Microsoft Build 2026 floods the feed: seven first-party AI models, MXC sandboxes for agents, WSL containers, and GNU coreutils ported to Windows. A 1-click VSCode bug let attackers steal GitHub tokens. Anthropic doubles down on partners and ships a year of cyber-threat data.
Cloudflare productizes its internal SRE stack as Flagship, taking dead aim at Datadog and PagerDuty. A clear-eyed essay on where pure next-token prediction stops working makes the front page. A different post argues the famous ’engineer who can say no’ was just a ZIRP-era artifact. V2EX is debating whether domestic Chinese code agents can actually replace Cursor, and whether Qwen3.7-Coder really beat GLM5.1. Publickey reports .NET MAUI is finally migrating from Mono to CoreCLR, and VS Code shipped an Agent window for multi-AI workflows. Wildcards: Anthropic publishes the first Glasswing consortium results, Google ships Gemini 3.5 Flash straight to GA, and xAI’s Grok Build enters beta with parallel sub-agents.
Weekend edition. Browser politics meet AI plumbing again — Mozilla files a hard ’no’ on Chrome’s Prompt API (the one that lets pages call into a browser-bundled LLM), 564 points on HN. Shai-Hulud-style supply chain attack lands in PyTorch Lightning; AI training pipelines are now in the same threat model as npm. Two Japanese-source items: VS Code ships Agent window for parallel coding agents, Node.js 26 enables Temporal by default. From the Chinese dev community: ‘Gemini got worse this week’ and ‘AI coding is more exhausting than the old way’ — both early signals that the cost side of the AI coding ledger is finally being talked about.
Three threads this morning. (1) The platform layer is paying down years of debt at once: VS Code 1.108 ships a preview ‘Agent window’ for running multiple coding agents side-by-side, the long-running Bun rewrite-in-Rust PR finally lands on main, Node.js 26 turns on Temporal by default, and Mojo 1.0 hits Beta. (2) Security and privacy are pushing back hard: HN’s #1 story (442 pts) is an owner physically removing the DCM and GPS from a 2024 RAV4 hybrid, #2 is a public stack-overflow PoC against Nginx, and the V2EX thread of the day is a manager discovering coworkers resold the company’s LLM gateway key. (3) Skills as an interface have a real day in the sun: obra/superpowers cracks the GitHub trending top 5, and a Zenn write-up of Claude Code vs Codex playing Othello with identical Skills (final: 56-8) is making the rounds.
VSCode auto-injects ‘Co-Authored-by: Copilot’ into commits whether or not you used Copilot (1500+ comments), VideoLAN’s dav2d ships an open AV2 decoder, NetHack 5.0 finally lands, Ladybird posts April progress, Ask.com shuts down, Russia Poisons Wikipedia.