Curl Takes July Off, Apple FM Meets Claude, and Anthropic Sends Staff to DC

Good morning. It's Monday, June 15, and we're covering curl's decision to take a month off from vulnerability reports, Apple Foundation Models landing on Claude's platform, and Anthropic sending staff to Washington as the Fable export control situation continues to unfold.

The curl thread hit 414 points. Daniel Stenberg is telling security researchers to hold their findings until August.

In today's brief:

• Curl will not accept vulnerability reports during July 2026
• Apple Foundation Models get first-class Claude platform integration
• Anthropic flies staff to DC to address the White House directive
• Simon Willison on why AI has not replaced software engineers

THE BIG ONE

Curl Will Not Accept Vulnerability Reports in July

Daniel Stenberg announced that the curl project will not accept vulnerability reports during July 2026. The maintainer of one of the most widely deployed pieces of software on the internet is taking the team offline from the security disclosure treadmill for a month.

The HN thread (414 points, 158 comments) is debating whether this is reasonable or reckless. Stenberg's argument: the constant stream of security reports, many of low severity or invalid, burns out maintainers. A coordinated break lets the team recover without leaving individual maintainers to absorb the load alone.

The policy asks researchers to hold their findings until August. Critical vulnerabilities being actively exploited are the exception - those still get processed. But the vast majority of security work will pause.

Why it matters: Curl ships in everything. It is in your phone, your car, your router, your CI pipeline, and probably your toaster. The maintainer of that dependency just told the security community to wait. The reaction will reveal how much the industry respects maintainer sustainability versus how much it expects always-on response.

PLATFORMS

Apple Foundation Models Get Claude Platform Integration

Apple Foundation Models now have first-class integration on Claude's developer platform. The HN thread (150 points, 52 comments) is parsing what this means for the on-device versus cloud model split.

The integration lets developers use Apple's on-device models through the same SDK they use for Claude. This matters for apps that need to blend on-device inference with cloud capabilities - running simple tasks locally while routing complex ones to Claude.

Apple's Foundation Models run on-device for privacy-sensitive operations. Claude runs in the cloud for capability-intensive ones. The SDK now handles the routing logic, letting developers define policies for which model handles which task.

Why it matters: The hybrid model future just got easier to build. Developers no longer need to maintain two separate model integrations. The platform handles the coordination, and apps can lean on device capabilities without giving up cloud power.

POLICY

Anthropic Flies Staff to DC Amid Fable Fallout

Axios reports that Anthropic has flown staff to Washington to address the ongoing export control situation around Fable 5 and Mythos 5. The company is working to resolve the directive that suspended access to its frontier models.

This follows yesterday's WSJ report that Amazon's CEO held conversations with US officials before the suspension. Anthropic appears to be responding with direct engagement rather than public statements.

A Substack analysis titled "Did Anthropic ask for this?" (186 points) examines whether Anthropic's own safety messaging contributed to the regulatory environment that enabled the crackdown. The argument: if you tell regulators your models are dangerous enough to require special handling, regulators will eventually handle them specially.

Why it matters: Anthropic is now fighting on two fronts. The regulatory front requires Washington engagement. The narrative front requires addressing whether its own communications invited the scrutiny. Neither fight ends quickly.

Our coverage: why the US government pulled Fable 5, model dependency risk after Fable 5.

RESEARCH

Simon Willison: AI Has Not Replaced Software Engineers

Simon Willison shared his thoughts on Arvind Narayanan and Sayash Kapoor's analysis of why AI has not replaced software engineers.

The core finding: New York became the first US state to add an AI disclosure checkbox to WARN Act layoff filings in March 2025. In the full first year, more than 160 companies filed WARN notices. Not a single one checked the AI box.

The bottleneck is not writing code. The bottleneck is deciding what to build, verifying what was delivered, and the deep human understanding of codebase, business, and environment required for both. AI speeds up the typing phase, but typing was never the constraint.

Why it matters: The "AI will replace developers" narrative has clear data against it now. One full year of mandatory disclosure produced zero AI-attributed layoffs in the state that requires reporting. That does not mean AI has no effect - it means the effect is augmentation, not replacement.

TOOLS WORTH A LOOK

1. Kage - Shadow any website to a single binary for offline viewing. Captures pages with all assets into a standalone executable. Show HN with 565 points. (OSS)

2. OpenRouter Fusion API - Multi-model inference that runs the same prompt through multiple models and synthesizes responses. For when you want consensus rather than speed. (API)

3. Zeroserve Caddy compatibility - 3x throughput and 70% lower latency for static file serving. Drop-in replacement for Caddy's file server. (OSS, 188 points)

WHAT ELSE IS HAPPENING

• Formal methods and the future of programming (276 points): Jane Street on how formal verification is becoming practical for production code. Not just for aerospace anymore.
• Rio's "homegrown" LLM is a model merge (355 points): GitHub issue reveals Rio de Janeiro's Nex-N2 model is a merge of existing open weights, not original training.
• Even more batteries included with Emacs (206 points): The editor that keeps adding features. New built-in packages for tree-sitter, eglot, and more.
• What the Fuck Happened to Nerds (161 points): Essay on the cultural shift in tech identity. Provocative title, thoughtful content.
• Julia Evans on writing for one person (233 points): Write for "me, but 3 years ago" or a good friend. Simon Willison quoted it this morning.

---

Every link above goes to a primary source or our sourced coverage. Tomorrow's brief lands when the news does - subscribe to get it by email.