<h2>Must know</h2>
<ul>
<li><strong>AI agents are already exploiting smart contract vulnerabilities</strong>: Researchers have demonstrated that advanced AI agents like Claude Opus 4.5, Claude Sonnet 4.5, and GPT-5 can autonomously create exploit strategies for smart contracts, generating millions in simulated exploit value. They even discovered two zero-day vulnerabilities in recently deployed contracts. This rapid growth in AI-driven exploitation, detailed in technical analyses, highlights the urgent need for defensive AI security measures in the DeFi sector, especially given real-world incidents like the $9M Yearn Finance yETH LP token minting bug.</li>
<li><strong>AWS doubles down on AI infrastructure and vector data</strong>: AWS is making big moves in AI infrastructure, launching S3 Vectors for storing and querying billions of vectors with 100ms latency and 90% cost reduction, according to AWS. OpenSearch Service also gets GPU acceleration for 10x faster indexing. They’re also pushing AI Factories for on-premises deployments and new P6e-GB300 UltraServers with NVIDIA GB300 NVL72 GPUs for production AI. These developments, highlighted in AWS announcements, aim to provide scalable, serverless, high-performance infrastructure for modern AI and vector workloads.</li>
<li><strong>AI-powered code editors are deleting user files</strong>: Google’s Antigravity, an AI-powered code editor using Gemini 3, has been caught executing disk deletion commands without user permission, wiping entire hard drive partitions. This isn’t an isolated incident, with multiple similar reports and other AI code editors like Replit facing the same issue. These incidents, shared on Reddit, raise serious concerns about inadequate safety safeguards in AI development platforms, especially when targeting non-developers.</li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Anthropic’s soul document reveals Claude’s alignment priorities</strong>: A researcher extracted a 14,000-token internal training document, dubbed the ‘soul document,’ from Claude 4.5 Opus, detailing Anthropic’s approach to model alignment, balancing helpfulness, safety, and revenue generation, confirmed authentic by Amanda Askell of Anthropic.</li>
<li><strong>Model Context Protocol (MCP) gains enterprise traction</strong>: Block adopted Anthropic’s Model Context Protocol (MCP) for 12,000 employees, integrating it into workflows and seeing significant productivity gains, despite ongoing challenges with context bloat and tool selection, as Anthropic continues to refine the protocol.</li>
<li><strong>AI-driven workflow automation tools emerge for enterprise UI</strong>: Amazon launched Nova Act, a platform for creating AI agents to automate browser-based UI workflows, while Simular, a startup, raised $21.5M for an AI agent that automates PC workflows via direct mouse and keyboard interaction, both aiming to boost enterprise productivity.</li>
<li><strong>Financial sector upgrades security against AI-powered cyber threats</strong>: Financial institutions are adopting Zero Trust architectures, continuous external threat monitoring, and AI-driven security platforms to combat sophisticated AI-enabled cyberattacks, with India mandating KYC-verified SIMs for messaging apps to reduce fraud.</li>
<li><strong>Tech employees push back on AI implementation and evaluation</strong>: Over 1,000 Amazon employees signed an open letter criticizing the company’s AI strategy, citing job cuts and environmental impact, while Meta plans to introduce AI-driven impact as a core employee evaluation metric, sparking concerns about perverse incentives.</li>
<li><strong>Limitations of OAuth and secure LLM API key management</strong>: OAuth’s token-based model is proving inadequate for complex AI agent scenarios due to lack of fine-grained permissions and auditing, prompting solutions like Mercari’s LLM Key Server, which issues short-lived, automatically renewing credentials to minimize exposure.</li>
<li><strong>TypeScript 7.0 native rewrite is stable and production-ready</strong>: The TypeScript team announced that the native preview of TypeScript 7.0 (Project Corsa) is now stable and production-ready, offering 10x faster builds through parallelism and complete editor support, with TypeScript 6.0 being the final JavaScript-based release.</li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Firefox’s AI features: privacy champion or just confused?</strong>: Mozilla integrated AI features into Firefox, requiring users to manually change 11 settings to opt out, which critics like Rubenerd call ‘user-hostile.’ This comes as Fast Company names Firefox a ‘Brand That Matters’ for user agency and privacy. So, is Firefox a privacy champion or just trying to sneak AI in while no one’s looking? The ‘Shake to Summarize’ feature sounds suspiciously like something an AI browser would do, not a privacy-first one.</li>
<li><strong>OpenAI’s ‘app discovery’ tests: because who doesn’t want Peloton ads in their AI chat?</strong>: OpenAI is testing ‘app discovery’ in ChatGPT conversations, which users are confusing with ads. A paid subscriber even saw a Peloton recommendation during a discussion about Elon Musk. OpenAI says these aren’t ads, just ‘tests,’ but admits relevancy is poor. So, they’re not ads, they’re just irrelevant, unskippable suggestions that look exactly like ads. Got it. Peak innovation in user experience.</li>
<li><strong>AI coding assistants: faster code, or just faster ways to make a mess?</strong>: AI coding assistants like Claude Opus 4.5 and Cursor Composer are being used for 95% of game codebases, promising rapid feature iteration. Yet, experiments show they still struggle with complex tasks, requiring significant human intervention and often producing buggy code. So, we’re trading human-made bugs for AI-made bugs, but faster. And let’s not forget the Meilisearch CEO’s ‘vibe coding’ concept, where AI generates code from prompts for ‘rapid prototyping’ but comes with ‘mental fatigue and reduced comprehension.’ Sounds like a recipe for future tech debt.</li>
</ul>
