The biggest story this week was the personal and commercial trajectory of OpenClaw creator Peter Steinberger — the featured profile traced his arc from selling… Compiled for immediate developer deployment.
calendar_todaysummarizeWeek 8-2026
article
TAG: PROFILEREAD_TIME: 5_MIN
Who is OpenClaw creator Peter Steinberger? The millennial developer caught the attention of Sam Altman and Mark Zuckerberg | Fortune
Peter Steinberger, the Austrian-born developer behind OpenClaw, sold his PDF company PSPDFKit for a reported €100 million in 2023 after 13 years — then burned out entirely. He returned to coding in April 2025, and within months his local-first autonomous agent framework surpassed 145,000 GitHub stars and hit 2 million visitors in a single week. OpenClaw runs persistently on a user's machine, manages email and browsers via messaging apps like WhatsApp, and stores memories in plain Markdown files rather than corporate clouds. After personal outreach from Mark Zuckerberg and a likely six-figure offer from OpenAI, Steinberger chose the latter — primarily for access to frontier infrastructure — while pledging to move OpenClaw into an independent open-source foundation. He describes himself not as a CEO but a "full-time open-sourcerer."
Securing the AI software supply chain: Security results across 67 open source projects
GitHub's Secure Open Source Fund Session 3 concludes with 67 projects, 98 maintainers, and $670,000 in non-dilutive funding — bringing cumulative program totals across all sessions to 138 projects, $1.38M disbursed, 191 new CVEs issued, 250+ secrets prevented from leaking, and 600+ leaked secrets detected and resolved. In just the last six months, 500+ CodeQL alerts were fixed and 66 secrets blocked. Session 3 covered projects across six categories including core runtimes (CPython, Node.js, LLVM, Rustls), network libraries (curl, urllib3, Netty, quic-go), build and CI tooling (Jenkins, webpack, PyPI Warehouse, Apache Airflow), and identity/secrets frameworks (Keycloak, external-secrets, WebAuthn). Session 4 opens for applications in April 2026. Funding partners include Microsoft, Stripe, Shopify, Vercel, Datadog, and 1Password.
Enterprise-wide credential management tools for incident response - GitHub Changelog
GitHub Enterprise Cloud now gives enterprise owners four new incident-response actions for compromised credentials: reviewing counts of SSO-authorized credentials per organization, temporarily blocking SSO for all non-owner users to limit blast radius, revoking SSO authorizations for personal access tokens, SSH keys, and OAuth tokens enterprise-wide, and (for EMU accounts only) deleting user tokens and SSH keys even without an SSO authorization. A new fine-grained permission — "Manage enterprise credentials" — lets owners delegate these powers to trusted administrators. GitHub warns these actions can break automations and disrupt developer workflows, and recommends using them only during major security incidents; for routine token rotation, setting maximum token lifetimes is advised instead.
Open sourcing the Liveblocks sync engine and dev server | Liveblocks blog
Liveblocks has open-sourced its server stack with two new packages: `@liveblocks/server`, a WebSocket-based realtime data storage and presence server compatible with both Liveblocks Storage and Yjs sync engines; and `liveblocks-cli`, which bundles a local dev server launchable via `npx liveblocks dev` (default port 1153) or Docker. The dev server stores per-room data in SQLite inside a `.liveblocks/` directory, enabling fully offline development, CI integration, and Playwright E2E testing without cloud dependency. Server-side packages are released under AGPL v3 — following Grafana, Matrix/Element, and Mattermost's dual-licensing playbook — while client SDKs (`@liveblocks/client`, `@liveblocks/react`, `@liveblocks/node`) remain Apache 2.0. Comments, notifications, and AI features are not yet included but are on the near-term roadmap.
Google launched Gemini 3.1 Pro in preview, drawing its "core intelligence" directly from the invite-only Gemini 3 Deep Think reasoning model. On ARC-AGI-2, it scores 77.1%, up sharply from the previous generation's 31.1% and ahead of Anthropic's Opus 4.6 (68.8%) and OpenAI's GPT-5.2 (52.9%). It also leads on Terminal-Bench 2.0 agentic coding, though OpenAI's 5.3-Codex claims a higher score under its own harness. The notable weakness is GDPval-AA, a real-world task benchmark where Gemini 3.1 Pro scores only 1317 points versus Anthropic Sonnet 4.6's 1633. Pricing holds at $2/$12 per million input/output tokens — significantly cheaper than Opus 4.6 at $5/$25 — with a 1-million-token context window and 64,000-token output limit. The model is available now via Gemini API, Google AI Studio, Vertex AI, Gemini CLI, Android Studio, and the Gemini consumer app.
Beyond the vibe code: The steep mountain MCP must climb to reach production
A field report from the London MCPconference finds the Model Context Protocol still largely confined to internal, behind-firewall deployments. Developers are bridging bug-report emails to Salesforce or JIRA, but production paths beyond that remain murky. Security was the dominant concern: OAuth 2.1 implementation is complex, and "security elicitation" — where servers must safely request credentials from users via clients mid-workflow — is still poorly handled by most MCP clients. The author warns that returning 100 tools to an LLM wastes context window space, advocating instead for "progressive disclosure" — surfacing only the tools needed for the next step. On the commercial side, ChatGPT apps are positioning MCP servers as brand storefronts, but payment processing introduces the same friction-versus-security dilemma that plagues the protocol broadly.
Theo uses Sonnet 4.6's launch as a springboard for a 47-minute critique of Anthropic's developer relations and policy decisions. He notes that while Sonnet 4.6 scores near Opus 4.6 on Artificial Analysis benchmarks, it burns over 25% more tokens per task — narrowing the practical cost gap between tiers. The core policy grievance: Anthropic updated its terms to prohibit using Claude.ai OAuth tokens (from free, Pro, or Max subscriptions) in any third-party product or tool, including the Agent SDK, directly contradicting earlier statements by developer advocate Tarek that the Agent SDK with subscription tokens was explicitly allowed. Theo details how OpenClaw was hard-coded into Anthropic's server as a blocked term, contrasts this with OpenAI's openly collaborative stance (sharing Codex app-server auth for third-party builds), and argues Anthropic's reluctance to engage publicly — refusing to clarify whether open-source, non-commercial UIs can use subscriber tokens — reflects a deeper organizational culture problem.
Who is OpenClaw creator Peter Steinberger? The millennial developer caught the attention of Sam Altman and Mark Zuckerberg | Fortune
Peter Steinberger, the Austrian-born developer behind OpenClaw, sold his PDF company PSPDFKit for a reported €100 million in 2023 after 13 years — then burned out entirely. He returned to coding in April 2025, and within months his local-first autonomous agent framework surpassed 145,000 GitHub stars and hit 2 million visitors in a single week. OpenClaw runs persistently on a user's machine, manages email and browsers via messaging apps like WhatsApp, and stores memories in plain Markdown files rather than corporate clouds. After personal outreach from Mark Zuckerberg and a likely six-figure offer from OpenAI, Steinberger chose the latter — primarily for access to frontier infrastructure — while pledging to move OpenClaw into an independent open-source foundation. He describes himself not as a CEO but a "full-time open-sourcerer."
Theo uses Sonnet 4.6's launch as a springboard for a 47-minute critique of Anthropic's developer relations and policy decisions. He notes that while Sonnet 4.6 scores near Opus 4.6 on Artificial Analysis benchmarks, it burns over 25% more tokens per task — narrowing the practical cost gap between tiers. The core policy grievance: Anthropic updated its terms to prohibit using Claude.ai OAuth tokens (from free, Pro, or Max subscriptions) in any third-party product or tool, including the Agent SDK, directly contradicting earlier statements by developer advocate Tarek that the Agent SDK with subscription tokens was explicitly allowed. Theo details how OpenClaw was hard-coded into Anthropic's server as a blocked term, contrasts this with OpenAI's openly collaborative stance (sharing Codex app-server auth for third-party builds), and argues Anthropic's reluctance to engage publicly — refusing to clarify whether open-source, non-commercial UIs can use subscriber tokens — reflects a deeper organizational culture problem.
Securing the AI software supply chain: Security results across 67 open source projects
GitHub's Secure Open Source Fund Session 3 concludes with 67 projects, 98 maintainers, and $670,000 in non-dilutive funding — bringing cumulative program totals across all sessions to 138 projects, $1.38M disbursed, 191 new CVEs issued, 250+ secrets prevented from leaking, and 600+ leaked secrets detected and resolved. In just the last six months, 500+ CodeQL alerts were fixed and 66 secrets blocked. Session 3 covered projects across six categories including core runtimes (CPython, Node.js, LLVM, Rustls), network libraries (curl, urllib3, Netty, quic-go), build and CI tooling (Jenkins, webpack, PyPI Warehouse, Apache Airflow), and identity/secrets frameworks (Keycloak, external-secrets, WebAuthn). Session 4 opens for applications in April 2026. Funding partners include Microsoft, Stripe, Shopify, Vercel, Datadog, and 1Password.
Enterprise-wide credential management tools for incident response - GitHub Changelog
GitHub Enterprise Cloud now gives enterprise owners four new incident-response actions for compromised credentials: reviewing counts of SSO-authorized credentials per organization, temporarily blocking SSO for all non-owner users to limit blast radius, revoking SSO authorizations for personal access tokens, SSH keys, and OAuth tokens enterprise-wide, and (for EMU accounts only) deleting user tokens and SSH keys even without an SSO authorization. A new fine-grained permission — "Manage enterprise credentials" — lets owners delegate these powers to trusted administrators. GitHub warns these actions can break automations and disrupt developer workflows, and recommends using them only during major security incidents; for routine token rotation, setting maximum token lifetimes is advised instead.
Open sourcing the Liveblocks sync engine and dev server | Liveblocks blog
Liveblocks has open-sourced its server stack with two new packages: `@liveblocks/server`, a WebSocket-based realtime data storage and presence server compatible with both Liveblocks Storage and Yjs sync engines; and `liveblocks-cli`, which bundles a local dev server launchable via `npx liveblocks dev` (default port 1153) or Docker. The dev server stores per-room data in SQLite inside a `.liveblocks/` directory, enabling fully offline development, CI integration, and Playwright E2E testing without cloud dependency. Server-side packages are released under AGPL v3 — following Grafana, Matrix/Element, and Mattermost's dual-licensing playbook — while client SDKs (`@liveblocks/client`, `@liveblocks/react`, `@liveblocks/node`) remain Apache 2.0. Comments, notifications, and AI features are not yet included but are on the near-term roadmap.
Google launched Gemini 3.1 Pro in preview, drawing its "core intelligence" directly from the invite-only Gemini 3 Deep Think reasoning model. On ARC-AGI-2, it scores 77.1%, up sharply from the previous generation's 31.1% and ahead of Anthropic's Opus 4.6 (68.8%) and OpenAI's GPT-5.2 (52.9%). It also leads on Terminal-Bench 2.0 agentic coding, though OpenAI's 5.3-Codex claims a higher score under its own harness. The notable weakness is GDPval-AA, a real-world task benchmark where Gemini 3.1 Pro scores only 1317 points versus Anthropic Sonnet 4.6's 1633. Pricing holds at $2/$12 per million input/output tokens — significantly cheaper than Opus 4.6 at $5/$25 — with a 1-million-token context window and 64,000-token output limit. The model is available now via Gemini API, Google AI Studio, Vertex AI, Gemini CLI, Android Studio, and the Gemini consumer app.
Beyond the vibe code: The steep mountain MCP must climb to reach production
A field report from the London MCPconference finds the Model Context Protocol still largely confined to internal, behind-firewall deployments. Developers are bridging bug-report emails to Salesforce or JIRA, but production paths beyond that remain murky. Security was the dominant concern: OAuth 2.1 implementation is complex, and "security elicitation" — where servers must safely request credentials from users via clients mid-workflow — is still poorly handled by most MCP clients. The author warns that returning 100 tools to an LLM wastes context window space, advocating instead for "progressive disclosure" — surfacing only the tools needed for the next step. On the commercial side, ChatGPT apps are positioning MCP servers as brand storefronts, but payment processing introduces the same friction-versus-security dilemma that plagues the protocol broadly.
The biggest story this week was the personal and commercial trajectory of OpenClaw creator Peter Steinberger — the featured profile traced his arc from selling PSPDFKit for 100 million euros, through burnout, to returning to code and watching a local-first autonomous agent framework accumulate 145,000 GitHub stars and 2 million weekly visitors in months. His decision to join OpenAI over a Zuckerberg offer, while pledging to move OpenClaw to an independent foundation, illustrated the tensions between open-source ideals and frontier infrastructure access that recurred across the week.
That tension was sharpest in Theo's lengthy critique of Anthropic's policy shift, which prohibited using Claude.ai OAuth tokens in any third-party tool — directly contradicting earlier statements — and included hard-coding OpenClaw as a blocked term server-side. Against that backdrop, the Gemini 3.1 Pro launch offered a counterpoint: strong benchmark improvements (77.1% on ARC-AGI-2 versus the prior generation's 31.1%) at $2/$12 per million tokens, though it trails Sonnet 4.6 sharply on real-world task benchmarks like GDPval-AA. MCP's field report from London's MCPconference was sobering: the protocol remains largely behind-firewall, with OAuth 2.1 complexity and security elicitation still unsolved for production paths.
On the security side, GitHub closed out its Secure Open Source Fund Session 3 — $670,000 to 67 projects, 191 new CVEs — while also shipping enterprise-wide credential revocation tools designed for rapid incident response. Both moves reinforce a week in which open-source supply-chain health and AI policy boundaries were the clearest fault lines.
Key Takeaways
OpenClaw hit 145,000 GitHub stars and 2M weekly visitors months after launch; its creator joining OpenAI signals how frontier infrastructure access shapes open-source strategy
Anthropic's OAuth token policy reversal and Gemini 3.1 Pro's ARC-AGI-2 leap (31% to 77%) are reshaping AI developer market dynamics simultaneously
GitHub's Secure Open Source Fund Session 3 deployed $670K across 67 projects issuing 191 CVEs — Session 4 opens for applications in April 2026
