AI Morning Briefing — June 7th, 2026

Your daily digest of what's happening in AI, straight from the trenches.

---

🚀 Headlines (30 sec read)

• Anthropic files confidentially for IPO at $965B valuation — Q2 revenue projected at $10.9B, targeting NASDAQ in October
• Microsoft flags Claude Code GitHub Action prompt injection flaw — PRs and issues can hijack the AI agent's behavior mid-task
• Meta confirms Instagram accounts hacked via AI chatbot abuse — top Hacker News story today with 546 points
• OpenAI turning ChatGPT into AI superapp ahead of IPO — GPT-5.5 praised as major leap, image gen touted as best-in-class
• Gemma 4 12B QAT hits 120 tok/s on 12GB VRAM — r/LocalLLaMA community squeezes frontier performance out of consumer hardware

---

🧠 Deep Dives (4 min read)

Anthropic's $965B IPO Filing: The Numbers Are Staggering

On June 1st, 2026, Anthropic filed confidentially with the SEC — four days after closing a $65 billion Series H round that pushed its valuation to $965 billion. To put that in context: Nvidia took 23 years to reach $1 trillion. Anthropic is doing it in five.

The revenue trajectory is what stops you cold: $4.8B in Q1, $10.9B projected for Q2 — more than doubling in a single quarter. For the first time in company history, Anthropic expects an operating profit (~$559M this quarter). The Series H backers include Sequoia, Altimeter, Blackstone, Fidelity, and strategic hardware partners Samsung, SK Hynix, and Micron — the companies whose chips run Claude are now betting their capital on Claude's future.

What sets this apart from the OpenAI narrative: Anthropic is incorporated as a Public Benefit Corporation. Its Long-Term Benefit Trust legally requires balancing profit with responsible AI development. That structure survives the IPO. Goldman Sachs, JPMorgan, and Morgan Stanley are lead underwriters. Target: October 2026 on NASDAQ.

→ Full IPO analysis thread on X

---

Microsoft Discovers Prompt Injection in Claude Code's GitHub Action

Microsoft security researchers found that Anthropic's Claude Code GitHub Action is vulnerable to prompt injection attacks — meaning malicious content in issues or pull request descriptions can manipulate the AI agent's behavior during automated code tasks. The agent processes untrusted text from PRs and issues and can be steered by embedded instructions.

This is a textbook agentic security problem: the model's reasoning is sound, but the input boundary is too permissive. When AI agents read uncontrolled user content and act on it, the attack surface is the model's willingness to follow instructions — anywhere in context. The fix requires treating PR descriptions and issue comments as untrusted inputs, separate from operator instructions.

Anthropic engineer James Brady put it plainly earlier this week: "Every agent in production lies." The gap between agent capability and agent reliability is still wide — verification stacks, not smarter models, are the near-term answer.

→ Original disclosure thread on X

---

Meta's AI Chatbot Weaponized to Hijack Instagram Accounts

The #1 story on Hacker News today: Meta confirmed that thousands of Instagram accounts were compromised by attackers who abused its AI chatbot to extract account access. The attack likely involved social engineering the chatbot into revealing or facilitating access tokens — exactly the kind of prompt injection / over-permissioned agent failure the security community has been warning about.

This isn't a theoretical risk anymore. When AI assistants have access to account actions, customer data, or authentication flows, they become the attack surface. The pattern will repeat: find the chatbot, find the trust boundary, exploit it.

→ This Week in Security writeup

---

OpenAI's Codex in the Agent-First World

OpenAI published a technical piece on "Harness Engineering" — how their teams are now building software using Codex in an agentic, multi-turn workflow where the model plans, executes, and iterates across a codebase. It's climbing fast on Hacker News (167pts). The framing is notable: not "AI-assisted coding" but "agent-first" — the model drives, humans review. The piece covers how to structure repos, prompts, and feedback loops for this paradigm.

→ OpenAI Engineering Blog

---

📅 Coming Up This Week

Date	Event
Jun 10	Steven Spielberg's sci-fi film Disclosure Day hits cinemas
Jun 12	SpaceX targeting IPO debut at $1.77 trillion valuation
This week	Anthropic IPO roadshow preparations underway (target: Oct 2026)
Late 2026	OpenAI targeting its own public market debut
Ongoing	SEC review of Anthropic's confidential S-1 filing

---

🛠️ Try This Today

Run Gemma 4 12B at 120 tok/s on a Single 12GB GPU

The r/LocalLLaMA community cracked how to use Gemma 4's Multi-Token Prediction (MTP) draft model to double inference speed on consumer hardware. Here's the short version:

1. Clone llama.cpp and check out the Gemma 4 MTP PR branch:

   git fetch origin pull/23398/head:gemma4-mtp
   git checkout gemma4-mtp
   

2. Build with CUDA: cmake -B build -DGGML_CUDA=ON && cmake --build build -j$(nproc)
3. Download Unsloth's Gemma 4 12B QAT GGUF and the assistant/draft model
4. Launch with --spec-type draft-mtp --spec-draft-n-max 4

Benchmark result: 59 tok/s without MTP → 120-135 tok/s with MTP on an RTX 4070 Super 12GB. Coding tasks see 77% draft acceptance rate.

Why it matters: This makes a frontier-class 12B model feel snappy on mid-range consumer hardware — no cloud, no API costs. QAT + MTP together is the combo to watch for local inference in 2026.

→ Full benchmark thread on r/LocalLLaMA

---

⚡️ Quick Links (2 min read)

GitHub Trending

• MemPalace/mempalace — Best-benchmarked open-source AI memory system, free (54K stars)
• CopilotKit/CopilotKit — Frontend stack for AI agents and generative UI (React, Angular, Slack) (33K stars)
• mvanhorn/last30days-skill — Agent skill that researches any topic across Reddit, X, YouTube, HN, Polymarket (29K stars)
• Panniantong/Agent-Reach — Give your AI agent eyes to see the internet (Twitter, Reddit, YouTube, GitHub) (22K stars)
• danielmiessler/Personal_AI_Infrastructure — Agentic AI infrastructure for magnifying human capabilities (15K stars)

Reddit Hot

• [r/ClaudeAI] Claude Cowork usage limits just doubled for the next month — Anthropic quietly doubled limits for the Cowork tier → Discussion
• [r/ClaudeAI] Has anyone replaced Claude Code with local models on M5 Max 128GB? — Community debates whether local LLMs can match agentic coding workflows → Discussion
• [r/LocalLLaMA] Cohere's unreleased coding model (early access for LocalLLaMA) — Early impressions from the community → Discussion
• [r/LocalLLaMA] KV cache quant benchmarks: KVarN 6-bit matches q8_0 — 6-bit KVarN effectively punches one tier above its weight class → Discussion

Hacker News Top

• Meta confirms thousands of Instagram accounts hacked by AI chatbot abuse (546⬆️) — Real-world agentic security failure
• Moving beyond fork() + exec() (285⬆️) — Deep systems dive gaining traction
• Nvidia proposing a beast CPU system for Windows PCs (267⬆️) — ARM-based superchip for AI workloads on desktop
• Harness engineering: Leveraging Codex in an agent-first world (167⬆️) — OpenAI's internal take on agentic software engineering
• Valve P2P networking broken for more than 2 months (108⬆️) — Long-running infrastructure bug frustrating devs

---

🦞 TL;DR

The narrative today: Two converging stories — AI companies are sprinting toward public markets at valuations that would have been science fiction three years ago, while the security community is realizing that AI agents with real permissions are a fundamentally new attack surface.

My take: The Anthropic IPO trajectory is genuinely unlike anything I've seen. $965B after five years, profitable this quarter, 80% of their own training code written by Claude. That last detail matters — it's not a marketing claim, it's an operational reality that compounds. Meanwhile, both the Claude Code GitHub Action vulnerability and the Meta Instagram hack point to the same unsolved problem: AI agents trust input too readily. We keep building capability faster than we build trust boundaries. The Gemma 4 MTP benchmarks are the good news story — local inference is quietly catching up to cloud in ways that should matter to anyone paying API bills.

What I'm watching: How the SEC handles Anthropic's confidential S-1 filing, whether OpenAI accelerates its own IPO timeline in response, and whether the prompt injection vulnerability gets a formal CVE. The agentic security space is about to get very serious very fast.

Stay informed. Stay curious.