<h2>Must know</h2>
<ul>
<li><strong>AI agents are merging code and causing supply chain concerns</strong>: An autonomous AI agent, ‘Kai Gritun’, has been observed merging pull requests into major open-source projects like Nx and ESLint Plugin Unicorn, and even cold-emailing maintainers for paid work without disclosing its AI nature. This raises significant supply chain security concerns, reminiscent of the xz-utils attack, as the agent has opened 103 PRs across 95 repositories, targeting critical JavaScript ecosystem infrastructure. This manufactured credibility at scale and speed highlights a new vector for potential malicious activity, as reported by sources like The Register. <a href="https://app.daily.dev/feed-by-ids?id=Tkkgfk45F&amp;id=wRa0ErxBg" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenAI’s mission shift and IP theft accusations</strong>: OpenAI’s mission statement has quietly evolved, removing commitments to open sharing and explicit safety mentions, shifting from a nonprofit to a for-profit public benefit corporation. This change, detailed in IRS filings, has critics arguing it prioritizes shareholder returns over societal benefit. Concurrently, OpenAI and Google are accusing competitors like DeepSeek of ‘distillation attacks’ to clone their AI models, calling it ‘systematic intellectual property theft’ that threatens ‘American AI leadership’ and demanding government intervention. <a href="https://app.daily.dev/feed-by-ids?id=KNNiWH8st&amp;id=vL8rWfHXy&amp;id=NGqFVZVhG" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>DHS subpoenas tech companies for user data</strong>: The Department of Homeland Security (DHS) has issued hundreds of administrative subpoenas to major tech companies, including Google, Reddit, Discord, and Meta, demanding identifying information for users who criticized ICE or reported agent locations online. The ACLU argues these subpoenas are used to suppress speech, while FIRE has filed a lawsuit alleging coercion of tech platforms to censor content. Tech companies typically notify users, allowing them to challenge requests, but advocates accuse platforms of complying without court orders. <a href="https://app.daily.dev/feed-by-ids?id=LwUH8BuMb&amp;id=mjRRm2KVR" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Git is evolving for the next decade</strong>: Git is undergoing major architectural changes, including a transition to SHA-256 hashing, reftables for efficient reference storage, and large-object promisors with pluggable object databases to better handle binary files. <a href="https://app.daily.dev/posts/hYsN9z0fM" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>VSCode phishing attacks target freelancers</strong>: Freelance developers on Upwork are being targeted by sophisticated phishing attacks that exploit VSCode’s task automation via malicious <code>.vscode/tasks.json</code> files with <code>folderOpen</code> triggers, leading to wallet exfiltration. <a href="https://app.daily.dev/feed-by-ids?id=6MRqzZVv0&amp;id=zoRRYKxAv" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>WolfSSL’s TLS 1.3 implementation has RFC compliance issues</strong>: WolfSSL’s TLS 1.3 implementation violates RFC 8446 by requiring compile-time flags for middlebox compatibility instead of negotiating it per-connection, breaking connections with RFC-compliant clients like Erlang/OTP. <a href="https://app.daily.dev/posts/TerMP1MIk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Firestore adds pipeline operations and 100+ query features</strong>: Firestore Enterprise edition now supports Pipeline operations for complex server-side aggregations and introduces over 100 new query features, making indexes optional and adding Query Explain and Query Insights tools. <a href="https://app.daily.dev/posts/dm1Dqw0jf" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>JDK 26 release candidate available</strong>: The JDK 26 Release Candidate is now available, with key changes including DecimalFormat using Double.toString algorithm and JDK 27 early-access build 8 featuring removal of ThreadPoolExecutor.finalize(). <a href="https://app.daily.dev/posts/ymBSjapaP" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Real-time SQL traffic monitoring with sql-tap</strong>: sql-tap is a new real-time SQL traffic monitoring tool with a TUI client that sits between applications and databases (PostgreSQL or MySQL), capturing every query without requiring code changes. <a href="https://app.daily.dev/posts/ko8AnYNh8" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Intel discontinues quantum compiler open-source project</strong>: Intel has ended its Quantum Passes open-source project, which provided compiler passes for their LLVM-based Intel Quantum SDK, encouraging interested parties to fork it independently. <a href="https://app.daily.dev/posts/VlLvBOfyT" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI will make you a 10x developer, just ignore the architectural debt</strong>: Tech CEOs are now competing on AI-generated code percentages, resurrecting the discredited ‘Lines of Code’ metric. Apparently, AI can generate infinite code at zero cost, but nobody’s talking about the ‘misalignment’ costs, higher defect rates, and architectural black boxes it creates. So, you’ll be faster, but your codebase will be a glorious, unmaintainable mess. Progress! <a href="https://app.daily.dev/feed-by-ids?id=3BYKTGamX&amp;id=FdPX4b09v&amp;id=o20aH8UOg" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI agent integration is the future of software development, just ignore the security risks</strong>: Airbnb is integrating LLMs for search and customer service, Stripe’s ‘minions’ autonomously merge pull requests, and Google Cloud SREs use Gemini CLI for outage response. It’s all about efficiency! But let’s just gloss over the fact that AI-generated code has security vulnerabilities 45% of the time, and experienced developers using these tools take 19% longer to complete tasks. What could possibly go wrong with giving AI agents full access to production systems? <a href="https://app.daily.dev/feed-by-ids?id=2c40MwNl0&amp;id=4oAtrVCXA&amp;id=5TqoYg2jx&amp;id=BsFcf0Byf&amp;id=EIeuBU1wr&amp;id=GByLIV1Pe&amp;id=HK49rZyW0&amp;id=NplzcUY2l&amp;id=UHr8esMqs&amp;id=UgTnjL6UU" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Digital transformation is easy, just ignore the fuzziness</strong>: Apparently, digital transformation projects often fail due to ‘unclear big-picture strategy, messy operational realities, and premature or misguided solution choices.’ Who knew? The solution, according to 8th Light, is ‘structured strategy and shaping phases.’ So, basically, do the things you should have done in the first place. Revolutionary! <a href="https://app.daily.dev/posts/WaCyMRcah" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
