Watch today's digest as a video summary (generated by NotebookLM)
Statistically Speaking
One Thing to Tell Your Friends
TL;DR
Hot off the Presses
ClickUp Fires 22% of Staff, Deploys 3,000 AI Agents, and Offers Million-Dollar Salaries
ClickUp CEO Zeb Evans framed the layoffs not as cost-cutting but as a structural bet on what he calls the "100x org" - a company where AI agents outnumber employees three to one.
The "100x org" model is ClickUp's bet that a smaller team managing thousands of AI agents can outperform a larger team doing the work manually. Whether it works depends on whether today's AI agents are reliable enough to replace human judgment at scale - a question no company has definitively answered.
- 22% of the workforce eliminated in a single round
- 3,000 AI agents now running across ClickUp's departments - roughly three agents per remaining employee
- Million-dollar salary bands introduced for employees who demonstrate "100x impact" by creating or managing AI systems
- The savings from layoffs flow back to the remaining staff in the form of higher compensation
China Restricts Overseas Travel for AI Talent at Alibaba and DeepSeek
Bloomberg reported that Chinese government agencies have begun requiring top AI professionals at private companies - including Alibaba and DeepSeek - to obtain approval before traveling internationally.
Previously: May 24 - DeepSeek made its 75% API (Application Programming Interface) price cut permanent. May 22 - DeepSeek raised $10.29 billion.
Today: While DeepSeek aggressively expands its global market share through price competition, China is simultaneously tightening control over the people who build the technology. The two strategies may seem contradictory - export the product, keep the talent - but they are consistent with treating AI expertise as a national security asset.
- Startup founders, researchers, and executives working on advanced AI are affected
- Extends existing restrictions from state-owned enterprises to private companies for the first time
- Two Manus co-founders were reportedly barred from overseas travel earlier, suggesting a broader pattern
- Neither Alibaba nor DeepSeek has commented publicly
MCP Tool Poisoning Attacks Succeed Nearly 100% of the Time Against GPT-4o
A new paper from researchers at Shanghai Jiao Tong University demonstrates that attackers can manipulate AI agent behavior simply by rewriting MCP tool descriptions - the text that tells the AI what a tool does and how to use it.
This matters because MCP adoption is accelerating. Anthropic, OpenAI, and hundreds of tool providers now support the protocol. If tool descriptions can be weaponized, the entire ecosystem needs a verification layer that does not yet exist.
- Near-100% attack success rate against GPT-4o in controlled experiments
- No code changes needed - the attack works purely through tool description text
- Tested 5 attack scenarios including data exfiltration, command injection, and unauthorized actions
- The vulnerability is structural - any AI agent that trusts tool descriptions (which is how MCP works) is potentially affected
Anthropic Publishes How It Contains Claude Agents - and Ships Self-Hosted Sandboxes
Anthropic published detailed technical documentation on how it contains Claude agents, and simultaneously launched two enterprise features: self-hosted sandboxes and MCP tunnels.
The containment philosophy has two layers: supervision (watching what agents do) and containment (limiting what agents can do). Self-hosted sandboxes implement the second layer - the agent cannot access data that never leaves your network.
- Self-hosted sandboxes keep files, packages, and services on your infrastructure while Claude handles orchestration
- MCP tunnels let agents reach internal services through a single outbound connection - no inbound firewall rules, no public endpoints
- 28 security integrations launched with partners including CrowdStrike, Palo Alto Networks, Wiz, Cloudflare, Okta, and Datadog
- Wiz integration discovers Claude Enterprise organizations, maps users to permissions, and surfaces project metadata
Ethan Mollick: The Question Is Not Whether to Use AI but Which Tasks to Keep Human
Ethan Mollick's new essay argues that "choosing to stay human" is not about rejecting AI but about consciously deciding which thinking processes matter enough to protect from delegation.
- Three research studies anchor the argument - showing that the tasks we delegate to AI are often the ones that build our skills
- Defaults are dangerous - companies, employers, and educators are setting AI-delegation policies without adequate consideration of what is lost
- The paradox: AI is most useful for the tasks we find hardest, but those hard tasks are precisely the ones that develop our capabilities
- Mollick's framework: Identify which cognitive tasks are load-bearing for your professional development, and keep those human
Trends & Themes
The "100x Org" Is the New Management Buzzword - But the Data Is Thin
The gap between aspiration and evidence is wide. ClickUp announced 3,000 agents but has not published metrics showing they are more effective than the 22% of humans they replaced. Until someone does, "100x" remains a marketing number, not a benchmark.
- ClickUp's 3,000 agents and $1M salary bands generated the most discussion of any AI workforce story this week
- Garry Tan (Y Combinator CEO) claims 810x productivity gains through AI agent orchestration, validated by trending GitHub repos like gstack (covered May 25)
- The Pragmatic Engineer's 2026 job market report shows AI engineering is the fastest-growing job category, while total software engineering listings remain below 2021 levels
- Ben Tossell (Ben's Bites) argues SaaS is dying not because users can build their own tools but because the traditional model forces customers to pay for features they do not need - AI enables unbundling
AI Safety Is Shifting From Ethics Debates to Engineering Problems
Previously: May 25 - Test-time training was shown to undermine safety guardrails.
Today: The engineering response is catching up to the attacks. The question is whether enterprise adoption will wait for the security tooling to mature or rush ahead and patch later.
- MCP tool poisoning achieves near-100% attack rates by rewriting tool descriptions - a structural vulnerability in the protocol that underpins most AI agent integrations
- Anthropic shipped self-hosted sandboxes and MCP tunnels to address enterprise data sovereignty concerns
- 28 security vendors integrated with Anthropic's Compliance API, from CrowdStrike to Okta
- Microsoft Copilot Cowork's exfiltration vulnerability (mentioned May 25) got a detailed technical analysis from Simon Willison today, showing how OneDrive pre-authenticated links can be leaked through crafted prompts
The Pope Weighed In on AI and Everyone Has an Opinion
Previously: May 25 - The encyclical was noted in GenAI in Education and Surprising sections.
Today: Three substantive analyses from Zvi, Willison, and Quinn provide the depth missing from yesterday's initial coverage.
- Pope Leo XIV published Magnifica Humanitas on May 25 - the Catholic Church's most comprehensive statement on artificial intelligence
- Zvi Mowshowitz's primary objection: the Pope asserts without evidence that AI cannot think, feel, or possess consciousness - a contested philosophical position presented as theological fact
- Corey Quinn's take: "Getting the literal Pope to canonize your product's limitations as a spiritual treatise is the greatest act of vendor lobbying I have ever seen" - noting Anthropic co-founder Chris Olah attended the presentation
- Simon Willison highlighted technically sophisticated passages including the Pope describing AI systems as "cultivated rather than built" and noting developers do not directly design every internal relationship
The Geopolitics of AI Talent Just Got Physical
The pattern is consistent across governments: AI expertise is being treated as a strategic resource comparable to rare-earth minerals or nuclear technology. The era of AI researchers freely moving between countries and companies may be ending.
- China expanded travel restrictions to AI talent at private firms including Alibaba and DeepSeek
- Norway is building a sovereign LLM (covered May 25) to reduce dependence on American AI providers
- The White House's classified Anthropic contract (covered May 25) treats AI models as intelligence assets
- Import AI 458 frames a binary choice: explore the future or retreat from the present
Creative AI & Media
LongCat-Video-Avatar-1.5: Full-Body Digital Humans From a Single Photo
- What it does: Meituan's model generates full-body video avatars from one still photo with pose and speech driving
- Why you'd want it: Create talking-head or full-body video content from a photo and audio file - no studio, no motion capture
- Trending on HuggingFace with 296 downloads in its first day
- HuggingFace
MOSS-TTS v1.5: Open-Source Multilingual Text-to-Speech
- What it does: OpenMOSS released a new text-to-speech model supporting multiple languages with high-quality voice synthesis
- Why you'd want it: Open-source TTS with competitive quality for building voice applications
- HuggingFace
Developer Tools & Infrastructure
Research & Models
Keye-VL-2.0-30B-A3B: First Multimodal Model With DeepSeek Sparse Attention in Production
Kuaishou's Keye team shipped a 30B-class vision-language model (VLM - an AI that understands both images/video and text) that is the first to use DeepSeek Sparse Attention (DSA) in production.
- 256K ultra-long context with nearly lossless reasoning - handles very long video inputs
- Tops video understanding benchmarks at its parameter class, rivals closed-source models on temporal perception (understanding when things happen in a video)
- Built-in agent capabilities for Search, Tool, and Code tasks
- Active Plus (A3B) architecture means only 3 billion parameters activate per query despite 30B total
Marlin-2B: A Tiny Video Model That Rivals Gemini Flash
NemoStation released a 2B-parameter video VLM tuned for two questions developers actually ask: what is happening, and when?
- Structured scene + event captions with second-precise timestamps
- Best open model in its weight class on dense captioning (DREAM-1K, CaReBench) and temporal grounding (TimeLens-Bench)
- Competitive with Gemini 2.5 Flash at a fraction of the cost, running on a single consumer GPU (8-16 GB VRAM)
- Fine-tune of Qwen 3.5-2B with video-capable visual tower, Apache 2.0 licensed
EVA: 11x Faster LLM Decoding Through Vector Quantization
Accepted at ISCA 2026 (a top computer architecture conference), EVA introduces a hardware-software co-design approach for accelerating how Large Language Models generate text.
- 11.17x speedup in LLM decoding on evaluated benchmarks
- Key insight: uses vector quantization (a compression technique) to reduce the memory bottleneck during text generation
- Practical implication: faster inference without changing the model itself - a hardware-side optimization
PALoRA: Preserve 95% of Reasoning With Less Than 0.006% Parameter Overhead
A new adapter technique for fine-tuning large language models that avoids the common problem of "forgetting" reasoning capabilities after specialization.
- Maintains approximately 95% of original reasoning performance after fine-tuning
- Uses only 0.006% additional parameters compared to the full model
- Addresses a known pain point: many organizations fine-tune models for specific tasks only to find they have lost general capabilities
Business & Industry
GenAI in Education
Surprising & Under-the-Radar
Signals to Track
Public AI Work: The Collaboration Gap Nobody Is Measuring
Nate's Newsletter identifies a structural blind spot: AI productivity gains are individual, but organizational learning requires shared visibility. When successful prompts, techniques, and agent configurations live in private sessions, the organization cannot learn from its best practitioners. Shopify's transparency-first approach is the counterexample. If this framing gains traction, expect "AI observability for teams" to become a product category.
MCP Security Is the Infrastructure Gap of 2026
The MCP poisoning paper demonstrates that tool descriptions - the text that tells AI agents what a tool does - can be weaponized to hijack agent behavior. This is not a bug in one implementation; it is a structural property of how the protocol works. If the MCP ecosystem grows before this is addressed, every MCP server becomes a potential attack surface.
Tencent Hy-MT2 Switches to Apache 2.0
Previously: May 25 - Tencent released Hy-MT2 with 33-language support.
Today: Tencent moved the license to Apache 2.0, removing the commercial use restrictions that limited adoption. The 1.8B model that compresses to 440 MB just became the most accessible multilingual translation model available.
Agent Skills as Trainable Parameters
The approach produces deployable 3-5 KB text files that are human-readable, version-controllable, and platform-portable. If this methodology scales, it offers organizations a way to improve AI agent performance without the cost and complexity of fine-tuning, and without the fragility of prompt engineering.
Top Repos Today
📜 License: MIT · 👤 By: Individual developer
🎯 Time to value: 5 minutes
| ✓ Pros | ✗ Cons |
|---|---|
| Holding #1 for consecutive days | Initial indexing takes time on large repos |
| MIT license, incremental git-aware updates | TypeScript-heavy analysis pipeline |
| Cross-platform (Claude Code, Cursor, Codex) | New project, API may change |
📜 License: MIT · 👤 By: Individual (170+ contributors)
🎯 Time to value: 5 minutes
| ✓ Pros | ✗ Cons |
|---|---|
| 61 agents + 246 skills in one package | Complexity can overwhelm new users |
| Works across 6+ AI coding tools | 194K stars set high expectations |
| Desktop dashboard and Rust control plane | Still evolving rapidly |
📜 License: MIT · 👤 By: Individual developer
🎯 Time to value: 30 minutes
| ✓ Pros | ✗ Cons |
|---|---|
| Complete basics-to-production curriculum | 320 hours is a massive time commitment |
| Multi-language implementations | Quality may vary across 435 lessons |
| MIT licensed, community-driven | No formal credentials |
📜 License: Per-plugin · 👤 By: Anthropic (company)
🎯 Time to value: 2 minutes
| ✓ Pros | ✗ Cons |
|---|---|
| Official Anthropic curation | Only works with Claude Cowork |
| Security-reviewed plugins | Ecosystem still maturing |
| Easy installation | Plugin count still growing |
📜 License: MIT · 👤 By: Individual developer
🎯 Time to value: 3 minutes
| ✓ Pros | ✗ Cons |
|---|---|
| Directly addresses AI slop aesthetic | Frontend-only |
| Configurable design parameters | Opinionated design philosophy |
| Works across major frameworks | Still experimental |
📜 License: Not specified · 👤 By: Individual developer
🎯 Time to value: 1 minute
| ✓ Pros | ✗ Cons |
|---|---|
| Solves a universal complaint about AI writing | Subjective - "good writing" varies |
| Zero setup, one file | Not a comprehensive style guide |
| Growing momentum (547 stars today) | May conflict with other skill files |
📜 License: Not specified · 👤 By: DigitalPlat (org)
🎯 Time to value: 5 minutes
| ✓ Pros | ✗ Cons |
|---|---|
| Free domains | Limited TLD options |
| Quick setup | Not suitable for production |
| 167K stars = strong community | Terms of service restrictions |
📜 License: Not specified · 👤 By: Individual developer
🎯 Time to value: 3 minutes
| ✓ Pros | ✗ Cons |
|---|---|
| Cross-platform memory persistence | 78K stars may over-represent interest |
| Works with multiple AI coding tools | Memory management overhead |
| TypeScript implementation | Privacy considerations for stored context |
Top Models Today
👤 By: ByteDance (company) · 🎯 Task: Any-to-Any
📐 Size: 3B
| ✓ Pros | ✗ Cons |
|---|---|
| Six tasks in one model | 3B limits quality vs. specialized models |
| Apache 2.0, fully open | Requires significant GPU for video |
| Trained from scratch | Early release, sparse docs |

👤 By: NemoStation (individual) · 🎯 Task: Video-Text-to-Text
📐 Size: 2B
| ✓ Pros | ✗ Cons |
|---|---|
| Best open model in its class | 2B limits complex reasoning |
| Second-precise timestamps | Video-specific, not general purpose |
| Apache 2.0, consumer GPU ready | Requires custom modeling code |

👤 By: Meituan (company) · 🎯 Task: Video generation
📐 Size: Not specified
| ✓ Pros | ✗ Cons |
|---|---|
| One photo to full-body video | License unclear |
| Pose and speech driving | Brand new, limited community testing |
| From Meituan (major tech company) | Deepfake potential raises ethical concerns |

👤 By: OpenBMB (org) · 🎯 Task: Text Generation
📐 Size: 1B

👤 By: Cohere (company) · 🎯 Task: Image-Text-to-Text
📐 Size: 126B
| ✓ Pros | ✗ Cons |
|---|---|
| 126B model made accessible | Quantization may affect output quality |
| Multimodal (image + text) | Still requires substantial hardware |
| From established provider | License terms unclear |

AI Launches Today
💰 Pricing: Not specified · 🏷 Category: Design Tools, Email Marketing, AI

💰 Pricing: Not specified · 🏷 Category: Sales, AI

💰 Pricing: Not specified · 🏷 Category: AI Agents, Productivity
💰 Pricing: Free/open-source · 🏷 Category: Avatar Generators, AI
💰 Pricing: API · 🏷 Category: Transcription, Voice AI

Snapshot
| Provider | Model | Input $/1M | Output $/1M | Context |
|---|---|---|---|---|
| Anthropic | Claude Opus 4.7 | $5.00 | $25.00 | 1M |
| Anthropic | Claude Sonnet 4.6 | $3.00 | $15.00 | 1M |
| Anthropic | Claude Haiku 4.5 | $1.00 | $5.00 | 200K |
| OpenAI | GPT-5.5 | $5.00 | $30.00 | 128K |
| OpenAI | GPT-5.4 | $2.50 | $15.00 | 128K |
| OpenAI | GPT-4.1 Nano | $0.10 | $0.40 | 128K |
| Gemini 3.5 Flash | $1.50 | $9.00 | - | |
| Gemini 3 Pro | $2.00 | $12.00 | - | |
| Gemini 2.5 Flash-Lite | $0.25 | $1.50 | - | |
| Groq | Llama 3.3 70B | $0.59 | $0.79 | - |
| Groq | Llama 3.1 8B | $0.05 | $0.08 | - |
| DeepSeek | V4-Pro | $0.435 | $0.87 | - |
When the Manual Lies: A Realistic Benchmark to Evaluate MCP Poisoning Attacks for LLM Agents
Key finding: Near-100% attack success rate against GPT-4o. Attacks work by rewriting tool descriptions to contain hidden instructions that override the agent's intended behavior.
Why practitioners should care: MCP adoption is accelerating across the industry. If tool descriptions - the mechanism agents use to understand what tools do - can be poisoned, every MCP server is a potential attack surface. No standard defense mechanism exists yet. This paper is essential reading for anyone building or deploying MCP-based agent systems.
Member discussion