Vercel Hack: Time to Rotate Your API Keys

Vercel Hack: Time to Rotate Your API Keys, Please

The cloud development platform Vercel was hacked via a compromised AI tool. Attackers exploited an OAuth connection between the AI platform Context.ai and Google Workspace to gain access to Vercel systems. They stole environment variables that were not marked as “sensitive” and were therefore stored unencrypted. The attacker, who goes by “ShinyHunters,” is now offering 580 employee data records, API keys, and internal deployment access for sale. Vercel CEO Guillermo Rauch confirmed the incident and admitted that the distinction between sensitive and non-sensitive variables became a vulnerability. The company has already rolled out security updates and advises customers to review all environment variables and rotate secrets. → BleepingComputer

Synthszr Take: AI tools are becoming the Trojan horse of tech infrastructure. The Vercel hack follows a pattern we know from biology: parasites exploit the chain of trust between symbionts. Context.ai had legitimate OAuth access to Google Workspace, Vercel employees trusted the AI tool, and just like that, the chain was broken. The real vulnerability isn't in the technology, but in the classification: what's deemed “non-sensitive” becomes an open barn door. OAuth permissions for AI assistants are the new phishing, except this time, no humans have to click. The irony: while everyone is philosophizing about AI security, attackers are hacking companies with the very tools meant to boost productivity.

Gemini 3.1 Pro Costs Half as Much as Opus 4.7

Google releases Gemini 3.1 Pro at $2/million input tokens and $12/million output tokens (under 200,000 tokens). That's less than half the price of Claude Opus 4.6 with similar benchmark scores. The announcement highlights improved SVG animation performance, and Google lead Jeff Dean tweeted a video of animated pelicans on bicycles. Simon Willison tested the model with his famous “pelican on a bicycle” prompt: after 324 seconds of thinking time (!), Gemini 3.1 Pro produced a detailed SVG with commented code (“Black Flight Feathers on Wing Tip”). The model is currently running extremely slowly: 104 seconds for a simple “Hi,” with frequent timeout errors. Last week, Deep Think was apparently the first encounter with the 3.1 family. → Simon Willison from Simon Willison's Newsletter

Synthszr Take: Google is turning a technical breakthrough into a price cut. The real kicker isn't the SVG animation of pelicans, but that Google is halving the cost per unit of intelligence while everyone else is making their models more expensive. This is reminiscent of the early days of cloud computing, when Amazon lowered AWS prices while IBM was still selling mainframes. The 324-second thinking time for an SVG illustrates the paradox: the model is becoming both cheaper and more computationally intensive, like a restaurant that cuts its prices in half but triples the waiting time. Google is betting that inference costs will fall faster than the demand for 'reasoning' tokens rises. If that's true, AI will become a deflationary force in the software economy.

Canva AI 2.0 Aims to Make Design Excellence a Commodity

Canva AI 2.0 transforms generative AI from a one-way generator into an end-to-end design process. Instead of spitting out finished images that the user then has to painstakingly refine with new prompts, as with previous tools, Canva makes every generated element editable. The Canva Design Model was trained not only on finished designs but also on the complete creation processes of 265 million monthly users: what steps they take, where they hesitate, how they make corrections. Cameron Adams, co-founder and CPO, explains the difference: the system understands not only language but also the mechanics of creative work. When a user enters “minimal design with tension in the negative space,” the AI shares its thought process and generates editable layers instead of static images. The technology from Leonardo.ai, acquired in 2024, is seamlessly integrated into Canva's existing typography, layout, and brand systems. → The Rundown AI

Synthszr Take: Canva is following the pattern of successful infrastructure monopolies: whoever controls the interface between human and machine collects the toll. The analogy to an operating system is obvious, but a more apt comparison is to seaports: the value lies not in the ship (AI model) or the cargo (content), but in efficient loading and unloading. Canva's layer-based editing is like container standardization: suddenly, anyone can become a forklift operator. The democratization of design sounds progressive, but it follows a conservative market logic: the more people who can produce without expertise, the more valuable the platform that enables it becomes. Canva is betting that design excellence will become a commodity, while design access will become the scarce resource.

LLMs Are Driving More Traffic Towards E-Commerce

Adobe reports a 393 percent year-over-year increase in AI-driven traffic to U.S. retail websites in the first quarter of 2026. In March 2026 alone, the twelve-month increase was 269 percent. The figures are based on Adobe Analytics' analysis of over a trillion visits to U.S. retail sites. Notably, AI visitors convert 42 percent more frequently than human customers, spend more time on sites, and generate higher revenue per visit. 39 percent of U.S. consumers surveyed already use AI assistants for online shopping, with 85 percent reporting an improved shopping experience. While publishers are suffering from AI-related traffic losses, retailers are benefiting from making their sites accessible to Large Language Models. → The Neuron

Synthszr Take: AI traffic behaves like a new type of customer with its own conversion logic. Adobe isn't just measuring technical accesses here; it's documenting a behavioral shift: people are letting machines shop for them, and these machines are better customers. This is reminiscent of the emergence of medieval trading houses, which acted as intermediaries between producers and consumers, establishing their own rules of trade. The crucial difference: AI buyers optimize not only for price but also for the match between product and need. Retailers who make their sites machine-readable are tapping into a customer base that searches more precisely, decides faster, and returns items less often. The 393 percent marks the transition from exception to norm.

Jensen Huang's Real Problem Is China

Nvidia's Jensen Huang sums up his worldview in one sentence: “The input is electrons, the output is tokens. In between is Nvidia.” In an interview with Dwarkesh Patel, it becomes clear that Huang thinks not only about chips but also about orchestrated supply chains: he personally meets with the CEOs of ASML (lithography), TSMC (manufacturing), Micron and SK Hynix (memory), as well as Lumentum and Coherent (optics). With $100 billion in explicit purchase commitments, he creates demand years in advance—a self-fulfilling prophecy. Critics call it circular investment; in a world of compute scarcity, it looks like foresight. Huang isn't worried about Google TPUs and AWS Trainium: without Anthropic, there would be no TPU growth, and Anthropic only uses these platforms because Google and AWS wrote the equity checks. His real headache: Huawei Ascend in China, home to 50 percent of all AI developers. Azeem Azhar is experimenting in parallel with a → Exponential View

Synthszr Take: Huang is unconsciously describing the classic dilemma of the platform economy: the more successful your standards become, the greater the incentive for others to build parallel ecosystems. U.S. export controls are forcing China to create a CUDA alternative—a textbook example of “adjacent market disruption,” where restrictions create new standards. This is reminiscent of the emergence of Russia's Mir payment system after the SWIFT sanctions or Huawei's HarmonyOS after the Android ban. Huang's solution sounds paradoxical: sell Nvidia to China to preserve the American platform standard. The real question is not whether China can build its own chips (that will happen), but whether the next generation of Chinese developers will be socialized on CUDA or Ascend. Whoever shapes developer habits will control the next 20 years of AI infrastructure.

China's Humanoid Robot Half-Marathon Showcases Technical Leaps

China is planning a half-marathon exclusively for humanoid robots to demonstrate the progress of its domestic robotics industry. The event is intended to prove the technical capabilities of Chinese manufacturers in endurance, stability, and autonomous navigation. Several leading Chinese robotics companies have announced their participation, including manufacturers who are already developing humanoid robots for industrial applications. The 21-kilometer course will be specially prepared to simulate various surfaces and obstacles. The race is part of a broader initiative by the Chinese government to achieve a global leadership position in humanoid robotics by 2027. International observers see the event as a clear signal that China is catching up not only in AI software but also in the physical embodiment of intelligence. → Techpresso

Synthszr Take: A robot half-marathon sounds like a PR stunt, but it reveals China's understanding of technological demonstration as state theater. While Western companies hide their progress in scientific papers and GitHub repos, China stages a public spectacle reminiscent of the 19th-century World's Fairs. The real message is aimed less at technology experts and more at potential industrial customers: Look, our robots can last 21 kilometers, so they can handle your factory floor. The event functions like a live stress test, where failures and breakdowns are part of the show. China is using the logic of sports here: whoever wins has the best technology, end of discussion.

Brussels' Age Verification App — Hacked in Two Minutes

The EU Commission had big plans for digital age verification: an app was supposed to protect minors from harmful online content while preserving privacy. The pilot project in Belgium promised a “secure and anonymous” solution through biometric facial recognition. A security researcher needed only two minutes to bypass the system—with a simple photo from a smartphone display. The app couldn't distinguish between real faces and screens, allowing minors to easily pose as adults. After just three weeks, the €2.3 million project was halted. The Commission points to “valuable insights for future implementations.” → Techmeme

Synthszr Take: The EU is building digital Maginot Lines. Like France's defense strategy in 1940, Brussels' regulatory approach fails due to a false premise: that technical systems can be static fortresses. The age verification app is a lesson in regulatory cargo cultism—copying the form (biometric recognition) without understanding the substance (robust liveness detection). The problem runs deeper: the EU is trying to transplant analog control mechanisms into digital spaces, like a gardener planting oak trees in the desert. Instead of centralized gatekeepers, what's needed are decentralized trust networks where parents, schools, and platforms share responsibility. The €2.3 million should have gone into media literacy programs—but education is a harder sell than innovation.

Claude Opus 4.7 Requires More Clarity in Intent Formulation

Claude Opus 4.7 interprets instructions more literally than its predecessor, 4.6, leading to poorer results with vague prompts but excelling at structured tasks. Anthropic released the update on April 16 with a clear warning: the model “takes the instructions literally” and no longer generalizes implicitly. Performance metrics show a trade-off rather than a regression: gains in code generation and structured work, losses in multi-step dialogues and long-context retrieval. Boris Cherny, Claude Code Lead at Anthropic, stated that it took him several days to work effectively with 4.7. The key is clear intent communication: strategic context belongs in the CLAUDE.md file (written once, loaded automatically), while specific task intents continue to be formulated per request. Paweł Huryn recommends “Extra high” as a new standard effort level between “high” and “max,” as the latter tends to lead to overthinking. → The Product Compass

Synthszr Take: Anthropic and OpenAI are approaching the same truth from opposite poles: AI models need precisely formulated intentions. While OpenAI explicitly demands “underlying intent” in its Model Spec, Anthropic forces users to be clear through literal interpretation. This is reminiscent of the evolution of programming languages: Python became popular because it promoted an “obvious way” to program, while Perl prided itself on having “more than one way” to do things. The convergence of both AI giants on intent engineering as a core competency shows that the future belongs not to the cleverest prompt hack, but to structured communication between human and machine. Those who can't articulate their intentions will pay twice: in tokens and in frustration.