<p><strong>TLDR:</strong> A supply chain worm called Miasma compromised 73 Microsoft GitHub repositories by targeting AI coding agent config files, harvesting cloud credentials from developers who cloned affected repos. Google agreed to pay SpaceX $920M per month for GPU access through 2029, a deal worth roughly $30B that follows SpaceX’s $1.25B/month arrangement with Anthropic. MiniMax M3 is getting real-world comparisons against Claude Opus 4.8, with Qwen 3.7 Plus emerging as a strong cost-efficient alternative for most workloads. OpenAI shipped Lockdown Mode to all ChatGPT users to reduce prompt injection exposure.</p>
<hr>
<h2>Miasma worm targets AI coding agent configs, disables 73 Microsoft GitHub repos</h2>
<p>The Miasma worm hit Microsoft’s Azure GitHub organizations by exploiting config files that Claude Code, Gemini CLI, Cursor, and VS Code read automatically on repo open. A compromised contributor account pushed a 4.6 MB obfuscated JavaScript payload that harvests AWS, Azure, GCP, Kubernetes, npm, and GitHub credentials, then spreads by committing itself to any repo the victim can write to. GitHub disabled 73 repositories in a 105-second automated sweep, breaking CI/CD pipelines globally including Azure/functions-action. This is a meaningful escalation from package registry poisoning — the attack surface is now any repo your editor opens, not just packages you install. Rotate credentials, audit config files for <a href="http://CLAUDE.md" target="_blank" rel="noopener nofollow">CLAUDE.md</a>, .gemini, .cursor, and .vscode entries, and pin GitHub Actions to commit SHAs. <a href="https://app.daily.dev/feed-by-ids?id=EeZFvGg3X&amp;id=kDc5M9aNT" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>Google pays SpaceX $920M/month for 110,000 Nvidia GPUs through 2029</h2>
<p>Google signed a deal to pay SpaceX $920M per month from October 2026 through June 2029 for roughly 110,000 Nvidia GPUs — about $30B over the contract lifetime. Google described it as bridge capacity for surging Gemini Enterprise demand. Combined with Anthropic’s $1.25B/month arrangement, SpaceX’s Colossus data center is now pulling in $2.17B per month in compute revenue, which reframes the xAI infrastructure story considerably ahead of SpaceX’s anticipated $75B IPO. <a href="https://app.daily.dev/posts/hBRhbYlPh" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>Qwen 3.7 Plus is roughly 6x cheaper than Max and handles vision — the default choice for most teams</h2>
<p>Alibaba’s Qwen 3.7 Plus (released June 1) costs $0.40/M input tokens versus $2.50/M for Max, adds multimodal vision support, and matches Max on SWE-Bench Pro at around 60%. Max holds a small edge on pure-text leaderboards and runs 7-15% faster on text-only cold starts, but for any workflow involving screenshots, diagrams, or mixed inputs, Plus wins decisively — Max simply can’t see images. Real-world benchmarks show Plus saves roughly 5x on monthly costs for text-only teams and far more for visual workflows. Default to Plus; only pay for Max if you need that latency edge on text-only tasks. <a href="https://app.daily.dev/feed-by-ids?id=YVaztkNUq&amp;id=zYcqfwIhv&amp;id=yDp08cQWm&amp;id=NTbFwB8p8" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>OpenAI ships Lockdown Mode to all ChatGPT users including free tier</h2>
<p>OpenAI rolled out Lockdown Mode broadly, including free accounts, after initially targeting Business and eligible personal accounts. It blocks live outbound network requests — disabling web browsing, deep research, and agent mode — to cut off the main exfiltration paths in prompt injection attacks. OpenAI acknowledges it doesn’t fully eliminate the risk. Enable it via Settings &gt; Security &gt; Advanced Security if you’re feeding ChatGPT sensitive data. <a href="https://app.daily.dev/feed-by-ids?id=ZLJ7uE5fR&amp;id=8muf9RAtS" target="_blank" rel="noopener nofollow">Read more</a></p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>AI agent found 21 zero-days in FFmpeg for $1,000; Chrome patched a record 429 bugs:</strong> Depthfirst’s autonomous agent discovered 21 previously unknown FFmpeg vulnerabilities for roughly $1,000 in compute — some bugs had sat in the codebase for over 20 years — while Google shipped Chrome 149 with 429 security patches, over 100 rated critical or high, partly driven by AI-assisted discovery including Anthropic’s Mythos model finding 271 Firefox bugs in a single pass. <a href="https://app.daily.dev/posts/LoICHspDC" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Netflix engineer’s Headroom tool saved users ~$700K by compressing LLM context windows 70-90%:</strong> Tejas Chopra built Headroom, an open-source local proxy on port 8787 that compresses redundant content in LLM requests (server logs, JSON, HTML, code) before they hit the API, reducing token usage 70-90% depending on content type and storing originals in Redis or SQLite — reportedly saving users around 200 billion tokens across multiple Netflix teams. <a href="https://app.daily.dev/posts/InAeFdqn2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Claude Mythos model slug spotted in Dev Mode; Anthropic’s model reportedly found 271 Firefox bugs:</strong> A ‘Claude Mythos 5’ model slug appeared via Dev Mode, and separately a rumored ‘Oceanus’ checkpoint has been spotted — with Anthropic’s Mythos model already credited with finding 271 Firefox vulnerabilities in a single pass for Mozilla. <a href="https://app.daily.dev/feed-by-ids?id=6BdxVsYLx&amp;id=ZQlr93jsk&amp;id=uogm6QOAG&amp;id=WIQDtCGlt" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Gemma 4 12B runs on 16GB VRAM by replacing a 550M-parameter vision encoder with a 35M linear projection:</strong> Google DeepMind’s encoder-free architecture in Gemma 4 12B swaps the traditional 550M-parameter vision encoder for a 35M linear projection layer, cutting VRAM enough to run the model on a standard laptop while hitting performance close to 26B-parameter models — confirmed working on an M2 MacBook Pro via MLX. <a href="https://app.daily.dev/posts/SuLsTAKoa" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Meta is assigning software engineers to manual data labeling, echoing Scale AI’s practice under Alex Wang:</strong> Multiple sources report Meta is now assigning SWEs to manual data labeling tasks — the same practice Scale AI used under Alex Wang that new leadership there stopped immediately upon discovering it. <a href="https://app.daily.dev/feed-by-ids?id=7jSZEON9u&amp;id=K9LA8pcD7" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>


AI coding assistants, code generation tools, and vibe coding workflows.

Agentic Digest

A supply chain worm called Miasma compromised 73 Microsoft GitHub repositories by exploiting AI coding agent config files (Claude Code, Gemini CLI, Cursor, VS Code), harvesting cloud credentials from developers who cloned affected repos. Google signed a ~$30B deal paying SpaceX $920M/month for 110,000 Nvidia GPUs through 2029 as bridge capacity for Gemini Enterprise demand. Alibaba's Qwen 3.7 Plus is highlighted as a cost-efficient default over Max, being 6x cheaper with added vision support. OpenAI rolled out Lockdown Mode to all ChatGPT users to mitigate prompt injection exfiltration risks. Additional items cover an AI agent finding 21 FFmpeg zero-days for $1,000, a Netflix engineer's LLM context compression tool saving ~$700K, a Claude Mythos model slug spotted in Dev Mode, Gemma 4 12B's encoder-free architecture enabling 16GB VRAM operation, and Meta assigning engineers to manual data labeling.

Miasma worm hits 73 Microsoft repos, SpaceX lands $30B Google compute deal