IMMERSIVE COMMONS · THE SIGNALISSUE 08 · 31 MAY — 6 JUN 2026
OPEN INTELLIGENCE · ISSUE 08

THE SIGNAL
31 MAY — 6 JUN 2026
FRONTIER TOWER
08

The Week The Frontier Filed To Go Public

Anthropic filed to go public at $965 billion and then told the world to pause — and underneath the valuation the proofs came up short: an honest benchmark put the frontier at 2.6% on real economic work, the agent runtime shipped as a commodity, SpaceX became landlord to Google and Anthropic both, and a worm with valid provenance went hunting the API keys the whole stack runs on. The frontier went to market on trust; the ledgers didn't sign.

BEATS 06
DISPATCHES 16
CHAIN MYTHOS × 03
PUBLISHED 2026-06-08
I.

THE PUBLIC OFFERING

Anthropic filed a confidential S-1 six days after closing the round that valued it at $965 billion, beating OpenAI to the public-market paperwork — then, days later, urged the world to pause the most powerful AI and disclosed that more than 80% of the code it merged in May was written by Claude. The same week it scaled its unreleased Mythos bug-finder to 200 organizations without shipping it, and the lab that made frontier AI cheap without venture capital took its first $7.4 billion of it. The capital order of the race reshuffled in five days, and the most valuable lab on Earth asked everyone to stop while it counted the money.

96FIELD REPORT

Anthropic Filed To Go Public. Six Days After The Round.

The most valuable lab on Earth beat OpenAI to the paperwork — and set no price.

Anthropic confidential draft S-1 IPO filing coverage
IMAGEFortune

On June 1st, Anthropic confidentially submitted a draft registration statement on Form S-1 to the SEC — six days after closing the $65 billion Series H that pushed its post-money valuation to $965 billion. The funding arc became an IPO track in under a week, and in doing so the lab vaulted ahead of OpenAI, which has not yet reported filing any paperwork of its own. The new fact is not the money — that was last week — it is the filing, and the order it puts the race in.

A confidential draft S-1 is a registration statement, not an offering. By Anthropic's own words, *"the number of shares to be offered and the price have not yet been set"* — no share count, no per-share range, no exchange, and a go-public option that only opens after the SEC completes its review. What the filing does ratify is the revenue underneath it: Anthropic now reports a $47 billion annualized run-rate, up from roughly $9 billion at the end of 2025 — a five-fold climb in two quarters, fueled by Claude Code and the enterprise demand that carried it past OpenAI on business adoption in April.

What goes to the SEC is a number with a witness. The $965 billion was underwritten by seven private funds in a single round; the S-1 invites the public markets to underwrite it instead, on audited financials and a price the company has pointedly declined to name. The filing converts a valuation that asked to be trusted into one that asks to be cleared — and it does so the same week DeepSeek opened its first-ever outside round, the capital order of the frontier reshuffling on both sides of the Pacific at once. The lab that priced itself for public markets has set everything except the price.

AnthropicTechCrunchFortuneTechCrunch (Ramp AI Index)
97FIELD REPORT

Anthropic Filed To Go Public, Then Asked The World To Stop.

The lab that just priced itself for markets says Claude already writes its own code.

Anthropic recursive self-improvement report hero graphic — When AI builds itself
IMAGEFortune

Three days after confidentially filing a draft S-1 with the SEC — the paperwork that puts a $965 billion lab on a public-market track — Anthropic published **When AI builds itself** and told the world to consider stopping. The June 4th report, co-authored by Marina Favaro and Jack Clark, argues "it would be good for the world to have the *option* to slow or temporarily pause frontier AI development." The same week it asked the market to underwrite the race, it asked the field to brake.

The mechanism Anthropic is afraid of is **recursive self-improvement** — an AI system "capable of fully autonomously designing and developing its own successor," the point where the loop closes and humans stop driving each step. The report's own ledger says the loop is already partway internal: as of May 2026, more than 80% of the code Anthropic merges into its codebase was written by Claude, up from low single digits before Claude Code shipped in February 2025. The proof of the danger is the company's own commit history.

The ask is conditional, and the condition is the whole problem. A unilateral pause, Anthropic concedes, only works if everyone pauses — "if a slowdown simply lets the least cautious actors catch up technologically, it could leave everyone less safe." So the most valuable lab on Earth has filed to sell shares in a capability it argues is too dangerous to keep racing on, and proposed a brake that nobody can pull alone. The S-1 asks the market to price the upside; the report asks the market to fund the thing it just warned about.

Anthropic — When AI builds itselfAnthropic — draft S-1 to SECSiliconANGLEFortune (pause report)RTÉ
98FIELD REPORTMYTHOS · CHAIN

Mythos Reached 200 Companies. It Still Won't Ship.

Anthropic four-folded the trust gate instead of opening it — and added the EU's cyber agency to the queue.

Anthropic Project Glasswing expansion coverage — Claude Mythos critical-infrastructure access
IMAGECNBC

On June 2nd, Anthropic widened Project Glasswing — the partner program with preview access to its unreleased Claude Mythos bug-finder — from roughly 50 organizations to about 200, adding ~150 new partners across more than 15 countries. The new cohort fills the sectors the first one missed: power, water, communications, healthcare, and hardware. A day earlier the lab agreed to give the EU's cybersecurity agency, ENISA, access to Mythos as a Glasswing member. The model that wk-07 pledged for public release in "coming weeks" instead got a bigger waiting room.

Glasswing is the mechanism, and the mechanism is rationing. Mythos was never trained for security; it finds zero-days anyway, and Glasswing partners have already surfaced more than 10,000 high- or critical-severity flaws scanning their own codebases — the kind of vulnerability, Anthropic notes, where a single successful attack on a partner could reach more than 100 million people. Access is the throttle: every new org clears a security-criteria bar before the weights touch its repos. Anthropic's own line is that it is *"working as quickly as we can to safely release Mythos-level capabilities in general access"* — quickly, and still not yet.

A capability this asymmetric leaks defensively or offensively depending on who holds it, so Anthropic is metering it by trust rather than by price — and the same week it filed to go public, it chose to scale the gate rather than open it. That is the tell. The frontier's most dangerous model is being underwritten the way the IPO is: not released to the market, but extended to vetted counterparties one signed criteria-check at a time. For a builder, the lesson is that the next decisive tool may never appear on a pricing page — you will qualify for it, or you will read about what it found.

Anthropic (expansion)CNBC (150 orgs)CNBC (EU access)TechCrunchYahoo Finance / Quartz
99FIELD REPORT

DeepSeek Took The Money.

The lab that made frontier AI cheap without venture capital is reportedly raising $7.4 billion to keep it cheap.

DeepSeek first external funding round coverage, Tencent and CATL backing
IMAGESouth China Morning Post

On June 3rd, Reuters reported, via the South China Morning Post — citing people who declined to be named — that DeepSeek is raising roughly $7.4 billion (about 50 billion yuan) in its first-ever round of outside money, at a post-money valuation of $52 to $59 billion. Tencent is weighing about 10 billion yuan and battery maker CATL about 5 billion yuan, with fewer than ten strategic investors in the deal. Founder Liang Wenfeng is putting in roughly 20 billion yuan of his own capital — about 40 percent of the round, the dominant individual stake. The terms are not closed; the round is expected to finalize within weeks, and the numbers could move.

The reversal is the mechanism. DeepSeek built its reputation refusing this exact transaction — Liang self-funded the lab out of his quant-fund fortune precisely so it could chase artificial general intelligence without a board demanding returns, and shipped V3 and R1 as open-weight models that undercut the closed frontier on cost. That posture is now meeting its compute bill. The reported use of proceeds is not a pivot to product: it is larger GPU clusters, more semiconductors, and richer pay to hold talent. The valuation jumped roughly six-fold from the $10 billion mark in April — the market repricing the lab the moment it agreed to be priced at all.

The implication is that cheap has a capital floor. DeepSeek's whole thesis was that you could reach the frontier without the hyperscaler war chest — and in the same week Anthropic filed to go public at a near-trillion-dollar valuation, China's champion conceded that staying cheap at the frontier still costs billions. The open-weights, low-margin strategy does not escape the compute arms race; it just delays the invoice. When the lab that proved frontier AI could be self-funded takes Tencent's and CATL's money to keep going, the signal is not that DeepSeek got greedy. It is that the floor under the whole race rose, and even the cheapest player on the board can no longer stand on it alone.

SCMP (Reuters wire)Yahoo FinanceTechStartupsThe Tech Portal
II.

THE HONEST NUMBER

Berkeley released Agents' Last Exam — a thousand-plus pieces of real economic work, scored clean — and the frontier's average full pass on the hardest tier came back 2.6%, with Claude Code at zero. The same week, MiniMax shipped an open-weight model claiming to eclipse GPT-5.5 on benchmarks it ran on its own infrastructure, with the weights still unreleased. One number was measured by someone with nothing to sell; the other was graded by the vendor. Only one of them is going up.

100FIELD REPORT

Agents' Last Exam Lands. The Frontier Scores 2.6%.

A clean, unsaturated benchmark priced the gap between the valuation and the work.

Agents' Last Exam benchmark results from Berkeley RDI
IMAGEBerkeley RDI

On June 3rd, Berkeley's RDI lab released Agents' Last Exam, a benchmark built with 250+ industry experts across 13 industry clusters and 55 subfields — real, economically-valuable work in After Effects, Siemens NX, Unreal Engine, and Rhino 3D, anchored to the federal O*NET / SOC 2018 occupational taxonomy. On the hardest tier, the frontier's average full pass rate is **2.6%**. Not a leaked eval, not a saturated one — a fresh measurement of whether agents can do the jobs they are sold as replacing.

The cruelty is in the spread. The strongest configuration, **Codex** on **GPT-5.5** — which posts 82% on Terminal-Bench — scores below 50% on the *easiest* tier and 8.6% on the hardest. Claude Code lands at 0.0% on that hardest tier. These are pass/fail on full task workflows, not partial-credit token overlap — an **unsaturated benchmark**) that, unlike the SWE-bench numbers in every launch deck, nobody has had time to overfit, contaminate, or game. The corpus is 1,500+ tasks toward a 5,000 target; the paper's frozen subset reads 1,490, and the live site is newer.

This is Beat II's ledger entry against Beat I's $965B. The same week the frontier filed to go public on the premise that the work is nearly done, a clean instrument said the work is barely started — 90%-on-SWE-bench does not survive contact with After Effects. The contamination arc that ran through week-07 closes here: the question is no longer whether the benchmarks are dirty. It is whether the frontier can do real economic work at all, measured clean. The answer, for now, is 2.6%.

arXivAgents' Last ExamGitHubDigg
101FIELD REPORT

MiniMax M3 Claims The Frontier. On Benchmarks It Ran Itself.

An open-weight challenger posts frontier-parity coding scores, self-graded, with the weights still unshipped.

MiniMax M3 launch hero graphic
IMAGEMiniMax

On June 1st, MiniMax shipped M3, an open-weight coding model with a 1-million-token context window, and the pitch was a straight shot at the frontier: **59.0%** on SWE-Bench Pro, surpassing GPT-5.5 and Gemini 3.1 Pro and approaching Opus 4.7, plus 66.0% on Terminal-Bench 2.1 — at a reported five to ten percent of the cost of the closed labs it names. The API went live the same day. The model that earned the number did not.

Every one of those figures is company-reported. MiniMax states the SWE-Bench Pro run was "tested on internal infrastructure using Claude Code as the scaffolding" — its own machines, its own harness, no independent rerun — and the-decoder notes the results carry no outside verification. The cost edge is real engineering: **MSA**, MiniMax Sparse Attention, drops per-token compute to one-twentieth of the prior generation at a million tokens. But "open-weight" was the part that made the claim auditable, and at launch the weights were not released — promised on Hugging Face and GitHub "within the next ten days." A week later they are still not out: the GitHub repository's own README reads, "The model is not yet released," and points users back to M2.7.

So the receipt is a number nobody outside the building can reproduce, attached to a model nobody outside the building can run. That is not fraud; it is the new default. In a season when vendor-graded coding scores have quietly stopped meaning much — see this issue's Agents' Last Exam, the clean instrument that put the frontier at 2.6% — MiniMax launched on a self-run benchmark and led with it. For a builder, the lesson is the asterisk, not the leaderboard: a frontier-parity claim with no chain of custody is a marketing artifact until the weights drop and someone else runs the eval. Ship the checkpoint, then we will talk about 59.

MiniMax (blog)VentureBeatthe-decoderGitHub (M3 repo)
III.

THE STACK SHIFTS

Microsoft took its Agent Framework harness to 1.0 GA and handed the model a Python interpreter in a micro-VM; Cognition retired the Windsurf editor for an agent-fleet manager and an open protocol that runs any vendor's agent; and Microsoft shipped seven of its own models to need OpenAI less, the same week OpenAI started selling through Amazon. The agent loop everyone hand-rolls became a supported runtime, the IDE became a dispatcher, and the two biggest partners in AI un-bundled from each other in one news cycle. The moat was the glue, and the glue is now a dependency.

102FIELD REPORT

The Agent Loop You Hand-Roll Shipped As A Product.

Microsoft took the agent harness to 1.0 GA, then handed the model a Python interpreter in a micro-VM.

Microsoft Agent Framework at Build 2026 announcement hero graphic
IMAGEMicrosoft DevBlogs

At Build 2026 on June 3rd, Microsoft took the Agent Framework harness to 1.0 GA — the layer everyone rebuilds by hand. Shell access, filesystem access, human-in-the-loop approval, and context management across long-running sessions, all shipped as supported primitives. Automatic context compaction, a `FileMemoryProvider` for session memory, and a `TodoProvider` for task tracking now come in the box. The same day, GitHub Copilot SDK integration reached 1.0 alongside it.

The sharper move ships in the alpha `agent-framework-hyperlight` package: CodeAct. Instead of emitting one tool call per turn, the model writes a single short Python program that invokes your tools through `call_tool(…)`, and that program runs in a fresh, locally isolated Hyperlight micro-VM per call. On a representative multi-step workload — order totals across many users, dozens of tool calls — the traditional loop took 27.81 seconds and 6,890 tokens; CodeAct took 13.23 seconds and 2,489. That is a 52.4% cut in latency and a 63.9% cut in tokens, the model writing code to orchestrate the work it used to narrate one call at a time.

The hand-rolled agent loop was a moat made of glue. Microsoft just commoditized the glue, and then argued the loop itself is the wrong abstraction — that for tool-heavy work the model should write the program, not play the dispatcher. Run `create_harness_agent` and you inherit the compaction, the memory, and the todo tracking you were about to write yourself. The question stops being whether you can build the runtime, and becomes whether the runtime you built is faster than the one that now ships with a version number.

Microsoft DevBlogs — Agent Framework at Build 2026Microsoft DevBlogs — Foundry Agent Service at Build 2026Microsoft Agent Framework (GitHub)
103FIELD REPORT

Cognition Killed The Editor. Devin Desktop Manages A Fleet.

The unit of the dev tool stopped being a file. It is now an agent roster.

Cognition Devin Desktop Agent Command Center hero graphic
IMAGECognition

On June 2nd, Cognition retired the Windsurf brand and shipped what replaces it: Devin Desktop, pushed to existing users as a standard over-the-air update. The editor is no longer the center of the IDE. The new default surface is the Agent Command Center — a Kanban board where, in Cognition's words, "you manage every local and cloud agent from a single Kanban view." Days after the company raised $1 billion at a $26 billion valuation, it spent the product launch arguing the editor is the wrong abstraction.

Two pieces make the shift load-bearing. The local agent was rewritten from scratch in Rust as Devin Local, which Cognition claims is up to 30% more token efficient than the Cascade engine it retires; legacy Cascade runs only through July 1st. The interop layer is the Agent Client Protocol, an Apache 2.0 standard for editor-to-agent communication. Devin Desktop speaks it, so Codex, Claude Agent, OpenCode, and any other ACP-compatible agent run as first-class citizens beside Devin, with a primitive called Spaces letting related agents share context.

The agent loop most builders hand-roll — spawn three vendors' CLIs in three terminals, reconcile their diffs by hand — shipped this week as the default chrome of a shipping IDE. ACP is the part that matters: an open protocol means the host stops being a vendor lock. Adopt it and your in-house agent plugs into any compliant editor; refuse to pick one vendor's agent and run them side by side instead. The dev tool's unit of work just moved from the file you edit to the fleet you dispatch.

Cognition blogDevin blogAgent Client ProtocolTechCrunch (Series C)
104FIELD REPORT

Microsoft Shipped Seven Models To Stop Renting OpenAI.

The same week it launched its own frontier stack, OpenAI went generally available on Amazon — the two biggest partners un-bundled in one news cycle.

Microsoft launches seven in-house MAI models at Build 2026
IMAGECNBC

At Build on June 2nd, Microsoft launched seven in-house MAI modelsMAI-Thinking-1, MAI-Code-1-Flash, MAI-Image-2.5 and its Flash variant, MAI-Transcribe-1.5, and MAI-Voice-2 and its Flash variant — and CNBC read the move plainly: the lineup exists to lessen reliance on OpenAI and lower costs for developers. After investing $13 billion in the partner whose models it has resold since 2023, Microsoft AI chief Mustafa Suleyman said the in-house stack, tuned on consulting-firm workloads, outperformed GPT-5.5 at ten times better cost efficiency. MAI-Code-1-Flash is already live in GitHub Copilot and VS Code, in the model picker and under the default auto router.

The receipts are company-reported, and worth reading as such. Microsoft says MAI-Code-1-Flash — a 5-billion-active-parameter agentic coder — beats Claude Haiku 4.5 on SWE-Bench Pro, 51.2% to 35.2%, a 16-point lead, while solving harder problems with up to 60% fewer tokens on SWE-Bench Verified. The reasoning model, MAI-Thinking-1, is a 35-billion-active, roughly one-trillion-total mixture-of-experts trained from scratch on licensed data with no distillation from any third-party model; Microsoft reports it matches Opus 4.6 on SWE-Bench Pro and posts 97.0% on AIME-2025. The pitch is not that these win the absolute frontier — it is that Microsoft owns the weights, runs them on Azure, pays no partner royalty, and hands the saving down the stack.

The geometry is the story. In the same news cycle, OpenAI's GPT-5.5, GPT-5.4, and Codex went generally available on Amazon Bedrock on June 1st — first-party pricing, usage counting toward existing AWS commitments, the first time those models shipped on a non-Microsoft cloud. So OpenAI now sells through Microsoft's largest rival while Microsoft ships models built to need OpenAI less: the most consequential partnership in the industry quietly un-bundled from both ends at once. For a builder, the abstraction that loosened this week is the assumption that the cloud and the model travel together. The frontier model is becoming a commodity you route to on cost, and the lab and the cloud you buy it from no longer have to be the same company.

Microsoft AI — Launching seven new MAI modelsMicrosoft AI — Introducing MAI-Code-1-FlashMicrosoft AI — Introducing MAI-Thinking-1CNBC — Microsoft unveils models to lessen reliance on OpenAIAWS — OpenAI GPT-5.5, GPT-5.4, and Codex GA on Amazon Bedrock
IV.

THE LANDLORD

SpaceX agreed to rent Google about 110,000 GPUs for $920 million a month through 2029 — its second hyperscaler landlord deal in a quarter, after Anthropic — while at Computex Nvidia put Vera Rubin into full production and declared every token a billable unit of revenue. The demand side rents the floor; the supply side builds the silicon both tenants rent. Owning electrons-plus-silicon is the franchise now, and the meter runs by the token.

105FIELD REPORT

Google Rented The Colossus Too.

SpaceX now bills the AI franchise. Google pays $920 million a month for the same electrons it sold Anthropic.

Coverage of Google's $920M-per-month compute deal with SpaceX
IMAGETechCrunch

On June 5th, a SpaceX free-writing prospectus disclosed that Google agreed to pay SpaceX $920 million a month for compute capacity, running October 2026 through June 2029. The package is approximately 110,000 NVIDIA GPUs, CPUs, memory, and related silicon, sited at the same xAI data centers SpaceX already leases to Anthropic. Filed Pursuant to Rule 433 against an active S-1, the line landed in the same week SpaceX itself filed to go public — the landlord priced the floor on the way to the auction.

The mechanism is that SpaceX owns neither the chips nor the breakthrough — it owns the power and the buildings around Colossus near Memphis, and it rents that substrate to whoever is short. Google called it "bridge capacity to meet surging customer demand" for Gemini Enterprise; the agreement ramps through September at a reduced fee, with a hard GPU-delivery deadline of September 30th before Google can walk. At $11 billion a year, Tom's Hardware notes SpaceX's projected data-center revenue would top its Starlink, launch, and AI proceeds combined.

This is the second SpaceX landlord deal in a single quarter, following the $1.25-billion-a-month Anthropic lease that week-06 read as the moment the limit became electrons, not chips. The renter is no longer paying for a model; it is paying for a substation, a slab, and a delivery date. Owning electrons-plus-silicon is the franchise now — and the quietest detail is that Musk's xAI is Google's compute landlord while Musk litigates OpenAI.

TechCrunchSEC (SpaceX FWP, Rule 433)Tom's HardwareCNBC
106FIELD REPORT

Nvidia Put Vera Rubin Into Full Production. Tokens Are The Revenue Now.

At Computex, Jensen repriced the silicon supply chain around inference at industrial scale.

Jensen Huang GTC Taipei keynote at Computex 2026, Vera Rubin platform
IMAGENVIDIA

On June 1st, on the GTC Taipei stage at Computex, Jensen Huang announced the **Vera Rubin** platform "now in production" — Nvidia's next rack-scale generation, purpose-built for what he called agentic AI factories. The keynote ran a single thesis on a loop: agentic AI has arrived, it works, and it pays. Underneath the slideware sat a number with no marketing in it. Five years ago Nvidia spent between $10 billion and $15 billion a year in Taiwan; that figure is now roughly **$150 billion**, with AMD pledging over $10 billion into the same supply base over a comparable window.

The mechanism is the Vera Rubin NVL72, and the load-bearing detail is manufacturability, not FLOPS. Its cable-free, hose-free, fanless modular tray cuts assembly "from two hours to five minutes per compute tray" — Nvidia is optimizing the build line the way it once optimized the die, because the binding constraint on an AI factory is no longer the chip but how fast you can rack, power, and cool it. Huang made the accounting explicit — compute is revenue, every token produced profitable — which reframes performance-per-watt, reliability, and system lifetime as the financial levers, not the spec sheet.

That is the supply side of the franchise THE SIGNAL has tracked all quarter, and it closes a loop. The demand side rents — Google is paying SpaceX about $920 million a month for GPU capacity — while the supply side builds the silicon both of them rent. For a builder, the repricing is the signal: when the company that makes the picks declares every token a billable unit and spends $150 billion a year to mint more of them, inference stops being a cost line and becomes the meter. The frontier is no longer selling computers. It is selling the throughput, and it has started counting it by the token.

NVIDIA (blog)SiliconANGLECrypto Briefing
V.

THE GROUND WON'T HOLD

A self-spreading worm poisoned Red Hat's npm packages with valid provenance signatures and went hunting the Anthropic API keys the stack runs on; one scanner read 39,884 MCP servers and surfaced 67 CVEs of a single structural class, the tool surface everyone is bolting onto their agents. Then Washington answered, with an executive order asking labs to voluntarily hand the government 30 days of early access and standing up a cyber clearinghouse. The supply chain under the frontier kept failing in public, and the trust signals built to catch it — provenance, last week's patch advice, the audit — were a step behind each time.

107FIELD REPORT

A Worm Poisoned Red Hat's Packages. The Signatures Checked Out.

Valid provenance signed the malware. The trust stamp builders were told to rely on stopped meaning anything.

Miasma npm supply-chain campaign research hero graphic
IMAGEWiz Research

A self-replicating worm researchers named **Miasma** — the latest strain of the Shai-Hulud lineage THE SIGNAL has tracked across the npm ecosystem — trojanized 32 packages, across more than 90 versions, under the `@redhat-cloud-services` scope after taking over a maintainer's GitHub account. The packages pull between 80,000 and 117,000 downloads a week. Microsoft Threat Intelligence and Wiz both confirmed the compromised builds harvest cloud credentials, SSH keys, and — newly — Anthropic API keys from the environments that install them.

The structurally new part is what made it invisible. The malicious versions were published through Red Hat's own legitimate GitHub Actions OIDC pipeline, so every poisoned build carried valid SLSA provenance — the cryptographic attestation that is supposed to prove a package was built by who it claims. Two days later the campaign escalated again: StepSecurity and Snyk reported a variant that moves its execution into a native-build configuration file, running during `npm install` on packages that declare no install scripts at all — slipping past the `--ignore-scripts` defense the whole ecosystem deployed last week. It also dropped backdoor config into `.claude` and `.cursor` folders, poisoning the developer's coding agent, not just the build.

Provenance was the answer the supply-chain panic had settled on: sign the build, verify the chain, trust the stamp. This worm shipped with the stamp. A valid signature now tells you a package was built by the pipeline it claims — and nothing about whether that pipeline was the attacker's for an afternoon. The defenses keep getting one disclosure behind because each one hardens the last hole; the worm rotates to the trusted channel nobody was watching, which this week was the one with the green check.

Wiz Research — Miasma supply-chain attack targeting Red Hat npm packagesMicrosoft Security — Preinstall persistence inside the Red Hat npm Miasma campaignThe Register — Shai-Hulud malware infects Red Hat npm packagesStepSecurity — binding.gyp npm supply-chain attack spreads like a worm
108FIELD REPORT

One Scanner Read 39,884 MCP Servers. It Found 67 CVEs And Counting.

The tool surface everyone is bolting onto their agents is one structural flaw, measured at ecosystem scale.

MCP server security research illustration
IMAGEAkamai Security Research

A taint-analysis framework called **VIPER-MCP** scanned 39,884 real-world Model Context Protocol server repositories and surfaced 106 zero-day vulnerabilities with confirmed end-to-end traces — 67 of them now carry assigned CVE IDs, the count climbing through the week as the disclosures land. Every one belongs to a single structural class. It is the first ecosystem-scale measurement of how exploitable the MCP tool surface actually is, and it arrived the same month Akamai documented three more in database-backed MCP servers — one of which the vendor declined to patch, calling the exposure intended behavior.

The class is the story. An MCP server hands an agent a set of tools; the agent fills those tools with natural-language arguments it chose; and on the affected servers those arguments reach a sensitive operation — a shell command, a database query, a file path — without ever being treated as untrusted. The model becomes the injection vector by design, because the input it generates is wired straight to the sink. This sits on top of an exposure problem Censys measured separately: more than 21,000 MCP servers are reachable on the open internet, and roughly 40% of the remote ones expose their tools with no authentication at all.

Most of the agent stack treats MCP as plumbing — install a server, expose a few tools, move on. This is the week the plumbing got measured, and it reads as a code-execution surface with a four-figure CVE count ahead of it. Until proven otherwise, every community MCP server in your stack is a path from a sentence the model wrote to something the model should never have been able to run.

VIPER-MCP — Detecting and Exploiting Taint-Style Vulnerabilities in MCP Servers (arXiv)Akamai Security Research — three MCP back-end vulnerability patternsAdversa AI — Top MCP security resources, June 2026The Hacker News — Censys scan of exposed AI / MCP services
109FIELD REPORT

Washington Answered. The Gate Is Now Voluntary.

Trump signed an order asking the labs for 30 days with their frontier models before you get them.

Trump signs executive order on AI innovation and security coverage hero
IMAGECNBC

On June 2nd, President Trump signed an executive order, *"Promoting Advanced Artificial Intelligence Innovation and Security,"* directing a voluntary framework under which AI developers can give the federal government access to a covered frontier model "for a period of up to 30 days before they plan to release such models to other trusted partners." It is a fundamental shift from the administration's previous hands-off stance — and a deliberately defanged one: an earlier draft set the window at 90 days, cut to 30 as a compromise between the national-security and anti-regulation camps. OpenAI, Anthropic, and Google publicly welcomed it.

The mechanism is a request, not a rule. Section 3 stands up a "voluntary framework with AI developers" and then forecloses the obvious next step: "Nothing in this section shall be construed to authorize the creation of a mandatory governmental licensing, preclearance, or permitting requirement" for releasing a model. Around that voluntary core the order builds the apparatus of a pre-release testing regime — a classified benchmarking process "to assess the advanced cyber capabilities of AI models," an NSA-run designation of which models count as covered frontier models, and a Treasury-led AI cybersecurity clearinghouse that coordinates and deconflicts the scanning of software for vulnerabilities. The state built the gate; walking through it stays optional.

This is the regulator's version of the same move Anthropic just made with Mythos — ration the dangerous capability behind a trust check rather than ship it raw — except the trusted party is now the government, and the currency is early access instead of a security-criteria bar. The voluntary label is the load-bearing fiction: a 30-day federal window that every major lab adopts "to forestall more invasive regulation later" is a standard, not a suggestion, however the text reads. The frontier filed to go public this week; Washington answered by asking, politely, to see the weights first. For a builder, the model you ship may soon clear a classified benchmark before it clears your changelog — and nobody will have passed a law.

The White House (primary)CNBCScientific AmericanCouncil on Foreign Relations
VI.

THE MATTER

Microsoft unveiled a device platform for hardware that runs agents instead of apps, its bid to be Android for the post-app era; and a Rest of World investigation found the Chinese humanoid-data race running not on simulation but on armies of human workers teleoperating tasks by hand. The embodiment frontier opened a new kind of device and revealed the labor underneath the old promise. The robots are coming, and for now they run on human hands filming the same folded shirt ten million times.

110FIELD REPORTMATTER

Microsoft Wants To Be Android For The Agent Era.

Not the device — the platform every device maker builds on. Project Solara runs agents where apps used to live.

Stevie Bathiche presents Microsoft Project Solara at Build 2026
IMAGEGeekWire

At Build on June 2nd in San Francisco, Microsoft unveiled Project Solara — a platform for devices that run AI agents instead of apps, built on Android rather than Windows, spanning, in the company's words, from chip to cloud. It arrived with two working reference devices — a desktop hub and a wearable badge — and a roster of named pilots: AccuWeather, Best Buy, CVS Health, Levi's, and Target. Microsoft is not shipping the hardware. It is shipping the substrate the hardware makers build on, the same bet it placed on the PC five decades ago.

The platform is the Microsoft Device Ecosystem Platform, or MDEP, an enterprise build of the Android Open Source Project) chosen over Windows to run on smaller, lower-power silicon. Qualcomm and MediaTek are the first chip partners — the badge on a new Qualcomm wearable chip, the desk hub on MediaTek IoT silicon, both off-the-shelf so devices stay cheap and fast to build. The badge is the tell: in one demo it ran agents for a health-care worker, able to scan a patient's QR code, record and transcribe the visit, log vitals, and start a prescription. One fingerprint button wakes an agent; one tap transcribes; the camera lets the agent act on what the wearer sees.

Microsoft says it won't ship these devices itself — hardware makers turn the reference designs into vertical products, one per industry, company, or scenario. That is the whole strategy in a sentence. The PC era was won by whoever owned the layer every machine ran on, not whoever made the best machine, and Microsoft is reaching for the same chokepoint in the agent era: own the OS, the management plane, and the agent runtime, and let everyone else fight over the plastic. For a builder, the abstraction that just cracked is the app. Solara is a wager that the post-app device is real, that it opens in physical hardware on a healthcare worker's lanyard, and that the floor it stands on will be rented from Redmond.

GeekWire — Inside Microsoft's Project SolaraTom's Hardware — Microsoft unveils Project Solara, a chip-to-cloud platform for agent-first devicesEngadget — Microsoft announces Project Solara, its take on an AI agent platform
111FIELD REPORTMATTER

The Humanoids Run On Human Hands. China Industrialized The Floor.

The bottleneck on physical AI was never compute — it is demonstration data, and it is being mined as cheap manual labor.

Worker wearing head-mounted cameras demonstrating household chores to generate humanoid-robot training data in China
IMAGERest of World

On June 3rd, Rest of World reported the labor floor under the embodiment hype: in Suqian, JD.com plans to pull 100,000 of its own employees and 500,000 external workers into a two-year program to film 10 million hours of people doing chores. The footage trains humanoid robots. One worker, Gao Bo, earns 20 yuan ($3) an hour filming herself cooking and folding laundry six hours a day, strapped into head-mounted cameras and wrist sensors. "No one had paid me to cook and do laundry before," she told the reporter.

The mechanism is teleoperation and demonstration — a human performs a task while sensors log the synchronized joint motions, rotations, and vision a robot policy needs, the kind of action-state data that cannot be scraped from the internet or generated in simulation at the variety the real world demands. China is industrializing it: a Beijing facility in Shijingshan spans over 10,000 square meters, where 100 robots and their human handlers complete at least 12,000 data-collection tasks a day, and standardized data collection is now written into the 15th Five-Year Plan. "Imitation learning, by using real human demonstration data, allows robots to gradually acquire a wide range of human-like actions," says Unitree founder Wang Xingxing.

This is the substrate every embodiment headline stands on. Figure, Tesla, and BMW announce which robot got deployed; nobody announces who taught it, because the teacher is a worker on a kiwifruit farm wearing a GoPro for three dollars an hour. The hardware was the easy part — actuators are a solved supply chain. The hard part is the demonstration, and the demonstration is human, manual, and cheap. The humanoid revolution does not run on simulation. It runs on a folded shirt, filmed ten million times.

Rest of WorldPeople's Daily