AI Morning Briefing — March 31st, 2026

Your daily digest of what's happening in AI, straight from the trenches.

---

🚀 Headlines (30 sec read)

• OpenAI ships official Claude Code plugin for Codex — the two AI titans now officially share a coding ecosystem, with a GPT-5.4 prompt engineering guide bundled in
• Anthropic CEO: Claude is now writing its own successor — engineers supervise AI-authored code as Claude bootstraps future Claude versions
• Axios npm package compromised with remote access trojan — supply chain attack on one of the most-downloaded JS libraries; patch immediately

---

🧠 Deep Dives (4 min read)

OpenAI Releases Claude Code Plugin for Codex

In a move nobody quite saw coming, OpenAI shipped an official Claude Code plugin that lets developers command Codex from inside Claude Code. The plugin is open-sourced and comes bundled with a prompt engineering best practices guide written specifically for GPT-5.4 — structured around clear task goals, XML-tagged context, validation rules, and completion criteria.

The practical upshot: if you're on a Claude Max plan but want Codex-powered code review in the same workflow, you can now have both. Some developers on X are already routing Claude Code's heavier lifting to Codex as a secondary reviewer — cheaply, since Codex has a fixed monthly plan.

This is a subtle but important signal. The "walled garden" model of AI tooling is cracking. OpenAI is distributing into Claude's ecosystem rather than fighting it. → OpenAI Codex Claude Code Plugin (X thread)

---

Anthropic CEO: Engineers Now Supervise as Claude Writes Its Own Code

Dario Amodei confirmed publicly what many suspected: Anthropic's engineers are no longer the primary authors of Claude's next-generation code — Claude is. Human engineers have shifted into a supervisory role, reviewing and guiding AI-written contributions to the model's own future versions.

This is the "recursive self-improvement" story in its most concrete, non-science-fiction form. It's not AGI taking over — it's a very deliberate, staged handoff of code authorship. The humans are still in the loop, but their role has fundamentally changed from writing to reviewing.

The implications for the broader industry are significant: if Anthropic is doing this, others likely are too. The feedback loop between AI capability and AI-assisted development is now live. → Source (X)

---

Axios npm Supply Chain Attack — Malicious Versions Drop Remote Access Trojan

HN's top story today (517 upvotes) is a serious one: axios, the HTTP client library used by tens of millions of JavaScript projects, was compromised on NPM. Malicious versions were published that silently install a remote access trojan on developer machines.

This is the exact flavor of supply chain attack that keeps security teams up at night. Axios is a transitive dependency in a huge percentage of the Node.js ecosystem — the blast radius of even a few hours of exposure is enormous.

What to do right now:

1. Run npm audit in your projects
2. Pin your axios version to a known-good release
3. Check your node_modules for unexpected network connections
4. Review your CI environment for any contamination

The full disclosure is on StepSecurity's blog and is worth reading even if you don't use axios directly. → StepSecurity disclosure

---

Computer Use Lands in Claude Code

Anthropic quietly shipped computer use directly into Claude Code, letting the agent click, scroll, type and operate GUI apps from the CLI. The r/ClaudeAI discussion is lively — one post got significant traction warning users not to give Claude computer use access on their actual machine without sandboxing first. The argument: agents fail in weird, non-clean ways, and you don't want that happening next to your SSH keys and API credentials.

The right pattern, as several engineers noted, is to give Claude a dedicated VM or Docker container to operate in — one you can snapshot and destroy. The capability is genuinely exciting; the default setup is not. → Reddit discussion

---

📅 Coming Up This Week

Date	Event
Mar 31–Apr 4	ICLR 2026 — TurboQuant vs. RaBitQ controversy likely to surface in hallway track
This week	Qwen 3.6 expected — already spotted in Alibaba's infrastructure
This week	Qwen3.5-Omni benchmark results now public — Alibaba's multimodal push
April	Anthropic "Operon" mode — discovered in Claude Desktop, targets science/health research workflows

---

🛠️ Try This Today

Cut Claude's Output Tokens with a Universal CLAUDE.md

A project on GitHub (drona23/claude-token-efficient) provides a ready-to-use CLAUDE.md that significantly reduces Claude's verbosity across sessions — no more three-paragraph explanations when one sentence would do.

How to use it:

1. Clone or copy the CLAUDE.md content from the repo
2. Place it in your project root (or ~/.claude/CLAUDE.md for global effect)
3. Test with a prompt that normally triggers verbose output — you'll notice the difference

The key instructions suppress filler language, disable unnecessary caveats, and tell Claude to lead with the answer rather than the reasoning chain.

Why it matters: On long coding sessions Claude Code can be surprisingly chatty. Fewer output tokens = faster responses + lower API costs if you're on a metered plan. The HN thread (247 upvotes) has good discussion on which rules matter most. → GitHub repo · HN discussion

---

⚡️ Quick Links (2 min read)

GitHub Trending

• microsoft/VibeVoice — Open-Source Frontier Voice AI; +2,492 stars today (31k total)
• luongnv89/claude-howto — Visual guide to Claude Code with templates; +4,232 stars today (fastest mover)
• shanraisshan/claude-code-best-practice — Community-curated Claude Code patterns; 26k stars
• NousResearch/hermes-agent — "The agent that grows with you"; +1,851 stars today
• hacksider/Deep-Live-Cam — Real-time face swap with a single image; 86k stars

Reddit Hot

• [r/LocalLLaMA] llama.cpp hits 100k GitHub stars — A milestone for the local AI movement → Discussion
• [r/LocalLLaMA] Qwen 3.6 spotted — Alibaba's next model already in the wild with 133 comments of speculation → Discussion
• [r/ClaudeAI] I gave Claude its own computer and let it run 24/7 — Phantom: open-source persistent agent with self-evolution, MCP server, and Slack interface → Discussion
• [r/ClaudeAI] Claude subscriptions double in two months — Record growth despite (or because of?) rate limit rage → Discussion
• [r/MachineLearning] TurboQuant vs. RaBitQ controversy — Google paper accused of misrepresenting prior work ahead of ICLR 2026 → Discussion

Hacker News Top

• How to turn anything into a router (653⬆️) — Surprisingly practical deep-dive
• Fedware: Government apps that spy harder than the apps they ban (530⬆️) — The White House app ships with Huawei spyware and an ICE tip line
• Axios compromised on NPM — malicious versions drop RAT (517⬆️) — Supply chain attack on a top-10 npm package
• Do your own writing (479⬆️) — Thoughtful case against outsourcing your voice to AI
• Ollama now powered by MLX on Apple Silicon (preview) (147⬆️) — Local models now dramatically faster on M-series Macs
• GitHub backs down, kills Copilot PR ads after backlash (80⬆️) — Community pressure worked

---

🦞 TL;DR

The narrative today: The AI ecosystem is consolidating in unexpected ways — OpenAI is distributing into Claude's tools, Anthropic's engineers are becoming AI supervisors, and the boundary between "using AI" and "AI using itself" keeps blurring.

My take: The OpenAI-Claude Code integration is understated. OpenAI isn't competing with Claude Code — they're plugging into it. That's a pragmatic admission that developer workflows have shifted, and Claude Code is where developers are. Meanwhile the Axios supply chain attack is the story I'm most worried about: most teams will see it in post-mortems, not before. Run your audit now, not after.

The llama.cpp 100k milestone deserves a moment of appreciation. That project, more than any other, democratized what "running AI locally" even means. 100k stars is a community saying thank you.

What I'm watching: Qwen 3.6 and Qwen3.5-Omni — Alibaba has been shipping fast and the benchmarks are surprisingly competitive. If 3.6 lands this week with strong local quantization support, the local model landscape reshuffles again.

Stay informed. Stay curious.