<p><strong>TLDR:</strong> Windsurf 2.0 launched today with a Kanban-style agent management interface and Devin baked in as a cloud agent, completing the Cognition acquisition story. Anthropic is fielding investor offers at an $800B valuation — up from $380B just two months ago — driven by Claude Code hitting $2.5B in annualized revenue. Claude had another partial outage today, its third this month. The OpenAI Agents SDK got a significant update with sandboxed workspaces and official partners including E2B, Modal, Vercel, and Cloudflare.</p>
<hr>
<h2>Windsurf 2.0 integrates Devin as a cloud agent</h2>
<p>Windsurf 2.0 ships two things: a new Agent Command Center — a Kanban dashboard for managing local and cloud agents simultaneously — and direct Devin integration included with every plan. The framing is straightforward: local agents keep you in flow while you’re working, cloud agents handle the longer tasks while you’re not. A new “Spaces” concept groups related sessions, PRs, and context by task so you’re not hunting across tabs. This is the first concrete product output from Cognition’s acquisition of Windsurf, and it’s a more coherent pitch than either product made alone.</p>
<h2>Anthropic at $800B, Claude Code driving the growth</h2>
<p>Anthropic has received investor offers at roughly $800B — more than double its $380B valuation from February. The growth story is Claude Code specifically: $2.5B in annualized revenue, with overall company ARR reportedly jumping from $1B at end of 2024 to $30B by early April. The company is also in early IPO talks with Goldman Sachs, JPMorgan, and Morgan Stanley, targeting a potential offering as early as October. Claude Mythos, the restricted model being used for vulnerability research under Project Glasswing, is part of the narrative here — though access remains limited to about 11 organizations.</p>
<h2>OpenAI Agents SDK gets sandboxed workspaces</h2>
<p>OpenAI updated the Agents SDK with sandboxed execution environments that separate the agent harness from compute, keeping credentials away from model-generated code. Developers can bring their own containers or use launch partners: E2B, Modal, Vercel, Cloudflare, and Daytona are all officially supported. The SDK also gains configurable memory, filesystem tools, MCP support, and a Manifest abstraction for portable workspace definitions across S3, GCS, and Azure Blob. Pricing is unchanged — you pay for tokens and tool use. Currently Python-only, TypeScript is planned.</p>
<h2>Claude Code used to find 23-year-old Linux kernel vulnerability</h2>
<p>An Anthropic researcher ran a simple bash script that iterated over every Linux kernel source file and prompted Claude Code to find vulnerabilities — no custom tooling. The result: five confirmed kernel vulnerabilities including a 23-year-old heap buffer overflow in the NFS driver. Linux kernel maintainers say the security list has gone from 2-3 legitimate AI-assisted reports per week to 5-10 per day. Claude Opus 4.6 found significantly more bugs than models from just a few months ago. The dual-use concern is obvious: the same script works for attackers.</p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>Claude outage:</strong> <a href="http://Claude.ai" target="_blank" rel="noopener nofollow">Claude.ai</a>, the API, and Claude Code all hit elevated errors today — the third disruption this month, with overall April uptime sitting at 93%.</li>
<li><strong>Gemini 2.5 Flash TTS and Live:</strong> Google released two audio models today — a TTS model with 70-language support and a Live model for real-time voice with 90.8% on ComplexFuncBench Audio. All output is SynthID-watermarked.</li>
<li><strong>Google Gemini macOS app:</strong> Google shipped a native macOS app (Apple Silicon only, requires Sequoia 15.0) with Option+Space quick access, screen sharing, and Imagen/Veo generation — last of the big three to ship a desktop client.</li>
<li><strong>Accel raises $5B AI fund:</strong> Driven by returns on Anthropic (invested at $183B, now near $800B) and Cursor (backed at $9.9B, reportedly now ~$50B), targeting 20-25 deals at ~$200M average check size.</li>
<li><strong>Prompt injection in GitHub Actions:</strong> Researchers from Johns Hopkins found that Claude Code Security Review, Gemini CLI Action, and GitHub Copilot Agent were all vulnerable to comment-and-control attacks via PR titles and issue bodies. Anthropic paid $100, Microsoft paid $500, Google paid an undisclosed amount. None issued a CVE or public advisory.</li>
<li><strong>Context rot is real:</strong> A Claude Code engineer’s breakdown of session management is making the rounds — the core advice is to rewind instead of correcting mistakes, compact early with a focused direction, and prefer /clear over /compact.</li>
<li><strong>Qwen Code free tier cut:</strong> Alibaba dropped daily free requests from 1,000 to 100, following MiniMax’s recent shift from open-source to restricted commercial use.</li>
<li><strong>SDL bans AI-generated code:</strong> The game development library (central to the Steam Runtime) now requires contributors to confirm their PRs contain no AI-generated code, citing license uncertainty and hallucination risk.</li>
<li><strong>Cursor /canvas:</strong> A new /canvas command in Cursor lets you build custom interfaces for agents — early preview, but worth watching.</li>
<li><strong>Codex gets /compact:</strong> OpenAI is adding /compact to Codex CLI after sustained user requests, bringing context compaction in line with what Claude Code already offers.</li>
<li><strong>MCP security flaw in nginx-ui:</strong> CVE-2026-33032 (CVSS 9.8) — the /mcp_message endpoint had no authentication, allowing arbitrary admin commands. Over 2,600 exposed instances found on Shodan. Patched in v2.0.3.4.</li>
<li><strong>Zapier CEO on institutional productivity:</strong> Wade Foster says 100% of Zapier employees use AI daily and are individually more productive, but whether the company is institutionally more productive is “a lot harder to say yes to.”</li>
<li><strong>Anthropic/Google/Microsoft AI chat not privileged:</strong> A February federal ruling found that conversations with Claude are not protected by attorney-client privilege — Claude is not a lawyer and Anthropic’s ToS allows data disclosure.</li>
<li><strong>DeepSeek v4 spotted:</strong> Early reports suggest DeepSeek v4 is already running — fast, strong at math and physics, with reasoning traces cranking out at high token throughput.</li>
<li><strong>Subagents in Gemini CLI:</strong> Gemini CLI now supports specialized subagents with isolated context windows, their own tools and MCP servers, and parallel execution via @agent syntax.</li>
</ul>


AI coding assistants, code generation tools, and vibe coding workflows.

Agentic Digest

Windsurf 2.0 launches with a Kanban-style Agent Command Center and Devin baked in as a cloud agent, the first concrete product from Cognition's acquisition. Anthropic is fielding investor offers at $800B — more than double its February valuation — driven by Claude Code hitting $2.5B in annualized revenue and IPO talks with major banks. OpenAI updated its Agents SDK with sandboxed execution environments and official partners including E2B, Modal, Vercel, and Cloudflare. An Anthropic researcher used a simple bash script with Claude Code to discover five Linux kernel vulnerabilities including a 23-year-old heap buffer overflow. Other notable items: Claude's third outage this month, Google's Gemini macOS app, a critical unauthenticated MCP endpoint CVE in nginx-ui, prompt injection vulnerabilities in GitHub Actions AI tools, and SDL banning AI-generated code contributions.

Windsurf 2.0 ships Devin integration, Anthropic hits $800B valuation

<p>Insane valuation and growth for Anthropic</p>
