Welcome back. While Alibaba's Qwen Image model dominates to become the open-source image king, Google's getting cooked differently — hackers are exploiting Google Cloud to blast phishing emails from legitimate addresses.

Also: How to code with AI agents, hacks to build robust APIs, and what separates good engineering leaders from great ones.

Welcome to The Code. This is a 2x weekly email that cuts through the noise to help devs, engineers, and technical leaders find high-signal news, releases, and resources in 5 minutes or less. You can sign up or share this email here.

Alibaba's Qwen-Image-2512 claims open-source image crown: The Chinese giant just dropped a major update to its text-to-image model, featuring enhanced human realism and sharper text rendering. After 10,000+ blind evaluations on AI Arena, Qwen-Image-2512 ranks as the strongest open-source image generator — and holds its own against closed-source rivals from Google and ByteDance.

Hackers exploit Google Cloud to bypass email filters: Cybercriminals are abusing Google Cloud's Application Integration feature to send phishing emails from legitimate Google addresses, effectively bypassing security checks. Researchers at Check Point found attackers sent over 9,000 emails targeting 3,200 organizations in just two weeks. Google says it has blocked the campaign.

Sam Altman admits AI models are "presenting some real challenges," hiring safety lead: OpenAI announced that it’s hiring a Head of Preparedness, a role focused on mitigating risks from increasingly capable AI systems, which comes with a $555,000 annual salary. Altman acknowledged that AI is starting to present serious challenges, including the impact of models on cybersecurity and mental health. The hire will be responsible for balancing growth and scale with safety.

Why every company should be building internal AI agents: Imprint CTO Will Larson argues that even non-AI companies should invest in building internal agent workflows. In a new guide, he shares lessons on skill support, context window compaction, and eval systems — recommending teams build their own lightweight framework before adopting off-the-shelf SDKs. His take: a small engineering bet now could pay off big as AI capabilities grow.

HeyGen CTO on what separates good engineering leaders from great ones: Forget climbing the corporate ladder the traditional way. HeyGen's CTO argues that the best engineering leaders stay hands-on technically, use that depth to drive strategy, and think of themselves as "directors" of organizational vision — not just people managers. His other tips: set a clear career North Star, be radically transparent when hiring, and prioritize real impact over title chasing.

LangChain claims 'agent engineering' is the next big discipline: Building AI agents that work in demos is easy — making them reliable in production is a whole different story. LangChain says the teams succeeding at this are pioneering a new discipline that blends product thinking, engineering, and data science. The key insight: ship fast and treat production as your teacher, since every user input is an edge case and traditional debugging doesn't cut it anymore.

How I code with AI: This tutorial demonstrates a developer’s AI coding workflow that prioritizes planning over blind generation. You will learn how to use Cursor’s agent mode and work trees to execute parallel tasks efficiently. The video also explains how to build validation scripts—such as dry runs and type checks—that create feedback loops for AI. Perfect for developers who want to learn AI as we move into 2026.

How I code with agents, without being 'technical’: Factory's Ben Tossell has burned 3 billion tokens building real software without traditional coding skills. His workflow relies on CLI agents, detailed agents.md instruction files, and relentless iteration. The takeaway for devs: treat bugs as learning opportunities, prefer CLIs over MCPs for simplicity, and let the model explain what you don't understand. It's your ever-patient expert programmer.

Claude Code in action: Anthropic released a course on Claude Code where you’ll learn to manipulate files, execute commands, and analyze code using its core tools—plus advanced techniques like Plan Mode for complex tasks, custom automation workflows, and GitHub integration for hands-free PR reviews. Ideal for engineers looking to accelerate development with AI assistance.

mHC (Manifold-Constrained Hyper-Connections): This research paper by DeepSeek solves the instability in "Hyper-Connected" models, where uncontrolled data mixing causes training failures. They introduce mHC, which applies mathematical guardrails to regulate this flow, ensuring models are stable and scalable.

Toward training superintelligent software agents through self-play SWE-RL: Meta researchers identify that current AI coders are limited by their need for human-labeled data. They found that agents using "self-play" to generate and fix their own bugs consistently beat models trained on human examples.

The missing layer of AGI: This paper argues over whether LLMs are a dead end or a complete solution for AGI. It argues that while LLMs provide a necessary foundation, reliable reasoning requires an added "coordination layer" to effectively guide and constrain their outputs.

You can also reply directly to this email if you have suggestions, feedback, or questions.

Until next time — The Code team