In this episode

• MCPwn audit: 52% of MCP servers abandoned, single-maintainer packages dominate critical OAuth paths — Pluto Security disclosed two named MCPwn exploit campaigns (CVE-2026-33032, CVE-2026-27825/27826) and Proof of Commitment published a supply chain audit of 14 widely-used MCP servers. All exploited servers scored below 55/100 on maintainer commitment. 52% of the 10,000+ public MCP server ecosystem is abandoned. Critical infrastructure (server-github, mcp-remote, mcp-atlassian) sits at 42–50, and transitive dependencies in OAuth flows (zod: 159M weekly downloads, 1 maintainer) are single points of failure.
• Hyperliquid launches HIP-4 prediction markets; Bitcoin contract volume ~3x Polymarket+Kalshi combined — Hyperliquid's first outcome contracts (HIP-4) launched over the weekend, with Bitcoin prediction markets generating roughly 3x the volume of equivalent Polymarket and Kalshi markets combined. Permissionless deployment is targeted for mid-June ahead of the FIFA World Cup. Bernstein extended digital assets coverage to include prediction markets as an institutional hedging tool, citing FalconX prime brokerage, Ripple Prime clearing, and Anchorage custody as the institutional stack already plumbed into Hyperliquid.
• Kelp DAO migrates rsETH from LayerZero to Chainlink CCIP after $292M exploit; LayerZero approved 1-of-1 verifier — Kelp DAO confirmed migration of rsETH from LayerZero's OFT standard to Chainlink CCIP following the April 18 exploit that drained $292M. Kelp published screenshots showing LayerZero personnel approved the 1-of-1 verifier configuration that enabled the attack. Roughly 47% of active LayerZero applications used similar single-verifier setups. Aave separately filed an emergency federal motion to unfreeze 30,766 ETH (~$73M) tied to the same hack recovery.
• Vitalik flags oracle integrity as the weakest link in prediction markets; advocates private attester voting — Vitalik Buterin publicly identified oracle integrity as the structural weak point in decentralized prediction markets, warning that financially-motivated oracles introduce bribery risk and that centralized resolution creates single points of failure. He advocated decentralized oracle models with private attester voting to prevent coordination attacks. Separately, Atlas (CoinMarketCap-backed) is taking over BNB Chain oracle services from Binance Oracle on a 90-day transition with configurable aggregation methods and confidence bands.
• Polymarket V2 protocol deep-dive: Ghost Fill vulnerability, NegRisk math, and Operator/Relayer economics reverse-engineered — Eight months of reverse-engineering by the insiders.bot team produced a technical breakdown of Polymarket V2: order mechanics, Operator role, Relayer economics, three matching modes (COMPLEMENTARY/MINT/MERGE), p(1-p) fee symmetry, NegRisk adapter conversion math, and the Ghost Fill vulnerability fixed in the latest upgrade. Includes PnL traps from Split/Merge/Redeem effects and the Deposit Wallet solution.
• Linea ZK stack moves to Linux Foundation as 'Lineth'; first major L2 under vendor-neutral governance — Linea Consortium became a premier member of Linux Foundation Decentralized Trust and contributed its production ZK-rollup stack — execution layer, consensus, coordinator, prover, smart contracts — as 'Lineth.' The codebase (live on mainnet since July 2023, securing ~$2.5B TVL) transitions to LFDT incubation with 30 proposed maintainers. Roadmap includes forced transaction inclusion (May 2026), RISC-V prover transition (Q3), and a path to Type-1 Ethereum equivalence.
• Securitize, Jump Trading, and Jupiter ship fully onchain regulated trading for tokenized equities — Securitize, Jump Trading, and Jupiter launched a regulated onchain trading system for tokenized equities. Jump provides liquidity via PropAMM on Solana; Jupiter is the user-facing interface; Securitize handles broker-dealer, ATS, transfer agent, and KYC-whitelisted wallet infrastructure. The system operates within Reg NMS and aligns with recent SEC staff guidance on tokenized securities.
• Uniswap DAO votes to claw back $42M in UNI loaned to Foundation and delegates; vote closes May 8 — Uniswap DAO is voting on reclaiming 12.5M UNI (~$42M) loaned to the Foundation and key delegates between 2022–2023, with ~53% support and voting ending May 8. Passed proposals now average 75M votes (88% above quorum), with 56 delegates holding >1M UNI each. The DUNI legal wrapper, protocol fee activation, and Labs-Foundation merger are cited as the structural fixes that make organic delegation viable.
• Claude Code 2.1.128 + Agent SDK Python v0.1.74: hook event streaming, deferred tool use, strict MCP config — Claude Code shipped v2.1.128 with .zip plugin support, reserved 'workspace' namespace, tool re-announcement on reconnect, and sub-agent prompt-cache fixes (~3x token cost reduction on long runs). Agent SDK Python v0.1.74 adds PreToolUse/PostToolUse HookEventMessage streaming, deferred tool-use decisions, strict MCP config mode for reproducible server sets, updatedToolOutput in post-tool hooks, and xhigh effort level for Opus 4.7.
• Trump administration drafts pre-deployment AI vetting EO; Commerce evaluations now cover all five frontier labs — The White House is drafting a 16-page executive order that would create a federal pre-deployment vetting regime for frontier AI models, prohibit private-sector interference with government AI use, and tighten federal contractor standards. Google, Microsoft, and xAI have joined OpenAI and Anthropic in the Commerce Department's Center for AI Standards and Innovation voluntary evaluation program (40+ evaluations completed). Cybersecurity framing focuses on open-weight models and Anthropic's Mythos capabilities; trigger appears to be Anthropic's refusal to enable military surveillance use cases.
• California Bar proposes mandatory verification of every AI output; Georgia DA suspended for fabricated citations — The California State Bar's Standing Committee on Professional Responsibility proposed amendments to six Rules of Professional Conduct requiring lawyers to independently verify all AI-generated output, disclose material AI use to clients, prevent confidential information exposure to AI systems, and ensure cited authorities are not fabricated — with no carve-outs for routine tasks. Concurrently, the Georgia Supreme Court suspended ADA Deborah Leslie six months for filing AI-fabricated case law. A federal judge separately ruled senior partners are personally liable for AI errors by their teams.
• Kalshi takes April taker-volume lead at $5.42B; Polymarket retains fees and 8x user advantage — Kalshi surpassed Polymarket in April 2026 taker volume ($5.42B vs $1.99B) for the first time. Despite lower volume, Polymarket collected $29.22M in fees and maintains an 8x user advantage. Sector-wide open interest hit $1.11B as of May 1, with Kalshi and Polymarket controlling 98%. Clear Street launched as Kalshi's first institutional FCM, and Mesh integrated 300+ wallets/exchanges for Kalshi crypto deposits. SEC missed the 75-day window on Roundhill, Bitwise, and GraniteShares prediction-market ETFs.
• Phascolarctos sulcomaxilliaris: dimpled koala from WA, extinct ~28,000 years ago at eucalypt forest collapse — Western Australian Museum researchers formally described Phascolarctos sulcomaxilliaris from cave fossils collected over a century but never properly examined. Distinguishing features: deep cheekbone grooves, shorter robust skull, broader teeth, thinner skeletal bones than modern Phascolarctos cinereus. Uranium-thorium and radiocarbon dating places extinction at ~28,000 years ago, coinciding with southwest Australian eucalypt forest collapse during a major rainfall decrease.

Read the full briefing with sources →

Generated with AI from public sources — verify before acting on anything important.