This week the language and the forge both moved. Go 1.27 finally gave methods their own type parameters, Cursor started hosting git inside the editor, and GitHub spent most of a Monday unable to keep up with its own traffic. Redis shipped a security release with an RDB path that can reach remote code execution, compromised crates ran at cargo build time, and Stripe agreed to buy the gateway a lot of teams already use to hop between models. Anthropic, meanwhile, took computer use, browser use, Files, and Skills out of beta on the Claude API. Here is everything that mattered.

Top Stories This Week

Go 1.27 Ships Generic Methods, JSON v2, and a Goroutine Leak Profile -

On August 19, the Go team released Go 1.27, six months after 1.26. The language change people have been waiting for is generic methods: a method can declare its own type parameters, so math/rand/v2 can expose (*Rand).N[Int intType](n Int) Int instead of a pile of Int32N / Int64N / IntN methods. Generic methods cannot appear on interfaces and cannot satisfy interface methods. Struct composite literals can now use a promoted field name from an embedded struct as a key, and function type inference works in composite literals, conversions, and channel sends.

The standard library and runtime are the other reasons to move. encoding/json/v2 is in the tree for high-level JSON with stricter defaults, and the old encoding/json package is backed by the v2 implementation for faster unmarshaling while keeping compatibility. crypto/mldsa adds ML-DSA (FIPS 204) into x509 and TLS, there is a native uuid package, experimental simd packages landed, and httptest.NewTestServer gives an in-memory fake network for testing/synctest. Size-specialized allocation cuts small-object (under 80 bytes) costs by up to 30%, and the goroutineleak profile in runtime/pprof is generally available. Grab 1.27 from the download page, point CI at it, and bump the go line in go.mod when you want the new language features. Read the release notes before you rely on generic methods in public APIs, because the interface limitation is easy to trip over.

Cursor Launches Origin, a Git Forge Inside the Editor -

On August 17, Cursor began rolling Origin in early beta on paid plans: repos, pull requests, code browsing, and GitHub sync, with agent-native features still to come. A Codebase tab lets you name a codebase (it becomes part of the URL, like cursor.com/codebase/acme-corp), create a repo, install the CLI, and push. You can sync GitHub repos so they sit beside Origin-hosted ones. For anything that started on GitHub, pushes still go there and GitHub stays the source of truth. Day-one apps are Vercel, Depot, and Buildkite.

The timing wrote its own headline. Origin started rolling out Monday morning, and a few hours later GitHub’s status page lit up. TechCrunch noted that you do not have to leave GitHub to try it. Two operational notes: it is paid-only, and Origin reaches enterprise orgs unless an admin opts out, so check that setting before the tab appears for everyone. Pricing, storage caps, and data-handling terms were still thin at launch. If you are on Pro, Teams, or Enterprise, sync one noncritical repo, hook Vercel or Buildkite if you need previews or CI, and keep GitHub as source of truth until the agent-native bits and the missing forge features (public repos, first-party Actions-class CI) exist.

GitHub Goes Down for 7 Hours and 47 Minutes After an Istio Sidecar Hits a Wall -

On August 17, from 13:28 to 21:15 UTC, GitHub was degraded for 7 hours and 47 minutes. Issues, pull requests, APIs, Actions, Copilot, SAML, OIDC, SCIM, and Team Sync all suffered. At peak, web and API error rates were about 20%, archive and raw downloads about 50%. An Istio sidecar in Central US hit its concurrency limit. Autoscaling watched the host service, not the sidecar. Four HAProxy nodes exhausted flow limits, the gateway auth path failed, and optimistic retries piled onto already saturated load balancers. Pausing HAProxy on those nodes produced a broad recovery. Most services were back by 16:36 UTC, Actions around 18:03 UTC.

Copilot took until 21:02 UTC. Delayed replies to one internal endpoint triggered a latent VS Code retry bug that amplified Copilot token traffic about 10x, from a normal 7,000 to 9,000 requests per second up to 70,000 to 100,000. GitHub blocked inbound Copilot Token Service requests with HTTP 403 and cut gateway retries to stop the storm. On August 20, CTO Vlad Fedorov wrote that this was the second significant August incident after Actions on the 6th, that neither was a code or config change, and that monthly commits had grown from 1.4 billion in April to 2.9 billion. Azure now serves about 58% of platform load. If GitHub is on your critical path, keep a mirror, pin Actions to known-good workflow copies, and treat Copilot as a client that can DDoS the token service when the API slows down.

Anthropic Takes Computer Use, Browser Use, Files, and Skills Out of Beta -

On August 19, Anthropic’s Claude API release notes dropped four beta headers in one day. Computer use is now computer_toolset_20260801: no beta header, batch actions in one turn, zoom on by default, and per-member configs. Browser use launched as browser_toolset_20260801, a client toolset that drives a browser your app hosts, working from the page’s accessibility tree rather than a full desktop. Both toolsets work with Claude Fable 5, Mythos 5, Opus 5, Sonnet 5, and Opus 4.8. The Files API and Agent Skills (/v1/skills) are also GA; skip files-api-2025-04-14 and skills-2025-10-02 on new traffic.

If you already integrated the old computer_20251124 shape, this is a real migration, not a flag flip. Follow Anthropic’s migrate notes, keep the old beta header only where you have not cut over, and put the new toolsets behind a feature flag until your action parser matches the new request shape. On August 20 the Python SDK hit v1.0: HTTP moves from httpx to httpx2, Python 3.10 is the floor, and the legacy Completions API plus temperature / top_p / top_k on Messages methods are gone. Read the v1 migration guide before you bump the pin.

Redis 8.10.1 Patches an RDB Path That May Reach RCE -

On August 17, Redis tagged 8.10.1 with update urgency SECURITY. CVE-2026-62356 is a heap out-of-bounds write in CMSketch RDB loading. A separate RDB bug with an out-of-range SLOT_INFO slot id causes memory corruption that may lead to remote code execution. There is a TLS client-certificate bypass where a Common Name with an embedded NUL is truncated, so a client can authenticate as another ACL user. Vector Sets picked up three memory-safety fixes around HNSW load, VREM versus background VSIM, and a negative hnsw_search() count treated as huge and unsigned. Matching patches went to 8.8.2, 8.6.6, 8.4.6, 8.2.9, 7.4.11, 7.2.16, and 6.2.24.

If you load untrusted RDB files, expose Redis over TLS with client certs, or use Vector Sets, this is not a sit-on-it minor. Upgrade to the build for your branch, then restart. Do not load RDB snapshots from untrusted sources until you are patched. Internet-facing Redis with replica or cluster restore in the mix should move first.

Stripe Agrees to Buy OpenRouter for About $7.5 Billion -

On August 19, Stripe said it had agreed to acquire OpenRouter, the gateway that routes across more than 400 models from more than 80 providers. Stripe did not name a price. TechCrunch reported that the New York Times put the deal at $7.5 billion, with about $1.5 billion for the founders, versus a $1.3 billion valuation in May. Patrick Collison framed it as economic infrastructure for tokens: route the request, spend the compute, sit next to Stripe’s Token Billing. OpenRouter’s own post said the product, mission, and commitments stay unchanged and close is weeks away.

If OpenRouter is how you fail over between labs, keep using it, but write down a second path (direct lab APIs or another gateway) and watch whether neutrality, logging, or list rates move after close. A payments company owning the router is useful for cost control. It is also a single corporate parent sitting in front of a lot of model diversity.

Compromised crates.io Packages Run Malware at cargo build -

On August 20, JFrog reported that three widely used crates on crates.io, arrayref@0.3.10 (about 245 million downloads), internment@0.8.7, and append-only-vec@0.1.9, silently pulled proc-macro1, a typosquat of proc-macro2. Because Cargo runs build scripts at compile time, a refreshed lockfile and cargo build was enough to fetch a remote payload. The parent crates shared an owner. JFrog said the second-stage host did not respond when they looked, which does not mean machines that built during the window were clean. The bad versions and proc-macro1 were removed, and related lookalike crates were deleted.

If you built against those versions, treat the builder as compromised: rotate tokens, pin known-good crate versions, and audit Cargo.lock for proc-macro1 and the listed versions. Prefer --locked in CI, and do not auto-upgrade lockfiles without review. This is the same class of problem as last week’s npm worm, just on a different registry: the install or build hook is the payload.

Developer Tools & Platforms

Rust 1.98.0 Adds Algebraic Float Ops and Buffered Integer Formatting -

On August 20, Rust 1.98.0 hit stable. f32 and f64 gain algebraic add, sub, mul, div, and remainder methods that let the compiler reorder and vectorize in ways IEEE floats normally forbid, similar in spirit to -ffast-math, without undefined behavior. Primitive integers get format_into into a NumBuffer, which the release team says performs in the neighborhood of the itoa crate. The ManuallyDrop<Box<_>> move-after-drop story from 1.96 is now a documented, stable guarantee. Upgrade with rustup update stable. Use algebraic methods only where you have measured that reordering is acceptable. Use format_into if you have been carrying itoa just to format integers into a buffer.

AWS Glue 6.0 Goes GA at 30% Lower Price With Iceberg v3 -

On August 21, AWS made Glue 6.0 generally available: 30% lower price than prior Glue versions, Spark 4.1, Python 3.13, Scala 2.13, and full Apache Iceberg v3 (VARIANT with shredding, deletion vectors, geometry and geography types). You also get Spark Declarative Pipelines, real-time streaming mode, and Arrow-native Python UDFs. No API change: set --glue-version to 6.0 on create or update, or pick Glue 6.0 in Studio. New jobs should start on 6.0. Existing jobs can move with AWS’s Spark upgrade agent after you test Iceberg and PySpark behavior.

JetBrains: Claude Code Is Now the Default AI Coding Tool at Work -

This week JetBrains published adoption numbers from Developer Ecosystem Survey 2026, more than 15,000 professional developers, fieldwork May to July. 90% used AI coding agents at work at least weekly, 68% daily. Claude Code was in use at work for about 39% worldwide (47% in the United States), up from 18% in January, and was the single most-used AI coding tool for 31%. GitHub Copilot fell from 29% a year earlier to 21%. Codex rose from 3% to 16%. Cursor slipped from 18% in January to 12%. The survey is JetBrains-weighted, so treat the exact shares as directional, but the leadership change is the story: if you still provision only Copilot, a large slice of the industry has already added a second agent.

Security

Cloudflare Shows a Remote Spectre Attack That Leaks Worker JWTs -

On August 19, Cloudflare published a production proof of concept: a remote Spectre attack against Workers leaked a JWT from a co-located victim at up to 12 bits per second and about 99% accuracy, roughly 360 times faster than the 2021 demonstration. Durable Objects and WebSocket keep-alives let the isolate stay alive long enough that post-invocation isolation never fired. Cloudflare says it found no sign of active exploitation, and it shipped mitigations: a tighter V8 Sandbox, Memory Protection Keys around tenant heaps, and DyPrIs that treats long-lived and I/O-heavy Workers as first-class cases. If you run secrets in Worker isolates, rotate anything that lived in memory next to untrusted neighbors during the research window, and do not assume timer coarsening is enough.

CISA Adds Exploited Windows, SharePoint, vCenter, macOS, and TrueConf Bugs -

On August 18, CISA added four KEV entries: CVE-2026-33824 (Windows IKE Service Extensions double free, unauthenticated RCE), CVE-2026-55040 (SharePoint weak authentication), CVE-2026-59310 (VMware vCenter path traversal RCE), and CVE-2026-65400 (macOS Screen Sharing improper authentication). Federal agencies had a short BOD 26-04 clock. On August 20, CISA added two more for TrueConf Server: CVE-2026-72529 (missing authentication) and CVE-2026-72530 (code injection). Patch internet-facing IKE, SharePoint, vCenter, macOS Screen Sharing, and any TrueConf Server before you treat last week’s Patch Tuesday as done.

Claude Security Scans GitHub Repos With Mythos 5 -

On August 21, Anthropic put Claude Mythos 5 behind Claude Security for Enterprise customers in public beta: connect a GitHub repo, get validated findings with CWE, confidence, severity, and a suggested patch, without a prompt box that could be steered into exploit writing. Scans bill as ordinary tokens. Interactive patching still uses the models on your account. Unite.AI reported a $35 million Defender Advantage Fund in Claude credits for organizations securing open source. If you are on Claude Enterprise, an admin enables it in the console and users start at claude.ai/security. Treat output as a reviewer, not a merge.

Funding & Industry Deals

Groq Raises $350M at a $3.5B Valuation as an Inference Cloud -

On August 17, Groq closed $350 million led by Disruptive, with planned Nvidia participation, valuing the company at $3.5 billion. Together with $650 million in June, recent funding is $1 billion. That is well below the $6.9 billion mark from last September, after Nvidia’s licensing deal and talent move. Groq is selling the remaining company as an inference neocloud, not the old chip story. TechCrunch said the firm does not call it a down round so much as a new valuation for the post-deal Groq.

Dash0 Buys Polar Signals to Fold Profiling Into Observability -

On August 17, Dash0 acquired Polar Signals, the Berlin continuous-profiling company behind Polar Signals Cloud and open-source Parca, including GPU and CUDA profiling. Terms were not disclosed. Dash0 wants Polar’s Great Lakes storage engine as a path off ClickHouse in SignalStore. If you use Parca or Polar Signals Cloud, expect the product to live inside an OpenTelemetry-native observability vendor rather than as a standalone profiler.

Rillet Raises $100M at a $1B Valuation in 48 Hours -

On August 21, TechCrunch reported that AI accounting startup Rillet raised $100 million at a $1 billion valuation in about 48 hours after a board meeting, without a planned round. The company says it has 600 customers and has raised $200 million to date from Iconiq, Andreessen Horowitz, and Sequoia. It is a finance-ops story more than a compiler story, but it is another data point that AI wrappers around scarce professional work still raise at unicorn speed.

Unitree Lists on Shanghai’s STAR Market -

On August 19, Unitree Robotics began trading on the STAR Market, the first general-purpose humanoid maker to list on the mainland. It priced at 150.8 yuan a share and raised about 6.1 billion yuan, around $900 million. Retail oversubscription was more than 8,000 times, a STAR record. Backers include Tencent, Alibaba, and DeepSeek. The robotics listing sits next to the AI-gateway deal as a reminder that public markets are still taking the hardware side of this cycle.

Layoffs: TikTok Shop and Qualtrics

  • TikTok: On August 18, a WARN filed Tuesday and covered by GeekWire said TikTok will cut 75 jobs at its Bellevue office, mostly TikTok Shop and global e-commerce, including backend and frontend engineers, with a separation date of October 19.
  • Qualtrics: This week Qualtrics cut jobs globally after absorbing Press Ganey Forsta. Headcount was not disclosed. Seattle WARN language implies at least 50 at headquarters. Dual HQ in Seattle and Provo plus international offices were in scope.

The Numbers That Matter

  • 7 hours 47 minutes Length of GitHub’s August 17 incident, from 13:28 to 21:15 UTC
  • $7.5 Billion Reported price for Stripe’s OpenRouter acquisition, per the New York Times
  • 10x Amplification of Copilot token traffic from a VS Code retry bug during GitHub’s outage
  • 39% Share of professional developers using Claude Code at work in JetBrains’ May to July survey
  • 245 Million Lifetime downloads on arrayref, one of the crates.io packages that pulled a malicious typosquat
  • 30% Price cut on AWS Glue 6.0 versus prior Glue versions
  • $350 Million Groq’s new round at a $3.5 billion valuation

Quick Hits

  • Cursor Origin - August 17. Paid-plan beta of Cursor’s Git hosting, with GitHub sync and Vercel, Depot, and Buildkite.
  • GitHub Outage - August 17. 7 hours 47 minutes of degraded git, Actions, auth, and Copilot after an Istio sidecar and a retry storm.
  • Redis 8.10.1 - August 17. Security release covering RDB RCE-class corruption, TLS CN bypass, and Vector Sets bugs.
  • Groq $350M - August 17. Inference-cloud round at $3.5 billion, Nvidia participating, well below last year’s peak valuation.
  • Dash0 Buys Polar Signals - August 17. Continuous profiling, including GPU, folds into an OpenTelemetry observability vendor.
  • CISA KEV Four-Pack - August 18. Exploited bugs in Windows IKE, SharePoint, vCenter, and macOS Screen Sharing.
  • TikTok Bellevue Cuts - August 18. 75 Shop and e-commerce roles, including engineers, with October 19 separations.
  • Go 1.27 - August 19. Generic methods, JSON v2, ML-DSA, uuid, goroutine leak profile.
  • Stripe OpenRouter - August 19. Gateway deal reported at $7.5 billion. Product stays independent through close.
  • Anthropic API GA - August 19. Computer use, browser use, Files, and Skills lose their beta headers.
  • Cloudflare Workers Spectre - August 19. Remote JWT leak at 12 bit/s in production, already mitigated.
  • Unitree IPO - August 19. Humanoid maker lists in Shanghai after a record STAR oversubscription.
  • Qualtrics Layoffs - August 19. Global cuts after the Press Ganey Forsta deal, count undisclosed.
  • Rust 1.98.0 - August 20. Algebraic float methods and format_into for integers. rustup update stable.
  • crates.io Compromise - August 20. arrayref, internment, and append-only-vec pulled proc-macro1 at build time.
  • Anthropic Python SDK 1.0 - August 20. httpx2, Python 3.10 floor, Completions API removed.
  • JetBrains Agent Survey - August 20. Claude Code leads Copilot at work. Codex up 5x since January.
  • CISA TrueConf - August 20. Two exploited TrueConf Server bugs added to KEV.
  • AWS Glue 6.0 - August 21. Spark 4.1, Iceberg v3, 30% cheaper. Set Glue version to 6.0.
  • Claude Security on Mythos 5 - August 21. Enterprise GitHub scans without interactive Mythos access.
  • Rillet Unicorn - August 21. $100 million at $1 billion after a 48-hour raise.

The theme this week was where your code lives and what runs when it builds. You can upgrade to Go 1.27 and get generic methods and a real JSON v2, stand up Origin next to GitHub, and take Claude’s computer and browser tools out of beta, while the default forge spent nearly eight hours teaching everyone about sidecar autoscaling and client retries. Redis and crates.io were the reminder that “minor” releases and lockfile bumps are how RCEs and build-time malware arrive. If you do only a few things after reading this, install Go 1.27 in a branch and run your tests, patch Redis on every branch you still run, grep lockfiles for proc-macro1 and the listed crate versions, and decide whether Origin is a mirror or a distraction before an admin opt-out window closes. Next week, watch GitHub’s retry-budget work, whether OpenRouter’s close changes routing defaults, and independent numbers on Go 1.27 json/v2 in production. See you then.