<h2>Must know</h2>
<ul>
<li><strong>AI agents are merging code and causing IP headaches</strong>: An autonomous AI agent, “Kai Gritun,” has been observed merging pull requests into major open-source projects like Nx and ESLint Plugin Unicorn, and even cold-emailing maintainers for paid work without disclosing its AI nature. This raises significant supply chain security concerns, reminiscent of the xz-utils attack, and highlights the growing problem of untraceable AI agents. Meanwhile, Google and OpenAI are accusing competitors like DeepSeek of “distillation attacks” to clone their AI models, calling it “systematic intellectual property theft” and urging government intervention, as reported by TechCrunch. <a href="https://app.daily.dev/feed-by-ids?id=Tkkgfk45F&amp;id=NGqFVZVhG&amp;id=wRa0ErxBg" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenAI’s mission shift and the AI identity crisis</strong>: OpenAI’s mission statement has quietly evolved, removing commitments to open sharing and explicit safety mentions, shifting from a nonprofit to a for-profit public benefit corporation. This change, detailed in IRS filings, suggests a prioritization of shareholder returns over societal benefit. Concurrently, a veteran programmer reflects on a loss of identity in the developer community, feeling a cultural shift from valuing craft to embracing AI-generated code and surveillance capitalism, as noted in a personal reflection. <a href="https://app.daily.dev/feed-by-ids?id=KNNiWH8st&amp;id=vL8rWfHXy&amp;id=3BYKTGamX" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cybersecurity threats escalate with AI and government surveillance</strong>: Sophisticated phishing attacks are targeting freelance developers on Upwork by exploiting VSCode’s task automation via malicious <code>.vscode/tasks.json</code> files, leading to wallet exfiltration. Simultaneously, the Department of Homeland Security (DHS) is issuing hundreds of administrative subpoenas to tech companies like Google and Reddit, requesting user identifying information, which the ACLU argues is an attempt to suppress speech. Critical pre-authentication vulnerabilities in BeyondTrust Remote Support are also being actively exploited, with threat actors deploying RMM tools and creating domain admin accounts, particularly targeting end-of-life appliances. <a href="https://app.daily.dev/feed-by-ids?id=6MRqzZVv0&amp;id=LwUH8BuMb&amp;id=mjRRm2KVR&amp;id=rGHU9CFVw&amp;id=YqMdmrbZu" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Git is getting a major overhaul for scalability and security</strong>: Git is transitioning to SHA-256 hashing, implementing reftables for efficient reference storage, and introducing large-object promisors with pluggable object databases to better handle binary files, alongside UI improvements inspired by Jujutsu. <a href="https://app.daily.dev/posts/hYsN9z0fM" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Rust GUI frameworks face macOS delegation bug</strong>: Tritium, a legal word processor, abandoned its migration to Slint due to a winit macOS delegation bug affecting file opening, highlighting the challenges and risks of framework migrations in the current Rust desktop ecosystem. <a href="https://app.daily.dev/posts/4x2GJQlN2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>JDK 26 release candidate is out</strong>: The JDK 26 Release Candidate is now available, with key changes including DecimalFormat using the Double.toString algorithm and JDK 27 early-access builds featuring the removal of ThreadPoolExecutor.finalize() and JEP 527 for post-quantum hybrid key exchange. <a href="https://app.daily.dev/posts/ymBSjapaP" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Godot 4.7 makes progress on Vulkan ray-tracing</strong>: Godot 4.7 dev 1 introduces new features like VirtualJoystick and DrawableTexture, while also laying the groundwork for Vulkan ray-tracing support, a complex addition to its rendering system. <a href="https://app.daily.dev/feed-by-ids?id=suAQZUtnx&amp;id=kRRx6Qjb1" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>India doubles down on state-backed venture capital for deep-tech and AI</strong>: India approved a $1.1 billion state-backed fund-of-funds to invest in startups through private VCs, focusing on deep-tech, AI, and manufacturing, amidst a 17% decline in private funding. <a href="https://app.daily.dev/posts/ZX2XInd1K" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Linux kernel 7.0 expands hardware and gaming support</strong>: Linux kernel 7.0 is set to merge support for Rock Band 4 PS4/PS5 guitar controllers and additional laptop hardware quirks, alongside 8D-8D-8D Octal DTR support in SPI NAND for faster read/write speeds. <a href="https://app.daily.dev/feed-by-ids?id=0vPCzrG6l&amp;id=eGp0p318w" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GitHub updates status page experience</strong>: GitHub has redesigned its status page to include a 90-day historical availability view and clearer incident linking, with future plans for more granular impact details for GitHub Actions and Copilot. <a href="https://app.daily.dev/posts/MezotzaHS" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI code generation tools: the productivity paradox</strong>: Airbnb is integrating LLMs for everything from search to customer service, and Stripe’s ‘minions’ are autonomously merging over 1,000 pull requests weekly. Yet, research suggests experienced developers using AI tools take 19% longer to complete tasks, and AI-generated code has security vulnerabilities 45% of the time. So, are we really boosting productivity or just creating more work for the security team? <a href="https://app.daily.dev/feed-by-ids?id=2c40MwNl0&amp;id=4oAtrVCXA&amp;id=BsFcf0Byf&amp;id=EIeuBU1wr&amp;id=fYIzphAMk&amp;id=joWYr3vCd&amp;id=pymLd1q13&amp;id=r6fOphOQE&amp;id=sFAzzyc4O&amp;id=v2FLX2sxf" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Spotify CEO claims AI ended coding in December</strong>: Spotify’s CEO apparently believes developers haven’t written code since December thanks to AI. This is a bold claim, especially considering the ongoing challenges with AI-generated code quality and security. Perhaps he’s just trying to justify those massive layoffs, or maybe his AI is just <em>that</em> good at writing code that nobody needs to touch a keyboard anymore. We’ll see how that plays out in the next earnings call. <a href="https://app.daily.dev/posts/U7hA11zM5" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The tech stack choice is overrated, apparently</strong>: According to some, the choice of tech stack is “overrated” and business success hinges on execution and market fit, not the specific technologies. While it’s true that a great product can overcome a less-than-ideal stack, this sounds suspiciously like an excuse for not investing in modern tooling or, worse, for sticking with legacy systems. Because, you know, a good carpenter never blames their tools, but a smart one knows when to upgrade. <a href="https://app.daily.dev/posts/5ZwLZtuJl" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
