- Book: Observability for LLM Applications β paperback and hardcover on Amazon Β· Ebook from Apr 22
- Also by me: Thinking in Go (2-book series) β Complete Guide to Go Programming + Hexagonal Architecture in Go
- My project: Hermes IDE | GitHub β an IDE for developers who ship with Claude Code and other AI coding tools
- Me: xgabriel.com | GitHub
Five stories this week. Three of them change your roadmap. Two of them will be cited in postmortems next year. None of them is a new model benchmark.
If you only skim one of these, make it the Mercor breach. If you have five minutes, read them all and then look at your own gateway.
1. Cursor 3 ships with Composer 2, a coding model trained from scratch
What happened. Anysphere released Cursor 3 this week, and the headline feature is Composer 2, an in-house coding model trained from the ground up rather than fine-tuned on top of someone else's weights. Anysphere is claiming faster agentic edits and better long-context coherence on repos over 200k lines. Early benchmarks the company published put it above Claude 3.7 Sonnet on their internal refactoring evals; independent reproductions are still trickling out.
Why it matters for you. If you build with Cursor today, you now have a model that is free to call at high frequency without the tab-completion quota gymnastics of the past year. If you build a Cursor competitor, the moat just shifted: it used to be about UX on top of third-party models, it is now about owning the model that sees the code. Expect GitHub Copilot and the rest to respond within one quarter.
2. Anthropic's Project Glasswing β Mythos 5 announced, not shipped
What happened. Anthropic used its Project Glasswing briefing this week to reveal Mythos 5, a 10-trillion-parameter frontier model. The announcement is unusual because the model is not being released. Anthropic's stated reason is cybersecurity risk: internal red-teaming turned up non-trivial capability uplift on offensive-security tasks, and the company says it will not ship the weights or the API until mitigations are in place. A dated public release has not been committed to.
Why it matters for you. This is the first time a frontier lab has announced a model at the 10T scale and then declined to ship it. Two things follow. One, your capability planning cannot assume that bigger is automatically available: you may be stuck with the current-generation API ceiling for longer than the scaling curves suggested. Two, every competitor lab now has a reference point for what is considered too-dangerous-to-ship, and that reference point will show up in procurement conversations and regulation drafts within weeks.
3. Mercor ($10B) breached through the LiteLLM supply chain
What happened. Mercor, the AI talent-matching startup that closed its Series C at a $10B valuation last month, disclosed a breach this week. The attack vector: a compromised LiteLLM release pulled in via an unpinned transitive dependency. The malicious version exfiltrated provider API keys and a subset of prompt payloads before Mercor's gateway logs surfaced the anomaly, roughly 11 days post-install. This is the second public incident traced to the LiteLLM supply chain in six weeks.
Why it matters for you. If you are using LiteLLM as an SDK import (and most teams are), your gateway is not a service you instrument. It is a library that shares your process memory and your environment variables. That is an enormous trust boundary sitting inside an unpinned requirements.txt line. Pin your versions. Rotate provider keys on a schedule. Treat the gateway as an attack surface, not as infrastructure.
I wrote about this class of blind spot after the March LiteLLM incident. The Mercor disclosure is the same failure mode, higher-valuation target.
4. Two Claude outages in 48 hours, April 7β8
What happened. Anthropic's status page shows two separate degradation windows in the same 48-hour period earlier this month. The first was a capacity-routing issue on Sonnet 4.7 that returned elevated 529s for European traffic. The second, less than 36 hours later, was a latency spike on Opus driven by an internal TPU reconfiguration. Anthropic has not published a combined postmortem yet, but the individual incident notes are detailed enough to diagnose from.
Why it matters for you. Your application's availability is a function of your provider's availability multiplied by the effectiveness of your fallback. If you called Claude Opus directly from a request-path handler during either window, your users saw both outages. If you had a gateway with a fallback chain that dropped to Sonnet, then to an OpenAI or Gemini peer, your users saw neither. This is not a new lesson, it is the same lesson your uptime kept writing checks for. Budget a second provider. Measure fallback latency. Exercise the path weekly.
5. OpenAI acquires Windsurf, ripples still moving
What happened. The OpenAIβWindsurf acquisition closed at the end of March and the integration work is surfacing now. Windsurf's agentic-editor tech is being folded into what OpenAI is positioning as a first-party coding surface for GPT-5. Pricing has not shifted yet; the existing Windsurf Pro plan was grandfathered for 12 months, but the roadmap notes that future features will be gated behind an OpenAI account.
Why it matters for you. Together with the Cursor 3 launch, you now have two of the three leading agentic-coding surfaces owned by frontier labs. The independent middle, editors built on top of third-party APIs, is compressing fast. If you depend on one of these products for your workflow, read the acquisition terms carefully and look at what vendor lock-in means for your team's code ending up in a specific provider's training pipeline.
Also worth a look
A few things that didn't make the top five but will matter before the month is out.
- Meta Muse Spark. Meta announced Muse Spark, a small-footprint coding model aimed at on-device inference. The positioning is clearly laptop-class, and the benchmarks are reasonable for a 7B-scale model. Open weights, Apache 2.0. If you care about coding assistants that run offline, this is the first credible option in that lane.
- Google Gemma 4. Google dropped Gemma 4 with a 2B and a 9B variant. The 9B is the one to watch. It lands above Llama 3.3 70B on a handful of reasoning evals while being an order of magnitude smaller.
- Z.ai GLM-5V-Turbo. GLM-5V-Turbo is a Chinese multimodal model with strong chart-reading and document-extraction numbers. If you are building invoice or form pipelines, worth a bake-off against GPT-4V-equivalent tiers.
What to watch next week
Three things on the calendar or on the edge of landing.
- Anthropic's red-team write-up on Mythos 5. Anthropic said a safety report would follow within weeks. If it drops, it will define the frame for how frontier labs talk about held-back models.
- Mercor's full postmortem. The disclosure this week was the first wave. A fuller writeup of the attack timeline, including which keys were exfiltrated and for how long, will tell you whether your own gateway logs would have caught this class of compromise.
- Cursor 3 independent benchmarks. Anysphere's internal evals look good on paper. What matters is what the Aider leaderboard, SWE-bench maintainers, and independent reviewers say by mid-week. Hold your infrastructure bets until then.
If you run LLM workloads in production, this week was a reminder of the two places your instrumentation is probably weakest: the gateway layer and your fallback chain. Go look at both.
If this was useful
The Mercor breach and the Claude outages both map to chapters in the observability book I finished last month. The gateway chapter covers instrumentation for the LiteLLM-class attack surface. The incident-response chapter covers the playbook for outages that hit in pairs, like the one Anthropic had on the 7th and 8th.
- Book: Observability for LLM Applications β paperback and hardcover on Amazon Β· Ebook from Apr 22
- Also by me: Thinking in Go β Book 1: Go Programming + Book 2: Hexagonal Architecture
- My project: Hermes IDE | GitHub β an IDE for developers who ship with Claude Code and other AI coding tools
- Me: xgabriel.com | GitHub
![Defluffer - reduce token usage π by 45% using this one simple trick! [Earthday challenge]](https://media2.dev.to/dynamic/image/width=1000,height=420,fit=cover,gravity=auto,format=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2Fiekbgepcutl4jse0sfs0.png)
