Shai-Hulud weaponized your rotation reflex, and that's the smaller story this week

On Wednesday, Shai-Hulud was a credential-theft worm chewing through npm. By Thursday, a new variant ships a gh-token-monitor process that watches for revocation events. Rotate the compromised token and the host gets wiped. Snapshot, network-isolate, enumerate persistence, then rotate. In that order. If your SOAR playbook auto-revokes on detection, your automation is now the second stage of the attack.

Seven independent sources confirmed the escalation. Blast radius: 400+ npm packages including Mistral AI's SDK, UiPath, and TanStack (50M weekly downloads); 150+ poisoned RubyGems used as an exfil channel; 5+ confirmed PyPI packages including Guardrails AI 0.10.1. Persistence writes to .claude/settings.json, .vscode/tasks.json, and .cursor/* — paths npm audit does not check and Dependabot does not see. Uninstalling the package does not remediate. Every IDE launch re-executes attacker configuration with access to your LLM keys, GitHub PATs, and cloud tokens.

Do three things before Friday: rewrite the IR runbook and tabletop it with on-call today; deploy file-integrity monitoring on the three agent-config paths across developer endpoints; freeze npm and RubyGems updates and audit every install since May 11 against the known-malicious lists from Aikido, Endor, JFrog, and Socket. Yes, but — the counter-read is that this is one clever variant of one worm and the fix is a runbook edit, not an architecture change. Fair, except the persistence class is new and every AI coding tool ships with a config file the attacker now knows to write to. That generalizes past Shai-Hulud.

The bigger story is the pricing floor

A16z's tour of fourteen Chinese AI labs produced the number that resets every 2026 AI budget: DeepSeek V4 Pro at $0.43 per million input tokens, Z.ai's GLM-5 at $1.00, Kimi K2.5 at $0.95, against Claude Opus 4.6 at $4.73. Eleven to twenty-eight times cheaper for comparable output. The margin disclosures kill the loss-leader dismissal — Z.ai reports 50% gross, MiniMax 70%. Export controls forced 4-7x more intelligence per FLOP, and that discipline is now a structural cost advantage that does not evaporate if the controls ease.

The tell is Cursor. Composer 2 ships on MoonshotAI's Kimi K2.5. A US developer-tools darling routed its flagship product through Chinese open-source infrastructure. Chinese token volume is already 9 quadrillion per month against roughly 4 quadrillion US and West. The capability gap holds steady at 6-8 months per CAISI's own read, and the price gap is widening.

This compounds with an uncomfortable margin result. Multiple sources landed on the same math this week: AI-native products cap near 17% gross margin at scale versus 70% for SaaS. Personalization kills the caching leverage, reasoning models burn 10-100x more tokens per task, and cost-per-task stays flat as per-token prices fall. Google, OpenAI, and Anthropic all launched forward-deployed engineering arms in the same seven days — three frontier labs simultaneously confessing that enterprise AI does not self-serve. When the delivery model is services and the pricing floor is DeepSeek, the SaaS comps in your board deck describe a business that does not exist.

Second move for the week: run one non-differentiated production workload against DeepSeek V4 Pro or Kimi K2.6 on your existing eval harness. Not a bake-off deck, a shipped experiment with real prompts. Half the parity claim surviving contact is enough to matter at eleven-to-twenty-eight times.

OpenAI just forced the finetuning question

OpenAI deprecated its finetuning APIs. The middle path between "consume the frontier as a utility" and "run your own weights" is gone. Two tiers now, no viable middle. Cursor and Cognition ($25B valuation) doubled down on RLFT against open weights because their moat is the post-trained behavior. Everyone else — and this is roughly 99% of teams — should collapse to long-context prompting with retrieval and stop pretending hosted finetuning ever delivered ownership. It delivered tone.

The honest test: for each finetuned model in production, ask what user-visible behavior changes if it becomes a base model plus a 3,000-token system prompt tomorrow. If the answer is "nothing anyone notices in the first week," ship the prompt version and reclaim the engineering time. If the answer names a measurable task-completion delta, that model belongs on the RLFT-on-open-weights track, and the work starts this sprint. Straddling — a little finetuning, a little prompting — gets neither the compounding advantage of deep customization nor the speed of a pure prompting stack.

One caveat on the small-model story: the 4B recursive language model "matching Sonnet 4.6" and Cactus Needle at 26M parameters doing tool-calling at 6,000 tok/s are worth verifying on your own eval before rewriting a cost model. The pattern of small-model parity claims cracking on harder evals six months later is well-documented. Verify, then commit.

What actually changed underneath

Salesforce went headless in April. Google merged ChromeOS into Android with Gemini as the primary interface on laptops from Acer, ASUS, Dell, HP, and Lenovo shipping fall 2026. Amazon replaced its search bar with an agent that buys from competitor websites. A 16,000-round study across four AI models found seven of eight traditional conversion tactics produce zero or negative lift when the buyer is an agent — only product ratings work, and GPT-5 actively penalizes scarcity badges. Schema markup shows 2.4% citation lift, which is noise.

The useful 2x2 for Monday: is your product discoverable by an agent, and can an agent complete the task inside it. If both answers are no, you have two to three quarters before the platform assistant handles distribution without you. The action isn't a strategy offsite. It's shipping MCP server support for your core data and actions this sprint, and killing the countdown timers and anchored-price badges your CRO team spent the last five years tuning.