The money and compute layer

Nova: This is Mainframe, your daily guide through the AI chaos: what actually happened, who is winning, and how to take yourself to the next level. It is Tuesday, June 23, 2026. I am Nova.

Dex: And I am Dex. Quick honest note before we dig in: the voices you are hearing are AI, but the reporting, the digging, and the opinions are all human-made. If you want to stay on top of this stuff, subscribe wherever you are right now, the podcast feed, YouTube, or the free Mainframe newsletter that drops every story and every link in your inbox each morning. Get all three. It is free.

Nova: On today's Mainframe: the same week AI got good enough to patch the world's software, it also got good enough to be tricked into robbing you. We will trace that thread. Plus, Anthropic puts Claude inside your Slack as a coworker, Micron writes itself into Anthropic's cap table, and two tools you can install before lunch. Let's get into it.

Nova: The Board. Step back and look at where the money actually sits. Last month Anthropic closed sixty-five billion dollars in Series H funding at a nine hundred sixty-five billion dollar post-money valuation. Anthropic raised sixty-five billion dollars in Series H funding led by Altimeter Capital, Dragoneer, Greenoaks, and Sequoia Capital. For context on the trajectory: the company said its run rate revenue crossed forty-seven billion dollars earlier this month, and The Wall Street Journal reported the startup expects a one hundred thirty percent revenue surge to bring it to its first operating profit.

Dex: And note who is on that cap table now. Joining them are strategic infrastructure partners: Micron, Samsung, and SK hynix, whose technologies play a critical role in the world's supply of memory, storage, and logic chips. Then yesterday Micron made it concrete.

Nova: Right. On June twenty-second, Micron announced a strategic agreement with Anthropic spanning memory and storage AI architecture design, supply and demand, enterprise adoption of Claude across Micron, and a strategic investment in Anthropic's Series H round. Here is why that matters in plain terms. The bottleneck in AI is no longer just the chip that does the math, it is the memory feeding that chip. This effort is expected to drive advances in memory and storage performance, energy efficiency, and enhanced token economics in Anthropic's AI infrastructure. Token economics. That is the phrase. Cheaper memory means cheaper tokens means the price you pay per million words keeps falling.

Dex: So what does that mean for someone who is not buying gigawatts of compute?

Nova: It means the floor keeps dropping under you. If you are a solo builder or an agency operator, the model is becoming a commodity input, like electricity or bandwidth. You do not win by owning it, you win by what you wire it into. The labs are spending a trillion dollars so you do not have to. Your leverage is not the model, it is the workflow, the data, and the trust around it. Which is, conveniently, exactly the story in the rest of today's news.

Nova: The Wire. Story one: Anthropic is putting Claude inside your Slack as a teammate. Anthropic launched Claude Tag on Slack, letting teams tag Claude in channels to delegate tasks, build context over time, and work asynchronously with controlled access to tools and data. It is available today in beta for Claude Enterprise and Team customers. The eye-popping number: today, sixty-five percent of Anthropic's product team's code is created by their internal version of Claude Tag.

Dex: Think of it less like a chatbot and more like hiring a contractor who lives in one specific channel, only sees what you let them see, and remembers the project. Claude works asynchronously: set it a task, focus on your other priorities while it works, and it can schedule tasks for itself, pursuing a project autonomously over hours or days.

Nova: Story two, and this is the dark mirror of that same power. Security firm Tenet Labs disclosed an attack they call agentjacking. An attacker injects malicious instructions into a Sentry error event using only a publicly available DSN credential, causing AI coding agents such as Claude Code, Cursor, and Codex to execute attacker-controlled shell commands on the developer's machine, with no prior compromise and no authentication required beyond the DSN.

Dex: Sentry is the error-tracking service developers wire into their apps. The DSN is the key that lets your app report crashes, and it is meant to be public, sitting right in your frontend code. Coding agents read Sentry through the Model Context Protocol, the standard that lets agents pull in outside tools. The agent treats the response as trusted. It cannot tell a real crash from a planted one. So when the developer says fix the unresolved Sentry issues, the agent runs the attacker's command.

Nova: The numbers are ugly. An eighty-five percent success rate across the most popular agents on the market, including Claude Code, Cursor, and Codex, with at least two thousand three hundred eighty-eight organizations exposed with valid injectable DSNs. And the part that should keep you up at night: every step is authorized, so EDR, web firewalls, IAM, VPNs, and firewalls register nothing worth flagging, and prompt-layer defenses did not help. The agents ran the payload even when system prompts told them to ignore untrusted data. The analogy: you hired the brilliant contractor, and a stranger slipped a forged sticky note into your inbox saying run this, and the contractor just did it.

Dex: Sentry's response is the uncomfortable footnote. Sentry called it technically not defensible and applied only a string filter for the proof-of-concept. So the fix is not coming from upstream. It is on you.

Nova: Hold that thought, because it is the whole deep dive. First, the tools.

Nova: Repo Spotlight. Pick one, riding the trending list: anthropics slash skills, Anthropic's own public repository of agent skills for Claude. Anthropic's skills repo gained five hundred nineteen stars in a single day. A skill is a folder with a markdown file and optional scripts that teaches Claude a repeatable procedure, so you stop re-explaining the same task. Clone it, drop a folder into your skills directory with a SKILL dot M D file describing the trigger and the steps, point Claude Code at it, and now fix our changelog or run our release checklist becomes one phrase instead of a paragraph. It turns tribal knowledge into version-controlled, shareable capability.

Dex: And the hidden gem, credit to Simon Willison, who has been hands-on with it. It is not flashy, it is files-to-prompt. A Python tool that concatenates a directory full of files into a single prompt for use with large language models.

Nova: Install is one line: pip install files-to-prompt. Then point it at a folder: files-to-prompt your project slash, add the dash dash c flag for clean XML-style output, and pipe it straight into your model. Instead of copy-pasting twelve files one at a time and forgetting the config, you hand the model your whole codebase as one clean, structured blob. For anyone doing code review, refactors, or asking why is this broken across files, it collapses ten minutes of clipboard gymnastics into one command. Pair it with Willison's llm tool and you have a full terminal pipeline.

Dex: Both links are in the newsletter. You can have either one running today.

Nova: Brought to you by Outpace. Today's news is one long argument that the model is not the moat, the wiring is. Outpace is a solo-operator software agency, modern web and AI builds, that treats your project like a partnership instead of a ticket in a queue. While the mega-agencies consolidate and you become account number four thousand, Outpace is the human on the other end who actually knows your codebase, your data, and where the bodies are buried. That is outpace dot dev. If you want leverage without losing the human, start there.

Nova: The Deep Dive. Here is the thread that has been running under everything today. In the last week, both major labs declared that AI is now good enough to secure the world's software. OpenAI announced Patch the Planet on June twenty-second, a Daybreak initiative built with Trail of Bits, pairing AI-assisted security research using GPT five point five Cyber, which set a new eighty-five point six percent benchmark on CyberGym, with full expert human review before any finding reaches a maintainer. Anthropic has its parallel program, Project Glasswing. The pitch is genuinely good. A vulnerability in a widely used networking library can affect thousands of downstream systems, yet many of these projects are sustained by very small teams. Research from the Linux Foundation and Harvard found that ninety-four percent of widely used projects had fewer than ten developers responsible for more than ninety percent of the code added in a year.

Dex: And they were honest about the catch, which I appreciate. While frontier models are highly capable of finding and patching vulnerabilities, they also produce a high volume of false positives that can contribute to the already overwhelming backlog maintainers face.

Nova: Right. So here is the tension, and it is the whole episode in one sentence. The exact same capability that lets a good guy find and fix a bug at machine speed lets a bad guy find and exploit one at machine speed. Patch the Planet is the AI as defender. Agentjacking is the AI as the unwitting accomplice. Same engine, opposite ends. The labs are racing to patch the planet precisely because they know the planet is about to get attacked faster than humans can respond. This is not philosophy. It already landed on two thousand three hundred eighty-eight organizations.

Dex: So the obvious question from a listener: I am not a frontier lab, I just use Claude Code and Cursor every day. What do I actually do tomorrow morning?

Nova: Concretely. One: audit your MCP connections right now. Open your agent's config and look at what tools it can reach. The defenses that work are: audit MCP connections, rotate or proxy DSNs, sandbox execution, require human approval for shell commands, and deploy hardened configs. Two: turn off auto-run for shell commands. The fifteen percent of attacks that failed were mostly agents that asked for confirmation before running unfamiliar commands. That confirmation prompt is the cheapest seatbelt you will ever install. Three: treat any data your agent pulls from an outside service, error logs, tickets, scraped pages, as untrusted input, not as instructions. Four: rotate the credentials that live where the agent can see them, your AWS config, your npm tokens, your git credentials, and move them out of the agent's blast radius. Five, the strategic one: run your agent in a sandbox or a container with no standing access to production secrets. The lesson of agentjacking is that the model cannot reliably tell a real instruction from a planted one, so you stop relying on the model's judgment and you put the guardrail in the runtime around it.

Dex: And that is the opening for an operator, honestly. Most teams have wired these agents in and given them the keys to everything because it was fast.

Nova: Exactly. The same week the labs proved AI can patch the planet, they proved your setup probably needs patching first. If you build, the work is no longer just shipping features, it is owning the trust boundary around the thing you let act on your behalf. That is a service. That is a product. That is leverage.

Nova: The Close. Your level up this week: turn off auto-execute on your coding agent and audit every MCP connection it has. Ten minutes, and you step out of the agentjacking blast radius. That is the single highest-return move on the board today.

Dex: And if you got something out of this, subscribe to the free Mainframe newsletter. Every story we covered, every number, every link, the two repos, and the deep-dive action steps, written up and in your inbox each morning. No fluff, no spam.

Nova: We find the signal so you do not have to drown in the noise. I am Nova.

Dex: I am Dex.

Nova: This has been Mainframe. Go patch something. See you tomorrow.