CURRENT

Happy Friday: over 170 npm packages are actively compromised in the Shai-Hulud campaign, collectively pulling 200 million downloads per week. Three malicious node-ipc versions dropped yesterday. The payloads steal credentials silently from dev machines and CI/CD pipelines. And the genuinely nasty part: the worm monitors for token revocation and wipes your machine when you try to remediate. The attacker built a booby trap into your incident response playbook. TanStack's compromise happened in a six-minute window, with 2FA enabled, passing every provenance check the industry has built.

The original "Attention Is All You Need" paper was published in June 2017 with eight authors. Six eventually left Google. The architecture they described still powers nearly every major AI system running today, which makes it arguably the most influential and least appreciated piece of computer science in a generation.

A year ago, running a 70B model locally was ambitious. The numbers people are hitting on consumer hardware would have seemed absurd twelve months back.
The phrase "AI agent" meant something very specific in computer science for decades. In 2026, it means whatever the company launching one needs it to mean.
Every major workspace and app platform is racing to become an agent orchestration layer. The workspace wars just acquired a new dimension.

Nine years into the transformer era, the ground may be shifting underneath it.

A year ago, running a 70B model locally was ambitious. The numbers people are hitting on consumer hardware would have seemed absurd twelve months back.
The phrase "AI agent" meant something very specific in computer science for decades. In 2026, it means whatever the company launching one needs it to mean.
Every major workspace and app platform is racing to become an agent orchestration layer. The workspace wars just acquired a new dimension.

Nine years into the transformer era, the ground may be shifting underneath it.

Google researchers reportedly released a new architecture tackling catastrophic forgetting and memory degradation in transformers. Being called "Attention Is All You Need V2." No paper link has surfaced. The AI community is buzzing anyway, because of course it is.

Redis creator antirez shipped DS4, a handcrafted C inference engine running DeepSeek V4 Flash at 26 tokens/sec on an M3 Max. Asymmetric quantization, NVMe as a KV cache extension. Built, he says, with "strong assistance from GPT 5.5."

Incognito Chat with Meta AI on WhatsApp promises zero logs and total privacy. Launched five days after Meta quietly killed end-to-end encryption on Instagram DMs. The EFF called that move "a broken promise." Community trust is approximately zero.

New developer platform connects external AI agents like Claude Code, Cursor, and Codex directly into Notion workspaces. Users chat with agents, assign tasks, track progress. A million custom agents built since February suggests the workspace-as-orchestration-layer play has already arrived.

Apple is reportedly working on letting autonomous AI agents into the App Store. Agents that make purchases, book services, and navigate apps on your behalf. Expect Apple's signature privacy guardrails. The shift from apps-you-tap to agents-that-act is getting concrete.

whichllm auto-detects your GPU, CPU, RAM, and disk, then ranks HuggingFace models that actually fit your system. Scores on benchmarks, quantization penalty, speed, and source trust. A useful companion for anyone going local with their inference stack.

A fresh class-action complaint landed in the Southern District of California targeting OpenAI over ChatGPT. Details are thin so far, but the legal pile keeps growing. OpenAI's courtroom calendar might genuinely need its own project manager at this point.

Record quarterly revenue of $15.8 billion. Four thousand jobs gone anyway. The money's flowing to AI infrastructure: $5.3B in orders from hyperscalers this fiscal year, projected $9B by year end. Stock jumped 17%. LinkedIn reportedly planning similar cuts.

Microsoft started removing Copilot features from Windows apps after users pushed back hard against AI crammed into every corner of the OS. Turns out people don't want unsolicited AI suggestions in their calculator. A rare corporate retreat.

Threat actors encoded prompt injections in Morse code to slip past detection filters, then aimed them at AI agents managing cryptocurrency wallets. Drained roughly $200K before anyone noticed. Creative enough to be almost admirable. The implications for agent security are less charming.

PraisonAI's legacy Flask server hard-codes AUTH_ENABLED = False. Anyone who can reach it triggers agent workflows without a token. CVSS 7.3. The "ship fast, skip security basics" era of AI tooling continues without interruption.

The UK replaced a Palantir system used for its Homes for Ukraine refugee matching with one built by its own team. More flexible, higher security standards, millions saved. A former government tech advisor called it "an important step toward sovereign technology."

Security researcher physically removed the data modem and GPS from a 2024 RAV4 Hybrid to kill telemetry. Everything still works. Warranty intact thanks to Magnuson-Moss Act. The catch nobody expected: CarPlay and Android Auto still capture vehicle data anyway.

Day one of Pwn2Own Berlin 2026: researchers collected $523,000 after exploiting 24 unique zero-day vulnerabilities. Just day one. The annual reminder that everything you rely on has holes someone already knows about.

Someone built a web project that wraps Wikipedia in a full Windows XP desktop interface. Draggable windows, start menu, taskbar, the whole thing. Completely unnecessary and completely wonderful. Go waste ten minutes.

Friday, May 15

Friday, May 15

The npm Worm That Punishes You for Fighting Back

The npm Worm That Punishes You for Fighting Back