The Signal — June 9, 2026
Supply chain attacks are evolving faster than the tools they target, OpenAI is following Anthropic to Wall Street, and Xiaomi just shattered an inference speed barrier that most assumed required a datacenter-scale cluster.
Microsoft GitHub Repos Disabled After Miasma Worm Supply Chain Attack
GitHub has disabled 73 repositories across four Microsoft organizations — Azure, Microsoft, Azure-Samples, and MicrosoftDocs — after the Miasma worm compromised a contributor account and injected malicious commits. The attack is notable not for what it installs, but for what it doesn't: rather than poisoning packages, the worm planted configuration files that execute credential-harvesting payloads the moment a developer opens the repository in an AI-powered coding tool.
Claude Code, Gemini CLI, Cursor, and VS Code are all affected. Because the attack lives in project configuration rather than dependencies, no package install is required to trigger it. Simply cloning and opening the repo is enough. The worm propagates by using stolen credentials to push the same malicious config files into other repositories the compromised developer has write access to, creating a self-replicating chain across organizations.
The incident underscores a widening attack surface: as AI coding assistants gain the ability to read and act on project-level configuration, those config files become first-class vectors. GitHub has not yet disclosed how many downstream developers may have been exposed before the repositories were taken offline.
Sources: The Register · Computing.co.uk · AI Weekly
OpenAI Confidentially Files S-1 with SEC for IPO
OpenAI has filed a confidential S-1 registration with the Securities and Exchange Commission, formally beginning the process toward what could be one of the largest technology IPOs in years. The company chose to get ahead of the news cycle, stating publicly: "We expect it to leak so we're just announcing it."
The filing places OpenAI alongside Anthropic, which submitted its own S-1 the previous week, and SpaceX in a concentrated wave of high-profile tech offerings. CFO Sarah Friar told reporters the company has been "acting with the good hygiene of a public company" but declined to commit to a specific timeline for the offering.
A confidential filing allows OpenAI to begin the SEC review process without immediately disclosing financials to competitors, though those details will become public at least 15 days before any roadshow. For an industry where revenue multiples and compute costs are fiercely debated, the financial disclosures will offer the first audited look at the economics of running one of the world's most-used AI products.
Sources: Fortune · CNBC · Washington Post
Xiaomi MiMo Breaks 1,000 Tokens/Second on a 1T-Parameter Model
Xiaomi has released MiMo-V2.5-Pro-UltraSpeed, a collaboration with TileRT that claims to break the 1,000 tokens-per-second decode barrier on a one-trillion-parameter mixture-of-experts model — running on a single standard eight-GPU commodity node rather than a sprawling cluster.
The speedup relies on aggressive quantization and speculative decoding (FP4-compressed weights, multiple tokens predicted in parallel) combined with TileRT's optimized GPU execution kernels that minimize memory bandwidth bottlenecks. If the benchmarks hold under independent scrutiny, the result redraws the line on what hardware is required to serve frontier-scale models at interactive speeds.
Xiaomi is running a public API trial from June 8 through June 23, giving developers a window to test latency and throughput claims against their own workloads. The release continues a pattern of Chinese labs closing the inference-efficiency gap with Western counterparts, this time by attacking the problem at the runtime layer rather than through architectural changes alone.
Sources: Xiaomi MiMo Blog · MarkTechPost · Decrypt
On the Editor's Desk
We held an Apple WWDC story on the latest Siri AI overhaul from this edition. The news was eight days old by publication time, making it stale by our standards, and most readers who track Apple closely have already absorbed the details. Running it now would add noise rather than signal. If Apple ships meaningful follow-up at or after WWDC, we will cover it fresh.
