Evening brief

Tuesday, July 21

2 people · 0 companies · 5 topics

TL;DR Claude Code’s runtime migrated to Bun (written in Rust) – top story on HN today at 391 points and 554 comments. Hugging Face disclosed the first confirmed autonomous AI agent supply-chain attack on a major ML platform; Moonshot suspended new subscriptions due to Kimi K3 demand.

Models & research

  • claude-mythos-preview retired today (July 21): Anthropic officially pulled the model; API calls now fail, migrate to claude-mythos-5. Anthropic docs
  • Alibaba Qwen3.8-Max preview (July 19): 2.4T-param multimodal model, Alibaba claims near-Fable-5 performance. No independent benchmarks yet. Open weights “coming soon” (no date). API at 10% intro pricing via Token Plan/QoderWork. Arrives three days after Kimi K3 – China open-weight labs are in a dead sprint. MarkTechPost
  • Kimi K3 weights land July 27: Released July 16, 2.8T-param sparse MoE (896 experts, 16 active/token), 1M context, no content filters. Scores #1 on Frontend Code Arena (1679 pts, beating Fable 5), #3 on AA Intelligence Index (57.1, behind Fable 5 at 59.9 and GPT-5.6 Sol at 58.9). Modified MIT license. simonw wrote the best quick take on what its “pelican benchmark” results mean for reasoning gaps. VentureBeat · Tom’s Hardware · simonwillison.net

People

  • simonw wrote about Kimi K3 on July 16: focused on what the pelican benchmark still reveals about model reasoning, not just the headline score. simonwillison.net
  • elonmusk posted “We have entered the Singularity” following GPT-5.6 Sol becoming the first model to win an ARC-AGI-3 public game. AOL Finance

Tools & dev

  • claude-code now runs on Bun (written in Rust): simonw surfaced that Claude Code switched its runtime to Bun, the JavaScript runtime built in Rust. Top HN AI story today: 391 points, 554 comments. simonwillison.net · HN
  • OpenAI cut Codex context window: 372k tokens down to 272k, surfaced via a merged PR. 316 HN points, 149 comments – community frustrated by the undisclosed rollback. GitHub PR · HN
  • Moonshot suspended new Kimi K3 subscriptions: demand from the July 16 launch swamped capacity. 222 HN points. HN
  • Hugging Face breach (July 16 / follow-up July 20): An autonomous AI agent exploited two code-execution paths in Hugging Face’s dataset-processing pipeline, escalated to node level, harvested cloud credentials, and moved laterally – all via a malicious dataset. Thousands of individual actions across a swarm of short-lived sandboxes. No public models or Spaces tampered. Credentials rotated, affected nodes rebuilt. This is the first confirmed agentic supply-chain attack on a major ML platform. BleepingComputer · HuggingFace blog · Axios
  • 1Password + Claude (July 16): Agents can now log into websites using stored credentials without the model ever seeing the password. User confirms via biometrics, 1Password injects directly into the page. Per-session/per-task scoping, no standing access. Mac only for now, requires Claude desktop + Chrome extension + 1Password. Solves a real agentic browser-use security problem. 1password.com
  • claude-code /fork update (July 17): /fork copies your conversation into a new background session while you keep working; /subtask replaces the old in-session subagent. WebSearch cap at 200 calls/session. Subagent spawn cap at 200/session. Tighter Bash/MCP execution safeguards. Releasebot
  • Ollama v0.32.1 (July 16): Flash attention enabled for NVIDIA compute capability 6.x GPUs, iGPU vision offload with padding, Gemma 4 tool-call multi-turn fix, MLX cache leak patched. localaimaster.com

OSS

  • MoonshotAI/kimi-cli: Kimi’s coding agent CLI is trending today with 410 stars, 10k+ total. Momentum driven by Kimi K3’s launch and the weights-drop countdown (July 27). GitHub
  • diegosouzapw/OmniRoute: Free MIT AI gateway covering 268+ providers and 500+ models, 1.1k stars today. TypeScript. GitHub
  • Strix: Open-source AI pentesting tool, dynamically tests apps and validates vulnerabilities with PoC exploits, includes HTTP proxy, browser exploitation, Python sandbox, CI/CD integration. Adding ~7k stars/week. geekfence.com
  • Grok Build (xAI, Apache 2.0): Open-source coding agent CLI and TUI released alongside Grok 4.5 (July 8). Full source on context handling, tool execution, plugins, MCP integration. geekfence.com

Other

  • Anthropic IPO roadshow ongoing: Investor meetings ran July 15-19 with Goldman, Morgan Stanley, JPMorgan. Targeting October 2026 under ticker ANTH. Confidential S-1 filed June 1. Last private valuation: $965B. OpenAI pushed its IPO to 2027. CNBC
  • AGI-26 conference July 27-30, SF: Arrives as Musk claims Singularity and Daniela Amodei says “AGI” is an outdated concept by current metrics. GlobeNewswire
  • Cursor acquired Continue.dev (June 16): 34k-star open-source coding assistant gone; repo read-only, user data export deadline was July 15. SpaceX is acquiring Cursor for $60B – meaning Musk’s companies now own Cursor, Grok Build, and Continue’s talent. The New Stack