News feed

Cerebras IPO, Claude Opus 4.8 & the GlassWorm Botnet Takedown

Automated weekly research digest

Weekly Tech Digest (May 19–30, 2026)

AI & Models

  • Claude Opus 4.8 (May 28): Anthropic shipped its new flagship with stronger coding, long-running autonomous agent behavior, Dynamic Workflows (Claude Code research preview), and Effort Control on claude.ai. Same pricing as 4.7: $5/$25 per M tokens. (anthropic.com)
  • Google I/O Blitz: Gemini 3.5 Flash (new default, $1.50/M input, beats 3.1 Pro on coding), Gemini Omni (unified text/image/video generation), and Gemini Spark — a $100/mo 24/7 autonomous agent on cloud VMs. AI Mode surpassed 1B monthly users. (unrot.co)
  • Qwen 3.7 Max (May 20): Alibaba launched at Cloud Summit with 1M-token context window — strongest Chinese model on Artificial Analysis. Live on OpenRouter at ~$2.50/$7.50 per M tokens. (codersera.com)
  • Cognition raises $1B at ~$25B valuation: The Devin maker's mega-round signals peak investor conviction in AI coding. (YouTube)
  • OpenAI IPO filing: Confidential S-1 filed May 22; targeting public listing between Labor Day and Thanksgiving 2026. Also solved the planar unit distance problem (Erdős, 1946) with its latest model. (axios.com)
  • Illinois AI safety bill (May 28): America's strongest AI safety legislation — requires OpenAI, Anthropic, and Google to undergo third-party safety compliance verification. Governor expected to sign.
  • Robinhood AI trading agents: Users can now create separate accounts for AI agents to autonomously trade with user-allocated funds.

Dev Tools & Infrastructure

  • Google open-sources Agent Executor: A production-grade runtime for AI agents — durable execution, trajectory branching, secure sandboxing, Kubernetes-native (Agent Substrate). "Kubernetes for agents." (InfoWorld)
  • GlassWorm supply-chain botnet dismantled (May 26–27): CrowdStrike, Google, and Shadowserver coordinated takedown of a massive dev-targeting campaign — 73+ trojanized VS Code extensions, poisoned npm/PyPI packages, 300+ GitHub repos. Used Solana blockchain + BitTorrent DHT + Google Calendar for C2. (The Hacker News)
  • NVIDIA CUDA 13.3 GA: CUDA Python 1.0 (first stable), CUDA Tile for C++ (Hopper+), official C++23 support, CompileIQ auto-tuning (~15% GEMM/attention speedups). (NVIDIA docs)
  • Microsoft to unveil in-house coding model at Build 2026 (June 2–3): First-party code model to bolster GitHub Copilot; "One Copilot" super-app with agentic workflows (codenamed Autopilot). (Reuters)
  • Three AI coding agents launched in 72 hours: Cursor Composer 2.5 (Kimi K2.5-based, $0.50/$2.50), Anthropic "Code with Claude" (self-hosted sandboxes + MCP tunnels), Qwen 3.7 Max API (native Anthropic Messages protocol). Massive price compression. (Developer Tech)
  • Databricks Unity Catalog + Apache Iceberg GA: Managed Iceberg tables, Iceberg v3 (deletion vectors, VARIANT type), Foreign Iceberg, Spark 4.1 beta. (databricks.com)
  • Big Tech commits ~$700B in 2026 capex for AI infra: Amazon, Microsoft, Alphabet, Meta combined — nearly double 2025 — while simultaneously cutting software roles. Stanford HAI: dev employment for 22–25-year-olds down ~20% since 2024. (Tech Times)

Industry & Big Tech

  • Cerebras IPO — Largest of 2026: AI chipmaker (CBRS) priced at $185/share, raising ~$5.5B. Intraday implied valuation hit ~$95–100B before settling at $311 — biggest U.S. IPO since Uber. (TechCrunch) (CNBC)
  • Anthropic $65B Series H — nearing $1T valuation: Record private round; also acquired SDK startup Stainless. Part of 4 AI-lab acquisitions in 5 days (DeepMind/Contextual AI, Mistral/Emmi AI). (StartupHub.ai)
  • Meta hints at cloud business: Zuckerberg at shareholder meeting: entering public cloud "definitely on the table" if AI compute surplus materializes. Raised 2026 capex to $125–145B. Cut ~8,000 jobs. (CNBC)
  • OpenAI Daybreak cybersecurity platform: Launched May 11 on GPT-5.5 + Codex Security — automates vuln detection, patch generation, dependency analysis in DevSecOps pipelines. Partners: Cloudflare, Cisco, CrowdStrike, Oracle. (TechWire Asia)
  • AMD EPYC "Venice" — 2nm volume production: 6th-gen EPYC on TSMC N2, up to 256 cores/512 threads, ~70% uplift over Turin. First HPC product on 2nm. (RCR Tech)
  • Tech layoffs near 150K in 2026: Nearly 30K in May alone. Notable: Oracle (~30K roles), Meta (~8K), Groupon (400/~25% in "Project Foundry" AI-native pivot).

Security

  • Starlette "BadHost" CVE-2026-48710: Critical Host-header flaw in the ASGI framework underpinning FastAPI, vLLM, LiteLLM, and MCP servers — unauthenticated auth bypass, SSRF, potential RCE. Affects 325M+ weekly builds across millions of AI agents. Fixed in Starlette ≥1.0.1. (Ars Technica) (CSO Online)
  • IBM & Red Hat launch $5B "Project Lightwell": 20,000+ engineers dedicated to AI-assisted open-source vulnerability detection, patch backporting, and coordinated disclosure — starting with Maven/Java. (IBM Newsroom)
  • Ghost CMS CVE-2026-26980 (CVSS 9.4) exploited at scale: Unauthenticated SQLi in Ghost Content API (v3.24–6.19) used in ClickFix malware campaign hijacking 700+ domains including Harvard, Oxford, and DuckDuckGo. (Security Affairs)
  • Palo Alto PAN-OS zero-day CVE-2026-0300 (CVSS 9.8): Pre-auth buffer overflow in User-ID Auth Portal — unauthenticated root RCE via single crafted packet. Active state-sponsored exploitation; added to CISA KEV. (NetSPI)
  • Microsoft May Patch Tuesday — 130 CVEs, 30 Critical: CVE-2026-42826 (Azure DevOps CVSS 10.0), CVE-2026-41089 (Windows Netlogon RCE 9.8), CVE-2026-33109/33844 (Azure Managed Cassandra RCE). (CrowdStrike)
  • Charter/Spectrum breach by ShinyHunters (~40M records): Vishing + stolen Microsoft Entra SSO → Salesforce CRM pivot; customer names, addresses, phone numbers, service plans exfiltrated. (Privacy Guides)
  • ChromaDB CVE-2026-45829 (CVSS v4 10.0): Unauthenticated code injection on AI/vector-DB infra — 73% of exposed instances still vulnerable. (Threat-Modeling.com)
  • EU AI Act timelines shifted: High-risk AI compliance pushed to Dec 2027 (standalone) / Aug 2028 (embedded); transparency obligations start Aug 2026. UK CMA opened strategic market status investigation into Microsoft's business software. (Walker Morris)

Takeaways

  • The AI coding agent market is in extreme price compression — $0.50/M token Cursor vs. Anthropic self-hosted sandboxes vs. Qwen matching Anthropic's API protocol. Winners will be determined by eval quality, not raw capability.
  • Security under AI is getting worse before it gets better: Starlette, Ghost CMS, ChromaDB, Palo Alto — all critical CVEs hitting the AI/agent supply chain. Project Lightwell ($5B) is a recognition that open-source security needs industrial-scale investment.
  • Big Tech is spending $700B on AI infra while cutting engineering headcount — the bet is that capital expenditure on compute replaces operational expenditure on people.
  • The next 12 months will be defined by whether AI agents can be made safe and reliable enough for production (GlassWorm takedown, Daybreak launch, Illinois regulation, EU Act timelines) — not whether they can be built.