Dev Digest — May 15, 2026

🔥 HOT RELEASES

xAI Grok Build Beta Elon's entry into the AI coding agent war. Autonomous CLI with parallel subagents, worktrees, MCP support, headless mode for CI/CD. SuperGrok Heavy subscribers only. Elon also teased that Grok V9 1.5T training is looking great, with Cursor data coming in supplemental training. 🔗 X: https://x.com/RoundtableSpace/status/2055117211774181690 🔗 X: https://x.com/elonmusk/status/2055296105949401342

Supabase Plugin for AI Coding Agents New MCP + skills plugin that lets AI coding agents (Codex, Claude Code, Cursor, Gemini CLI) build directly on Supabase — schema management, migrations, runtime queries through a unified protocol layer. 🔗 X: https://x.com/dshukertjr/status/2055272485424132488

cmux Vault (v0.64+) cmux now has a right sidebar vault showing every Codex, Claude Code, OpenCode, and Pi session. Full-text search across all sessions, drag-and-drop into workspace. 🔗 X: https://x.com/lawrencecchen/status/2055248017025114609

OpenClaw fs-safe TypeScript Security Library New filesystem security hardening lib shipping with OpenClaw — replaces ad-hoc hardening, 10x faster file ops. 🔗 X: https://x.com/steipete/status/2055179961535705327 🔗 Web: https://fs-safe.io

Bun v1.4 Incoming Jarred Sumner confirmed the next Bun release will be v1.4 (not a patch) — enough new features since v1.3.1 to justify a minor bump. 🔗 X: https://x.com/jarredsumner/status/2055213234517659671

VS Code: How GitHub Copilot's Agent Harness Works Deep engineering post from VS Code team on the coding harness layer — context management, tool calling, agent loops, terminal execution, and memory behind Copilot. 🔗 X: https://x.com/code/status/2055317356910367189 🔗 Blog: https://code.visualstudio.com/blogs/2026/05/15/agent-harnesses-github-copilot-vscode

Vercel: Protected Source Maps You can now protect source maps with Vercel Authentication — debug production without exposing source code. 🔗 X: https://x.com/vercel_dev/status/2055343597281800414 🔗 Web: https://vercel.com/changelog/protected-source-maps-ship-browser-source-maps-securely

🧪 INTERESTING REPOS

LEANN — 201GB to 6GB Text Compression Shrinks massive text datasets to 97% smaller than vector DBs without losing accuracy. Runs locally, drop-in MCP for Claude. Open source. 🔗 X: https://x.com/HowToAI_/status/2055295769549418580 💻 GitHub: https://github.com/yichuan-w/LEANN

X Algorithm (Open Source) xAI open-sourced the X/Twitter recommendation algorithm code. Worth a read to understand how posts are ranked and served. 🔗 X: https://x.com/AdrianDittmann/status/2055292266055659704 💻 GitHub: https://github.com/xai-org/x-algorithm

agents-towards-production Production-ready AI agent tutorials with real use cases. Full code + deployment guides. 🔗 X: https://x.com/midudev/status/2055276269705498790 💻 GitHub: https://github.com/NirDiamant/agents-towards-production

awesome-autonomous-vehicles Courses, datasets, and open source software for autonomous driving. Comprehensive resource list. 🔗 X: https://x.com/tom_doerr/status/2055244454995333237 💻 GitHub: https://github.com/manfreddiaz/awesome-autonomous-vehicles

voice_datasets 95+ open source voice datasets — useful for TTS/STT projects. 🔗 X: https://x.com/tom_doerr/status/2055113282134946065 💻 GitHub: https://github.com/jim-schwoebel/voice_datasets

🔐 SECURITY ALERT

node-ipc Compromised Again Three malicious versions (9.1.6, 9.2.3, 12.0.1) published via expired-domain account takeover. Credential stealer harvests AWS/GCP/Azure keys, SSH keys, npm tokens, .env files — exfiltrates via DNS TXT queries. CommonJS consumers affected; ESM-only safe. If you loaded it, rotate ALL credentials immediately. 🔗 X: https://x.com/feross/status/2055006045077230048 🔗 Blog: https://socket.dev/blog/node-ipc-package-compromised

Pwn2Own Berlin 2026 — Day 2 Orange Tsai earned $375K in 24 hours (Edge sandbox escape + Exchange). Cursor was exploited by Compass Security ($15K). OpenAI Codex, LiteLLM, NVIDIA Container Toolkit, and Claude Code all targeted. $500K+ awarded on Day 1 alone. 24 zero-days disclosed so far. 🔗 X: https://x.com/IntCyberDigest/status/2055314931495416051 🔗 X: https://x.com/thezdi/status/2055310957040046135

🎥 WORTH WATCHING

"How to Actually Build Mobile Apps with AI in 2026" — JS Mastery Full Duolingo clone in React Native using "Practical Vibe Coding" — AI-generated PRs reviewed by CodeRabbit, real-time AI teacher via Stream, zero manual code. 🔗 X: https://x.com/jsmasterypro/status/2055279049547944434 🔗 Video: https://jsm.dev/twitter-yt-lingua

freeCodeCamp: Claude Code for Beginners In-depth guide on Claude Code as an agentic coding partner — setup, workflows, permissions, real projects. 🔗 X: https://x.com/freeCodeCamp/status/2055318199453855835 🔗 Guide: https://www.freecodecamp.org/news/claude-code-for-beginners/

💡 TECHNIQUES & IDEAS

5-Person Startup Outrunning 50+ Teams Stack: Claude Code + Cursor for code gen, Supabase for DB, Vercel for deploy, PostHog for analytics, Kit for emails. The thesis: small teams with AI agents can outrun 10x larger companies. 🔗 X: https://x.com/askOkara/status/2055254550588907554

AI Coding Agent Rankings 2026 Claude Code (Opus 4.7) leads at 87.6% SWE-bench. GPT-5.5 tops Terminal-Bench at 82.7%. Most productive devs run three layers: terminal agent + IDE extension + open-source tool. 🔗 X: https://x.com/Marktechpost/status/2055205759949172793 🔗 Article: https://www.marktechpost.com/2026/05/15/best-ai-agents-for-software-development-ranked-a-benchmark-driven-look-at-the-current-field/

Karpathy on 2026 Hiring "Build a large project with Claude Code — like a Twitter clone. Have real agents using the platform. The interviewer uses parallel agents trying to break in to verify security." One person, multiple agents, shipping and defending simultaneously. 🔗 X: https://x.com/sairahul1/status/2055199868474589267

🔮 EMERGING TRENDS

The AI Coding Agent War Heats Up Three major launches in one day: xAI's Grok Build, Google gearing up for I/O (May 19), and VS Code revealing Copilot's agent harness internals. Every major player now has an autonomous coding agent. The differentiation is shifting from models to harnesses — context management, tool orchestration, and agent loops.

MCP Becoming the Standard Glue Supabase's new plugin, LEANN's Claude integration, Google's 13 official agent skills — everything speaks MCP now. The fragmentation era of custom integrations is ending.

Security Targets Shift to AI Tools Pwn2Own Berlin explicitly targets AI infrastructure (Cursor, Codex, Claude Code, LiteLLM). node-ipc supply chain attack shows the Node ecosystem remains vulnerable. Security is the next frontier for AI-powered dev tools.

Google I/O May 19 Official reminder dropped today. Expect Gemini updates, Android XR/smart glasses, and likely new developer AI tooling. Quantum + AI crossover session confirmed.

Full digest: https://digest.99.cooking