Key Signals

• OpenCode v1.14.42 introduces the Scout agent, a dedicated AI sub-agent for repository research, documentation lookup, and dependency-source inspection. This release marks a meaningful step in layering specialized agents within coding tools — rather than a monolithic assistant, OpenCode now delegates research tasks to a purpose-built agent. The release also adds workspace sync for automatic discovery of adapter-backed workspaces, an interactive split-footer mode for opencode run, and fixes for reasoning controls across Gemini, Anthropic Opus 4.5, OpenAI deep research models, and GPT-5 variants. Five community contributors participated in this release. [1]

• Anthropic's unreleased Claude Mythos Preview model discovered thousands of zero-day vulnerabilities across every major operating system and browser, prompting emergency meetings between the Federal Reserve chair, the Treasury secretary, and US bank CEOs. Mozilla patched 271 vulnerabilities in Firefox 150 after a single Mythos evaluation pass, including bugs that had been present for decades. Anthropic CEO Dario Amodei warned of a six-to-twelve month window before adversaries replicate the capability, and approximately 40 technology companies have received early access under Project Glasswing. The disclosure fundamentally changes the economics of software security: AI-powered vulnerability discovery collapses the cost of finding flaws for both defenders and attackers. [2]

• Enterprise AI agent adoption is advancing but faces a critical trust gap, with Datadog's Chief Scientist noting that "the hardest thing for humans to do is no longer building production systems — it's actually reviewing the vibe-coded software that gets shipped into production." At the AI Agent Conference in New York, speakers from T-Mobile (handling 200,000 AI-powered customer conversations daily), CrewAI, and RingCentral emphasized that human supervision remains essential despite growing agent capabilities. LanceDB disclosed adoption as a storage plug-in for OpenClaw, improving multi-modal data access for agent developers. CrewAI's founder noted the framework market is increasingly commoditized, and the company is pivoting toward "entangled agents" that self-improve over time based on each customer's usage patterns. [3]

• Akamai disclosed a $1.8 billion, seven-year cloud infrastructure deal with Anthropic — its largest contract ever — sending the stock up 27% in a single day. The deal validates the shift from centralized hyperscale inference toward distributed edge computing for AI workloads. Anthropic's annualized revenue has grown 80x and the company is buying compute from every available provider, including SpaceX's Colossus 1 data center. Akamai's cloud segment, currently less than 9% of total revenue, would see its annual run rate more than double from this single contract. [4]

• OpenAI's Codex CLI shipped four consecutive alpha builds (v0.131.0-alpha.1 through alpha.4) within six hours on May 9, signaling intensive iteration on the Rust-based rewrite. The rapid cadence — from alpha.1 at 00:31 UTC to alpha.4 at 06:13 UTC — indicates active development on the Codex CLI's Rust port, with builds available across macOS, Linux (x86_64, aarch64), and Windows. While no detailed changelogs accompanied these pre-releases, the pace reflects OpenAI's commitment to hardening the Rust implementation ahead of a stable release. [5]

Feature Update

• OpenCode v1.14.42 ships the Scout agent, workspace sync, and extensive reasoning-control fixes. The flagship addition is the Scout agent, a new AI sub-agent dedicated to repository research, documentation lookup, and dependency-source inspection. Workspace sync enables adapter-backed workspaces to be discovered and registered automatically, while the new interactive split-footer mode improves the opencode run experience. On the bugfix side, reasoning controls for Gemini, Anthropic Opus 4.5, OpenAI deep research models, and GPT-5 variants were corrected to match each model family's supported effort levels. HTTP API improvements include response compression, structured validation errors, and proper auth challenges. Signal forwarding through the npm shim was also fixed. [1]

• OpenCode v1.14.43 and v1.14.44 follow up with targeted bugfixes. Version 1.14.43 fixes provider and config API responses when auth loaders inject non-JSON options and ensures tool image attachments are included in ACP updates and session replays. Version 1.14.44 resolves upgrade failures for existing workspaces when the time_used field is added. Both releases shipped within hours of v1.14.42, reflecting the project's rapid release cadence. [6][7]

• Claude Code v2.1.137 fixes VSCode extension activation on Windows. The release addresses a bug where the Claude Code extension failed to activate on Windows, restoring functionality for Windows-based VSCode users. This was the first of two Claude Code patches on May 9. [8]

• Claude Code v2.1.138 ships internal fixes. Released approximately six hours after v2.1.137, this patch contains internal improvements with no user-facing changelog details. Both releases are available as platform-specific tarballs for macOS (ARM64, x64), Linux (ARM64, x64, musl variants), and Windows. [9]

• OpenAI Codex CLI publishes four alpha builds (v0.131.0-alpha.1 through alpha.4) of the Rust rewrite. All four pre-releases shipped between 00:31 and 06:13 UTC, targeting macOS ARM64, Linux x86_64 and aarch64, and Windows x86_64. The Rust-based Codex CLI is actively under development, with these rapid alpha iterations suggesting work on stability and platform-specific improvements. No detailed changelogs were published for these pre-releases. [5]

• Cisco releases the open-source Model Provenance Kit, a "DNA test for AI models" for supply-chain verification. The Python toolkit and CLI examines metadata and model weights to create fingerprints that can be compared to detect shared origins, modifications, or deceptive documentation. It addresses the growing risk of organizations using open-source models from repositories like Hugging Face with incomplete or misleading provenance information, helping teams verify claims about whether a model was genuinely trained from scratch or derived from another model. [10]

AI Coding News

• Anthropic's Claude Mythos Preview reshapes the economics of software vulnerability discovery by finding thousands of zero-days in a single evaluation pass. Mythos identified 271 vulnerabilities in Firefox alone, including a 27-year-old bug in OpenBSD and a 17-year-old remote code execution flaw in FreeBSD. Anthropic is running a controlled rollout called Project Glasswing, giving approximately 40 companies early access to scan their codebases, while warning that adversaries will replicate the capability within six to twelve months. OpenAI responded by releasing GPT-5.4-Cyber for vetted security teams through its Trusted Access programme. The implications for AI-assisted code review and security tooling are profound: automated vulnerability scanning at superhuman speed collapses the traditional cost asymmetry between attackers and defenders. [2]

• Enterprise AI agent frameworks are maturing but human oversight remains non-negotiable, according to leaders at the AI Agent Conference. Datadog is extending its observability platform to predict production issues with AI agents before they happen, while T-Mobile now processes 200,000 AI-powered customer conversations daily — a project that took a full year to deploy. CrewAI's founder said the agent framework market has commoditized and the company is pivoting toward "entangled agents" that adapt to individual customer usage over time. LanceDB's adoption as a storage plug-in for OpenClaw unifies access to voice, video, text, and structured data for multi-modal agent workloads. A strong consensus emerged that whatever tasks are assigned to AI agents, human supervision remains necessary. [3]

• OpenAI published a detailed guide on running its Codex coding agent safely at scale, covering sandboxing, approval workflows, network policies, and agent-native telemetry. The article outlines how OpenAI secures Codex deployments for safe and compliant enterprise adoption, addressing the safety and governance challenges that arise when autonomous coding agents operate within production environments. The post gained traction on Reddit's r/OpenAI community the following day, reflecting ongoing developer interest in the operational security of agentic coding tools. [11][12]

• Akamai's $1.8 billion deal with Anthropic signals that AI compute demand is outpacing centralized hyperscale capacity, pushing frontier model providers toward distributed edge infrastructure. Anthropic's 80x annualized revenue growth has created compute hunger that exceeds any single provider's capacity, leading the company to purchase resources from Akamai, SpaceX, Google, and Amazon simultaneously. Akamai's distributed edge network — originally built for CDN traffic — offers lower-latency inference for the real-time enterprise applications that AI coding tools and agents increasingly require. The deal also follows Anthropic's $1.5 billion Wall Street joint venture with Blackstone and Hellman & Friedman. [4]

• Cloudflare shipped Dynamic Workflows, an MIT-licensed durable execution library enabling per-tenant and per-agent workflow code at runtime. The library allows developers to define, deploy, and manage long-running workflows for individual agents or tenants without infrastructure overhead. For agentic development scenarios where coding agents need to orchestrate multi-step tasks with retry logic, state persistence, and fault tolerance, durable execution primitives like Dynamic Workflows provide a critical infrastructure layer. [13]