⚔️ SpaceX Just Bought Your Coding Tool

Two things happened today that every operator running an AI-assisted coding setup should notice.

First: SpaceX is buying Cursor (Anysphere) for $60 billion, per Reuters. That is a coding tool moving from an independent AI lab into a defence and aerospace conglomerate. What Cursor's roadmap looks like from inside SpaceX's priorities is genuinely unclear. If you have been building your workflow around it, that uncertainty is real.

Second: a critical vulnerability in Microsoft 365 Copilot let attackers steal 2FA codes from users, per Ars Technica. The exploit is called SearchLeak. It is patched now, but the underlying pattern (LLM outputs trusting crafted inputs in a security context) is not patched. It is a category problem.

These two stories on the same morning feel like a stress test for any operator who defaulted to the two biggest names in AI-assisted coding. Today's drops lean into what the community is actually starring, forking, and talking about on Reddit and Instagram right now. Including one repo that turns any codebase into an interactive knowledge graph you can ask questions of. That one has 61k stars for a reason.

Five signals, ten repos and skills, one MCP, and one technique the community surfaced this week that I had not seen before.

[Repo] Understand-Anything, turns any codebase into an interactive knowledge graph you can explore, search, and ask questions about. Works with Claude Code, Codex, and Cursor. The repo has 61,375 stars, and it surfaced across both Instagram and GitHub this week. "Graphs that teach, not graphs that impress" is their framing. That's the right bar.

[Repo] Puppeteer, JavaScript API for controlling Chrome and Firefox headlessly. 94,838 stars. The standard for browser automation: scraping, screenshot pipelines, E2E testing. If you are wiring a browser into an agent workflow, this is still the starting point.

[Repo] zvec, lightweight, in-process vector database from Alibaba. 10,374 stars and trending this week. No server, no infra overhead: embed it directly in your app. The move when you need fast local vector search without running a separate Qdrant or Weaviate instance.

[Skill] superclaude, turns Claude into a GitHub workflow co-pilot: converts "fix stuff" commits into proper commit messages, generates changelogs, and runs AI code reviews. 325 stars. The kind of skill that pays back in the first hour you install it.

[Skill] Pretty-mermaid-skills, gives Claude the ability to render Mermaid diagrams in SVG or ASCII output. 759 stars. Pipe any architecture decision through Claude and get a real diagram back, not a text description of one.

[Skill] claude-code-voice-skill, lets you talk to Claude about your projects over the phone. 168 stars. The use case is narrower than it sounds: hands-free code review while you are walking, or talking through a problem without touching a keyboard.

[Repo] claude-code-ide.el, Claude Code IDE integration for Emacs. 1,580 stars. If Emacs is your environment, this closes the gap that VS Code users take for granted.

[Repo] recall, full-text search and resume for Claude and Codex conversations. 187 stars. Solves the specific pain of losing context across sessions: find an old conversation by keyword, pick it up where you left it.

[Repo] vllm, high-throughput LLM serving engine. PagedAttention squeezes significantly more throughput per GPU than a naive serving setup. The default choice when you are self-hosting a model and request volume starts to matter.

[Repo] openinterpreter, natural-language interface that runs code directly on your machine. Connects an LLM to your OS: files, shell, browser. The practical use is one-shot automation tasks where you would otherwise write a throw-away script.

[MCP] opendocswork-mcp, Rust-native MCP server for Office document processing: Excel, Word, and PowerPoint. Sub-millisecond, local-first, open source. The non-obvious move is routing document-heavy workflows (contract prep, report generation, data extraction from spreadsheets) directly through Claude via MCP without ever leaving your local environment or paying a third-party doc API. Install it once; it handles the full Office format surface.

- Copilot's SearchLeak is patched, but the category isn't. A critical vulnerability let attackers intercept 2FA codes from Copilot users via crafted LLM outputs. The patch is out. The underlying failure mode, LLMs trusting injected content in a privileged context, is still baked into how most AI coding tools work. Ars Technica

- SpaceX is acquiring Cursor for $60B. Anysphere (Cursor's parent) is moving from independent AI lab to SpaceX subsidiary. Roadmap, pricing, and enterprise terms all become questions. If your team is locked into Cursor workflows, watch the next 60 days for policy changes. Reuters

- Wired on the government Fable 5 crackdown: the capability is coming regardless. The US crackdown on Anthropic's Claude Fable 5 and Mythos 5 points at a truth that the restriction doesn't fix: models with advanced offensive capabilities are becoming the norm, not the exception. The policy is a speed bump, not a wall. Wired

- Vercel Workflow SDK 5 beta adds inflight cancellation. You can now create an AbortController inside a workflow, pass its signal into steps, and cancel a running job mid-execution via API. Practical for long-running agent pipelines where a user action or upstream error should stop downstream steps instead of letting them run to completion. Vercel Changelog

- Georgi Gerganov on Qwen3.6-27B for local coding: "Over the last month and a half I've been using it almost daily, either on my M2 Ultra or on my RTX 5090." The creator of llama.cpp running a Qwen model daily for coding tasks is a credible endorsement of where local model quality sits right now. Simon Willison

This week's technique: context and cost control. How to keep Claude Code sharp on long sessions without starting from zero.

Most operators hit the same wall: a session that started clean gets bloated after an hour of back-and-forth, and Claude starts hedging or forgetting constraints it was holding earlier. That is a context window problem, not a model problem.

1. Run /clear deliberately, not reactively. Use it at natural task boundaries, when you finish one feature and start the next, not when things go wrong. Clearing at the wrong moment throws away useful context. Clearing at the right moment resets the window with only the carry-forward you choose (usually a fresh CLAUDE.md read). 2. Watch compaction happen. When the context window gets close to its limit, Claude Code auto-compacts: it summarises the conversation and continues. You can see this in the token count display. The gotcha is that compaction loses precise earlier instructions. If a rule matters for the whole session, it belongs in CLAUDE.md, not just the chat. 3. Price long sessions before they run. For expensive multi-step runs, use claude --print "" in a short test prompt first to check the token footprint of your task framing. An over-specified prompt that balloons the input on every step costs real money at scale.

You know it's working when a three-hour session still returns tight, constraint-respecting outputs on step 40 as it did on step 2.

Claude Code docs: memory

Move: wire Puppeteer into a headless audit pipeline that Claude interprets.

The job: you want to audit a list of URLs (competitor sites, prospect landing pages, your own staging URLs) and get back a structured assessment without doing it manually.

1. Clone Puppeteer and write a short script that visits each URL, captures a screenshot, and dumps the page's

What is it? aigent-OS is a self-improving Operator OS built for Claude Code. If you have ever thought "there should be a system for how I run Claude, not just a collection of prompts I paste in," this is the answer to that. It ships as a structured operating system that gets smarter the more you use it, because the feedback loop is built in. It's $197 and it's in the store now. Hit the button below to see what's inside.

Two AI coding tools shook loose from their anchors today. SpaceX owns Cursor. Copilot leaked 2FA. Meanwhile, 61,000 developers starred a repo that teaches you to read a codebase like a map. The community keeps building regardless. That's the move.

See you Thursday.