Weekly Digest: May 10

The split between AI haves and have-nots got louder this week, and you can feel it in every bucket. The labs are reorganizing around product, the agent harnesses keep climbing GitHub, and WordPress is doing what WordPress always does — shipping podcasts while patching critical CVEs in plugins with hundreds of thousands of installs. ArXiv started fighting back against lazy LLM submissions. SEOPress users need to update yesterday. Here’s the rundown.

AI & Automation

ArXiv will now ban authors for a year if they let AI write the whole paper — a sane line in the sand, and one journals should copy (TechCrunch).
Greg Brockman is taking over product strategy at OpenAI as ChatGPT and Codex get merged, which tells you where the company thinks the moat is now (TechCrunch).
The vibes piece on AI haves and have-nots is worth reading even inside the industry — the gap between people shipping with these tools and people buying conference tickets keeps widening (TechCrunch).
Chatbots at the McDonald’s drive-thru are the leading edge of consumer AI exposure, and the failure modes will shape public trust more than any benchmark (The Verge).
If you’re giving a 2026 commencement speech, the advice is don’t promise graduates an AI-shaped future — they already know, and they’re not thrilled (TechCrunch).

Trending Code & MCPs

n8n crossed 188k stars and remains the most practical self-hostable automation platform if you don’t want to be Zapier’s tenant forever (GitHub).
everything-claude-code is now at 184k stars — a full harness with skills, memory, and security baked in, and it works across Claude Code, Codex, Cursor, and Opencode (GitHub).
Ollama keeps pulling new model support fast — Kimi-K2.5, GLM-5, MiniMax, gpt-oss — and at 171k stars it’s still the cleanest local-first runtime (GitHub).
AutoGPT crossed 184k and feels less like a product and more like a museum piece for what agent ambitions used to look like in 2023, but the repo is still being worked (GitHub).
Mesh MCP on Smithery quietly hit 10k installs — networking exposed to LLMs is going to be either very useful or very loud, depending on how locked-down your home lab is (Smithery).

Side Hustles

Kilo Code v7 launched on Product Hunt with parallel agents, a diff reviewer, and multi-model comparisons — the “run three models, pick the best diff” pattern is becoming a category (Product Hunt).
RankSpot pitches AI SEO built on deep competitor intelligence, which is the right wedge if you can actually deliver — most tools in this space scrape SERPs and call it a day (Product Hunt).
Dune is a context-aware Mac keypad for workflows and meetings — niche hardware as a side-hustle category is back, and Stream Deck’s monopoly is real but not unbreakable (Product Hunt).
Failory’s 27 Shark Tank winners breakdown is mostly nostalgia, but the pattern — simple physical products, one obvious problem, repeatable QVC-style demos — still works in 2026 (Failory).
Vinted’s business model writeup is a useful reminder that marketplace fees on the buyer side instead of the seller side can completely reshape unit economics (Failory).

WordPress Pulse

SEOPress 7.9 patches an Object Injection vulnerability affecting 300k+ installs — update today, this is the kind of bug that gets weaponized fast (WPScan).
Profile Builder and Profile Builder Pro had an unauthenticated privilege escalation across 50k+ sites — attackers could grab admin without an account, so patch and audit your users table (WPScan).
WordCamp Asia 2026 in Mumbai leans hard into AI, enterprise WordPress, and developer workflows — the session lineup is the clearest signal yet of where the project sees the next two years (WordPress.org).
WP Tavern’s Zach Stepek episode on partnerships and trust is worth the listen if you sell into the WordPress ecosystem — the relationship dynamics are weirder than they look from outside (WP Tavern).
WPScan’s roundup of 10 website security tools is a decent baseline if you’re auditing a client site and want a checklist that isn’t trying to upsell you (WPScan).

Next week I’m watching whether the OpenAI product reorg produces anything visible or just an org chart, and whether more SEO plugins follow SEOPress into the disclosure pile — these audits tend to come in waves. I’m also testing Kilo Code v7’s multi-model diff review against my current Claude Code setup to see if the parallel-agent pattern is real or just a demo.