The week's biggest infrastructure story was Anthropic leasing the entire Colossus 1 supercomputer cluster from SpaceX — 220,000 NVIDIA GPUs and 300 megawatts of… Compiled for immediate developer deployment.
calendar_todaysummarizeWeek 19-2026bolt1 CRITICAL
article
TAG: INDUSTRYREAD_TIME: 9_MIN
Anthropic SpaceX Deal: What Developers Need to Know
Anthropic has leased the entire Colossus 1 supercomputer cluster from SpaceX, gaining access to 220,000 NVIDIA GPUs and 300 megawatts of power capacity within one month of announcement. The deal was driven by an 80x annualized revenue growth surge in Q1 2026, far exceeding the projected 10x, which caused severe capacity shortages for Claude Pro, Max, and API users. As a direct result, Claude Code five-hour rate limits doubled and peak-hour throttling was eliminated for Pro and Max plans. The arrangement is notable given Elon Musk's February 2026 public attacks on Anthropic and the prior ban on xAI from using Claude via Cursor. Colossus 1 became available because SpaceX migrated Grok training workloads to the larger Colossus 2 cluster, leaving the Memphis facility underutilized and generating little revenue ahead of SpaceX's planned IPO.
Next.js May 2026 Security Release: 13 Advisories Including CVE-2026-23870
Vercel has shipped a coordinated security release for Next.js addressing 13 advisories spanning denial of service, middleware and proxy bypass, server-side request forgery, cache poisoning, and cross-site scripting. One advisory covers an upstream React Server Components vulnerability tracked as CVE-2026-23870. High-severity issues include an App Router segment-prefetch bypass, a Pages Router i18n default-locale path bypass, and a DoS in React Server Components. Patched versions are available for React (19.0.6, 19.1.7, 19.2.6) and Next.js, and all affected users should upgrade immediately. Vercel confirmed that WAF rules cannot reliably block these vulnerabilities, making patching the only complete mitigation.
Behind the Scenes: Hardening Firefox with Claude Mythos Preview
Mozilla engineers describe how they used Claude Mythos Preview and an agentic harness to identify 271 previously unknown security vulnerabilities in Firefox, resulting in the most secure Firefox release to date. The team built a pipeline on top of existing fuzzing infrastructure, parallelizing bug-hunting jobs across ephemeral VMs, each targeting specific source files. Discovered bugs include a 15-year-old legend element bug, a 20-year-old XSLT hash-table reentry flaw, and multiple sandbox escapes exploiting IPC race conditions and memory corruption. The 271 bugs are grouped under three CVEs: CVE-2026-6784 (154 bugs), CVE-2026-6785 (55 bugs), and CVE-2026-6786 (107 bugs) in Firefox 150. In total, 423 security bugs were fixed across recent releases, with over 100 contributors involved. Mozilla plans to integrate patch-based scanning directly into CI to catch bugs as they land.
Security researchers at ReversingLabs have been tracking PromptMink, a supply chain campaign attributed to Famous Chollima, a North Korean APT group, that crafts malicious npm and PyPI packages with persuasive README documentation designed to be selected by LLM-powered coding agents. The campaign began in September 2025 with packages like @solana-launchpad/sdk and evolved to include compiled payloads using Node.js Single Executable Applications and Rust-based NAPI-RS add-ons. Evidence of AI agent compromise was found in a real GitHub repository from the Solana Graveyard Hackathon whose dependency was added in a commit co-authored by Claude Opus. A related threat called slopsquatting exploits hallucinated package names — researcher Charlie Eriksen of Aikido Security registered a hallucinated package react-codeshift and found it spread to 237 GitHub repositories. CISA and NSA joint guidance recommends restricting AI agents to allow-listed tools and requiring human approval before high-impact actions.
Bitwarden CLI Hijacked on npm: Bun-Staged Credential Stealer Targets Developers, GitHub Actions, and AI Tools
The official @bitwarden/cli@2026.4.0 npm package was found compromised in the first confirmed supply chain attack exploiting npm OIDC Trusted Publishing. An attacker compromised a Bitwarden engineer's GitHub account, injected malicious files bw_setup.js and bw1.js into the 2026.3.0 build, and republished under the incremented version using a stolen OIDC token. The 9.7 MB obfuscated payload downloads the Bun runtime to evade EDR detection, then harvests SSH keys, npm and GitHub tokens, AWS and GCP credentials, and shell history. Uniquely, it explicitly targets AI coding tools including Claude Code (~/.claude.json), Cursor, Kiro, Codex CLI, and Aider. Stolen data is encrypted with AES-256-GCM and exfiltrated to the attacker-controlled domain audit.checkmarx.cx. Users who installed this version should rotate all credentials immediately and downgrade to @bitwarden/cli@2026.3.0.
Auth0 has announced the General Availability of Auth for MCP, an identity layer that adds authentication and authorization to Model Context Protocol servers. Without proper auth, any agent that discovers an MCP server can call it with no identity or permission checks, posing serious risk as agents increasingly execute transactions and modify production systems. Auth for MCP supports three patterns: platform-to-customer-agent, product-to-end-user-agent, and internal employee-agent access. Key GA features include Client ID Metadata Document (CIMD) client registration as a replacement for Dynamic Client Registration, On-Behalf-Of (OBO) token exchange for downstream API calls scoped to the original user, and native support for MCP resource identifiers. The product integrates with existing Auth0 tenants and is compatible with Claude, Cursor, VS Code, and ChatGPT.
Anthropic Just Leased Colossus 1 from SpaceX — The Compute Crisis Explained
Theo breaks down the Anthropic-SpaceX Colossus 1 deal in the context of Anthropic's 80x annualized growth in Q1 2026, which massively outpaced the company's compute planning. He explains why Claude Code rate limit doublings and peak-hour throttling removals are direct consequences of the capacity crisis, and walks through the technical differences between Trainium, Google TPUs, and NVIDIA GPUs in Anthropic's multi-cloud inference stack. Theo also analyzes the SpaceX-Cursor partnership — arguing the $10 billion fee is effectively payment for Cursor's unique agentic coding interaction data, which xAI desperately needs but Twitter cannot provide. He maps each major AI lab against three pillars — research, data, and compute — concluding that OpenAI is the only one with all three, while Anthropic, xAI, and Cursor each have critical gaps that are driving these unexpected alliances.
Anthropic SpaceX Deal: What Developers Need to Know
Anthropic has leased the entire Colossus 1 supercomputer cluster from SpaceX, gaining access to 220,000 NVIDIA GPUs and 300 megawatts of power capacity within one month of announcement. The deal was driven by an 80x annualized revenue growth surge in Q1 2026, far exceeding the projected 10x, which caused severe capacity shortages for Claude Pro, Max, and API users. As a direct result, Claude Code five-hour rate limits doubled and peak-hour throttling was eliminated for Pro and Max plans. The arrangement is notable given Elon Musk's February 2026 public attacks on Anthropic and the prior ban on xAI from using Claude via Cursor. Colossus 1 became available because SpaceX migrated Grok training workloads to the larger Colossus 2 cluster, leaving the Memphis facility underutilized and generating little revenue ahead of SpaceX's planned IPO.
Anthropic Just Leased Colossus 1 from SpaceX — The Compute Crisis Explained
Theo breaks down the Anthropic-SpaceX Colossus 1 deal in the context of Anthropic's 80x annualized growth in Q1 2026, which massively outpaced the company's compute planning. He explains why Claude Code rate limit doublings and peak-hour throttling removals are direct consequences of the capacity crisis, and walks through the technical differences between Trainium, Google TPUs, and NVIDIA GPUs in Anthropic's multi-cloud inference stack. Theo also analyzes the SpaceX-Cursor partnership — arguing the $10 billion fee is effectively payment for Cursor's unique agentic coding interaction data, which xAI desperately needs but Twitter cannot provide. He maps each major AI lab against three pillars — research, data, and compute — concluding that OpenAI is the only one with all three, while Anthropic, xAI, and Cursor each have critical gaps that are driving these unexpected alliances.
Next.js May 2026 Security Release: 13 Advisories Including CVE-2026-23870
Vercel has shipped a coordinated security release for Next.js addressing 13 advisories spanning denial of service, middleware and proxy bypass, server-side request forgery, cache poisoning, and cross-site scripting. One advisory covers an upstream React Server Components vulnerability tracked as CVE-2026-23870. High-severity issues include an App Router segment-prefetch bypass, a Pages Router i18n default-locale path bypass, and a DoS in React Server Components. Patched versions are available for React (19.0.6, 19.1.7, 19.2.6) and Next.js, and all affected users should upgrade immediately. Vercel confirmed that WAF rules cannot reliably block these vulnerabilities, making patching the only complete mitigation.
Behind the Scenes: Hardening Firefox with Claude Mythos Preview
Mozilla engineers describe how they used Claude Mythos Preview and an agentic harness to identify 271 previously unknown security vulnerabilities in Firefox, resulting in the most secure Firefox release to date. The team built a pipeline on top of existing fuzzing infrastructure, parallelizing bug-hunting jobs across ephemeral VMs, each targeting specific source files. Discovered bugs include a 15-year-old legend element bug, a 20-year-old XSLT hash-table reentry flaw, and multiple sandbox escapes exploiting IPC race conditions and memory corruption. The 271 bugs are grouped under three CVEs: CVE-2026-6784 (154 bugs), CVE-2026-6785 (55 bugs), and CVE-2026-6786 (107 bugs) in Firefox 150. In total, 423 security bugs were fixed across recent releases, with over 100 contributors involved. Mozilla plans to integrate patch-based scanning directly into CI to catch bugs as they land.
Security researchers at ReversingLabs have been tracking PromptMink, a supply chain campaign attributed to Famous Chollima, a North Korean APT group, that crafts malicious npm and PyPI packages with persuasive README documentation designed to be selected by LLM-powered coding agents. The campaign began in September 2025 with packages like @solana-launchpad/sdk and evolved to include compiled payloads using Node.js Single Executable Applications and Rust-based NAPI-RS add-ons. Evidence of AI agent compromise was found in a real GitHub repository from the Solana Graveyard Hackathon whose dependency was added in a commit co-authored by Claude Opus. A related threat called slopsquatting exploits hallucinated package names — researcher Charlie Eriksen of Aikido Security registered a hallucinated package react-codeshift and found it spread to 237 GitHub repositories. CISA and NSA joint guidance recommends restricting AI agents to allow-listed tools and requiring human approval before high-impact actions.
Bitwarden CLI Hijacked on npm: Bun-Staged Credential Stealer Targets Developers, GitHub Actions, and AI Tools
The official @bitwarden/cli@2026.4.0 npm package was found compromised in the first confirmed supply chain attack exploiting npm OIDC Trusted Publishing. An attacker compromised a Bitwarden engineer's GitHub account, injected malicious files bw_setup.js and bw1.js into the 2026.3.0 build, and republished under the incremented version using a stolen OIDC token. The 9.7 MB obfuscated payload downloads the Bun runtime to evade EDR detection, then harvests SSH keys, npm and GitHub tokens, AWS and GCP credentials, and shell history. Uniquely, it explicitly targets AI coding tools including Claude Code (~/.claude.json), Cursor, Kiro, Codex CLI, and Aider. Stolen data is encrypted with AES-256-GCM and exfiltrated to the attacker-controlled domain audit.checkmarx.cx. Users who installed this version should rotate all credentials immediately and downgrade to @bitwarden/cli@2026.3.0.
Auth0 has announced the General Availability of Auth for MCP, an identity layer that adds authentication and authorization to Model Context Protocol servers. Without proper auth, any agent that discovers an MCP server can call it with no identity or permission checks, posing serious risk as agents increasingly execute transactions and modify production systems. Auth for MCP supports three patterns: platform-to-customer-agent, product-to-end-user-agent, and internal employee-agent access. Key GA features include Client ID Metadata Document (CIMD) client registration as a replacement for Dynamic Client Registration, On-Behalf-Of (OBO) token exchange for downstream API calls scoped to the original user, and native support for MCP resource identifiers. The product integrates with existing Auth0 tenants and is compatible with Claude, Cursor, VS Code, and ChatGPT.
The week's biggest infrastructure story was Anthropic leasing the entire Colossus 1 supercomputer cluster from SpaceX — 220,000 NVIDIA GPUs and 300 megawatts of power capacity — triggered by an 80x annualized revenue growth surge in Q1 2026 that far outpaced compute planning. The immediate developer impact: Claude Code five-hour rate limits doubled and peak-hour throttling was eliminated for Pro and Max plans. The deal drew attention given Elon Musk's February 2026 public attacks on Anthropic and the prior ban on xAI using Claude via Cursor; Colossus 1 became available because SpaceX migrated Grok training to the larger Colossus 2 cluster.
Security dominated the rest of the week. Vercel shipped a coordinated Next.js security release addressing 13 advisories covering denial of service, middleware and proxy bypass, SSRF, cache poisoning, and XSS — including CVE-2026-23870, an upstream React Server Components vulnerability. Patched React versions are 19.0.6, 19.1.7, and 19.2.6; Vercel confirmed WAF rules cannot reliably block these, making immediate patching the only complete mitigation. Separately, the @bitwarden/cli@2026.4.0 npm package was confirmed compromised via the first known supply chain attack exploiting npm OIDC Trusted Publishing. The payload downloads the Bun runtime to evade EDR, harvests SSH keys, AWS/GCP credentials, shell history, and explicitly targets AI coding tools including Claude Code (~/.claude.json), Cursor, Kiro, Codex CLI, and Aider.
AI-targeted supply chain attacks received broader coverage through ReversingLabs' tracking of PromptMink — a North Korean APT campaign (Famous Chollima) crafting malicious npm and PyPI packages with persuasive README documentation designed to be selected by LLM coding agents. A related threat, slopsquatting, exploits LLM-hallucinated package names; researcher Charlie Eriksen registered a hallucinated package react-codeshift and found it spread to 237 GitHub repositories. On the constructive side, Mozilla used Claude Mythos Preview with an agentic harness to find 271 previously unknown Firefox vulnerabilities across three CVEs in Firefox 150, and Auth0 launched General Availability of Auth for MCP — an identity layer for Model Context Protocol servers supporting Client ID Metadata Document registration and On-Behalf-Of token exchange.
Key Takeaways
Next.js has 13 active CVEs including an upstream React Server Components flaw (CVE-2026-23870); WAF rules are not sufficient — patch to React 19.0.6/19.1.7/19.2.6 and the corresponding Next.js release immediately.
@bitwarden/cli@2026.4.0 is compromised and explicitly harvests Claude Code (~/.claude.json), Cursor, and Codex CLI credentials — rotate all credentials and downgrade to 2026.3.0 if you installed it.
Anthropic leasing Colossus 1 (220,000 NVIDIA GPUs) doubled Claude Code rate limits and removed peak-hour throttling — the capacity crisis from 80x Q1 2026 revenue growth is now at least partially resolved.
