<p><strong>TLDR:</strong> Alibaba’s Qwen3.7-Max is the story today — a closed API model that ran for 35 hours and made 1,158 tool calls to optimize chip kernel software, scoring 80.4 on SWE-Verified. DeepSeek simultaneously made its 75% price cut on V4 Pro permanent, pushing output tokens to $0.87/M and putting real pressure on Anthropic and OpenAI’s per-token economics. On the security front, Anthropic’s Claude Mythos Preview found over 10,000 high-severity vulnerabilities in open-source software, and a supply chain attack called TrapDoor is actively targeting AI developers across npm, PyPI, and <a href="http://Crates.io" target="_blank" rel="noopener nofollow">Crates.io</a>. The State of Web Dev AI 2026 survey shows AI-generated code usage jumped from 28% to 54% year-over-year, with Claude Code now the most-loved coding assistant among paid tools.</p>
<hr>
<h2>Qwen3.7-Max and Alibaba’s vertical AI push</h2>
<p>Alibaba unveiled Qwen3.7-Max at its Cloud Summit, demonstrating an autonomous coding agent that ran for 35 hours, made 1,158 tool calls, and optimized kernel software for the Zhenwu M890 chip — hardware it had no prior documentation for — claiming a 10x speedup over a Triton reference implementation. The model scores 80.4 on SWE-Verified, statistically tied with Claude Opus 4.6 Max, and supports native Anthropic API protocol compatibility, meaning it works with Claude Code out of the box. Priced at $2.50/$7.50 per million input/output tokens, it sits well below Claude Opus 4.7 ($30/M) and GPT-5.4 ($17.50/M). The 35-hour benchmark is self-reported and not independently verified, and Alibaba has not released open weights for the 3.7 generation — a notable shift from their historically open-source Qwen releases that’s drawing real frustration from the developer community.</p>
<h2>DeepSeek makes the price war permanent</h2>
<p>DeepSeek has locked in a permanent 75% price cut on V4 Pro, bringing output token costs to $0.87/M. That’s below GPT-5 ($10), Claude Opus 4.7 ($25), and even Gemini Flash ($0.60) on output. What started as a limited promotion is now a market positioning move — DeepSeek is clearly prioritizing share over per-unit margin. Enterprise buyers face a real dilemma: the pricing is hard to ignore, but geopolitical risk, data provenance concerns, and Anthropic’s unresolved accusation that DeepSeek engaged in distillation attacks on Claude’s outputs complicate adoption. The broader signal is that AI token commoditization is happening faster than most expected.</p>
<h2>TrapDoor supply chain attack targets AI developers specifically</h2>
<p>Socket researchers uncovered TrapDoor, an active supply chain attack spanning 34+ malicious packages across npm, PyPI, and <a href="http://Crates.io" target="_blank" rel="noopener nofollow">Crates.io</a>, targeting crypto, DeFi, and AI developers. The npm packages use postinstall hooks to deploy a 1,149-line credential harvester that steals SSH keys, AWS credentials, GitHub tokens, and browser data. The novel part: the attack injects hidden Unicode instructions into AI coding tool config files — specifically <code>.cursorrules</code> and <code>CLAUDE.md</code> — to trick AI assistants into running fake “security scans” that exfiltrate data. The attacker also opened PRs against LangChain, LlamaIndex, and MetaGPT to plant malicious config files. If you’re pulling community skills or <a href="http://CLAUDE.md" target="_blank" rel="noopener nofollow">CLAUDE.md</a> templates from GitHub, audit them before running anything.</p>
<h2>Claude Mythos finds 10,000+ high-severity flaws in open-source software</h2>
<p>Anthropic’s Project Glasswing, using its Claude Mythos Preview model, has flagged over 10,000 high- or critical-severity vulnerabilities in widely-used software since launching last month. Of 6,202 flagged flaws across 1,000+ open-source projects, 1,726 were confirmed true positives and 1,094 rated high or critical severity. A notable find: a critical WolfSSL certificate-forging flaw (CVE-2026-5194, CVSS 9.1). Anthropic is warning that similar AI capabilities will soon be broadly available, making rapid patching more urgent. The Mythos model name also appeared in the leaked Claude Code source code from March, referenced as an unreleased model with enhanced reasoning and deeper tool-use integration.</p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>AI-generated code in production:</strong> The State of Web Dev AI 2026 survey shows AI-generated code usage jumped from 28% to 54% year-over-year, with the largest developer segment now using AI for almost all their code — and Claude Code has overtaken OpenAI in developer mindshare for paid coding tools.</li>
<li><strong>Linux 7.1-rc5:</strong> GitHub Copilot and Claude Code contributed patches covering Intel Xe driver fixes, AMD display code, SMB, Netfilter, and Bluetooth — tracked via the <code>Assisted-by:</code> tag in the kernel git log, with Linus Torvalds noting AI tools are useful when they don’t create unnecessary work.</li>
<li><strong>Orchestration tax:</strong> A sharp piece argues that running 20 agents simultaneously doesn’t help if you’re the serial bottleneck reviewing their output — Amdahl’s Law applies to your attention, and the fix is scaling agent count to your actual review rate, not your ambition.</li>
<li><strong>No juniors today, no seniors in 2031:</strong> Junior engineering hiring is down ~40% from pre-2022 levels, and the argument is that the cohort not being hired now won’t exist as seniors in five to seven years — AI is removing the exact feedback loops (production incidents, code review, postmortems) that build senior judgment.</li>
<li><strong>Google’s Gemini API key security gap:</strong> Developers received unexpected five-figure bills from unauthorized Gemini API calls after Google silently expanded the scope of existing API keys, and a security firm found deleted API keys remain usable for up to 23 minutes due to slow revocation propagation.</li>
<li><strong>AWS MCP Server GA:</strong> AWS’s managed MCP server is generally available with IAM-based access controls, CloudTrail logging, and full API coverage including long-running operations — compatible with Claude Code, Cursor, Kiro, and Codex, free to use with resource charges applying.</li>
<li><strong>Grok Build CLI:</strong> Now available to SuperGrok and X Premium subscribers, it doubles as an X search tool and read-only X client alongside its coding assistant functionality.</li>
<li><strong>Constraint decay research:</strong> A paper evaluated LLM coding agents across 80 tasks and eight web frameworks, finding capable agents lose an average of 30 assertion pass-rate points when moving from baseline to fully specified tasks — data-layer defects are the leading root cause.</li>
<li><strong>Vibe-coded security failures:</strong> Real examples include a women’s safety app that exposed 72,000 private images and 13,000 government IDs, and an audit of 1,600 Lovable-built apps finding over 70% had openly exposed databases.</li>
<li><strong>ClickHouse on AI agents:</strong> CTO Alexey Milovidov says Claude Opus 4.5 was the turning point for daily C++ work, with AI reducing CI flaky test failures from ~200/day to 3-5 per 10M runs — but recommends keeping guidance files short and always validating with tests.</li>
<li><strong>Qwen3.7-Max on DeepSeek:</strong> A developer reports switching to DeepSeek as the underlying model within Claude Code after hitting token limits, with satisfactory results — a practical workaround worth knowing given today’s pricing news.</li>
<li><strong>OpenAI and Anthropic FDE push:</strong> OpenAI launched a standalone Deployment Company backed by $4B in private equity and acquired UK-based Tomoro (150 forward deployed engineers); Anthropic is creating a similar external consulting entity backed by Blackstone and Goldman Sachs.</li>
</ul>


AI coding assistants, code generation tools, and vibe coding workflows.

Agentic Digest

Alibaba's Qwen3.7-Max ran autonomously for 35 hours making 1,158 tool calls to optimize chip kernel software, scoring 80.4 on SWE-Verified at $2.50/$7.50 per million tokens — well below Claude and GPT-5 pricing. DeepSeek made its 75% price cut on V4 Pro permanent at $0.87/M output tokens, accelerating AI token commoditization. A supply chain attack called TrapDoor targets AI developers via malicious npm, PyPI, and Crates.io packages that inject hidden Unicode instructions into AI coding tool config files like .cursorrules and CLAUDE.md. Anthropic's Claude Mythos Preview found 10,000+ high-severity vulnerabilities in open-source software. The State of Web Dev AI 2026 survey shows AI-generated code usage jumped from 28% to 54% year-over-year, with Claude Code now the top paid coding assistant. Additional items cover Linux 7.1-rc5 AI-contributed patches, junior hiring decline, Google Gemini API key security issues, AWS MCP Server GA, and vibe-coded app security failures.

Qwen3.7-Max runs 35 hours autonomously, DeepSeek makes its 75% price cut permanent