News Digests

Key Highlights GitHub’s internal repos were exfiltrated through a poisoned VS Code extension. Microsoft confirmed a compromised employee device — via the malicious NX Console extension — pulled an estimated 3,800 internal repos. Theo (t3.gg) and security firm Aikido lay out the kill chain: a contributor’s GitHub token stolen in the earlier Shai-Hulud worm wave was used to publish a malicious version that auto-updated to ~2.2M installs in 18 minutes. The marketplace has no staging window, no audit gate, and no takedown push. This is now the second VS Code extension–driven supply chain breach in six months (after Async API in Nov 2025), and credentials harvested by that earlier worm are still being weaponized. The Trump White House paused its AI security executive order over the requirement that frontier labs share models with federal evaluators 14–90 days before launch. The order was triggered by Anthropic’s Mythos and OpenAI’s GPT-5.5 Cyber — both of which can autonomously find and exploit security flaws — but Trump said the pre-release review language “could have been a blocker” and that he doesn’t want anything in the way of “leading China.” Expect a softer redraft and a continued split between national-competitiveness framing and pre-deployment evaluation regimes. Two Day-After-I/O takes converged on the same thesis: Google has the platform but not the execution. The Rundown’s Pichai interview pitches agents as flip-phone-obvious within three years; Theo’s “I’m scared to make this video” walks through Gemini 3.5 Flash’s tripled per-token price, its 2× cost-to-completion vs. 3.1 Pro on real agentic tasks, the closure of the open-source Gemini CLI in favor of a closed Antigravity CLI, and Google Cloud abruptly suspending Railway’s $2M/month account. The pattern shared across both: capability gains are real, but distribution/trust is fraying. OpenAI says a general-purpose reasoning model disproved an 80-year-old Erdős conjecture on unit distances — a novel discrete-geometry result reviewed by Tim Gowers and Noga Alon. Notable because the work came from an upcoming general model, not a math-specialist system like AlphaProof. Sam Altman (with Patrick Collison) and Jensen Huang (with Michael Dell) gave essentially the same diagnosis in different words this week: coding models inflected hard in late 2025, demand has gone “parabolic,” and compute per task is up 100–1000× because agents now plan-act-iterate instead of one-shot replying. Altman thinks OpenAI can stay near-flat on headcount (2× over five years) while scaling output; Huang says Vera CPU + Rubin/Blackwell racks are the substrate for “unmetered intelligence” on-prem. Analysis & Opinion Trump delays AI security executive order, saying language “could have been a blocker” — TechCrunch Trump postponed signing an executive order that would have required AI labs to share advanced models with the Office of the National Cyber Director and partner agencies between 14 and 90 days before public launch. The order was prompted by recent releases from Anthropic (Mythos) and OpenAI (GPT-5.5 Cyber), both capable of rapidly identifying and exploiting security vulnerabilities — exactly the dual-use frontier the EO was meant to address. Trump’s stated reason: he doesn’t want anything “to get in the way” of US leadership over China. CNN reported the unofficial reason was scheduling — too few tech CEOs could fly in for the signing ceremony — but the substantive disagreement over pre-release review remains unresolved. The outcome will likely set the template for how the second Trump administration handles frontier-AI oversight: voluntary commitments and red-team reporting rather than statutory pre-deployment review. Watch for a redraft with the disclosure window stripped or relaxed to post-launch reporting. ...

Key Highlights The I/O 2026 dust settles into a single story: agents, not models. The Rundown’s day-after recap frames Google’s whole keynote as a “deploy Gemini as an agentic engine” play across Search, Workspace, and the new Spark personal agent — with Omni at 4× speed and roughly half the cost of competing video generators. NVIDIA quietly shipped the most interesting agent-safety primitive of the week. Its new Verified Agent Skills program treats agent capabilities like signed software packages — daily scans by a new “SkillSpector” tool, cryptographic signing, and skill cards documenting provenance — pushing trust down from runtime guardrails to the capability layer itself. Slack is positioning DMs as the agent-to-agent protocol. Stack Overflow’s podcast with Slack CPO Jaime DeLanghe argues the enterprise chat substrate already solves the hardest agent-interop problems (identity, context, audit) and that bots, not new APIs, will be how agents talk to each other. Pushback on “AI-generated” accusations is starting. A widely-shared Lobsters post — “LLemdashes” — flips the usual concern: dismissing real writers by emdash-spotting silences entry-level authors at exactly the moment AI tools are already suppressing their wages. Worth reading as a counterweight to the current detector arms race. Analysis & Opinion Gemini’s busy agentic day at Google I/O — The Rundown The Rundown’s day-after framing of I/O 2026 cuts through the firehose: Google’s central bet isn’t on a flagship model but on making Gemini “capable, fast, and affordable enough” to be the default agentic engine inside products people already use. Gemini Omni gets singled out for the price/performance combination — text/image/audio/video inputs to video output at 4× competitor speed and roughly half the cost. The redesigned Search (cross-modal input, 24/7 information agents, generative UI) is treated as the most consequential reveal because it’s the surface that touches the most users daily. ...

Key Highlights Google I/O 2026 was an all-agents show. Gemini 3.5 Flash launched at ~4× the speed of competing frontier models, Gemini Omni generates video from any combination of text/image/audio, Gemini Spark becomes a 24/7 cloud-resident personal agent across Gmail/Docs/Workspace, and Antigravity 2.0 + a new Managed Agents API let developers spin up sandboxed Linux environments through a single Gemini API call. AI-content provenance got a real industry handshake. OpenAI is adopting Google’s SynthID invisible watermark and C2PA Content Credentials; Google has now watermarked 100B+ images/videos and 60,000 years of audio, with verification rolling out to Search, Chrome, and Pixel cameras. Andrej Karpathy joined Anthropic’s pre-training team to use Claude to accelerate Claude’s own training — a clear bet that AI-assisted research, not raw compute, is the next moat. A California jury dismissed Musk’s $100B+ suit against OpenAI on statute-of-limitations grounds, not the merits; Musk is appealing and warning the ruling sets a “nonprofit-to-for-profit looting” precedent. Across two interviews this week he also predicted digital intelligence will exceed all human intelligence within ~5 years. Theo (t3.gg) ran a self-exposing 50-session attack on GitHub Copilot’s $40 plan, burning Microsoft an estimated $15–46K of inference using cryptography puzzles that kept GPT-5.4 running 16 hours per “message” — and used the demo to argue this is why every agentic coding tool has had to abandon message-based billing. Analysis & Opinion Musk’s OpenAI case runs out of time — Rundown Musk’s lawsuit alleging Altman and Brockman converted OpenAI from charity to ~$800B for-profit was thrown out as time-barred, not adjudicated on its core claim of unjust enrichment. OpenAI’s defense: Musk himself backed the for-profit pivot and only sued after launching xAI. Musk’s appeal argument, which he repeated at a Forbes dinner the next day, is that the precedent enables founders to “start a nonprofit, take charity money, then flip to for-profit once it’s successful” — a structural risk to American charitable giving, in his framing. ...

Key Highlights A viral X experiment by artist SHL0MS exposed reflexive anti-AI bias: thousands of users savaged what they thought was AI-generated “slop” — which turned out to be an authentic 1915 Monet. Aligns with prior Norwegian research showing people prefer AI art when blind but reject it once labeled. Addy Osmani warns that auto-generated AGENTS.md files (the default /init output) made coding agents slower, more expensive, and no more accurate — research from early 2026 found a 2–3% drop in task success and >20% cost increase versus human-authored context files. AI glasses are shipping in real volume: 8.7M units in 2025 (up 300% YoY) with 15M+ projected this year. South Korean optics startup LetinAR raised $18.5M to supply the lenses powering the Meta/Google/Apple rush. Analysis & Opinion AI anger comes for Claude (Monet) — Rundown Artist SHL0MS posted a Water Lilies-style image on X, claimed it was AI-generated, and asked critics to articulate exactly why it was inferior. Thousands of replies piled in to dismiss it as “emotionless” and “slop,” critiquing its depth, reflections, and composition. The reveal: it was a real Monet from 1915. The experiment dovetails with 2024 Norwegian research showing that blind viewers prefer AI art but flip to clear negative bias the moment “AI” is in the frame. The takeaway is uncomfortable for the creative community — anti-AI sentiment has become reflexive enough that the label alone now overrides perception, independent of the work’s actual provenance or quality. Expect more of this kind of credibility-flip stunt as the gap between perceived and actual AI-generated work narrows. ...

Key Highlights AI has collapsed the software-security disclosure model. Theo (t3.gg) argues that CopyFail (and its CopyFail2/Dirty Frag descendants), an unprivileged Linux LPE, a single-git push GitHub.com RCE found by Wiz, and 84 compromised Tanstack npm packages in a single week prove that frontier models can now read patch diffs, infer the vulnerability, and write the exploit before distros ship the fix — the 90-day embargo is effectively dead. Jeff Kaufman’s experiment of handing the CopyFail2 fix-diff to Gemini 31 Pro, GPT-5.5 Thinking and Claude Opus 4.7 (all three flagged it as a security patch from the diff alone) is the empirical kill-shot for “patch-to-exploit is hard.” OpenAI launches Daybreak. Buried in the same Theo segment: OpenAI announced Daybreak, a request-based vulnerability scanning service that runs your codebase through 5.5-cyber (a non-public hardened variant) to find issues “before they ship” — the first major lab move to put a frontier model behind a defender-only API to rebalance the cat-and-mouse asymmetry against attackers who already have open-weight options like Kimmy K26. El Niño 2026 is a measurable food-security event, not a forecast. All-In Podcast’s David Friedberg warns ocean temperatures running 4°C above normal hold ~11 million terawatt-hours of excess energy heading into the Northern-Hemisphere summer — putting Indian, Brazilian, Australian and Southeast Asian monsoon crops at risk and threatening caloric deficit for ~1.5 billion people who depend on those rains, with 150M Indian farmers on the front line. Benioff: “Not my first SaaSpocalypse.” The Salesforce CEO frames the AI-driven SaaS rerating as a market mood swing, not an existential one, while disclosing Salesforce expects to spend ~$300M/year on Anthropic tokens — a useful data point for how big “we use a frontier model” looks at hyperscaler-customer scale. A serious case for AlphaGo as the right scale to study reasoning. Eric Jang (ex-1x, ex-DeepMind Robotics) rebuilt AlphaGo from scratch on sabbatical and tells Dwarkesh Patel that the open question — how a 10-layer net amortises a search tree previously thought intractable — is the cleanest small-budget proxy for what LLM “thinking” actually is. Interviews & Conversations Everything is pwn’d now — Theo - t3.gg (34 min) Theo Browne argues that the past week of disclosures — CopyFail (a 732-byte Python script that root-escalates on every major Linux distro running kernel 6.x or 7.x), CopyFail2, Dirty Frag, a Slab-memory breakout, a Mythos-discovered curl bug, a Wiz-disclosed RCE on github.com via a single git push, and the 84-package Tanstack npm supply-chain compromise (with 121 additional compromised packages found across those names) — is not a bad news cycle but evidence that three assumptions underwriting open-source security have collapsed simultaneously: that only well-paid experts find exploits, that the 90-day embargo gives defenders a usable lead, and that going from a silent patch to a working exploit is hard. The empirical kill-shot is Jeff Kaufman’s test where Gemini 31 Pro, GPT-5.5 Thinking and Claude Opus 4.7 all flagged the CopyFail2 fix-commit as a security patch — two of three did so even with the commit message stripped — meaning any bot can now monitor kernel commits and produce working exploits in the window between merge and distro shipment. The proposed response is structural: a new “trusted actors” disclosure tier (paid certification for distro maintainers and large IT shops to receive embargoed details earlier), a rethink of open-source publishing that allows staged-private patch windows on platforms like GitHub, and at the personal level, treating every system as already compromised and reorienting backup strategy from “prevent leaks” to “survive ransomware-style destruction” — including offline air-gapped Synologys, drives mailed to family, and explicit safe-words to defeat voice-cloned social-engineering calls. The piece also flags OpenAI’s Daybreak announcement as the first frontier-lab move to put a defender-only model (5.5-cyber, non-public) behind a vulnerability-scanning API. Theo is open about the falsifier — if CVE volume drops sharply over the next month, this was just five years of lowhanging fruit found in three weeks — but notes that current trajectory points the other way. Pairs directly with the ArXiv enforcement story from yesterday’s digest: both are institutions trying to re-establish accountability in a world where frontier models removed the cost barrier to certain kinds of bad output. ...

Key Highlights AI-exposed job losses move from forecast to data. Bloomberg reports the U.S. is starting to see heavy losses concentrated in roles directly exposed to generative AI, with Menlo Ventures’ Deedy Das describing the SF outcome divide — ~10,000 founders/staff at OpenAI, Anthropic, and Nvidia past $20M net worth, while six-figure engineers face mass layoffs — as “the worst I’ve ever seen.” ArXiv begins banning sloppy AI authors. Papers with “incontrovertible evidence” of unchecked LLM output (hallucinated references, embedded chat exchanges) trigger a one-year ban, after which submissions must clear a peer-reviewed venue before reposting — a meaningful enforcement shift for the preprint server that currently functions as the de facto publication record for CS and ML. OpenAI consolidates products under Brockman. With Fidji Simo on medical leave, Greg Brockman formally takes product strategy and plans to merge ChatGPT, Codex, and the API into one platform — the latest “code red” move after Sora and OpenAI for Science were shuttered. Frontier AI quietly kills the open CTF format. Kabir Acharya argues that Claude Opus 4.5 and GPT-5.5 trivialize medium-hard CTF challenges, collapsing the human skill ladder; Plaid CTF and other prestige events have already shut down, and scoreboards now measure willingness to orchestrate frontier models rather than security expertise. Steering vectors get a second life on local models. Sean Goedecke flags that DwarfStar 4 (a stripped-down llama.cpp running only DeepSeek-V4-Flash) makes activation-level steering a first-class feature on a model good enough for low-end agentic coding — moving Anthropic’s “Golden Gate Claude” trick from research demo to local-dev practice. Analysis & Opinion US is starting to see heavy job losses in roles exposed to AI — Hacker News (AI) Bloomberg reports concrete employment damage now showing up in U.S. labor data for roles directly exposed to generative AI, validating earlier modeling work that had been dismissed as speculative. The HN thread (129 points, 178 comments) frames this as the inflection point where “AI will take jobs” stops being a forecast and starts being a measurable economic phenomenon. Commenters split between viewing it as a normal technology-cycle adjustment and arguing this round is structurally different because the displaced roles — knowledge work, junior dev, paralegal, mid-tier analyst — were previously considered the upskill destination, not the displaced category. The article lands alongside Deedy Das’s “haves and have-nots” piece (see below), reinforcing that the AI economic story is now a distributional one, not a productivity one. Policy implications — UBI, training credits, AI-displacement insurance — are still missing from the U.S. conversation in a way that European discourse, by contrast, has already started addressing. ...

Key Highlights Access to frontier AI is closing. Anton Leicht argues compute scarcity, security concerns, and U.S. government oversight will lock most users out of the most capable models — Anthropic’s Mythos and OpenAI’s Daybreak-gated gpt-5.5-cyber are early signals of a structural shift rather than one-offs. Anthropic’s June 15 monetization change reframes “programmatic” usage. Paid Claude plans will get a separate, smaller dedicated credit for Agent SDK / Claude-P usage, cutting effective rate limits by up to 40x for tools like T3 Code, Zed, OpenClaw, and any CI integration — a hard line that many developers are calling an attack on open-source harnesses built around Claude Code. Mobile coding agents go mainstream. OpenAI launched Codex Mobile in preview in the ChatGPT iOS app with a secure relay layer for live thread management, while Ramp data shows Anthropic has overtaken OpenAI in enterprise paid-user adoption (34.4% vs 32.3%) for the first time. Local-AI infrastructure keeps maturing. Osaurus (open-source macOS app) and whichLLM (hardware-aware local model selector) ship the same day Anthropic open-sources Claude for Legal — 14 practice-area plugins, scheduled agents, and 20+ MCP connectors — signaling a pivot from chat UIs toward harnesses and embedded workflows. Bun is being rewritten in Rust by agents in under a month. Jared Sumner reports 99.8% of Bun’s pre-existing test suite passes on Linux x64 in a Rust port that is already ~960k LOC — but with ~13,000 unsafe calls (vs ~73 in UV), raising concerns about whether AI-driven line-by-line ports trade known bugs for an unknown long tail. Analysis & Opinion Access to frontier AI will soon be limited by economic and security constraints — Hacker News AI Anton Leicht argues that broad API access to frontier models is structurally unsustainable. He identifies three compounding forces: compute economics (high marginal cost per query makes wide distribution loss-making), security and misuse concerns (model theft, distillation, and weaponization push labs toward gated access and stronger identity verification), and U.S. government involvement (export controls and national-security review of frontier deployments). He points to Anthropic’s restriction of Mythos to vetted cybersecurity firms and OpenAI’s selective Daybreak distribution of gpt-5.5-cyber as early structural moves rather than one-offs. The implication is that the assumption of “powerful AI for everyone” underlying much current policy discourse may be wrong within 12–24 months. ...

Key Highlights Anthropic’s lead over OpenAI in enterprise widens. Ramp’s latest AI Index puts Anthropic at 34.4% share of paid business users vs. OpenAI’s 32.3% — and shows Anthropic’s adoption up 4× since 2025 while OpenAI’s growth has plateaued. Much of the gap traces to Claude Code expanding beyond engineering into finance, legal, and research workflows. NVIDIA and David Silver bet on “superlearners.” A new strategic engineering partnership between NVIDIA and Ineffable Intelligence — the London lab founded by the AlphaGo architect — targets RL infrastructure for systems that “learn continuously from experience.” Silver: researchers have largely solved “the easier problem of AI… how to build systems that know all the things humans already know.” The next frontier is discovery. Video becomes searchable infrastructure. NVIDIA’s Metropolis VSS Blueprint v3 ships with a modular fusion-search architecture and agent-skill integration, letting coding agents like Claude Code and Codex deploy live-stream video analytics through chat prompts instead of manual microservice wiring. Quantum-materials science gets a 1,000× speedup. Researchers compressed XFEL data analysis from nine months to under four hours on 32 NVIDIA GB200 Grace Blackwell Superchips — a concrete demonstration of how accelerated computing collapses experimental cycle times in materials physics. Google Arts × Es Devlin launches a UK-wide AI portrait installation at the National Portrait Gallery, running through October 2026 — pairing Gemini Image with charcoal-and-chalk styling for a participatory live wall. Analysis & Opinion The enterprise shift OpenAI saw coming — Rundown Two months after OpenAI leadership flagged Anthropic’s enterprise momentum as a strategic threat, Ramp’s AI Index — drawn from corporate-card and invoice data across 50,000+ U.S. businesses — confirms the inflection. Anthropic’s paid-customer share climbed to 34.4% in April, overtaking OpenAI’s 32.3%, while overall AI usage across companies in the index reached 50.6%. The shift is attributed largely to Claude Code, which has moved Anthropic beyond technical buyers into finance, legal, and research workflows. The piece reads alongside yesterday’s TechCrunch report on the same data, but adds OpenAI’s internal awareness as historical context — the company saw it coming, but couldn’t reverse the trajectory. ...

Key Highlights Anthropic overtakes OpenAI in business adoption. Ramp’s monthly index of 50,000+ companies shows 34.4% pay Anthropic versus 32.3% OpenAI — a stunning swing from May 2025 when only 9% used Anthropic. Anthropic also opened a Claude for Legal expansion and warned investors that eight secondary platforms (Forge, Hiive, Sydecar, others) trafficking its shares are unauthorized; transfers won’t be honored. Google reframes Android as an “intelligence system.” I/O preview unveils Googlebook laptops (Android + ChromeOS fusion), agentic Gemini in Chrome on Android, a Magic Pointer feature, Rambler voice dictation in Gboard, and AirDrop-compatible Quick Share. Theo’s “Bun in Rust” deep-dive worries this same Anthropic-led shift is starting to “enshittify” Claude Code’s dependencies as Bun gets rewritten line-by-line in unsafe Rust. A new Medicare model is built for AI agents. ACCESS, launching July 5, pays providers for outcomes managing chronic conditions and explicitly compensates “an AI agent that monitors a patient between visits” — the first federal payment mechanism for autonomous care agents. Pair Team is one of 150 selected organizations. Mira Murati’s Thinking Machines Lab debuts “interaction models” — a dual-architecture system (200ms foreground loop + slower background reasoning) for real-time voice/video collaboration without turn-taking lag, framing human-centered design as a counterpoint to the agentic-first race. Jensen Huang boards Air Force One. A last-minute addition to Trump’s Beijing delegation, lifting NVIDIA shares and reopening speculation on whether export controls on H200-class chips get loosened — even as Chinese AI-component exports hit $31B in April alone. Analysis & Opinion Android enters its Gemini Intelligence era — Rundown Google’s pre-I/O drop is read as a structural pivot: AI moves from bolted-on feature to OS foundation across Googlebook hardware, Chrome’s agentic auto-browse, and on-device Gemini context. The piece argues this is the clearest sign yet that “Personal Intelligence” is being repositioned as Android’s organizing primitive, not just an app. ...

Key Highlights Cognitive debt vs. technical debt: A widely-shared essay (and Theo’s reaction) argues agentic coding is atrophying developer skills — Simon Willison and senior engineers report losing mental models of their own code, and juniors who learned with AI can’t debug without it. The split is widening between devs who use AI to learn faster and those who pull the slot machine until something works. Google DeepMind’s AI co-mathematician: A Gemini 3.1-based system hit 48% on FrontierMath Tier 4 — more than double the raw model’s 19% — using a coordinator + sub-agent architecture similar to Claude Code, with Oxford’s Marc Lackenby finding a viable proof strategy buried in a rejected output. Google Finance redesign lands in Europe: AI research, Deep Search, expanded crypto/commodities data, and live earnings-call transcripts with AI-highlighted annotations. Analysis & Opinion We all fell for it… — Theo - t3.gg (video, 57 min) Reacting to Lars Fay’s “Agentic coding is a trap,” Theo agrees that cognitive debt is now a real and quantifiable risk: devs who never built up the friction of debugging, learning fundamentals, and building systems are being handed orchestrator roles they aren’t ready for, and the slot-machine UX of coding agents lets them avoid the discomfort that produces actual skill. He concurs with Anthropic’s own “paradox of supervision” framing — effectively using Claude requires the very skills that atrophy from overusing it — and cites Reddit threads, a LinkedIn director of engineering banning AI for “tasks that require critical thinking,” and Simon Willison admitting he no longer has firm mental models of his own apps. Theo pushes back on two points: per-token cost (GPT-5.5 medium delivers GPT-5.4-high intelligence at <50% the price, so cost-per-IQ-point is dropping ~8× even as total spend rises) and the vendor lock-in framing (he calls it a competence failure — tools like T3 Code, Codex, Cursor and open-code make hopping models trivial). His sharpest take: AI should make the code that matters higher quality AND the code that didn’t used to be worth writing (one-off scripts, migrations, NAS asset shufflers) 10× more prolific — when those two modes get confused, everything falls apart. ...