Vercel Got Hacked, Lovable Blamed Users, and Opus 4.7 Costs More Than You Think - This Week in AI

A Vercel employee's Google Workspace was compromised via a third-party AI tool — attackers pivoted from the OAuth app into Vercel's environment variables, moving at a speed attributed to AI assistance.  René Brandel, founder of Casco (YC X25) and ex-founding member of AWS's Generative AI team, joins live to break down the attack chain and walk through the exact Google Workspace admin setting that could have prevented it. In a separate incident, every Lovable project created before November 2025 was readable by any free account, exposing database credentials and chat histories. Their response blamed unclear documentation rather than the underlying issue — and the contrast with Vercel's handling is stark.   Beyond security: Claude Opus 4.7 launched to mixed reactions. The benchmarks look good, but Simon Willison measured the new tokenizer at 1.46x the tokens of 4.6 on identical content — at unchanged prices, that's ~40% cost increase, and 3x for images. Anthropic's own docs said 1–1.35x. Independent measurements landed at 1.47x. Theo called the redesign "vibe-coded," and a locally run open-source Qwen model drew a better pelican SVG than Opus 4.7 at thinking level max.   Anthropic launched Claude Design, which lets you make prototypes, slides, and one-pagers by talking to Claude, powered by Opus 4.7. OpenAI shipped a major Agents SDK update with Codex memory and GPT-Rosalind for biomedical research. Cloudflare shipped Artifacts and memory primitives for agents, Factory AI raised $150M at $1.5B, Qwen 3.6-35B went Apache 2.0.   🎙️ GUEST - René Brandel — Founder & CEO, Casco (YC X25) Casco is your always-on security engineer: agentic red-teaming for AI agents, apps, APIs, and cloud infrastructure. https://casco.com https://x.com/renebrandel https://x.com/getcasco 🔗 LINKS Jensen Huang on Dwarkesh: https://x.com/scaling01/status/2044502834230579437 Allbirds pivots to AI: https://x.com/KobeissiLetter/status/2044409012989407252 Vercel security bulletin: https://x.com/vercel/status/2045865072074035664 Guillermo's incident post: https://x.com/rauchg/status/2045995362499076169 Vercel bill meme: https://x.com/avgdatabaseceo/status/2045907399035298250 Lovable mass data breach: https://x.com/weezerOSINT/status/2046170666131669027 Lovable's response: https://x.com/lovable/status/2046270357674299623 Claude Opus 4.7 launch: https://x.com/claudeai/status/2044785261393977612 Boris Cherny's Opus 4.7 tips: https://x.com/bcherny/status/2044847848035156457 Qwen beats Opus 4.7 (Simon Willison): https://simonwillison.net/2026/Apr/16/qwen-beats-opus/ Opus 4.7 token count analysis: https://simonwillison.net/2026/Apr/20/claude-token-counts/ Tokenizer cross-check: https://www.claudecodecamp.com/p/i-measured-claude-4-7-s-new-tokenizer-here-s-what-it-costs-you Theo on Claude Code desktop: https://x.com/theo/status/2044680030706663726 Claude Design launch: https://x.com/claudeai/status/2045156267690213649 Claude Code desktop redesign: https://x.com/claudeai/status/2044131493966909862 Routines in Claude Code: https://x.com/claudeai/status/2044095086460309790 OpenAI Agents SDK update: https://x.com/stevendcoffey/status/2044465818239701041 Codex memory preview: https://openai.com/index/codex-for-almost-everything/ GPT-Rosalind: https://x.com/openai/status/2044861690911850863 OpenAgents: https://x.com/nicoalbanese10/status/2043745569278251112 Gemini CLI subagents: https://x.com/geminicli/status/2044460062320554319 Cloudflare Artifacts: https://x.com/Cloudflare/status/2044766515065499957 Cloudflare memory for agents: https://x.com/mattzcarey/status/2044404529085526158 Salesforce Headless 360: https://x.com/benioff/status/2044981547267395620 Factory AI $150M Series C: https://x.com/factoryai/status/2044822365494993000 Qwen 3.6-35B-A3B: https://x.com/Alibaba_Qwen/status/2044768734234243427 runthisllm.com: https://runthisllm.com/ Caveman repo: https://github.com/JuliusBrussee/caveman   📚 MASTRA RESOURCES https://mastra.ai https://x.com/mastra_ai https://mastra.ai/community/discord https://github.com/mastra-ai https://mastra.ai/course https://mastra.ai/books/principles-of-building-ai-agents https://mastra.ai/books/patterns-of-building-ai-agents   ⏱️ CHAPTERS 00:00 — Cold open 00:30 — Welcome to Agents Hour 01:20 — WTF Is Going On — Jensen's "we are not a car" + Allbirds pivots to AI 04:37 — The Security Horror Show — Vercel breach, Lovable mass data leak, René's Google Workspace tip 14:37 — Claude Opus 4.7 reality check 22:33 — Claude ships — Design, Code desktop, Routines 25:05 — OpenAI ships — Agents SDK, Codex memory, GPT-Rosalind 26:44 — Quick Hits 33:43 — GitHub Star Party — caveman token compression