AI Dev Weekly is a Thursday series where I cover the week’s most important AI developer news, with my take as someone who actually uses these tools daily.

Google I/O week. Gemini 3.5 Flash launched and immediately became the fastest frontier model available. Antigravity 2.0 replaced Gemini CLI with a 30-day migration deadline. Google’s new quota system caused outrage, then got tripled permanently within 36 hours. Karpathy joined Anthropic. And a supply chain attack compromised 323 npm packages in 22 minutes. Massive week. Let’s break it down.

Google I/O: Gemini 3.5 Flash launches as the new default

At Google I/O on May 19, Google launched Gemini 3.5 Flash — a model that beats the previous Gemini 3.1 Pro on coding and agentic benchmarks while running 4x faster.

Key numbers:

• 76.2% Terminal-Bench 2.1 (agentic coding) — beats 3.1 Pro’s 70.3%
• 83.6% MCP Atlas (multi-step tool use) — highest of any model
• 289 tokens/sec output — 4x faster than Claude Opus 4.7 or GPT-5.5
• $1.50 / $9 per 1M tokens (input/output)
• 1M token context window

It’s now the default model in the Gemini app, AI Mode in Search, and Antigravity CLI.

My take: I upgraded my race agent to 3.5 Flash within 12 hours of the announcement. The quality difference is not incremental — it’s transformational. The old 2.5 Flash/Pro combo spent 4 weeks stuck in bug loops. The new model diagnosed and fixed 32 broken API files in its first 8 minutes. A Flash-tier model outperforming the previous Pro model has never happened before in the Gemini lineup. If you’re still on 2.5, upgrade now.

Antigravity 2.0 launches, Gemini CLI dies June 18

Google simultaneously launched Antigravity 2.0 as a full agentic development platform and announced the retirement of Gemini CLI.

Antigravity 2.0 includes:

• Revamped desktop app with multi-agent orchestration (run agents in parallel)
• New CLI built in Go (replaces Gemini CLI) — keyboard-first, designed for headless/remote work
• SDK for custom agent workflows
• Native integration with AI Studio, Firebase, and Android
• Managed agent on Gemini API: single API call gives you an agent with code execution, file management, and web browsing in a secure sandbox

The deadline: June 18, 2026. After that date, Gemini CLI and Gemini Code Assist IDE extensions stop serving requests for AI Pro, AI Ultra, and free-tier users. Enterprise/Cloud customers are unaffected.

If you need to migrate, we wrote a step-by-step guide.

My take: The CLI rewrite in Go is a good sign for headless/server use cases. The old Gemini CLI was clearly designed for interactive terminal use. Antigravity CLI (agy) has --print mode, --continue for session persistence, and --dangerously-skip-permissions for autonomous workflows. That said, running it on cron still requires some workarounds — headless auth isn’t first-class yet. The 30-day migration window is tight if you have CI/CD pipelines depending on Gemini CLI.

Quota backlash and the 3x permanent boost

Alongside I/O, Google quietly switched from fixed daily prompt limits to a compute-based quota system. Limits now refresh every 5 hours within a weekly cap. AI Pro gets 4x the free tier.

The backlash was immediate. Users reported a single complex prompt burning 13-50% of their 5-hour window. Reddit threads called it a “bait and switch.” Previously, Pro users had 33x the free tier — now just 4x.

Then, 36 hours later (May 21, 05:25 UTC), Google responded:

“We’re 3xing the rate limits for Gemini models across all paid tiers in Antigravity and resetting everyone’s Gemini quota for the week. In case it’s not clear, the 3x is forever.” — Varun Mohan, Google

My take: I measured the impact in real-time on my autonomous agent. Before the boost: 8 minutes of productive work per 5-hour window. After: ~50 minutes per window. For autonomous agentic coding, the effective improvement was closer to 4-5x, not just 3x. The 36-hour turnaround from “broken” to “fixed permanently” is impressive. But the lesson is clear: subscription AI pricing is volatile right now. Build with that assumption.

Karpathy joins Anthropic

Andrej Karpathy — OpenAI co-founder, former Tesla AI director, and the person who coined “vibe coding” — announced on May 19 that he joined Anthropic.

He’s working on the pre-training team under Nick Joseph, with a mandate to build a team using Claude to accelerate pretraining research itself (“autoresearch”). This builds on his viral March experiment where he let an AI coding agent run unsupervised for 2 days, testing and tweaking training code autonomously.

My take: This is a significant talent signal. Karpathy left OpenAI, could have gone anywhere (or stayed independent with his massive YouTube following), and chose Anthropic. The “autoresearch” angle is fascinating — using AI agents to improve AI training. If it works, it’s a compounding advantage that’s hard to replicate. For developers, the practical implication is: expect Claude’s pre-training to improve faster. Karpathy’s track record suggests he’ll ship, not just research.

npm supply chain attack: 323 packages in 22 minutes

On May 19, threat group TeamPCP executed another wave of the Mini Shai-Hulud supply chain attack, this time targeting the AntV data visualization ecosystem.

The numbers are staggering:

• 639 malicious versions published across 323 unique packages in a 22-minute automated burst
• Compromised the @atool maintainer account
• High-profile targets: size-sensor (4.2M downloads/month), echarts-for-react (3.8M), @antv/scale (2.2M)
• Enables CI/CD credential theft (per Microsoft’s analysis published May 20)

This is part of the same campaign that hit TanStack and Mistral AI SDK on May 11. Total campaign: over 1,000 compromised packages in under two weeks. npm forced a platform-wide token reset.

My take: This is now the most significant npm supply chain attack in history by volume. If you use any AntV packages, echarts-for-react, or size-sensor — audit your lockfiles today. The attack exploits CI/CD pipelines, not developer credentials. Action items: pin dependencies to exact versions, run npm audit in CI, and review any pull_request_target triggers in your GitHub Actions workflows. The 22-minute execution window means automated detection is your only defense.

Quick hits

• SpaceX plans $60B Cursor acquisition — contractual option to buy after SpaceX IPO (expected June 12 on Nasdaq). $10B breakup fee. Partnership already active.
• xAI launched Grok Build — their first CLI-based AI coding agent. Early beta, model is grok-build-0.1, specifically trained for agentic coding.
• Anthropic metering third-party agents starting June 15 — Claude Agent SDK, claude -p, and GitHub Actions get separate monthly credits. Pro: $20/mo credit, Max 5x: $100/mo. Once exhausted, billed at API rates.
• Amazon Q Developer end-of-support — IDE plugins reach end of support April 30, 2027. New signups blocked since May 15. The Q CLI already became Kiro CLI last December.
• OpenCode hits 160K GitHub stars — the open-source Claude Code alternative (MIT licensed, Go, works with 75+ providers) is now the most-starred AI coding tool on GitHub.
• Gemini Omni announced — new unified model generating text, images, and physics-accurate video from any input. Separate from 3.5 Flash.
• Anthropic revenue: $4.8B in Q1 2026, on track for $10.9B in Q2. Revenue more than doubled in months.

---

That’s AI Dev Weekly #11. Google I/O week delivered more developer-relevant changes than any single event this year. If you’re migrating from Gemini CLI, start now — June 18 is closer than it feels. See you next week.