Thoughts on AI, the tech stack, and the indie hacker journey.
Between 5:57 and 7:30 PM ET on April 22, a malicious version of @bitwarden/cli was live on npm. The collectors specifically scanned for ~/.claude/mcp.json. The supply chain just got personal for solo devs who live in Claude Code, Cursor, and Codex CLI.
Beijing ordered Meta and Manus to "withdraw the acquisition transaction" — a deal that closed in December for $2–3B. Manus had moved from Beijing to Singapore before the deal specifically to dodge this. It didn't work. If you build on Manus or any China-roots AI tool, the boring question for your Monday is: what's the contingency plan?
Anthropic shipped /ultrareview on April 22. It spins up a fleet of review agents in a remote sandbox — application logic, edge cases, security, performance — each one independently verifying findings. Pro and Max subscribers get three free runs that expire May 5. Then it's $5–$20 per run. Here's whether to keep paying.
DeepSeek dropped V4-Pro and V4-Flash on April 24 under MIT license. Pro is within 0.2 points of Claude Opus 4.6 on SWE-bench Verified, beats Claude on Terminal-Bench 2.0 and LiveCodeBench, and costs roughly 1/4 of Opus. The routing decision for solo operators just got concrete.
OpenAI dropped GPT-5.5 on April 24 and made it generally available for GitHub Copilot the same day. Terminal-Bench 2.0: 82.7%, best in class. If your agent loop is Claude Code + MCP + Cursor, the question this week is narrow and practical: does GPT-5.5 actually out-execute Claude on your real work?
Pull up any indie hacker timeline in 2026 and you'll see three flavors of post over and over: "I switched from Stripe to Polar," "I left Vercel for Cloudflare," "I moved off Mailchimp to Resend." After auditing 30 of these posts, the pattern is uncomfortable: 80% are wrong about which decision actually moved the needle.
Ex-DeepMind reinforcement-learning lead David Silver emerged from stealth with Ineffable Intelligence: $1.1B seed at $5.1B post-money, the largest seed round in European history. The pitch: a superlearner that acquires knowledge through RL without human-generated data. Here's why I'm taking the thesis more seriously than the average stealth-startup headline.
Joby completed the first point-to-point electric air taxi flight in NYC history on April 27. JFK to West 30th Street, 7 minutes vs. 60–120 by car. Buried in the press coverage is the actual interesting story: Joby didn't build a new transit network. They bought a tiny existing one and rode along.
GitHub published GHSA-6w67-hwm5-92mq on April 21. By 03:35 UTC on April 22, a Sysdig honeypot caught the first exploitation attempt. No public PoC was ever needed. The threat model for self-hosted LLM servers just changed, and the math for solo operators changed with it.