EDIBLOG · DEVTREND · 2026.05.12
Anthropic Just Rented an Entire SpaceX Data Center — Tuesday Dev Trends
Bottom line. Anthropic leased SpaceX’s entire Colossus 1 data center, and Claude paid limits just doubled. On the side: an SAP npm supply-chain attack, a PyTorch Lightning credential-stealing malware, and GPT-5.5 Instant as the new ChatGPT default.
01 · MAINAnthropic Leases an Entire SpaceX Data Center
On May 6, Anthropic announced a deal to lease all of the compute at SpaceX’s Colossus 1 data center in Memphis, Tennessee. Over 220,000 NVIDIA GPUs and 300MW of capacity get absorbed into Claude infrastructure within a month. Colossus 1 was originally operated by xAI, but after the SpaceX·xAI merger, Anthropic stepped in as the tenant.
+ peak-time throttling removed
Pro · Max · Team · seat-based Enterprise all doubled across the board. Opus API caps raised too. “Heavy users” get first dibs as the SpaceX compute rolls in.
Narrow Opus API cap
Frequent 5h slot blocks
SpaceX
Higher Opus API cap
Rolls out within a month
One more thing — the same agreement includes an intent to “jointly develop orbital AI compute on a multi-gigawatt scale.” Translation: data centers in orbit. That part is a letter of intent with no timeline.
02 · SECURITYTwo Supply-Chain Attacks This Week
Four npm packages in SAP’s JavaScript and cloud-app dev ecosystem were poisoned on April 29, 09:55–12:14 UTC.
Type: Shai-Hulud variant (“Mini Shai-Hulud”) worm. A preinstall script runs attacker code during npm install. Action: audit SAP-related lockfiles immediately and pin ^/~ range deps to exact versions.
PyTorch Lightning 2.6.2 and 2.6.3 shipped with credential-stealing malware embedded.
Type: same campaign suspected (TeamPCP) — identical payload also found in Intercom-client 7.0.4·7.0.5 and the lightning PyPI package. Action: downgrade affected versions immediately and review rotation for AWS·GCP·OpenAI keys.
03 · SIDEOne More Thing — GPT-5.5 Instant Default
On May 5, OpenAI swapped ChatGPT’s default model from GPT-5.3 Instant to GPT-5.5 Instant. By internal evals, hallucinations on high-stakes medical, legal, and financial prompts dropped 52.5%, and responses got 30% shorter on average.
In the API, call it as chat-latest. GPT-5.3 Instant stays available as an option for paid users for 3 months, then gets retired.
“This was the week ‘compute capacity equals user limits’ became visible within seven days. Next watch: who flies to orbit first.”
— Eddie · 2026.05.12
npm supply-chain attacks just resurfaced from the same campaign one month later. Lockfile pinning + private registry mirroring aren’t optional anymore — they’re the baseline.
Anthropic — Higher limits and SpaceX compute CNBC — Anthropic, SpaceX compute deal Tom’s Hardware — 220K GPU, 300MW
The Register — SAP npm packages The Register — npm worm analysis
OpenAI — GPT-5.5 Instant TechCrunch — GPT-5.5 Instant default
Disclaimer: For information only. Apply security guidance after reviewing your own environment.
This post is part of an English mirror of a Korean dev experiments blog. Cross-posted for the global developer audience.