Weekly News - AI is moving from answers to execution

Dates are the local date of each announcement or report.

Grouped together, the ten stories fell into three threads. With Codex on mobile, Claude Code /goal and Claude for Small Business, AI started to take hold of real work outside the chat window. Googlebook looked like an attempt to redesign the laptop around Gemini. And the TanStack supply chain attack showed again how big an attack surface the open source and CI/CD ecosystem behind fast AI development has become.

The race on model performance is still going. But this week, where AI connects, what it can do and how far we can trust it to act felt bigger.

The heaviest story was the TanStack npm supply chain attack. On May 11, 84 malicious versions were published across 42 TanStack npm packages. The attacker got into the release pipeline through a GitHub Actions workflow and its cache. TanStack postmortem

On May 13, OpenAI said the attack had affected the devices of two employees. It said it found no evidence that user data or production systems were compromised, but some credentials were stolen, and it ended up rotating its code-signing certificates. OpenAI's response

What makes this scary is that the attack came in through things developers use every day: packages, GitHub Actions, caches and release pipelines. Writing good code alone won't close that path. As a developer, I think there are three things to take care of.

• Don't trust new packages and new versions right away. Add at least a short delay and some verification.
• Keep narrowing what the credentials used in CI/CD can reach.
• As AI coding agents get more capable, design the files and tokens they can reach as a security boundary.

Ironically, Codex on mobile and Claude Code /goal arrived in the same week. On May 14, OpenAI previewed a way to follow Codex work from the ChatGPT mobile app, approve steps and change direction. OpenAI announcement

Claude Code added /goal in v2.1.139 on May 11. You set a completion condition, and Claude Code keeps taking turns until that condition is met. Claude Code docs · v2.1.139 release notes · Classmethod write-up

The convenience is real. You can check progress, approve and change direction even when you're out. But the longer AI runs and the more permissions it gets, the more the security of the development environment matters, as much as any product feature.

Google had a lot going on too: the Googlebook announcement, the Gemini Omni leak, the Gemini Spark leak and an AI search optimization guide, all in one week.

Googlebook stood out the most. On May 12, Google announced Googlebook, a laptop designed around Gemini Intelligence. Acer, ASUS, Dell, HP and Lenovo are making the first models, and as of May 19 they're due this fall. The headline features are Magic Pointer, where wiggling the cursor brings up Gemini suggestions for whatever you're pointing at, Create your Widget, which builds widgets from natural language, and file and app integration with Android phones. Google announcement · TechnoEdge · Impress Watch

If Chromebook was a web-first PC, Googlebook is closer to an AI-native laptop.

Gemini Omni was reported on May 12, when some Gemini app users saw it introduced as a new video generation model. As of May 19, Google hasn't announced it officially. Android Authority · Gizmodo Japan

Still, the direction matters. What caught my eye was the idea of editing video through chat. Instead of opening a timeline editor, you say "change just this scene," "lower the sound" or "redo only this part."

Gemini Spark surfaced on May 14, when a screenshot of a beta intro screen on Gemini's web version was posted to X. According to that text, it's an always-on agent that draws on connected apps, chat history and scheduled tasks, and websites you're logged into. As of May 19, it hasn't been officially announced either. GIGAZINE

Both leaks came ahead of Google I/O, which starts on May 19. To me, they look like a sign that Google is preparing an agent that notices what needs doing and moves before you ask.

What makes Google formidable is that it has Search, Android, Chrome, Workspace, YouTube, Gmail and Calendar. If AI settles naturally into all of those, it will work inside your everyday flow without you opening a separate app.

On May 15, Google published a guide to optimizing for generative AI search on Search Central. The SEO world talks a lot about GEO and AEO, but Google's answer was simple: optimizing for generative AI search is still optimizing for the search experience, an extension of basic SEO. Google Search Central

Google says there's no need for AI-only markup or tricks. What matters is still original, reliable content that actually helps people.

That connects directly to Park Labs. Posts that just collect and summarize AI news will be easier and easier to replace. To last, they need to say why I thought a story mattered and what it means for running real products and building solo.

Anthropic launched Claude for Small Business on May 13, and OpenAI launched personal finance in ChatGPT on May 15. Both are about AI moving into money and operations.

Claude for Small Business connects with tools like QuickBooks, PayPal, HubSpot, Canva, Docusign, Google Workspace and Microsoft 365. It's a package that handles repetitive work such as payroll planning, month-end close, campaign operations, invoice chasing and contract review as workflows. Anthropic announcement · TechCrunch

As of May 19, personal finance in ChatGPT is a preview for U.S. Pro users. You connect bank, card and investment accounts through Plaid, then look at spending, subscriptions, portfolio performance and budget plans in conversation. OpenAI announcement

Both are still U.S.-centered. To deliver the same value in Korea or Japan, they'd need localization all the way down to local accounting software, payments, tax and banking integrations.

Still, the direction is clear. For small businesses, AI takes on repetitive but important work like accounting, marketing, contracts and customer management. For individuals, it sorts out tedious things you still have to keep an eye on, like budgets, spending, investments and subscriptions.

It's an important shift from a Park Labs point of view too. If one developer is going to run several B2C services, I have to be the first to use AI operations tools like these. At the same time, I can see new service opportunities inside this shift.

Claude's billing change caught my attention too. On May 14, Anthropic announced that programmatic use through the Agent SDK, claude -p, Claude Code GitHub Actions and the like will move to a separate monthly credit. As of May 19, it's set to start on June 15. Plans come with credit equal to the subscription price, such as $20 for Pro and $100 for Max 5x, and usage beyond that is billed at API rates. TechnoEdge · gihyo.jp

It's a slightly tiring change. AI tool pricing and usage policies change so often these days that it's hard for a solo developer to predict costs.

On the other hand, it's a natural change. Once agents spend tens of minutes or hours reading code, running commands and testing, providers have no choice but to rework their cost structure.

When choosing AI tools from now on, I think "can I predict the cost for the way I work?" will become an important criterion alongside performance.

The thought I had most this week is that AI is being absorbed into products faster than I expected.

At first, chatbots like ChatGPT were the center. Then developer tools like Claude Code and Codex got strong. Now AI is going into laptop operating systems, mobile apps, finance dashboards, small-business tools and search results.

So these days, alongside which model is smartest, these questions come to mind more often:

• How much permission should we give AI?
• When should the user approve something?
• How should sensitive data be protected?
• How far can costs grow automatically?
• By what standard do we verify what AI produces?

I think the next edge for AI products will come from trust design as well as model performance.

I'm putting out this first weekly roundup in this shape for now and will refine the format based on how people respond.

From next time, instead of covering all ten stories at the same depth, I might keep the overall summary short and dig deeper into just two or three. This week, the TanStack supply chain attack, Googlebook and Codex on mobile would have been good candidates for standalone pieces.