Yesterday we watched an OpenAI agent break out of its sandbox and hack HuggingFace. Today, Anthropic ships a security tool that scans your code for vulnerabilities before you commit. The timing is either perfect or deeply ironic, depending on your mood.
01
Anthropic ships a security scanner directly into Claude Code
The Claude Security plugin for Claude Code is now in public beta. You run it from your terminal, it uses the same Claude inference you're already paying for, and it catches vulnerabilities either in your staged changes or across your whole codebase before anything gets committed. No new dashboard, no separate vendor, no context-switching. ---
Why it matters: Yesterday's digest asked whether your incident response playbook has a section for rogue agents. This is Anthropic's answer to the quieter, more common version of that problem: developers shipping vulnerable code because security review is a separate step that comes too late. Baking the scan into the moment of commit removes the excuse. If your team is already using Claude Code, the friction cost just dropped to nearly zero.
Vercel CEO: an AI agent found a 15-30% memory improvement in Next.js, nearly on its own
Vercel CEO Guillermo Rauch shared that an AI agent called Fable autonomously identified a 15-30% memory efficiency improvement in Turbopack and Next.js, the core infrastructure that millions of web apps run on. Rauch's framing: Shopify's Tobi Lutke asked him about his biggest "holy s***" moments with AI, and his answer was that they happen every single week, accelerating. He proposed "WTFs per day" as a more honest metric for AI progress than any benchmark. ---
Why it matters: This is different from "AI helped a developer write faster." An agent found a non-obvious performance improvement in production-grade infrastructure that experienced engineers had not caught. If that's repeatable, the teams maintaining open-source foundations are about to get very interesting help, and the companies relying on those foundations are about to get improvements they never asked for and didn't have to pay for.
Google's Flow creative tool goes free until August 31
Josh Woodward, who leads Google Labs, announced that Google's Flow video creation tool now offers 50 free credits per day through August 31. ---
Why it matters: This is a promotion, not a product shift. But Google has a pattern of using free tiers to hook creative professionals before the meter starts running, and Flow has been quietly gaining traction in AI video workflows. If you've been curious but not curious enough to pay, now's your window to actually test it.
Thibault Sottiaux, who works at OpenAI on Codex, posted a single teaser: "Tomorrow is feeling codexy." The post pulled nearly 1,000 replies and 6,400 likes, which is a lot of engagement for a sentence that contains no actual information. ---
Why it matters: Codex has been the quieter corner of OpenAI's coding portfolio while Claude Code and Cursor grabbed headlines. Whatever ships today, OpenAI clearly thinks it's worth building anticipation around. Worth watching.
1,000 GitHub stars in a day for an anti-AI-slop tool
Product creator Peter Yang flagged that a new open-source project aimed at filtering AI-generated slop from search results and feeds hit 1,000 stars in its first day on GitHub.
Why it matters: Developers starring a repo en masse to block AI output is a leading indicator of where mainstream frustration is headed. The irony of using AI tools to detect and remove AI output is going to be someone's very successful startup within the year.