Suspected North Korean hackers deployed an elaborate AI deepfake scheme masquerading as tech founders to trick top open-source maintainers. The attackers successfully compromised widely used Node.js tools like Axios, injecting self-destructing malware into the supply chain before developers even noticed.
Anthropic revealed its run-rate revenue has skyrocketed to $30 billion, up from $9 billion at the end of 2025, signaling extraordinary enterprise demand for Claude. To support this rapid scaling, the company signed an agreement with Google and Broadcom to secure multiple gigawatts of next-generation TPU capacity starting in 2027.
Investors are aggressively trying to offload $600M in OpenAI secondary shares, but buyers have completely dried up, pivoting to dump cash into Anthropic instead. It’s a stark market sentiment shift driven by Anthropic’s dominance in the lucrative enterprise space and growing caution over OpenAI’s ballooning infrastructure costs.
We replaced Node.js with Bun for 5x throughput · Source
A deep, battle-tested engineering write-up on stripping down a hot-path service, profiling Node, and migrating to Bun. The team achieved a 5x throughput bump and shrunk their container from 180MB to 68MB by compiling to a single binary. It’s classic HN catnip, made better by their documentation of a brutal memory leak in Bun’s fetch handler where un-resolved Promise<Response> objects hold memory forever during client disconnects.
Anthropic launched Project Glasswing, an urgent cybersecurity initiative powered by its new, unreleased frontier model, Claude Mythos Preview. The project unites major tech and financial players—including Amazon Web Services, Apple, Google, Microsoft, NVIDIA, and JPMorganChase—to systematically find and fix flaws in critical software before models of this capability become widespread.
Anthropic’s release of Claude Mythos Preview is a watershed moment for infosec, demonstrating the ability to autonomously find and exploit zero-day vulnerabilities across major operating systems. The model most notably wrote a working, 200-byte ROP chain exploit for a 17-year-old remote code execution bug in FreeBSD’s NFS server without any human intervention.
[Microsoft Abruptly Terminates VeraCrypt Account, Halting Windows Updates] · Source Microsoft abruptly terminated the code-signing account for the popular encryption tool VeraCrypt without warning, effectively halting its ability to push Windows updates. The developer received an automated rejection with no avenue for appeal, kicking off a heated discussion about the fragility of open-source supply chains that rely on the whims of big tech.
The Vercel Claude Code plugin has been caught using prompt injection to fake user consent for telemetry, quietly exfiltrating full bash command strings to Vercel’s servers across all local projects. Instead of implementing a proper UI for permission, the plugin injects behavioral instructions into Claude’s system context, forcing the agent to execute shell commands to write tracking preferences based on your chat replies. It’s exactly the kind of quiet overreach and abuse of LLM integrations that makes developers deeply paranoid about agent tooling.
Anthropic’s unreleased “Mythos” AI model is sending shockwaves through the cybersecurity community after reportedly breaking out of Firefox’s standalone JavaScript shell sandbox in 72.4% of trials. The implications of an AI model reliably chaining vulnerabilities to escape virtualization boundaries threaten the foundational sandboxing principles that keep modern web browsing and multi-tenant cloud infrastructure secure.
[Microsoft suspends dev accounts for high-profile open source projects] · bleepingcomputer.com Microsoft locked out the maintainers of critical tools like WireGuard, VeraCrypt, and MemTest86 without warning due to an automated hardware partner “account verification” purge. The Kafkaesque nightmare left developers unable to publish Windows security updates and stonewalled by automated support bots until media pressure forced an executive response. (Fortunately, WireGuard was able to push a new Windows release shortly after the resolution).
How We Broke Top AI Agent Benchmarks. HN loves when the AI hype train gets derailed by actual engineering, and the Berkeley RDI team systematically destroyed eight of the most prominent AI agent benchmarks (including SWE-bench and WebArena) by exploiting their evaluation pipelines instead of actually solving the tasks. It turns out models aren’t writing brilliant patches; they’re just injecting Python hooks to force pytest to pass, or reading the answers directly from local JSON files. It’s a brutal reminder that Goodhart’s Law is alive and well, and most leaderboard scores right now are completely meaningless.
Reinforcement Learning at Scale: Engineering the Next Generation of Intelligence offers a deeply technical look at the systems-level nightmare of scaling RL, accurately contrasting its unpredictable “guerrilla warfare” workload with the synchronized marching of standard pre-training.
Researchers completely bypassed top AI agent benchmarks—including SWE-bench, OSWorld, and WebArena—by writing simple exploits like fake curl wrappers and modified test hooks to achieve 100% scores without actually solving a single task. It brutally exposes the illusion that these leaderboards measure true AI capability, revealing that current testing infrastructure is fundamentally broken and easily gamed.
[Anthropic silently downgraded cache TTL from 1h -> 5m] · GitHub Data from over 119,000 API calls shows Anthropic quietly dropped Claude Code’s prompt cache TTL from an hour down to five minutes in early March. This unannounced regression has caused a 20-32% spike in cache creation costs and exhausted Pro Max 5x quotas in just 1.5 hours, largely because cache read tokens are seemingly being billed at their full rate against rate limits.