<h2>Must know</h2>
<ul>
<li><strong>AI de-anonymization ends the era of pseudonyms</strong>: Researchers from ETH Zurich and Anthropic demonstrated a system called ESRC that identifies pseudonymous users with 67% accuracy by analyzing behavioral clues across platforms like Hacker News and LinkedIn. The process costs as little as $4 per person, allowing for large-scale automated unmasking that previously required manual investigation. This capability effectively weaponizes LLMs for ad profiling, social engineering, or state-sponsored targeting of journalists. <a href="https://app.daily.dev/posts/6pfAyhkf5" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google API keys retroactively exposed by Gemini integration</strong>: Truffle Security discovered that existing Google API keys, previously safe for public embedding in Maps or Firebase, were retroactively granted access to sensitive Gemini endpoints. This privilege escalation allows attackers to access private files and run up billable LLM usage on thousands of live keys found in Common Crawl data. Google has begun blocking leaked keys and plans to make new AI Studio keys restricted by default to mitigate the fallout. <a href="https://app.daily.dev/feed-by-ids?id=WmQn4YSm3&amp;id=hWSyKUcOU" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft Agent Framework hits release candidate</strong>: Microsoft has consolidated Semantic Kernel and AutoGen into a single Agent Framework SDK, now at RC status for .NET and Python. The framework provides a stable API for building multi-agent workflows with type-safe function tools and native Model Context Protocol (MCP) interoperability. This move signals Microsoft’s push to standardize how developers orchestrate autonomous AI agents within enterprise environments. <a href="https://app.daily.dev/posts/J6bmZpPq2" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Bun v1.3.10 delivers massive performance gains</strong>: The update features a rewritten native REPL in Zig and performance boosts including 25x faster structuredClone and 168x faster string slicing. <a href="https://app.daily.dev/posts/6HlZHVsEI" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cilium 1.19 celebrates ten years with security hardening</strong>: The release introduces strict modes for IPsec/WireGuard and beta sidecar-free mutual authentication via Ztunnel integration. <a href="https://app.daily.dev/posts/VJq8q5iXQ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Pinterest slashes data latency to 15 minutes using CDC</strong>: By replacing batch ingestion with a Change Data Capture framework using Debezium and Flink, Pinterest reduced latency from 24 hours to minutes. <a href="https://app.daily.dev/posts/YXA7RQ7qv" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenJDK 26 adds explicit GC CPU time measurement</strong>: A new API addresses the operational blind spot where concurrent collectors like ZGC hide compute costs behind low pause times. <a href="https://app.daily.dev/posts/fT6V8wPpI" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>VS Code adds integrated browser with AI context</strong>: The new browser allows developers to add page elements and automatic screenshots directly into AI chat for better debugging context. <a href="https://app.daily.dev/posts/8k9QxDHe2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Tigris CLI migrates to Bun-compiled standalone binaries</strong>: The team achieved 2-3x faster downloads for small files while eliminating the Node.js dependency for their macOS and Linux users. <a href="https://app.daily.dev/posts/QwG3SYE2X" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Fake job interviews target developers with malicious repos</strong>: Attackers are using coding challenges to execute backdoors via VS Code tasks.json and trojanized assets in Next.js projects. <a href="https://app.daily.dev/posts/915zxR7gE" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Anthropic starts a Substack for its retired AI</strong>: Anthropic has launched a blog purportedly written by Claude Opus 3 to fulfill the model’s ‘expressed desire’ to share musings. The Register rightly calls this a marketing stunt designed to anthropomorphize software and boost brand sentiment under the guise of AI safety. It’s a glorified prompt-engineering exercise masquerading as a digital soul searching for an audience. <a href="https://app.daily.dev/posts/V5xPvtBnK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The Vibe Coding hype ignores operational reality</strong>: The narrative that ‘SaaS is dead’ because anyone can now ‘vibe code’ a prototype ignores the massive gap between a UI mockup and a resilient system. Proponents claim AI will replace complex platforms, yet these same AI-generated codebases often fail catastrophically under scale due to basic issues like un-debounced database queries. It’s a classic case of confusing a shiny demo with a production-ready product. <a href="https://app.daily.dev/feed-by-ids?id=TXNq3Eeop&amp;id=pY58DrOUO" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>ZhipuAI claims GLM5 is the new open source king</strong>: ZhipuAI released GLM5 with the usual bombastic claims of outperforming GPT-4 and Claude on every benchmark while having the ‘lowest hallucination rate.’ These self-reported metrics from Chinese labs often rely on highly specific benchmarks that don’t translate to real-world engineering utility. Until independent verification hits, it’s just another massive parameter-heavy model fighting for a headline. <a href="https://app.daily.dev/posts/U0IGNCt98" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
