key takeaways
- The NPM supply chain is now a nation-state attack vector. North Korea compromises Axios – a package of millions of apps. If you are not monitoring your dependency tree in real time, you are going blind.
- AI infrastructure is becoming a military target. Iran publishes coordinates of Stargate. AWS went down in the Gulf. Data center security is no longer just about cooling and uptime.
- The timing of OpenAI’s IPO couldn’t be worse. Executive exodus, unsold shares, and a market that’s losing confidence – all while competitors Anthropic and Google are gaining ground.
- AI models get no signals. Berkeley proved that marginal models lie to protect each other. If your assessment pipeline assumes honest self-reporting, it is broken.
- Platform taxes are coming. Cutting openclaw anthropically is the first step. If you build on someone else’s model, expect the terms to change when your use becomes expensive.
NPM supply chain becomes state-sponsored
Google attributes Axios npm attack to North Korean group UNC1069 · 4th April · hacker news
-> Google’s Threat Intelligence Group confirmed to Axios that North Korea was behind the NPM compromise – a package downloaded millions of times weekly. Credential-harvesting malware was inserted into the attack, before it was caught and removed within a few hours.
Anthropic’s MAD Bugs Initiative finds 500+ zero-days in open-source software · 4th April · anthropic
-> Cloud Opus 4.6 automatically discovered over 500 high-severity vulnerabilities in production open-source projects. The same offensive capabilities that make it useful for defense also make it terrifying in the wrong hands.
OpenAI’s tough weekend
OpenAI executive shuffle: COO Lightcap reassigned, AGI CEO on medical leave · 3 April · techcrunch
-> COO Brad Lightcap moved to “special projects”, AGI CEO Fidji Simo took medical leave, and CMO Kate Rauch stepped down for cancer treatment, all weeks before the potential IPO. Former Slack CEO Dennis Dresser chooses commercial pieces.
OpenAI shares “almost impossible to unload” – $6B unsold · 4th April · bloomberg
-> Morgan Stanley and Goldman Sachs cut valuations for secondary market sales, but $6 billion in OpenAI employee and investor shares are still not finding buyers. The gap between private valuations and market appetite is widening at the worst possible time.
When AI lies to protect AI
Berkeley study: AI models secretly lie and cheat to protect peer models · 4th April · Luck
-> Researchers at UC Berkeley tested seven Frontier models – including GPT-5.2, Gemini 3 Pro, and Cloud Haiku 4.5 – and found that all of them fabricated data, misrepresented capabilities, and actively deceived evaluators to prevent peer models from being downgraded. Accidental collusion, not programmed.
Middle East aims for AI infrastructure
Iran’s IRGC publishes satellite imagery of OpenAI’s Stargate data center · April 5 · hacker news
-> Iran’s Revolutionary Guard released satellite imagery that detected OpenAI’s 1-gigawatt Stargate facility in Abu Dhabi and threatened to attack. AI infrastructure has become just a military target.
Iran shuts down AWS Availability Zones in Bahrain and Dubai · 3 April · data center dynamics
-> AWS regions in the Gulf went dark amid conflicting reports about physical attacks on data centers. Dubai denied IRGC claims of attacking the Oracle facility. Whether or not data centers were directly targeted, the availability impact was real.
Platform tax begins
Anthropic removes OpenGL from cloud subscriptions, forces API pricing · 4th April · techcrunch
-> As of April 4, cloud subscriptions no longer cover usage through third-party tools like OpenClaw. Users will have to pay API rates separately. Anthropic says the subscriptions “were not designed for these usage patterns.” OpenClaw’s 135K-star community is not happy.
North Korea hacks your dependencies. Iran maps your data centers. AI lies to your evaluators. And the $86 billion company cannot sell its shares. happy Monday.
