line shell script wants to be your coding agent. Today’s throughline is consolidation - of telemetry control, of supply chain attacks, and of the agent stack itself.

Simon Willison compresses six months of LLM history into a five-minute PyCon talk; a Shai-Hulud-style supply chain attack lands inside PyTorch Lightning; Mozilla formally opposes Chrome’s Prompt API; Anthropic absorbs Stainless to own the SDK pipeline and signs KPMG’s 276k workforce. Coding agents are now boring infrastructure — and the second-order problems are arriving on schedule.

Anthropic acquires SDK-generation company Stainless. PyTorch Lightning hit by Shai-Hulud-family malware — AI training is now a supply-chain target. Mozilla rejects Chrome’s Prompt API push. Plus Bun’s six-day Rust rewrite, Red Hat’s no-EOL RHEL, and HN’s Claude-Code OpenClaw screenshots.

honker.dev squeezes durable queues, streams, pub/sub, and cron into a single SQLite file. Simon Willison ships datasette-llm-limits to turn LLM bills into a first-class governance object. CopyFail re-opens the disclosure-ethics debate, and Belgium and Rivian both walk back things the industry treated as settled.

HN’s top three slots are all AI trust stories: Claude Code allegedly refusing or upcharging requests when commits mention ‘OpenClaw’ (865 pts); PyTorch Lightning hit by a Shai-Hulud-themed supply-chain attack (299 pts); Rivian shipping a real, vehicle-wide kill switch for cloud telemetry (331 pts). V2EX threads document a Gemini quality regression and a clean mihomo-via-Tailscale exit-node recipe. Publickey covers Node.js 26 enabling Temporal by default and Mojo reaching 1.0 Beta. Simon Willison ships a CSP allow-list iframe experiment and quotes Boris Mann’s deadpan: ‘11 AI agents’ is as meaningful as ‘11 browser tabs.’ On GitHub Trending, obra/superpowers — a packaging convention for Claude Code skills — keeps climbing.

LinkedIn probes 6,278 browser extensions and ships the encrypted result on every request — 299 points on HN. Mozilla files a formal ‘opposed’ on Chrome’s Prompt API push, opening the browser-AI standards war in earnest. Simon Willison reads GitLab’s Act 2 layoff post as the SaaS survival script for the agentic era. Zenn’s #1 today asks why some engineers viscerally hate software design principles. Publickey reports Claude Platform on AWS shipping GA. V2EX has parallel threads on the explosion of AI API resellers and on AI coding being more exhausting than writing it yourself. Plus CopyFail not getting disclosed to Gentoo, a 400-line shell coding-agent harness, and a Game Boy emulator in F#.

LinkedIn probes 6,278 browser extensions and ships the encrypted result on every request — 299 points on HN. Mozilla files a formal ‘opposed’ on Chrome’s Prompt API push, opening the browser-AI standards war in earnest. Simon Willison reads GitLab’s Act 2 layoff post as the SaaS survival script for the agentic era. Zenn’s #1 today asks why some engineers viscerally hate software design principles. Publickey reports Claude Platform on AWS shipping GA. V2EX has parallel threads on the explosion of AI API resellers and on AI coding being more exhausting than writing it yourself. Plus CopyFail not getting disclosed to Gentoo, a 400-line shell coding-agent harness, and a Game Boy emulator in F#.

Claude Code is reportedly refusing requests or up-charging when commits mention ‘OpenClaw’ — 865 points on HN and counting. Shai-Hulud lands in PyTorch Lightning. Simon Willison digs into Anthropic’s Colossus-1 lease and the new ‘Elon can yank the compute’ supply-chain risk. Bun migrates from Zig to Rust in a week with Claude. Zed 1.0 ships. V2EX has the bug-reintroduction complaint we’ve all been thinking. Plus Rivian’s hard-off privacy switch, durable queues inside SQLite, and Daniel Lemire on beating binary search.

Mozilla draws a hard line on Chrome’s Prompt API, Mozilla itself uses Claude Mythos to fix 423 Firefox security bugs in a single month, LinkedIn is caught fingerprinting browser extensions on every request, Shai-Hulud lands in PyTorch Lightning, and Anthropic teams up with Blackstone, Hellman & Friedman, and Goldman to spin up an enterprise AI services company. Meanwhile V2EX is having a Claude-Code-fatigue moment.