What's new in DevEx - May 22

Attackers obtained a privileged GitHub token, quietly downloaded Grafana's entire private codebase, then demanded a ransom to keep it private, but Grafana publicly refused to pay. The root cause: a single GitHub workflow token that slipped through rotation after the TanStack npm supply chain attack compromised Grafana's CI/CD pipeline two weeks prior.

TeamPCP delivered a poisoned VS Code extension through the same worm infrastructure, compromising a GitHub employee's machine and exfiltrating roughly 3,800 internal repositories. GitHub says no customer data was touched, but this is the third major security event at the platform in six weeks.

Karpathy is joining Anthropic's pretraining team, tasked with building a group that uses Claude to accelerate Claude's own training. It's the latest in a pattern worth tracking: CTOs of billion-dollar companies keep taking IC research roles at Anthropic over senior positions elsewhere.

Modal went from a $1.1B valuation to $4.65B in eight months, driven almost entirely by the explosion in AI-assisted coding. Modal provides GPU access for inference and sandboxes for testing AI-generated code before it ships. Expect fewer, larger infrastructure players as demand consolidates around the tools that can actually scale.

Anthropic acquired Stainless - the SDK and MCP server generator used by OpenAI, Google, and Cloudflare, in a deal reportedly worth over $300M, then wound down the hosted product entirely. It's Anthropic's fourth acquisition in six months, pulling shared AI infrastructure off the market and making agent connectivity a competitive surface.

Google launched Gemini 3.5 Flash claiming it outperforms Gemini 3.1 Pro on most benchmarks at 4x the speed, alongside Antigravity 2.0, a new standalone agent-first coding desktop app. The standout for developers: WebMCP, a proposed standard letting browser-based AI agents invoke JavaScript functions directly, now in Chrome origin trial.

🗽 New York Tech Week is right around the corner! If you're in town, we got you covered. Check out our Tech Week guide for the best engineering events throughout the week.

Till next time,