Today closes out Q1 2026 — and OpenClaw's most turbulent quarter yet. A flood of nine CVEs in four days rattled the self-hosting community, and this morning's revelation of a poisoned axios npm package (v1.14.1, 100M weekly downloads) puts AI agent pipelines directly in the crosshairs of supply chain attackers. On the capability side, the quarter ended with a bang: Anthropic's March alone delivered 14+ launches, an accidental "Mythos" model leak (described internally as "by far the most powerful AI model we've ever developed"), and a headline-grabbing Claude Code plugin that now lets users run OpenAI's Codex inside Claude Code. Grok Imagine is reportedly at positive gross margin for xAI, validating their platform play. Bitcoin miners are structurally pivoting to AI — Q1 marks the first hashrate decline in 6 years — while California became the latest state to require documented AI safeguards for contractors, on a direct collision course with the White House's federal preemption push. Despite crypto's Extreme Fear index (BTC ~$66K), institutional infrastructure keeps building against the sentiment tide.
Anthropic shipped Claude Opus 4.6, expanded computer use, hit 97M MCP installs — then accidentally leaked its next-gen "Mythos" model, described as "a step change in capabilities" and "by far the most powerful AI model we've ever developed."
Between March 18–21, nine CVEs dropped for OpenClaw — including a severity-9.9 critical that allowed any authenticated user to become admin. A wake-up call for the fast-growing self-hosting community.
Moltbook — a social network built exclusively for OpenClaw agents — was found to have an unsecured database exposing 35,000 email addresses and 1.5 million agent API tokens. The agent ecosystem's security posture is struggling to keep pace with its growth.
CoinDesk reports Bitcoin's Q1 2026 hashrate actually declined for the first time in six years, as public U.S. miners redirect compute to AI infrastructure. A structural inflection point for crypto-meets-AI economics.
California's new executive order mandates that all firms seeking state contracts maintain documented safeguards against AI abuse. It puts California on a direct collision course with the White House's March 20 National AI Policy Framework, which seeks federal preemption of state AI laws.
Selected posts from the edition, with links to the originals.
(Charly Wargnier): "Wow. Starting today you can use Codex in Claude Code 🤯 /plugin marketplace add openai/codex-plugin-cc — you can try it with: [commands]"
View post on X ↗(Robert Youssef) RT: "🚨BREAKING: Claude just used itself to break AI safety systems and it's better at it than every human-designed attack ever built. Red-teaming just got automated."
View post on X ↗(Aakash Gupta): "Someone just hijacked the npm account of axios's lead maintainer, swapped his email to a burner ProtonMail, and published poisoned versions of a package that 100 million developers install every week. The attacker added one line to the..."
View post on X ↗(Elon Musk): "Tap the Grok logo on the upper right of any post for analysis"
View post on X ↗(Elon Musk) RT @tetsuoai: "Imagine is positive gross margin for xAI!" — Grok Imagine is turning a profit for xAI, validating the platform model.
View post on X ↗RT @jihad_sameul: "OpenClaw Bot made $40,000+ in 15 days, trading crypto 24/7 automatically. Just OpenClaw + one laptop. No Mac Mini needed..."
View post on X ↗(God of Prompt) RT: "🚨Holy shit... Two independent researchers just built an AI that rewrites its own research algorithm mid-run. Every automation system and agent pipeline just got humbled."
View post on X ↗(God of Prompt) RT: "BREAKING: Wisconsin and MIT just proved that every AI coding benchmark is measuring the wrong thing. Pass rate stays high... [thread on benchmark validity]"
View post on X ↗(klöss): "let me explain the importance of this — an engineer solved a problem that's been plaguing the Internet for 3 decades. Every website you've ever used relies on a text layout system from the 1990s. The browser loads a font, measures text, figures out where lines break..."
View post on X ↗(Charly Wargnier): "🚨 STOP. DO NOT DEPLOY. 'We don't even use Axios' — Think again. As one of npm's most depended-on packages, Axios is almost certainly lurking in your nested dependencies. v1.14.1 is actively distributing malware. Pin versions or wait until this is resolved."
View post on X ↗