Illinois Just Passed the Strongest AI Safety Law in America. OpenAI and Anthropic Are Next.

The infrastructure companies didn't hold a press conference. They just started rewiring things.

AWS says it solved a fundamental data center networking problem this week. Cloudflare and others are redesigning cloud infrastructure for a future where machine-generated traffic dominates human traffic. TechCrunch called it plainly: the internet is being rebuilt for machines.

Meanwhile, Illinois became the first state to pass a serious AI safety law. Asana acquired a no-code agent builder. Microsoft pushed a Copilot redesign. The industry is moving in three directions at once, infrastructure, governance, and product, and none of them are slowing down to let anyone catch up.

Today is Friday, which means the full kit drops. If you've been here for a few weeks, you know what that means. If you're new: we build a real, runnable business each week. This week's is the one that got the most questions in replies, an AI agency that reads a prospect's site, builds them a better one in their own brand, and stages a personalized cold pitch in your Gmail drafts. $497 setup. $99/month. You close it like a freelancer. The pipeline does the labor.

Everything below is live.

---

1. The internet is being rebuilt for machines, not humans. AWS says a networking breakthrough has dramatically sped up information flow across its cloud. Wired has the technical breakdown. Cloudflare and others are redesigning infrastructure for AI agent traffic as the primary use case. TechCrunch frames the shift. If you're building agent pipelines, the underlying rails are actively being rebuilt around you.

2. Asana acquired StackAI, a no-code agent builder. TechCrunch reports Asana is folding StackAI's workflow tools into its product suite. This is the second major PM tool in a month to buy rather than build its AI layer. When Asana is buying agent infrastructure, the window for standalone agent-builder products is narrowing.

3. Illinois passed America's strongest AI safety bill. Governor Pritzker says he'll sign it. Wired has the details. The law requires OpenAI, Anthropic, and Google to bring in third-party auditors to confirm they're following safety standards. No other state has gone this far. Federal inaction just produced a state-level race.

4. Microsoft 365 Copilot gets a redesign and a speed claim. The Verge reports the new Copilot interface loads twice as fast and surfaces more reliable citations. Microsoft is betting the enterprise seat on Copilot stickiness. Whether the speed claim holds in production will matter more than the announcement.

5. Simon Willison on the Pope's AI encyclical, and what Corey Quinn noticed. The Vatican dropped a full AI ethics document this week. Willison called it interesting. Quinn called it "the single greatest act of vendor lobbying" he's ever seen, framing a company's technical limitations as a spiritual treatise. Willison's full notes on the document.

---

[Repo] screenshot-to-code, paste a screenshot, get production-ready HTML/CSS/JS back. Abi's repo sits at 67k+ stars and still ships updates. Drop a Figma export or a competitor's site screenshot and watch Sonnet render a working page. Direct input for the week's kit.

[Repo] repomix, packs an entire repo into a single LLM-ready file. 8k+ stars. Feed it to Claude before you start a build session and skip 20 minutes of context-setting. Works on any TypeScript monorepo including the one in today's kit.

[Repo] crawl4ai, async web crawler built for LLM pipelines, 38k+ stars. Handles JS-rendered pages, cleans output to markdown, and ships structured extraction out of the box. Drop-in replacement for basic Puppeteer scraping when you need cleaner LLM input.

[Repo] browser-use, gives LLMs direct browser control via Python. 60k+ stars and actively maintained. Useful for the audit step of any site-reading pipeline, let the agent navigate rather than waiting for a static screenshot API.

[Repo] composio, managed tool integrations for LLM agents. Connects to 150+ services including Gmail, Google Maps, and Vercel without writing OAuth boilerplate. 20k+ stars. Every dependency in today's kit has a Composio connector, worth checking before you hand-wire integrations.

[Skill] Cold-pitch subject line discipline, the biggest failure mode in outbound AI pipelines isn't the copy, it's the subject line. Never name the prospect's brand in the subject line of a cold email. It reads as template-generated immediately. Keep the subject to a single curiosity signal about the outcome, not the sender. Every mass-personalization tool makes this mistake by default. Add a hard rule in your personalize prompt: do not include brand name in subject.

[Skill] Vision-extraction prompt hygiene, when you give Claude a schema and ask it to extract data from a screenshot, the model will echo schema comments back as field values if you're not explicit. The fix: add a single rule to your extraction prompt, "return only data values, never schema descriptions or placeholder text." Saves you a full debugging session when you first see { "primaryColor": "the dominant color from the site's hero section" } in your output.

---

[MCP] Vercel MCP Server, exposes your Vercel account as Claude-callable tools: create projects, deploy files, read logs, manage domains. Today's kit uses the Vercel REST API directly, but the MCP server is the cleaner path once you're past initial setup. Install via npx @vercel/mcp-server and add it to your Claude Desktop config. Non-obvious trick: the deploy tool accepts a single HTML string, no zip, no build step required for static preview pages.

[MCP] Google Maps MCP, wraps the Places API v1 as MCP tools Claude can call directly. Find businesses by type and city, filter by rating and review count, pull phone numbers and websites. This is the scraper layer in today's kit without writing a single lines of Places API boilerplate. Requires a Maps API key from Google Cloud Console with Places API New enabled.

[Tool] Instantly, warm email outreach at scale. $37/month for 50+ sends per day from warmed-up sending IPs. If you're running 20-30 cold pitches a day from Gmail drafts, Instantly is the step-up path when you're ready to stop reviewing every draft manually. Connect your domain, import the CSV from the scraper, let it run.

[Tool] Puppeteer, headless Chrome automation for Node. The kit's auditor uses it to screenshot prospect sites and score them in under 3 seconds each. One non-obvious config: set --no-sandbox in your launch args when running in any containerized or CI environment, or it will fail silently and return blank screenshots.

---

Pattern: force-clean data extraction with a single constraint rule.

When you ask Claude to extract structured data from a screenshot or page, add this to your system prompt before the schema:

> "Return only the actual data values found. Never return schema descriptions, field names, or placeholder text as values."

Without this rule, Claude will sometimes return the schema comment as the field value, especially on Sonnet when the schema is dense. You'll get { "primaryColor": "the main brand color used across the site" } instead of { "primaryColor": "#2A4B8C" }. One line in the system prompt eliminates an entire class of downstream parsing failures. Anthropic's prompt engineering guide covers the general principle under structured output.

---

AWS solving a data center networking problem isn't a product announcement. It's an infrastructure bet, that machine-generated traffic will dominate cloud usage faster than anyone published a forecast for. When the rails are being rebuilt for agents, the businesses that win aren't the ones that waited for the rails to finish. The ones running agent pipelines right now are stress-testing infrastructure that everyone else will depend on in 18 months.

Illinois regulating OpenAI and Anthropic matters for a different reason: it confirms that the federal regulatory vacuum will be filled by states, one bill at a time. If you're building anything that touches consumer data, watch what governor Pritzker signs.

---