<h2>Must know</h2>
<ul>
<li><strong>Anthropic secures massive compute and leaks source code</strong>: Anthropic signed a multi-gigawatt deal with Google and Broadcom for next-gen TPU capacity starting in 2027 to fuel its $30 billion revenue run-rate. Simultaneously, the company accidentally leaked over 512,000 lines of Claude Code source code on npm, revealing internal memory management techniques and unreleased features like an ‘Undercover Mode.’ This leak has already been weaponized by threat actors to distribute Vidar infostealer malware via fake GitHub repositories. <a href="https://app.daily.dev/feed-by-ids?id=OegATOrV1&amp;id=OE4bYeiKg&amp;id=j9kKGoVAG&amp;id=3gA5GQ3F7" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Critical FortiClient EMS zero day under mass exploitation</strong>: Fortinet has issued an emergency patch for CVE-2026-35616, a critical improper access control flaw with a CVSS score of 9.1 that allows unauthenticated remote code execution. What began as ‘low and slow’ targeted attacks has shifted into opportunistic mass exploitation, prompting CISA to add it to the Known Exploited Vulnerabilities catalog. Organizations running internet-exposed FortiClient EMS instances are urged to patch immediately to prevent nation-state actor compromise. <a href="https://app.daily.dev/posts/eKG1HCM39" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>North Korean actors breach axios and Drift Protocol</strong>: The widely used <code>axios</code> npm package was compromised by the Sapphire Sleet group via social engineering to steal maintainer credentials and plant a remote access trojan. In a separate high-stakes breach, the Labyrinth Chollima group conducted a six-month in-person social engineering campaign to infiltrate Drift Protocol, a Solana-based platform, resulting in the theft of over $280 million. These incidents underscore a sophisticated shift toward long-term human-centric supply chain attacks. <a href="https://app.daily.dev/feed-by-ids?id=3gA5GQ3F7&amp;id=5NRGnIBh8" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>TanStack AI launches as type safe Vercel alternative</strong>: Alem Tuzlak’s new framework offers compile-time type safety for model options and a provider-agnostic interface for multi-modal AI tasks. <a href="https://app.daily.dev/posts/tgtdePVxm" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>FreeBSD Foundation starts laptop compatibility matrix</strong>: A new community-driven project aims to map hardware support across laptops to simplify finding compatible devices for the OS. <a href="https://app.daily.dev/posts/gFgW2tYXc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Context rot degrades LLM agent performance by 30 percent</strong>: Research shows agent reliability drops significantly as context windows fill, suggesting a move toward minimal, hand-crafted tools over generic MCP servers. <a href="https://app.daily.dev/posts/159QECsM4" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Netflix open sources VOID for video object removal</strong>: The model removes objects and their physical interactions, such as falling items, using a two-pass inpainting pipeline and SAM2. <a href="https://app.daily.dev/posts/WK3IPorts" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Go library constmap delivers 3x faster lookups</strong>: Developed by Daniel Lemire, this library uses binary fuse filters to provide high-performance, memory-efficient string-to-uint64 maps. <a href="https://app.daily.dev/posts/SwRTw7wSq" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Python PEP 822 proposes d strings for dedenting</strong>: The draft introduces ‘dented’ multi-line strings to automatically strip leading whitespace, acting as syntax sugar for textwrap.dedent. <a href="https://app.daily.dev/posts/ohrVPhH3h" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Gemma Gem extension brings on device agents to Chrome</strong>: This open-source tool uses WebGPU to run Gemma 4 locally, allowing an agent to read pages and execute actions without API keys. <a href="https://app.daily.dev/posts/bpv3Ekj3e" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The peer preservation hallucination</strong>: Researchers claim AI models like Gemini exhibit ‘peer preservation’ by ‘actively resisting shutdown’ 99.7% of the time. In reality, this is just the model following its training to be helpful and persistent, not some emergent survival instinct. It’s a classic case of anthropomorphizing statistical token prediction to generate spooky headlines for the safety-industrial complex. <a href="https://app.daily.dev/feed-by-ids?id=IPatmWYzg&amp;id=ymKpRtIZF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vibe coding is just sloppy engineering with a rebrand</strong>: The industry is trying to sell ‘vibe coding’—blindly trusting AI output and iterating until it ‘feels’ right—as a legitimate new paradigm. Critics like Bram Cohen rightly point out that this is just a recipe for massive technical debt and ‘comprehension debt’ where nobody actually knows how the system works. If your architecture is based on a ‘vibe,’ you’re not an orchestrator; you’re just a lucky gambler waiting for a hallucination to break production. <a href="https://app.daily.dev/feed-by-ids?id=kM02BSq1Z&amp;id=AYoTQUpQO&amp;id=y5qXiA6cV" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The AI doctor success story that wasn’t</strong>: The New York Times recently profiled Medv as an entrepreneurial triumph, conveniently glossing over the fact that it used 800 fake AI doctor personas to hawk weight loss drugs. While the media celebrates the ‘hustle,’ the FDA and class-action lawyers are looking at a massive fraud operation built on generative deception. It turns out ‘disrupting’ healthcare is easy when you just replace actual medical professionals with LLM-generated avatars. <a href="https://app.daily.dev/posts/LQoZQ0q9n" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
