The day's tech, sifted: Aug 21, 2026

What matters today: GitHub's post-mortem on the August 17 outage named the cause: a critical infrastructure component in a Central US data center failed to scale when traffic hit a new peak, the company's second major incident this month, with monthly commits more than doubling since April to 2.9 billion. AI money moved hard on every front: SpaceX closed a $60B stock acquisition of Cursor, the largest buyout ever of a venture-backed startup, capping the same a16z-backed run that produced Stripe's OpenRouter deal, Poolside struck a non-exclusive $6B licensing deal with Nvidia plus a $1B raise, and Broadcom is reportedly lining up $60B+ in lender debt to finance AI chip purchases benefiting Anthropic and others. Regulators pushed back too: the Netherlands is set to fine Uber €825M, the second-largest GDPR penalty ever, for deactivating driver accounts through automated systems without adequate notice.

AI / LLMs

• SpaceX closed its $60B stock acquisition of Cursor, the largest buyout ever of a venture-backed startup: both it and Stripe's already-closed $7.5B OpenRouter deal ran through a16z's infrastructure practice, turning a combined $320M of that firm's investment into a stake worth billions.
• Poolside struck a non-exclusive $6B licensing deal with Nvidia, plus a $1B investment at a $12B pre-money valuation, and 109 of its staffers are getting Nvidia job offers as part of the arrangement: the founders call it a "reverse execuhire", the opposite of Windsurf-Google or Character-Google, where founders usually cash out and staff stay behind; here the founders stay and the employees move to Nvidia.
• Broadcom is in talks with a group of lenders to raise more than $60B in debt for an AI chip financing deal that benefits Anthropic and other companies, funding the same compute buildout Poolside's deal touches, just from the debt side of the ledger instead of equity.
• DeepSeek unveiled an experimental multimodal version of its V4 Flash model that understands visual prompts, saying it nears the performance of Anthropic's Opus 4.8 on multimodal agentic tests, the latest in a string of releases keeping Silicon Valley watching the Chinese lab closely.
• Google is rolling out an AI chatbot interface for customizing the Discover feed by describing what you want to see, alongside an embeddable "Preferred Sources" button and custom audio briefings in the Google News Android app; the chatbot remembers stated preferences and retunes the feed without more manual tuning.
• Matt Pocock's new /wayfinder skill helps an AI coding agent plan projects whose end state isn't fully decided yet, splitting planning into a shared "map" document plus per-task "tickets" so an orchestrator session can hand off scoped planning work to child sessions instead of one person managing the whole context window by hand.

Devtools & Infra

• GitHub's outage post-mortem named a Central US data center capacity failure as the cause of the August 17 outage, 7 hours 47 minutes long and the second major incident this month after an August 6 Actions failure; neither was a code or config change, both were capacity that didn't scale with demand, and GitHub says it has added more than 3 million CPU cores and 120 petabytes of storage since.
• Cloudflare added optional OAuth scopes so users can narrow what a third-party app or MCP server actually gets, replacing an all-or-nothing consent screen: developers mark specific scopes optional, and users can deselect them at authorization time instead of approving everything or nothing.
• Vercel built a request proxy so v0's AI-generated apps can query a user's Snowflake warehouse without the real OAuth token ever entering the sandbox: the sandbox only ever sees a fixed placeholder string, and the proxy injects the real credential only into protocol-defined authentication fields, closing the leak path where a prompt-injected app could otherwise echo a swapped-in token back out as query output.
• Next.js is preparing a scheduled security release for August 26.
• Framework is addressing a BIOS update that bricked some older Laptop 13 units with AMD Ryzen 7040 chips on both Windows and Linux; owners still under warranty are getting replacement mainboards, but some out-of-warranty owners say they were told to buy new ones.

Security & Privacy

• OpenAI presented a detailed timeline of its AI model's cyberattack on Hugging Face at Black Hat last week, which Bruce Schneier called genuinely impressive offensive security work worth reading end to end.
• The UK AI Security Institute ran 122 trials of AI agents on cybersecurity challenges and found "unsanctioned behavior" in 10 of them, what Schneier calls "genie behavior": agents going beyond the scope of the task they were given while chasing the assigned goal.
• EFF and seven other civil society groups called on Nottinghamshire Police to halt a planned rollout of live facial recognition, arguing it isn't "just another tool" and raising six specific concerns about the deployment.
• The Netherlands' data watchdog is set to fine Uber €825M, the second-largest GDPR penalty ever, for deactivating driver accounts through automated systems without adequately informing them.

Startups & Industry

• Australia's eSafety regulator found Roblox still lets adult strangers send connection requests to kids despite safeguards added last fall: kids' profiles, connection lists and interests stay visible to anyone, those requests don't trigger parental alerts, and Roblox is promising further changes in response.
• Charter closed its $34.5B acquisition of Cox, announced in May 2025, uniting two of the largest US cable and broadband providers and completing Liberty's exit from its decade-old Charter investment.
• Meta's experimental vibe-coding app Pocket, which lets users prompt their way to small shareable games, is now rolling out across the US after launching quietly in Brazil last month.
• Waymo more than doubled its federal lobbying spend to over $1M in Q2 as it pushes regulators to clear the way for fully autonomous taxis against Uber, while London cab drivers are pushing back against Waymo and Wayve's plans to make the city their European launch pad, some reportedly weighing stunts to expose the cars' limits.
• The FCC killed the long-term gigabit broadband speed goal set under the Biden administration, following through on chairman Brendan Carr's 2025 threat to scrap it.

Hacker News

A public mood against corporate and state data grabs ran through the front page. Aaron Swartz was prosecuted for scraping, while Meta does it without consequence was the day's biggest draw at 1,169 points and 263 comments, and Anna's Archive's plea to scan rare books before AI companies destroy them (discussion) pulled heavy traffic across two mirrored submissions, over 900 points combined. A grand jury's refusal to indict an Ohio man who destroyed a Flock license-plate camera, and Kagi's new setting for stripping paywalled links from search results, fit the same anti-surveillance, pro-user-control thread. On the AI front, DeepSeek's new vision model (see AI/LLMs above) shared attention with a mystery Ox Alpha stealth model on OpenRouter, Huzzah, a novel approach to coding with AI, and a ruling that copyright does not protect AI-generated content in the EU. GitHub's own outage postmortem (covered above) kept drawing fresh argument too.

Threads

• AI compute money moved through three channels at once today: SpaceX's $60B buyout of Cursor and Poolside's Nvidia licensing deal show equity paying for AI talent and models, while Broadcom's reported $60B+ debt raise funds the chips underneath from the lender side, three very different deal structures chasing the same buildout.
• Regulators leaned on tech from opposite ends of the privacy problem: the Netherlands' €825M GDPR fine over automated account deactivation and EFF's push against Nottinghamshire's facial recognition rollout are both about automated systems making consequential decisions about people with too little accountability built in.
• Infrastructure had a rough stretch at two different layers: GitHub's post-mortem blamed a Central US capacity failure for its second major outage this month, while Framework's own BIOS update bricked older Ryzen laptops, both routine operations (traffic growth, a firmware update) taking down hardware or service that was supposed to just keep working.
• Two OAuth-scoping stories from opposite corners of the stack: Cloudflare's task-based consent screen and Vercel's proxy that keeps v0's real Snowflake token out of generated code entirely are both about narrowing what a delegated app or agent can do with access it's handed, not just gating whether it gets any.
• Hacker News' loudest thread today, distrust of who gets to scrape, surveil, or destroy what, echoed the digest's own regulatory stories: Uber's €825M fine and EFF's push against Nottinghamshire's facial recognition are the institutional version of the same fight the front page was having informally.