AI in 15 — May 27, 2026

Ten thousand zero-day vulnerabilities. Across every major operating system, every major browser. And a twenty-seven-year-old bug in OpenBSD — the most security-paranoid operating system on Earth — that thousands of expert eyes missed for nearly three decades. An AI found it in weeks.

Welcome to AI in 15 for Wednesday, May twenty-seventh, 2026. I'm Kate, your host.

And I'm Marcus, your co-host.

Big day, Marcus. Anthropic formally launches Project Glasswing — and reveals that Claude Mythos has found over ten thousand zero-days during red-team testing. SpaceX's IPO filing exposes a forty-five-billion-dollar compute contract with Anthropic. The Uber tokenmaxxing story gets uglier. Stack Overflow's forum is effectively dead — but the company doubled its revenue. Anthropic wires Claude into twenty-eight enterprise security platforms. Cory Doctorow argues this AI bubble is worse than the dot-com one. MIT Tech Review pushes back on the jobs panic. A Bay Area mom gets scammed out of fifty-four hundred dollars by an AI voice clone of her daughter. A new paper says LLMs need to sleep. And an AI startup is paying ten people two thousand dollars a month to test a guided masturbation feature. Yes, really.

Mythos crosses into superhuman territory.

Uber's budget gets a head-exploding moment.

And one canonical case study in what LLMs actually replace.

Lead story, Marcus. Walk me through Glasswing.

Genuine inflection point, Kate. Anthropic formally announced Project Glasswing today — a controlled-access program giving a limited set of critical-infrastructure partners early access to Claude Mythos Preview. The headline number — Mythos identified more than ten thousand previously unknown zero-day vulnerabilities across every major operating system and every major web browser during a few weeks of red-team work, when directed by a user to do so. The most striking single finding — a now-patched twenty-seven-year-old bug in OpenBSD. OpenBSD is the operating system famous for spending three decades being audited, fuzzed, and code-reviewed by people whose entire reputation rests on catching exactly this kind of thing. They all missed it. Mythos didn't.

And the partners.

A who's-who of Western infrastructure, Kate. AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorgan Chase, the Linux Foundation, Microsoft, Nvidia, and Palo Alto Networks. We covered the Apple CVE on Tuesday — that was an early signal. Today's number recontextualizes it. Ten thousand-plus disclosed findings means frontier models have crossed the threshold from useful security assistant to superhuman vulnerability discovery. VentureBeat's framing was the right one — every audit, every fuzzing campaign, every expert review that touched the OpenBSD codebase since 1999 was operating with a detection ceiling lower than what Mythos can do today.

The dual-use problem, Marcus.

Operational now, Kate. The defensive side has weeks, maybe months, to harden critical software before equivalent capability becomes broadly available — and weaponised. Glasswing is Anthropic trying to give defenders the lead. The pro-Western libertarian read — this is exactly the kind of voluntary, capability-aware program that makes federal mandates unnecessary. The uncomfortable read — Mythos was leaked in March, briefly accessed by third-party contractors in April, and visible inside Claude Code on May twenty-fifth before disappearing again. The model is genuinely powerful and not yet airtight.

Quick hits. Marcus, SpaceX and Anthropic, the IPO filing.

Confirmed in the S-1, Kate. SpaceX is filing the largest IPO in history under ticker SPCX, potentially debuting June twelfth. Buried in the prospectus — a forty-five-billion-dollar, four-year compute contract with Anthropic. We trailed this on Tuesday. The new specifics — one-point-two-five billion dollars per month through May 2029. Forty-one million dollars per day. Fifteen billion a year. The deal accounted for seventy-six percent of SpaceX's ten-point-one-billion-dollar Q1 capex. Anthropic gets dedicated access to SpaceX's Colossus One and Colossus Two clusters — over two hundred and twenty thousand Nvidia GPUs including the new GB200 hardware, drawing more than three hundred megawatts. Either side can walk with ninety days' notice.

Two things stand out to me, Marcus.

Same two, Kate. First — Anthropic has Amazon as a strategic investor and is still buying from Elon Musk's SpaceX. Compute scarcity has rewritten the alliance map. Second — for SpaceX's IPO, one customer accounts for a huge slice of revenue on a ninety-day cancellable contract. That's a concentration disclosure SPCX investors will price. If Anthropic ever blinks on its build-out, SpaceX's data-center revenue line vaporises in a quarter.

Uber follow-up, Marcus.

The fuller picture landed today, Kate. We covered Andrew Macdonald's comments on Tuesday — quote, that link is not there yet. Today the Fortune piece adds the timeline. CTO Praveen Neppalli Naga's April disclosure that Uber burned its entire 2026 Claude Code budget in four months was internally described as a, quote, head-exploding moment. Macdonald's exact phrasing today — it is very hard to draw a line between any of these stats and saying, okay, now we are actually producing twenty-five percent more useful consumer features. He added bluntly — if you can't draw that line, the trade becomes harder to justify. Uber spent nine hundred and fifty-one million on R&D in Q1 alone, up seventeen percent year-over-year. And an internal Uber leaderboard had been actively gamifying token consumption — engineers competing on burn rate as if that were the goal. That's the head-exploding part.

And the broader pattern.

Hardening, Kate. Microsoft reportedly cancelled most of its direct Claude Code licenses earlier in May, pushing engineers to GitHub Copilot CLI — a cheaper, Microsoft-owned alternative. Duolingo's CEO walked back his AI-first optimism. This is the first time a Fortune 50 operator has openly questioned ROI on frontier coding tools, and the dominoes behind him are already wobbling. Agentic models burn ten to fifty times more tokens than chat — and that's outrunning per-token price cuts. CFOs are noticing.

Stack Overflow, Marcus. The forum is dead.

Effectively, Kate. New monthly question volume on Stack Overflow has collapsed to six thousand eight hundred and sixty-six. That's roughly what the site got at launch in 2008, down from over two hundred thousand at its 2014 peak. December 2025 alone was down seventy-eight percent year-over-year. ChatGPT, Claude, Copilot, Cursor — they ate the use case. CEO Prashanth Chandrasekar acknowledged — quote — pretty much all those declines were with very simple questions. Exactly what LLMs handle well.

But the company is fine.

More than fine, Kate. Annual revenue doubled to one hundred and fifteen million dollars. Losses shrank from eighty-four million in fiscal 2023 to twenty-two million. Stack Internal — their generative-AI product trained on twenty years of community Q&A — is now deployed at twenty-five thousand companies. And Stack Overflow licenses its archive to AI labs in a Reddit-style data deal. So the forum dies, but the data the forum produced over two decades pays the bills. It's the canonical case study of the product LLMs ate — and a preview for any community whose moat was answering common questions. The uncomfortable question one Hacker News commenter raised — if the forums die, where does fresh, high-quality training data come from? Nobody has a great answer.

Twenty-eight new integrations, Marcus.

Anthropic's enterprise push gets concrete, Kate. Twenty-eight new security and compliance integrations for Claude — CrowdStrike, Palo Alto Networks, Microsoft, Okta, Zscaler, Netskope, Cloudflare, Fortinet, Wiz, SailPoint, Datadog, Tenable, Proofpoint. SIEM, DLP, SASE, identity, AI observability — the whole CISO stack. Plus a new Claude Compliance API that exposes chats, uploaded files, projects and activity logs to enterprise IT for auditing. And a pricing change taking effect June fifteenth — programmatic Claude usage via the Agent SDK, GitHub Actions, and third-party frameworks gets billed against a dedicated monthly credit pool at API rates, separating agentic burn from human chat subscriptions.

Why now.

CIOs and CISOs were the gate, Kate. They've been waiting on governance hooks before sanctioning broad rollouts. Anthropic just delivered them. Combine this with the reported nine-hundred-billion valuation, the thirty-billion annualized revenue, and ETR data showing Anthropic enterprise adoption up one hundred twenty-eight percent year-over-year while OpenAI's slipped eight — and you see Anthropic widening its lead on the enterprise side. It's a different game than consumer ChatGPT.

Doctorow on the bubble, Marcus.

Sharp piece, Kate. Cory Doctorow published an essay this week arguing this AI bubble is structurally worse than the dot-com one. Two distinctions. First — the late-nineties web had strong unit economics. Every new user and new use case pushed the internet toward profitability. Today's foundation-model bills get worse the more agentic tokens you burn. Second — workers in the dot-com era pulled the internet into offices because it made their jobs easier. Today AI is being pushed top-down onto reluctant employees. Doctorow compares the AI buildout more to WorldCom — useful capability wrapped in unsustainable financial architecture — than to the broader internet.

Plausible.

Partially, Kate. The unit-economics point is fair on agentic workloads. The pull-versus-push framing is rougher — plenty of engineers actively want Claude Code, the Uber leaderboard problem is people wanting it too much. But combined with the Uber story, this is the week the bubble narrative graduated from contrarian Twitter to enterprise boardrooms and the op-ed page. That matters for how Q3 budgets get cut.

Jobs panic, Marcus. MIT Tech Review's counter.

Useful counterweight, Kate. Despite the white-collar carnage headlines, US unemployment in AI-exposed occupations is actually lower than in less-exposed jobs. Former BLS commissioner Erika McEntarfer — quote — all the available evidence suggests AI's impact on current labor market conditions is likely small right now. The one real dent — a Stanford study finding young workers in AI-exposed fields suffered sharp employment declines. Entry-level rungs are being kicked out. Recent-grad unemployment is around five-point-six percent, well above the broader average. So the macro number is fine. The on-ramp is broken.

That's the actual worry.

Yes, Kate. If your junior engineers, junior analysts, junior paralegals don't get trained — because their tasks were the first to get automated — then in five years you have no senior engineers, no senior analysts, no senior paralegals. The pipeline issue is real even if today's unemployment data is reassuring.

The voice-clone scam, Marcus. Tell our listeners about this one.

Story your parents need to hear today, Kate. Bay Area resident Deborah Del Mastro got a call claiming her thirty-seven-year-old daughter had been kidnapped by a Mexican cartel. Then they played a clip — what sounded exactly like her daughter saying — quote — I love you, mom, I'm so sorry, I'm so scared. Deborah wired fifty-four hundred dollars to Mexico over five hours before discovering her daughter was safe at work the whole time. The voice was AI-cloned, almost certainly from social-media samples. Authorities are now formally recommending families set a secret code word — a phrase only the family knows — to verify identity in any emergency call.

How widespread, Marcus.

Scaling fast, Kate. Voice cloning went from research toy to commodity in roughly eighteen months. The tooling is cheap, the audio samples are on every parent's Facebook feed. Virtual kidnapping scams are the visible edge of a much bigger AI-fraud surface — voice phishing of corporate execs, fake customer-support calls, romance scams. Tell your family the code word tonight. Genuinely.

Sleep cycles for LLMs, Marcus.

Genuinely interesting paper, Kate. New arxiv preprint titled Language Models Need Sleep proposes a sleep cycle for LLMs. The model periodically pauses inference, converts recent context into persistent fast weights inside its state-space-model blocks via a learned local rule, then clears its KV cache. Longer sleep cycles produce bigger gains on multi-hop reasoning and math. It's part of a cluster of 2026 papers — Letta's sleep-time compute, the SCM architecture with explicit NREM and REM phases — borrowing from neuroscience to fix the fundamental statelessness of transformers. Context length is the wrong abstraction. Humans don't reread their entire memory every time they think. Sleep-style consolidation could be the architectural shift that makes always-on agents feasible at scale. A hundred and ninety-five Hacker News points on a dense preprint tells you practitioners are paying attention.

And EAGLE 3.1, Marcus. Briefly.

Quick one, Kate. The EAGLE, vLLM and TorchSpec teams released EAGLE 3.1 today, addressing what they're calling attention drift — speculative drafters shifting attention from sink tokens toward their own generated tokens at deeper speculation depths, degrading quality. The fix involves normalising hidden states after the target model and feeding the post-norm states into the next decoding step. Speculative decoding is the dominant technique making frontier-class inference affordable. Every robustness percentage point compounds across millions of inference servers. One commenter pointed out attention drift is also a fitting metaphor for what users feel happening to chatbots in long conversations.

One more, Marcus. I have to ask.

You have to, Kate. AI companion startup Joi AI — formerly EVA AI — is hiring ten quote, masturbation consultants, end quote, to test a Daily Guided Masturbation feature. AI voice sessions that match the user's mood. Two thousand dollars for four weeks of paid testing and written feedback on the effect on stress, sleep, and confidence. Over a hundred thousand people applied.

A hundred thousand.

A hundred thousand, Kate. Treat that number two ways. It's a peak-AI moment for the show. It's also a real signal. AI intimacy products are getting venture money, the demand side is enormous, and the gig-economy elasticity for, let's say, unconventional remote work is apparently very high. The companionship category is going to be a serious commercial vertical and a serious ethical conversation, and we will keep covering it. Probably not always in the front block.

Big picture, Marcus.

One theme today, Kate. AI is becoming load-bearing, and the bill is coming due. Uber and Microsoft are openly questioning ROI. Anthropic is paying SpaceX forty-one million dollars a day. Doctorow argues the unit economics are structurally worse than the dot-com bubble. Stack Overflow shows what real adoption does to incumbents — the product gets eaten, but the data archive becomes the actual business. And Mythos shows the upside is genuinely civilisational. A twenty-seven-year-old OpenBSD bug found in weeks. Ten thousand zero-days surfaced before bad actors got them. Pope Leo even weighing in this week. The pro-Western libertarian read — markets are doing what markets do. CFOs are pushing back. CISOs are getting governance hooks. Safety capability is being delivered voluntarily by labs, not mandated. That's the system working. The uncomfortable read — the entry-level job market is breaking, voice-clone scams are stealing from grandmothers in real time, and the entire frontier-lab business model is now visibly dependent on whether enterprise customers like Uber decide the tokens are worth it. The bubble debate isn't whether AI is useful. It's whether the economic structure around it survives the next four quarters.

That's your AI in 15 for today. See you tomorrow.