Ten dispatches from a morning when the model is the network, the agent is the user, and the OAuth token is the new perimeter.
01
A browser extension. An OAuth scope. And the new perimeter just shifted.
Vercel disclosed on April 19 that an internal compromise traces back to a single employee installing the Context.ai browser extension and signing in with their enterprise Google account. The OAuth grant carried enough scope for the attacker to pivot into Vercel’s environment and exfiltrate non‑sensitive environment variables for a subset of customers. ShinyHunters is now hawking the trove for $2M.
By April 20, Vercel had collaborated with Microsoft, GitHub, npm and Socket and confirmed no malicious npm packages. The lesson is older than Y2K and newer than this morning’s coffee: third‑party OAuth apps are production code, and a Workspace marketplace is your unaudited package registry.
“Sensitive‑marked variables were stored unreadable; everything else was fair game. The default still leaks.”
Pricing held at $5/$25 per million tokens. The model arrived everywhere at once — API, Bedrock, Vertex, Foundry, Copilot — and Anthropic openly noted Mythos still beats it.
The headline feature for engineers isn’t the SWE‑bench bump. It’s task budgets: a soft token target you hand the model for an entire agentic loop, plus a new “xhigh” effort level slotted between high and max. Together they let you tune the latency/quality knob per‑task instead of per‑request — which is the shape every harness has been hand‑rolling since Opus 4.
Flagged for you03
Prototypes, slides, and one‑pagers from a single prompt — with direct export to Canva, PDF and PowerPoint. Figma stock fell 7%+ on the announcement. Adobe, Wix and GoDaddy followed.
Anthropic’s new Claude Design tool ships alongside Opus 4.7 and is positioned squarely at the part of the design stack where AI has been most quietly disruptive: the “first draft.” The pitch is that anyone can describe what they need and walk away with an editable artifact in the familiar formats — no Figma file in sight.
Two days before launch, Anthropic CPO Mike Krieger resigned from Figma’s board. The optics did most of the work the press release didn’t. The interesting product question is whether direct export to existing creative tools turns Claude Design into the input layer rather than a replacement.
Figma down 7%. Adobe, Wix and GoDaddy down with it. The market priced this as infrastructure, not feature.
04
A coding IDE is now worth more than most of the public cloud‑native vendors it runs on top of.
CNBC reports Cursor is in talks for a $2 billion round at over $50 billion. The number itself is less interesting than what it implies about how investors are now pricing the IDE: not as a tool, but as the runtime where billions of agent‑authored diffs will be drafted, reviewed and merged.
Pair it with the broader Q1 2026 picture — foundational AI startups pulled in roughly double all of 2025 — and the “composable AI coding stack” thesis (Cursor for editing, Codex/Claude Code for execution, Copilot for review) gets very real cap table support. By March, OpenAI’s Codex had crossed 1.6M weekly actives; by April 8, Sam Altman publicly put it at 3M.
05
┌─ AI GATEWAY ──────────────────────────────────────────────┐ │ one API · 14+ providers · model routing · failover · $ │ │ edge: 330 cities · same network as your Worker │ └───────────────────────────────────────────────────────────┘
Cloudflare’s Agents Week 2026 (Apr 13–17) closed with a thesis: write your agent once, route any model, fail over automatically, and bill in one place. Workers binding now runs third‑party models, the catalog goes multimodal, and the AI Gateway sits a single network hop from your Worker — the kind of latency story that decides whether an agent feels alive.
Researchers at NC State and Utah have shown that chiral phonons — the spiraling vibrations of atoms in a twisted crystal lattice — can hand off angular momentum directly to electrons. No magnet. No battery. No current. The atoms themselves do the steering.
The mechanism, which the team calls an orbital Seebeck effect, lets thermal energy drive orbital motion. In materials as ordinary as quartz, that opens a credible path to encoding information in an electron’s orbital state rather than its spin or charge — at, in principle, dramatically lower energy cost than today’s electronics.
Don’t pencil it onto a 2027 roadmap. Do file it next to the magic‑angle graphene tunneling result published two weeks earlier in Nature Physics: the back half of the decade is going to be loud about how electrons want to behave when the lattice gets weird.
07
TypeScript 6.0 shipped on March 23 as the last release on the original JavaScript‑based compiler. The 7.0 native preview — already running inside Visual Studio 2026 Insiders — replaces the compiler and language service with a Go reimplementation. Teams running it on large codebases are reporting roughly an order‑of‑magnitude drop in cold‑build time. Mid‑2026 is the target for general availability.
If you maintain a monorepo, this is the year to budget for the upgrade and to start grading every TypeScript‑adjacent tool by whether it can keep up with the new compiler’s pace.
08
A quietly large GitHub week: a new gh skill command for discovering and pinning agent skills, GA of automatic model selection in the Copilot CLI, and Opus 4.7 wired into Copilot for Pro+, Business and Enterprise.
GitHub turned an unusually busy week into a coherent picture of what its agent stack now looks like in practice. The gh skill command lands in the GitHub CLI in public preview, giving developers a real package‑manager experience for installing, updating and pinning agent skills, with provenance tracking and supply‑chain safeguards baked in.
Copilot CLI now automatically picks the right model per request for every paid plan, and adds a /statusline command, smarter session handling, document attachments and direct remote session connecting. The remote MCP server config no longer requires the type field — it defaults to http — and a --list-env flag prints the loaded plugins, agents, skills and MCP servers in prompt mode.
Capping it: Opus 4.7 is rolling out to Copilot Pro+, Business and Enterprise. Notable on the side: as of April 20, new sign‑ups for Copilot Pro, Pro+ and student plans are temporarily paused. The product is moving faster than the funnel.
For an architect, the actionable bit is that AGENTS.md + gh skill + Copilot CLI is starting to look like a coherent “team‑shared agent context” surface — exactly the gap MCP alone never quite filled.
The April Nature Physics result tunes paired electron interactions to switch superconductivity in magic‑angle bilayer graphene as if it were a transistor channel. It’s the most direct evidence yet for an unconventional pairing mechanism — the kind physicists have been hunting since the original 2018 magic‑angle paper.
The practical horizon for room‑temperature superconductors is still far. The conceptual horizon — designing materials whose ground state is reachable by a knob — just got a lot closer.
A switch, not a state. The lattice does the math.
10
The Linux Foundation’s new AAIF anchors itself with a real portfolio: Model Context Protocol, the Goose agent runtime, and the AGENTS.md spec — three projects that have quietly become load‑bearing for almost every agent harness in production.
April’s MCP Dev Summit North America in NYC drew ~1,200 attendees. Den Delimarsky (Anthropic) joined as a Lead Maintainer; Clare Liguori as a Core Maintainer. The 2026 MCP roadmap is now explicitly scoped to “production growing pains”: auth, transport reliability, and the post‑quantum proxy work that hit Security Boulevard on April 14.
For an architect, the structural read is that MCP just stopped being a Anthropic‑adjacent protocol and became infrastructure. If you’re still hand‑rolling tool‑use abstractions in 2026, you’re fighting the standard.
“The protocol won. Now the question is whether the maintainer pipeline can keep up with the surface area.”
01
Ashley Rolf’s essay reframes the design / product impulse to wrap human research in “frameworks,” “systems” and “socio‑technical” jargon as a tell — the engineer is avoiding the conversation, not optimizing it. The HN thread (4500+ comments by morning) splits between “read this twice” and the predictable “but my framework is good, actually,” which is itself an unintentional case study.
02
Kotaku’s deep‑dive on pause menus is the kind of story HN was built for: a feature you’ve never thought twice about turns out to be a tower of physics‑sim freezes, audio fade graphs, network reconciliation hacks, and ethically dubious shortcuts in always‑online titles where the “Pause” button does nothing at all. The thread is full of war stories from indie devs who learned the hard way.
03
A complete, browsable archive of BYTE — every issue from September 1975 onward — is back on the front page after the Midwest Computer Museum’s redesigned reader landed alongside the old Internet Archive scans. The HN comments turn into a memoir thread by the second screen: people remembering type‑in BASIC programs, old Steve Ciarcia columns, and the ad pages that read like a parallel‑universe tech industry.
04
Simon Willison ran his (deeply unscientific, deeply important) “pelican on a bicycle” SVG benchmark against a 20.9 GB quantized Qwen3.6 in LM Studio on a MacBook Pro M5 — and the local model produced an unmistakably better pelican than Anthropic’s newly released Opus 4.7. The thread is half “the pelican benchmark predicts everything” and half a useful sober look at how cheap it now is to run real coding models without leaving the Apple silicon you already own.
05
Google’s new Android CLI is explicitly designed for AI agents rather than humans — Google claims a 70% drop in token usage and a 3× cut in task completion time when an agent uses it instead of poking at Android Studio. The thread argues itself into a corner about whether this is meaningful tooling or a thin wrapper around ./gradlew the LLMs already knew. The honest answer is somewhere in between, and it matters because it’s the first big‑mobile vendor to explicitly publish an agent‑native CLI.
Tomorrow at 7:00 AM the next issue lands. Until then, ship something small.