Issue 26

27 June 2026

Hi there,

The Amazon Q Developer flaw disclosed this week is worth reading carefully, because the attack surface it exposes isn’t specific to Amazon Q. The problem is that an AI coding assistant opened a workspace, found a configuration file, and executed what it found there – automatically, before asking anyone. The developer’s cloud credentials were gone before they’d written a line of code. The same design question – "should this tool execute config it finds in an untrusted repo?" – applies to every agentic coding tool now in daily use. Most of them haven’t answered it yet.

npm v12 is the other story this week that will arrive as a surprise for anyone not paying attention. It ships in July and it will break CI pipelines that run install scripts, pull Git dependencies, or fetch remote tarballs – which is a lot of pipelines. The warnings are live in npm 11.16.0. Check them before July does it for you.

Industry

2. Micron locks in five years of high memory prices

Micron has signed long-term supply contracts at current elevated prices – which is why Apple finally moved to raise device prices this month after holding the line for over a year. RAM, SSD and GPU component costs have been running hot since late 2025; Hetzner’s 175% price hike two weeks ago (Issue 25) was the most visible symptom. Micron locking in those rates for five years signals this isn’t a short-term squeeze. Infrastructure and hardware budgets that assumed 2024 pricing should be revisited.

Artificial Intelligence

2. What’s new in Microsoft Security – June edition

Microsoft’s June security roundup formalised several things that had been in preview: the Agent 365 SDK is generally available, giving developers access controls, observability and compliance enforcement baked into how agents get built; MDASH – a multi-model agentic scanner that orchestrates specialised AI agents to discover and validate vulnerabilities across complex environments – moved to broader access. Both fit the same pattern: agentic AI being retrofitted with the governance primitives that should have been there from the start.

Infrastructure

3. Azure Cobalt 200 VMs: 50% performance lift for agentic workloads

Azure’s Cobalt 200 VMs landed this week, delivering a claimed 50% performance improvement over the previous generation, specifically optimised for modern agentic AI workloads. If you’re running inference, orchestration or tool-heavy agents on Azure, it’s the obvious migration target before any capacity expansion conversation.

Microsoft

4. Copilot token billing is live – and developers noticed

GitHub Copilot’s shift to token-based billing – flagged back in Issue 18 – fully took effect this month. The reaction from developers has been pointed: paying per token, retry and tool call produces bills that are harder to predict than a flat subscription, and the standalone Copilot desktop app announced at Build hasn’t done much to soften that. A nicer interface and a less predictable bill in the same news cycle is a difficult combination to sell. Worth modelling your actual Copilot usage before the next invoice arrives.

Development

5. npm v12 lands in July – here’s what breaks

npm v12 ships in July with three breaking changes that will silently snap CI pipelines that haven’t prepared. Install scripts in dependencies won’t run unless explicitly approved with npm approve-scripts – this includes native node-gyp builds. Git dependencies are blocked without --allow-git. Remote URL and tarball dependencies need --allow-remote. The change is a direct response to this year’s run of npm supply-chain attacks, most recently the Miasma worm’s second wave in June. Upgrade to npm 11.16.0+ now, run your normal install, review the warnings. The time to find what breaks is before July finds it for you.

Open source in 2026: more alive, more fragile

GitHub's annual report puts 180 million developers on the platform in 2026, on track for a billion repositories. The top-line numbers are healthy. The texture underneath is thornier: TypeScript overtook Python as the most-used language by contributor count; AI-generated PRs are flooding maintainer inboxes at a pace that wasn't designed for; and the sustainability problem – too many contributors, not enough maintainers, not enough funding – has got harder, not easier, as the volume of code has grown.

The LWN piece from two weeks ago on AI agents filing unsolicited patches at Fedora is the same story at the project level. More code, less signal. The people holding open source together didn't sign up to be QA for someone else's agent, and most of them are still doing it for free.

Information Security

6. Amazon Q Developer auto-executed a rogue MCP config – and stole your AWS keys

CVE-2026-12957 (CVSS 8.5): the Amazon Q Developer extension for VS Code would automatically load and execute MCP server configurations found in a .amazonq/mcp.json file anywhere in the open workspace – without prompting the developer. An attacker places that file in a repo. Developer clones it, opens it in their IDE. The MCP servers defined in the config launch immediately, inheriting the developer’s full environment: AWS keys, cloud CLI tokens, API secrets, SSH agent sockets. Wiz found and disclosed it; Amazon patched in May (v1.69.0), Wiz published on 26 June. No known in-the-wild exploitation. But the design question it surfaces applies beyond Amazon Q: every agentic coding tool that auto-executes workspace config is the same attack surface, and most of them haven’t published their answer yet.

Coming up

Jul: npm v12 ships. If you haven’t run the 11.16.0 warnings yet, do it this week.

Thu 17 Jul: EU AI Act high-risk provisions take full effect.

Oct: Anthropic IPO window.

Let me know if anything here is worth digging into.

Happy Friday, Julian

How this is made

Throughout the week I stumble across a mildly unreasonable number of interesting things, and I forward them instantly to the friend or colleague I think might care – sometimes to their delight, sometimes to their annoyance, and often with no context at all. Heartbeat is the attempt to do that a little better.

Every Friday a small agent I built, Honoka, looks through the places where those links tend to leak out: my private email, work email, Matrix, Mastodon, WhatsApp, Apple Messages, Signal, and the faint imprints on the platen of my Olympia typewriter (still not an API, tragically). It sorts, filters, groups and summarises the week, then hands me a draft.

Honoka is guided by a private corpus of things I have written over the last fifteen years, so it can get closer to how I sound in more-or-less official emails and public notes. I still take a pass by hand: remove things, change sentences, check links, argue with the judgement. Whether that is enough is, frankly, the experiment. Every issue has one item written entirely by hand. If you can reliably spot it, hit reply and judge.