In partnership with
🧠 THAT ONE AI - This Week’s Signal
Here’s what’s shaping AI right now - without the noise:
🛡️ Anthropic named seven Chinese labs that were distilling Claude
💻 Gemini is now a native Windows app with a global hotkey
🚧 OpenAI stopped selling Pro subscriptions because Astra is too popular
🧠 How to stop your coding agent from installing a package that does not exist
📝 PROMPT WORTH SAVING
🧰 Tools worth testing
🛡️ Anthropic Named Seven Chinese Labs That Were Distilling Claude
Anthropic published a 154 page threat report covering eight months of misuse it shut down. The section builders should read twice is the one on distillation. Anthropic names Alibaba, DeepSeek, Moonshot, and Xiaomi among seven Chinese labs that ran thousands of fraudulent accounts to pull training data out of Claude.
Two of them went further than scraping. Anthropic says Moonshot and DeepSeek relayed paying customers' prompts to Claude in some cases, served the answers back as their own model output, then used those responses for training.
The rest of the report is heavier. A Yemen operation used Claude Code to write rocket guidance software and came back for advice after the test flight failed. A consultant built Mali's spy agency a system aimed at 25M phone lines. Add 4,700 dating app personas and malware rewritten to dodge antivirus. All of it happened on Opus-level models and below. Read the report.
The bigger signal: 👉 If you benchmarked a Chinese model this year and the outputs felt suspiciously familiar, you may have been benchmarking Claude.
Stop rewriting prompts. Start engineering loops.
Most developers still babysit AI one prompt at a time. Top engineers don't. They build loops: systems where AI plans, executes, and self-corrects while they focus on what matters. The Code built The Ultimate Guide to Loop Engineering to give you the exact techniques Silicon Valley engineers use to ship faster.
Sign up for The Code and get:
The Ultimate Guide to Loop Engineering, the patterns that turn AI from assistant into engine, plus real workflows you can set up today
The Code newsletter (5 min daily) to keep learning the agentic techniques keeping top engineers 6 months ahead
💻 Gemini Is Now a Native Windows App With a Global Hotkey
Google shipped Gemini as a real desktop application for Windows. Alt+Space opens it over whatever is on screen, and it reads context from Gmail and Drive without a browser tab sitting in the middle.
The app carries the Gemini Spark agent alongside chat, image generation, and video generation in one surface. Google also pushed Dreambeans out of Labs, which turns selected Gmail, Calendar, Photos, Search, and YouTube context into a short daily list of reminders. See the announcement.
Microsoft spent two years wiring Copilot into the Windows taskbar. Google skipped the negotiation entirely and put a competing assistant one keystroke away on the same operating system.
The bigger signal: 👉 The assistant fight moved from the browser to the OS keybinding, and Google does not need Microsoft's permission to compete there.
🚧 OpenAI Stopped Selling Pro Subscriptions Because Astra Is Too Popular
OpenAI paused new Pro signups. Thomas Sottiaux said Astra is drawing more demand than the company's systems can serve, so new Pro customers are locked out while existing ones get better access.
That landed in the same week Sam Altman reportedly floated pacing frontier development at an all-hands, and OpenAI asked Congress whether a coordinated industry slowdown would trip antitrust law. See the post.
Astra is being rationed by compute supply. Anyone who wrote it into a product roadmap this month now shares a budget with every ChatGPT Pro user on the planet.
The bigger signal: 👉 When a frontier lab turns off its own checkout page, model availability becomes a dependency you plan around the way you plan around a database.
🧠 That One AI Tip: Put a Gate Between Your Coding Agent and Your Package Manager
Two of this week's stories land on the same weak point. Package registries were built on the assumption that a human typed the install command. That assumption is gone.
The failure mode has a name now. Slopsquatting: a model hallucinates a package that sounds plausible, somebody registers that exact name with malicious code inside, and every agent that hallucinates it again installs the payload. Once the name exists on the registry, the hole stays open. A smarter model does not close it.
Four things to set up, ordered by how long each takes.
Write the rule where the agent will actually read it
Never install a package I have not approved.
Before adding any dependency, stop and tell me:
- the exact package name and version
- the registry it comes from
- what it does and why you need it
- whether it is already in the lockfile
Wait for my yes before running any install command.Positive rules land better than prohibitions. "Stop and tell me" gets followed more reliably than "do not install things."
Make new dependencies impossible to miss in review
Agents bury a new dependency at line 340 of a 900 line diff. Pull the manifest changes out on their own before you read anything else:
bash
git diff main --unified=0 -- package.json package-lock.json \
requirements.txt pyproject.toml Gemfile Gemfile.lock go.modRun it on every agent branch. An empty result means the diff is a lot safer than it looked.
Verify the package existed before your agent thought of it
A real dependency has history behind it. A slopsquat usually does not:
bash
npm view <package> time.created versions maintainers
pip index versions <package>
gem info -r <package>Published two weeks ago, one version on the shelf, a single maintainer, and no other packages under that account. Four flags like that together, and you stop.
Put a scanner in CI so the check survives your attention span
Add OSV Scanner to your pipeline. It checks your lockfile against the Open Source Vulnerability database and fails the build when it finds a known bad version. Get the scanner.
The bigger signal: 👉 Your agent's install command is an attack surface now, and the only control that holds is a human approval step you cannot skip by accident.
That One AI 🧰 TOOLBOX
A few tools quietly worth exploring:
🎨 Krea Agents → Creative agent with memory and style skills, wired into Slack and Figma.
🖥️ Figr → Generates product screens that follow your existing design system and flows.
🧑 Tavus Phoenix 4.5 → Renders real-time AI humans at 134ms with upper-body nonverbal cues.
🗂️ chat-recall → Merges Claude Code, Codex, Cursor, and OpenCode logs into one searchable local history.
The agentic era needs a different CRM. That’s Attio.
Parallel, Turbopuffer, and Wordsmith run their entire GTM motion on Attio, with agents that chase every buying signal, build pipeline, and move deals forward, 24/7.
📝 PROMPT WORTH SAVING: The Cut List
Every backlog is a graveyard with good lighting. This one makes the model do the part you keep avoiding, which is naming what dies and why.
You are a ruthless head of product. I am going to paste my backlog. Do not be encouraging.
For every item, score these four things and show your work:
- Reach: how many of my users this touches, as a number or a percentage. If I have not told you, write UNKNOWN and move on.
- Effort: your estimate in person-days, plus the assumption you made to get there.
- Reversibility: cheap to undo, or expensive to undo.
- Evidence: what I actually know versus what I am assuming. Quote my own words back to me where I am guessing.
Then do four things.
1. Rank every item. No ties. If two are close, break the tie and say why.
2. Name the bottom 40% as a cut list. For each one, give the specific reason it loses to the item ranked above it.
3. Flag any item I am building because it is technically interesting rather than because someone asked for it. Be blunt.
4. Tell me the single piece of evidence I could collect this week that would most change the ranking, and how I would collect it.
Finish with the two items I should start Monday, and what I should say to the person whose favourite feature just landed on the cut list.
Context: [team size, what you ship, who your users are, the deadline you care about]
Backlog: [paste it, one item per line]What it does: It scores every backlog item on reach, effort, reversibility and evidence, then forces a strict ranking with an explicit cut list and a named reason behind every kill.
How it helps: Most backlogs grow because nothing ever leaves them. The forced 40% cut is the part that does the work, and the evidence column stops you from ranking your own assumptions as facts. The closing line about the stakeholder is there on purpose, since that conversation is usually the real reason dead features stay alive.
The bigger signal: 👉 A backlog without a cut list is a wish list, and wish lists do not ship.