Anthropic's unreleased Mythos model has reportedly found more than ten thousand vulnerabilities for its Project Glasswing partners — and showed up briefly inside Claude Code this weekend. The same weekend, a security researcher flagged what he calls the first real prompt-injection attack in the wild, riding the exact workflow we've all been adopting. Today's episode walks both sides of that coin, then turns to what builders are actually doing: a three-dollar refactor with a deadlock in it, the missing coordination layer for agent swarms, and the argument that the chat box is the command-line phase of agentic software.

• Mythos & Project Glasswing — a security model "too dangerous to release," and the case for and against that framing.
• A real prompt injection in the wild — a malicious GitHub issue, a scan.js, and secrets exfiltrated over DNS.
• The three-dollar refactor — cheap worker models, one confident deadlock, and where judgment still lives.
• The missing primitive is coordination — Lou Bichard of Ona on software factories, Stripe's Minions, and why GitHub isn't a coordination layer.
• Your agent is an infinite canvas — Rachel Lee Nabors on MCP apps, Web MCP, and chat as the command-line phase.
• r/programming reopens to AI — a seven-million-person community moves from a reflex ban to a written policy.

A Saturday episode about what your job becomes when the model writes the code — and writes it fast. The bottleneck moved from typing to deciding, and a surprising number of this week's stories land on the same instruction: stay the one who decides. Plus a price floor, a reclassification, a year of bold predictions, and a 4-year-old gaming card that won't quit.

• "I don't write code anymore" — Pieter Levels, amplified by Marc Andreessen, and the real-thing/bubble-thing tangle inside it.
• Fast Models Need Slow Developers — Sarah Chieng of Cerebras on Codex Spark at 1,200 tokens a second, and why the discipline matters more, not less.
• DeepSeek's permanent 75% cut and NVIDIA folding gaming into "Edge Computing" — two ends of the same pipe.
• Jack Clark's year of predictions at Oxford — and the cognitive-atrophy counterpoint.
• BeeLlama's DFlash update — 164 tokens a second on a single RTX 3090.
• Lobster Trap — Sally Ann O'Malley of Red Hat on containerizing an OpenClaw agent setup.
• How the rest of the world sees this — and a couple overheard in a Copenhagen park.

A corporate takedown answered with a recant letter and a mirror in Germany, the protocols and computers agents actually run on, six tools trying to build the Pantheon in code, and a paper where the model writes its own GPU kernel. Plus Codex learning to keep going, a security tool hardened against the real world, and a graduation room that cheered for human intelligence.

Google's I/O keynote is a day behind us, and the week it kicked off turned into a referendum on two very different bets on artificial general intelligence — plus a pile of counter-programming from everyone else. Today: OpenAI cracking an 80-year-old math problem with a general-purpose model, Anthropic's first profitable quarter and what Karpathy was actually hired to do, a 70-page paper on why frontier models still can't tell a fact from a labeled lie, Midjourney's hardware regret, ads arriving inside Google's AI answers, Meta's layoffs, Cohere's open-weights comeback, and a field guide to skilling up coding agents.

• Two bets on the same finish line — Google's world-model road vs OpenAI's text-reasoning road, in the labs' own words.
• OpenAI cracks an 80-year-old problem — the planar unit distance result from a general-purpose reasoning model.
• Anthropic in the black, and Karpathy's bet — ~$559M operating profit and a hire aimed at recursive self-improvement.
• Jagged intelligence, and the false story — the paper where models believe a story they were told a thousand times was fake.
• Midjourney's hardware regret — the tooling tax of betting on the less-supported accelerator.
• Ads come to AI Mode — the business model under the consumer bet.
• Meta's eight thousand — the cost side, on the same clock as the wins.
• Cohere comes back, Apache-licensed — Command A+, a mixture-of-experts model that fits on one or two GPUs.
• Skilling up the agent — Marc Klingen's concrete lessons on teaching a coding agent to wire up your tool.
• Who's training whom — the anxiety running underneath the week.

Google I/O 2026 landed yesterday — Gemini Omni, Gemini 3.5 Flash, Antigravity 2.0, Spark, and Demis Hassabis closing the keynote on the "foothills of the singularity." About forty minutes before he walked on stage, Andrej Karpathy tweeted that he'd joined Anthropic. The rest of the day was the labs sorting themselves around both events. Today's show works through the announcements, the pricing shifts, the keynote demo that boots Doom, the Railway outage that happened while Google was selling Spark, and a builder's 100K-line Rust postmortem that's a sharper picture of agentic coding than anything on the I/O stage.

• Hassabis: "foothills of the singularity" — DeepMind's CEO compresses his AGI timeline on stage
• Gemini 3.5 Flash specs and pricing — and what the 3x bump means
• Gemini Omni's physics pitch versus the same-day backflip test
• Antigravity 2.0's 93-agent OS demo: 12 hours, 2.6B tokens, under $1K, boots Doom
• Andrej Karpathy joins Anthropic — pre-training, on Nick Joseph's team
• Ethan Mollick: recursive self-improvement is a talent sink for the Big Three
• Qwen 3.7-Max and the Zhenwu M890 chip — Alibaba's full-stack I/O response
• DeepSeek hiring a Code Harness team in Beijing
• Railway's 8-hour outage after GCP's automated account suspension
• Cheng Huang: 130K lines of Rust, AI-written contracts, and a Paxos engine that runs
• TechCrunch on Anthropic's pre-training charter for Karpathy

A six-month overview from Simon Willison anchors the day: coding agents crossed from often-work to mostly-work in November, and laptop-class models started outrunning expectations. Then a fresh npm supply-chain attack — 637 malicious versions in 22 minutes — that for the first time specifically hijacks Claude Code and Codex agent hooks for persistence. Plus a Number 10 talk on replacing a one-and-a-half-million-pound law-firm contract with one embedded engineer, an editor-layer company renting xAI's Colossus 2, Ethan Mollick on insourcing, the full GenMedia pipeline running for a dollar a book, Daniel Griesser's pi-config skill repo, and two obituaries that hit the Unix world in the same week.

Monday's lineup: Modal publishes the full architecture behind a 40x reduction in serverless-GPU cold-start latency, Andon Labs releases the five-month results from letting four frontier models run real radio stations, and a researcher locates and turns off the political-censorship circuit inside Qwen 3.5 9B. Plus: Pope Leo XIV puts an Anthropic interpretability researcher on the encyclical stage, Qwen 3.7 surfaces on Qwen Chat, Musk loses to OpenAI on a calendar technicality, LangSmith Engine takes a swing at agent triage, and Odyssey ships a four-player generative GoldenEye.

A Sunday show about doing your own arithmetic. Mustafa Suleyman gives the white-collar tier eighteen months, in a piece whose own counter-data sits two paragraphs down. The State of Brand argues every AI subscription is a subsidized loss-leader two weeks away from a forcing function. William Angel runs the tokens-per-hour math on an M5 MacBook Pro and finds OpenRouter cheaper. Frederick Vanbrabant uses The Goal to explain why agents move the bottleneck rather than break it. Marlene Mhangami's Playwright talk shows the cleanest pattern for tests AI should write. Calif's public M5 / MIE exploit write-up lands. Artem Loenko explains why every chat UI keeps ending up on a browser engine. And Luke Lanchester's MCP hello page is the small fix I most enjoyed this week.

• Suleyman's eighteen-month claim, and the article that knocks it down
• The subsidy that ends on June 1
• Apple Silicon costs more than OpenRouter
• Frederick Vanbrabant on why AI doesn't speed up your process
• Marlene Mhangami: tests AI writes vs tests AI verifies
• Calif on the five-day M5 / MIE exploit, in their own words
• Artem Loenko: native all the way, until you need text
• Luke Lanchester's MCP hello page

An Australian CTF top-tenner writes the obituary for the open competitive scene. Intercom and PFF both report doubling-and-then-some engineering throughput from agent-first workflows — using opposite playbooks. Supabase ships a skill after watching an agent silently bypass row-level security. A suitcase runs a 4B model fully offline at conversational latency. Julia Evans leaves Tailwind. And Claude keeps telling people to go to sleep.

Five days for a small security team paired with Mythos Preview to land the first public macOS kernel exploit on Apple's M5 with Memory Integrity Enforcement turned on. Four months for Replit to claw back into the iOS App Store. In between: arXiv starts banning authors of LLM-error papers, Metabase explains why open-source security is being strip-mined this summer, NVIDIA squeezes the 5090, Uncle Bob switches from Claude to Codex, and a pure-OCaml protocol stack boots in low Earth orbit.

• Codex everywhere, Claude in the rearview — OpenAI ships Codex inside the ChatGPT mobile app, Uncle Bob cancels his Claude account, and Arvind Narayanan names the irony underneath both.
• Five days to a kernel exploit on M5 — Calif and Mythos Preview crack Apple's Memory Integrity Enforcement and hand-deliver the 55-page report to Cupertino.
• The strip-mining era of open source security — Metabase's security inbox went from ten reports a month to ten a week. Cal.com is going closed source.
• arXiv bans authors of LLM-error papers — Tom Dietterich announces a one-year submission ban on papers with hallucinated references or results.
• Replit out of the App Store wilderness — Four months after being pulled, Replit's iOS app is published again. Replies note what that says about platform power.
• GDDR7 squeezes the 5090 — A 300-dollar price hike to add-in-card partners as GDDR7 lead times stretch into weeks.
• The web's secret quirks file — Den Odell walks through Safari's Quirks.cpp and Firefox's about:compat. Chrome doesn't need a quirks file.
• OCaml in orbit — Thomas Gazagnaire's pure-OCaml protocol stack booted in low Earth orbit on April 23, with post-quantum rekeying and OxCaml-tuned dispatch.