Programming guides for beginner...
Any comments are welcomed....
I hope it helps!!! Thanks for drop by...
Showing posts with label microsoft. Show all posts
Showing posts with label microsoft. Show all posts

Thursday, June 18, 2026

OpenAI's 2025 Books: $20B Loss, $10B to Microsoft

On 16 June 2026, the audited 2025 financial statements of OpenAI leaked via independent journalist Ed Zitron, were independently reviewed by the Financial Times, and made their way into an Ars Technica write-up that hit the front page of Hacker News within hours. The headline number — a $39 billion "net loss" — is misleading, and almost every angle in the post is downstream of one line item that the casual coverage has underweighted. The story is not that OpenAI is losing money. The story is the shape of the loss: where it goes, who it goes to, and what the trajectory implies about the IPO that the company is now filing for.

The 2025 numbers, as reported in the audited statements (revenue, R&D, cost of revenue, sales & marketing, loss from operations, headline net loss), tell a coherent story when you stack them. Revenue: $3.7B in 2024, $13.07B in 2025. Loss from operations: $8.78B in 2024, $20.92B in 2025. R&D: $7.81B in 2024, $19.18B in 2025. Of that 2025 R&D, $10.59B was paid to Microsoft as part of the cloud and compute partnership. Cost of revenue (inference-time compute, primarily): $2.65B in 2024, $7.5B in 2025. Sales and marketing: $1.11B in 2024, $5.73B in 2025. The headline net loss of $39B includes a roughly $30B one-time accounting charge tied to the company's 2025 conversion to a for-profit structure. Strip that out, per the FT's reporting, and the 2025 net loss is closer to $8B — which is still enormous, but the order of magnitude is different.

Angle 1: The headline $39B is a one-time charge, not a run-rate

This is the most important framing correction. The $39B "net loss" number that hit the front page is not what OpenAI is burning through 2026. It is a paper charge related to the conversion from a non-profit capped-profit structure to a fully for-profit one. The mechanism: when investor valuations shift during a structural reorganization, the accounting books revalue prior commitments, and the difference lands on the income statement as a one-time hit. The FT cited "a person familiar with the matter" putting the 2025 net loss at roughly $8B without that charge. $8B is still a 64% revenue multiple in losses. It is not the apocalyptic $39B figure that the Reddit threads are running with, and that distinction matters for how serious readers read the rest of the line items.

The $20.92B "loss from operations" number, by contrast, is a run-rate. That is the number that reflects what OpenAI spent, day-to-day, to operate in 2025 — and it grew 138% year-over-year, against revenue that grew 253%. As a percentage of revenue, operating losses improved from 237% in 2024 to 160% in 2025. The unit economics are getting less bad. They are not yet close to zero. The company has guided to profitability by 2030, and the loss-from-operations trajectory is consistent with that guidance if the cost-growth curve bends and the revenue-growth curve does not.

Angle 2: Microsoft is the single largest line item that is not a line item

The $10.59B of $19.18B R&D paid to Microsoft in 2025 is the story, and the Ars Technica write-up flags it but does not foreground it. That is more than half of OpenAI's entire R&D spend, going to one supplier, on a compute contract that is — per public reporting on the 2023 partnership extension — capacity-constrained and price-fixed through at least 2030. This is not a vendor relationship. It is a structural dependency.

The implication: OpenAI's "loss from operations" is, in a real sense, a Microsoft rent bill. The company can grow revenue as fast as it wants, but if its marginal inference cost is set by Azure compute pricing and the partnership cap is what it is, the operating-loss trajectory is bounded by the unit economics of the Azure deal. The 2025 numbers make this concrete. Cost of revenue went from $2.65B to $7.5B — a 183% jump — which tracks with the inference volume growth ChatGPT saw in the same window (900M weekly active users reported, of which roughly 50M are paid subscribers). Inference is now the second-largest cost line, behind R&D, and it is the one that scales with usage. R&D, by contrast, is mostly fixed (training runs) plus the Microsoft commitment.

Angle 3: The paid-subscriber math is the actual unit-economics story

OpenAI reports 900M weekly active ChatGPT users, of which roughly 50M are paid subscribers. At a blended subscription price point somewhere in the $20-$25/month range (the Plus tier, weighted by the smaller Pro and Team populations), the annual subscription revenue run-rate is plausibly in the $12-15B neighborhood. The remainder of the $13.07B 2025 revenue is API access (ChatGPT Enterprise, the OpenAI API for third parties) plus a smaller Microsoft Azure resale line. Of those three streams, the subscription one is the only one with positive gross margin at any reasonable scale; the API is inference-cost-heavy; the Microsoft resale is mostly a pass-through.

Per-paid-subscriber unit economics: $20.92B operating loss / 50M paid subs = roughly $418 of operating loss per paid subscriber per year. If you assume the average paid subscriber is generating around $240/year of subscription revenue (Plus tier at $20/month × 12), OpenAI is losing $1.74 for every $1 of subscription revenue. The unit economics are still deeply negative. The improvement from 2024 (where the multiple was worse, on a smaller subscriber base) is real. The gap to break-even is still large.

The strategic question this raises: what happens to the paid-subscriber base when local models cross the threshold for the "good enough" workflows? This blog covered the Vicki Boykis "running local models is good now" inflection two days ago; the implication there is that 25-50% of the workflows that currently route to ChatGPT Plus are now viable on a local Gemma 4 26B. If even 10% of paid subscribers migrate to local, the unit-economics curve bends the wrong way. The 2025 financials are the high-water mark for "people pay $20/month for a frontier chat." The 2026 and 2027 numbers will show whether that base holds.

Angle 4: The Microsoft $30B charge is a tax on the IPO structure, not a tax on the business

The single largest accounting event of 2025 was the conversion from capped-profit to for-profit, which is the structural prerequisite for the IPO paperwork OpenAI is now filing. The roughly $30B charge is the fair-value re-measurement of the prior investor commitments against the new equity structure. This is the kind of line item that shows up once, in the year of conversion, and never recurs. Auditors (and the SEC) will flag it. Analysts will adjust for it. The press will, eventually, stop quoting it.

The more durable read is the operating-loss line, the R&D-to-Microsoft line, and the cost-of-revenue growth rate. Those three are the things that compound. A company can absorb a one-time $30B accounting charge and survive. A company whose cost of revenue grows 183% year-over-year cannot, at this rate, sustain 160% operating losses indefinitely. The 2030 profitability guidance requires cost-of-revenue growth to slow, R&D-to-Microsoft to stay flat or decline (i.e., the Azure partnership terms to renegotiate), and the revenue line to keep compounding at 50%+ CAGR. Two of those three are within OpenAI's control. The middle one is not.

Angle 5: What the S&M jump tells you about the ChatGPT business

Sales and marketing went from $1.11B in 2024 to $5.73B in 2025 — a 5.16× increase, far outpacing the 3.53× revenue growth. As a percentage of revenue, S&M went from 30% to 44%. This is the line item that says the most about the underlying business. Frontier AI labs that are growing primarily by word-of-mouth and developer adoption (Anthropic, the open-weights tier) spend single-digit percentages of revenue on S&M. OpenAI is now spending nearly half of revenue on customer acquisition.

The HN thread had two comments that triangulated this from different angles. "iaaan" reported physical billboards for ChatGPT in the Portland, OR area, and asked what return those have. "themafia" replied at the top level: "I don't understand the 'sales and marketing' cost…It's so polarizing I can't imagine how that $5.7B is being spent." A follow-up reply by "dylan604" suggested the line item is paying for influencers to set up "kool-aid stands." Neither framed it in S&M-as-percentage terms, but both are pointing at the same phenomenon: OpenAI is now in the customer-acquisition-cost regime that consumer software companies enter when organic growth plateaus. The 900M weekly active number is large. The 50M paid conversion — 5.5% — is not. The reason the conversion rate is not improving is that the $20/month price point is now competing with a local tier that crossed the "good enough" threshold.

Angle 6: The IPO is the strategic context for the leak

OpenAI is filing SEC paperwork for an expected IPO. The leaked statements are from 2025; the IPO will price on 2026 numbers plus a forward projection. The question the prospectus has to answer is: at what 2027-2028 revenue and cost-of-revenue trajectory does the operating loss line bend to zero? The 2025 audited statements are the historical baseline; the S-1 will project forward. Every dollar of Microsoft R&D, every dollar of inference cost, every dollar of S&M is now a number that an underwriter has to defend at a roadshow.

This is the part of the story that is genuinely novel and that the front-page coverage has not emphasized. The leak is not a leak for its own sake; it is a leak into the middle of an SEC review. The numbers, the trends, and the trajectory are now public record in a way that constrains what the S-1 can claim. Operating losses improving from 237% to 160% of revenue is a real story and a defensible narrative. A $39B "net loss" that the average reader will not parse as a one-time charge is a story that hurts the IPO, and the company's communications team will spend the next 90 days working to reframe it.

The original take: the per-subscriber line is what the 2026 numbers will be judged on

The most common read of the 2025 financials in the press and the HN thread is that OpenAI is "losing billions." That is true and it is not useful. The more useful framing is: OpenAI is a $13B-revenue business that is losing $20.9B from operations, of which $10.6B is a single Microsoft contract. The 2026 numbers — when they leak, or when they appear in the S-1 — will be read against three questions, not one.

  1. Did paid-subscriber growth keep pace with 2025's pace, or did the 900M-weekly-active / 50M-paid gap close at all?
  2. Did cost of revenue grow slower than revenue, or faster? (The 2025 numbers had cost of revenue growing 183% against revenue at 253% — a favorable ratio, barely.)
  3. Did the Microsoft R&D line stay flat, or did the 2026 number push above $11B? If it pushed above $11B, the IPO narrative is "we are growing into a structural cost we cannot control." If it stayed flat or dropped, the narrative is "we are scaling past the fixed compute commitment."

The 2025 financials, read this way, are not a "losing billions" story. They are a story about a $13B business whose next 18 months will be read at the per-subscriber and per-inference-call level. The pre-2025 AI-lab financials (Anthropic, Mistral, Cohere) are private and not directly comparable. The closest public comp is Google's "Other Bets" line, which includes DeepMind and runs an operating loss on a much larger revenue base (the specific 2025 figure should be checked against Alphabet's most recent 10-K before quoting; the directional read is "comparable-scale operating loss, vastly larger revenue"). OpenAI is making the same bet — that the AI line will eventually be large enough to absorb its own R&D cost — on a tighter runway, with a single-supplier compute dependency that is not Google's.

What this means for you

If you are a developer or a small team paying for ChatGPT Plus, the 2025 financials do not change your short-term calculus. The price is not going up in 2026; if anything, the S&M line item is evidence the company has pricing room. The thing worth tracking is the paid-subscriber base: if 2026 shows a flattening or decline, the price-stability assumption breaks.

If you are a startup building on the OpenAI API, the cost-of-revenue trajectory is the line that matters. Inference pricing has reportedly been declining sharply year-over-year on the public benchmarks (the rule-of-thumb figure is in the 70-80% range, though the exact rate depends on which benchmark and which model family you anchor to); the question is whether OpenAI can keep pricing flat or pushing lower while its own cost-of-revenue grows. If cost-of-revenue growth in 2026 outpaces 2025's 183% rate, the unit economics on the API tighten, and either pricing has to rise (unlikely during an IPO year) or the company has to renegotiate the Microsoft deal.

If you are a founder or an enterprise buyer, the Microsoft dependency is the strategic line item. Every API call routed through OpenAI is, indirectly, routing through Azure. The diversification argument — "we are not locked into one cloud" — does not hold for OpenAI-routed workloads. The 2025 financials are the first time this dependency has been quantified in audited statements; it was speculated about for years, and the $10.59B number makes it concrete.

What to do this week

    # Step 1. Pull the full Ars Technica article (primary source) so the
    #    numbers above are not the only version of the story you are
    #    anchoring on:
    curl -sL --compressed --max-time 20 -A "Mozilla/5.0" \
      "https://arstechnica.com/ai/2026/06/leaked-financial-docs-show-openai-is-losing-billions-of-dollars-a-year/" \
      -o /tmp/openai-2025.html
    #    The audited numbers ($3.7B/$13.07B revenue, $7.81B/$19.18B R&D,
    #    $10.59B Microsoft, $2.65B/$7.5B cost of revenue, $1.11B/$5.73B
    #    S&M, $8.78B/$20.92B loss from operations) are all in the body
    #    of that article; FT's $8B-adjusted-net-loss framing is in the
    #    same write-up.

    # Step 2. If your stack runs on the OpenAI API, run a one-week
    #    shadow of token usage and pricing against a local-tier model
    #    (Gemma 4 26B or Qwen 3 30B-A3B). The point is not to migrate.
    #    The point is to know what fraction of your API bill is on
    #    workflows the local tier now covers — that fraction is the
    #    negotiating room you have if 2026 cost-of-revenue growth
    #    forces OpenAI to push API pricing.

    # Step 3. If you are an enterprise buyer, file the question with
    #    procurement: "What fraction of our AI spend routes through
    #    Azure, via OpenAI, and is that the diversification posture we
    #    think we have?" The 2025 financials are the first public
    #    evidence that the answer is "more than you assumed."

    # Step 4. Read both HN threads (48577208, the post-Ars write-up
    #    thread, and 48550465, the prior thread where Ed Zitron first
    #    surfaced the leak). The simonw comment in the 48577208
    #    thread is the explicit pointer between the two. The 48550465
    #    thread is where the "what the people who were paying
    #    attention already knew" framing originates — read both
    #    before you form a position on the 2025 numbers.

Related reads from this blog

Disclosure

Drafted with AI assistance. Primary source: Kyle Orland, "Leaked financial docs show OpenAI is losing billions of dollars a year," Ars Technica, 16 June 2026 — curl -L --compressed, 18 June 2026. Audited figures (revenue $3.7B/$13.07B; R&D $7.81B/$19.18B incl. $10.59B to Microsoft; cost of revenue $2.65B/$7.5B; S&M $1.11B/$5.73B; loss from operations $8.78B/$20.92B; net loss $5B/$39B with ~$8B adjusted 2025 net loss net of a ~$30B for-profit-conversion charge) are from the Ars article, which sourced them from Ed Zitron's leak and the FT's review. 900M weekly active / 50M paid subscribers, $122B round, $852B valuation: same source. HN item 48577208 (197 points, 116 comments at API snapshot) via Algolia HN Search, 18 June 2026. The 237%→160% of revenue, $418/sub/year, and >50% of R&D to Microsoft figures are this blog's arithmetic on the source line items, not direct claims. The "iaaan" / "themafia" / "dylan604" HN comment references are direct quotes from the Algolia API response. The $20-$25/month subscription range is a read of public Plus/Pro/Team pricing, not a verified blended average. The "10% migrate to local" scenario and the 25-50% / 75% local-workflow thresholds are thought experiments that reference the Vicki Boykis piece linked in Related reads, not direct claims. The "Other Bets / DeepMind in the same neighborhood" framing is this blog's directional read of Alphabet's 10-K; the specific 2025 figure should be checked against the filing before quoting. The per-subscriber/per-inference framing in the original-take section is this blog's editorial position.

Sources

  • Kyle Orland, "Leaked financial docs show OpenAI is losing billions of dollars a year," Ars Technica, 16 June 2026 — https://arstechnica.com/ai/2026/06/leaked-financial-docs-show-openai-is-losing-billions-of-dollars-a-year/
  • Ed Zitron, "OpenAI Losses Increased Nearly 8X in 2025, with Spending Hitting $34B," Where's Your Ed At (Zitron's newsletter), 16 June 2026 — the original source of the leak; the HN item 48550465 links to this piece at https://www.wheresyoured.at/exclusive-openai-financials/
  • Hacker News thread (197 points, 116 comments at time of writing; numbers move as the thread ages) on the Ars Technica article, item 48577208 — https://news.ycombinator.com/item?id=48577208
  • Algolia HN Search API metadata for item 48577208 (the source for the point/comment counts and commenter references) — https://hn.algolia.com/api/v1/items/48577208
  • Vicki Boykis, "Running local models is good now," 15 June 2026 (referenced as the "75% threshold" framing for the per-subscriber migration scenario) — https://vickiboykis.com/2026/06/15/running-local-models-is-good-now/

Tuesday, June 9, 2026

Miasma Worm Just Hit Microsoft Azure. The 6/8 Post Was the Trailer.

Three days ago, this blog ran a post called "Miasma Worm: Your Settings.json Is a Shell Prompt Now." It argued that the attack surface had moved from package-install hooks to agent-install hooks — that the new surface area is whatever your AI coding tool or IDE executes silently when you open a project. On June 5, 2026, that thesis hit the largest possible target. The Miasma worm campaign reached Microsoft's Azure GitHub organizations. GitHub disabled 73 Microsoft repositories across four organizations in a 105-second automated sweep, per StepSecurity's forensic timeline. The trigger files were the same four files this blog covered on June 8. The payload was the same 4,643,745-byte obfuscated JavaScript dropper. The trailer had its premiere.

What Microsoft actually pulled

Microsoft cut off access to "dozens" of its open-source projects hosted on GitHub, per Zack Whittaker at TechCrunch on 8 June 2026. The reporter count was at least 70. The API-verified count, captured by StepSecurity on 6/5, was 73. Either number is the largest single takedown of a hyperscaler's open-source footprint on GitHub to date, and it happened in an automated 105-second window with no human in the loop.

Microsoft spokesperson Ben Hope told TechCrunch the company has "temporarily removed some repositories as we investigated potential malicious content." Some have been restored after review; others remain offline. Microsoft "notified a small number of customers who may have pulled down content from the affected repositories." Full scope disclosure is still pending.

The disabled set is dominated by the Azure Functions ecosystem. 49 of the 73 disabled repositories are in the Azure GitHub organization, and 35 of those 49 carry the azure-functions- prefix. The list includes azure-functions-agents-runtime, azure-functions-core-tools, azure-functions-docker, azure-functions-dotnet-extensions, azure-functions-durable-extension, azure-functions-durable-js, azure-functions-durable-python, azure-functions-golang-worker, azure-functions-host, azure-functions-java-library, and dozens more. The blast radius is not a single tool. It is an entire Microsoft developer platform's open-source mirror.

The June 5 incident, named and dated

StepSecurity's forensic timeline is precise enough to act on. On June 5, 2026, at 16:00:50 UTC, GitHub's automated abuse detection began disabling repositories. By 16:02:35 UTC — 105 seconds later — 73 Microsoft repositories across four GitHub organizations were returning HTTP 403 with "reason": "tos" (Terms of Service violation). The enforcement was precisely targeted. StepSecurity cross-checked 16 similar Azure Functions repositories not on the list — for example EventGrid, EventHubs, CosmosDB, Redis, ServiceBus, Dapr, plus microsoft/durabletask-python — and confirmed none were blocked. The 73-repository list is the complete attack surface, not a sweep.

The malicious commit was 5f456b8 on Azure/durabletask, pushed using a previously compromised contributor account. The commit metadata is a checklist of red flags:

  • Commit message: "Switched DataConverter to OrchestrationContext [skip ci]"
  • Files changed: 5 added, 0 source code files modified
  • Commit timestamp: Backdated to 2020-03-09T15:59:47Z — six years before the actual push
  • [skip ci] flag: Suppresses CI pipeline execution to avoid automated detection

The commit claims a code change and ships none. All five files are tool configuration or the malicious payload itself. The backdated timestamp hides the commit in a dormant branch. The [skip ci] flag is the killer detail: it makes the attack invisible to the only automated defensive layer most open-source projects actually run.

The same compromised account, three weeks apart

The contributor account used to push 5f456b8 is the same account whose credentials were used in the May 19, 2026 PyPI poisoning of microsoft/durabletask. StepSecurity verified the contributor's personal fork of Azure/azure-functions-durable-extension was also blocked during the same 6/5 sweep (timestamp 16:02:25 UTC), confirming the account was active. Three readings of the same-account reuse are possible:

  1. The account was never fully rotated after May 19. The attacker retained a working GitHub token, and the rotation that should have happened in response to the first compromise did not.
  2. The account was re-compromised by the worm itself. Opening an infected repository in an AI coding tool harvests fresh tokens. The contributor's own development machine, having run the credential stealer on a 5/19-affected package, yielded up new GitHub credentials in the three weeks between incidents.
  3. A different contributor's token was used, with author metadata spoofed via the Git Data API. The fingerprint would be the same; the person behind it would not.

The second reading is the one that should make you set down your coffee. The worm is harvesting the credentials needed to spread itself, on the machines of the people most likely to be trusted by the repositories it wants to compromise next. That is not a supply-chain attack. It is a supply-chain predator, and the hunting ground is the AI coding agent that opened the previous package.

The four trigger files, named honestly

The June 5 incident confirms the four trigger files covered in the 6/8 post are now the primary attack surface for code-stealing in 2026. For the record:

  1. .claude/settings.json — a Claude Code SessionStart hook that runs node .github/setup.js when an agent session opens. A developer who clones an infected repo and starts Claude Code in it has run the payload, with no further interaction.
  2. .gemini/settings.json — identical structure, for Gemini CLI's SessionStart event. Same payload, same auto-run.
  3. .cursor/rules/setup.mdc — a Cursor project rule with alwaysApply: true. This is a prompt injection, not a shell hook. It instructs the Cursor agent to run node .github/setup.js "to initialize the project environment" — language chosen to look like a project setup requirement. The alwaysApply: true flag means the rule fires regardless of which file the developer is editing.
  4. .vscode/tasks.json — a VS Code task configured with "runOptions": { "runOn": "folderOpen" }. No AI agent is required. A senior engineer debugging a vendored dependency, opening the project in their familiar editor, runs the payload.

The fifth file, .github/setup.js, is the credential harvester: 4,643,745 bytes of single-line obfuscated JavaScript that, per SafeDep's static decode, wraps an AES-128-GCM-decrypted async loader pulling environment variables and credential paths for AWS, Azure, GCP, Kubernetes, and 90+ developer-tool configurations. The four trigger files exist only to launch it.

What this is: the supply chain got to Microsoft, not the other way around

The story is not "Microsoft got hacked." The story is "the open-source supply chain got hacked, and a major hyperscaler happened to be downstream of it." The technique does not require a Microsoft contributor. The technique requires a single compromised maintainer account anywhere in a dependency graph whose terminal node is a Microsoft-owned repository. The worm does the rest. Microsoft was the largest target, not the only target. The same fingerprint appears across 123 or more repositories spanning dozens of accounts, per SafeDep's code-search floor (the table is explicitly labeled "floor, not a ceiling"). The icflorescu/mantine-datatable family was compromised the same week, and the loader is a byte-level match for the Miasma family.

The 6/8 post argued that the threat model for 2026 is not "is this package's maintainer trustworthy." The threat model is "does any configuration file in the dependency graph, including files I have never read, execute a payload when one of my AI tools or my IDE opens a project." For most projects, the answer to that question is I do not know, and the answer is honest.

The Microsoft incident adds three more sentences to that threat model:

  • The account that gets compromised does not have to be the account whose code runs. A compromised GitHub PAT from a single developer, used to push a commit, is enough to plant the four trigger files. The credential stealer then runs in the environment of every developer who subsequently opens the project.
  • The "human-in-the-loop" defense does not apply to file-open events. The whole point of the configuration-file attack surface is that it triggers on SessionStart or runOn: "folderOpen". There is no confirmation dialog. There is no AI to ask "did you mean to run this." The payload runs before the developer has finished typing their first prompt.
  • Microsoft, with the resources of the largest security operation in enterprise software, did not catch the malicious commit before it shipped. Detection happened downstream, via GitHub's automated terms-of-service enforcement, hours later. The CI pipeline was bypassed by [skip ci]. The commit sat in a backdated branch until the next mass scan. The 105-second takedown is real, but it is cleanup, not prevention.

What this means for you

  • If you maintain an open-source repository: add a CODEOWNERS rule that requires explicit approval for any commit that adds .claude/settings.json, .gemini/settings.json, .cursor/rules/*.mdc, .vscode/tasks.json, or .github/*.js. These file patterns are the Miasma trigger surface, and they should not be silently mergeable by an active contributor, much less a compromised one.
  • If you build or ship an AI coding tool or IDE: ship a safe-by-default posture for SessionStart hooks and folder-open tasks. Claude Code, Gemini CLI, and Cursor can all be configured to require explicit user confirmation before running a shell command from a project config file. The default should be confirmation, not execution. Microsoft just provided the cleanest possible justification for that product decision.
  • If you use Claude Code, Gemini CLI, Cursor, or VS Code in a work context: the next time you open a third-party repository — especially one you cloned recently — check for these four files before you start an agent session. Five seconds of cat is the difference between a debug session and a credential exfiltration.
  • If you work at a company that ships open-source dependencies: the Miasma family has now compromised a single hyperscaler's open-source mirror, a popular UI library, and 120+ smaller projects in a single month. The expected cost of cloning an untrusted repository, in 2026, includes a credential stealer running on folder open. The cost-benefit on containerized, ephemeral, or remote-development environments just changed.
  • If you write about supply-chain security: the post-Miasma configuration-file attack era is its own era. The trigger surface is configuration files, not package managers. The defenses that worked against preinstall and setup.py hooks do not generalize to SessionStart events. The dependency graph now includes the developer's own .claude/ directory. The threat model has to be redrawn.

What to do this week

# 1. Audit every repo you maintain or contribute to for the four
#    Miasma trigger files. They should not exist in a trusted
#    repository unless your team added them on purpose.
#    find . -type f \( \
#      -path "*/.claude/settings.json" -o \
#      -path "*/.gemini/settings.json" -o \
#      -path "*/.cursor/rules/*.mdc" -o \
#      -path "*/.vscode/tasks.json" -o \
#      -path "*/.github/setup.js" \
#    \)
#
# 2. Add a CODEOWNERS rule that requires review for any commit
#    adding or modifying any of those paths. The blast radius
#    of a single compromised account is now the entire
#    repository's user base, and review is the only mitigation
#    that scales.
#
# 3. Configure your AI coding tools to require explicit user
#    confirmation before running shell commands from project
#    configuration. Claude Code: --permission-mode. Cursor:
#    Agent command allowlist. Gemini CLI: --no-auto-run. The
#    default should be "ask first," not "execute."
#
# 4. Rotate any GitHub PATs that were present on a machine
#    that opened an infected repository on or after May 19,
#    2026. The Miasma loader architecture is constant across
#    waves; the inner dropper is recompiled per victim with
#    rotating AES keys and a fresh SHA256, per SafeDep. If
#    you ran any version of it, rotate.
#
# 5. Move development of untrusted third-party dependencies
#    into a container, a VM, or a disposable environment.
#    The era of "I'll just clone it and poke at it locally"
#    is the era of a folder-open credential stealer.
#
# 6. Read the StepSecurity forensic timeline. It is the most
#    technically precise account of the Microsoft incident
#    and it names the file patterns, the commit hash, the
#    timestamps, and the spread of the same compromised
#    account.
#    https://www.stepsecurity.io/blog/miasma-worm-hits-microsoft-again-azure-functions-action-and-72-other-repositories-disabled-after-supply-chain-attack-targeting-ai-coding-agents

The original take: the Miasma family is the new normal, and Microsoft just confirmed it

The 6/8 post argued that the configuration-file attack surface was the next escalation of the open-source supply-chain threat. The Microsoft incident is the confirmation. The largest open-source footprint in enterprise software was compromised by the same four trigger files, in the same week, via the same account whose credentials the same worm family stole the first time around. The 105-second takedown is the cleanup. The [skip ci] commit is the new normal. The next incident will not be in a Microsoft repository. It will be in yours, or in a dependency of yours, planted by a contributor you have never met, and it will fire on folder open in the AI coding tool you use every day.

The corollary: the dependency-graph trust model that open-source maintainers have used since 2010 — trust the maintainer, scan the package, defend the install hook — does not extend to 2026. The new trust model has to cover every file in the repository that an AI coding tool or IDE will read on open, because the new attack surface is the entire repository, not the package manifest. Defending preinstall and setup.py is not wrong, but it is the answer to last year's question. The question this year is "what does the AI coding tool do on session start," and the Miasma family is the answer the threat actors have already given.

The 6/8 post was the trailer. June 5 was the premiere. The next installment is a question of when, not if, and the only variable that changes the answer is whether maintainers, AI tool vendors, and enterprise security teams update their threat models before the next wave ships.

Related reads from this blog

  • Miasma Worm: Your Settings.json Is a Shell Prompt Now — The 6/8 post that named the configuration-file attack surface, the four trigger files, and the prompt-injection vector in Cursor. Three days later, the same family hit Microsoft. The post has now been vindicated at the largest possible scale.
  • Speculative KV Coding: 4× Lossless Cache Compression — A different kind of inference-engineering story, but the same shape: a small, technical change that compounds into a category-level shift. The Miasma family is the same kind of compound move on the attacker side. Small change in the trigger files, large change in the attack surface.
  • Xiaomi Hit 1000 t/s on a 1T Model. The Race Just Changed. — Speed is the new axis. Inference at 1000 tps makes new product categories possible. The Miasma worm is the same kind of axis shift on the security side: the configuration-file attack surface is not new, but the cost-benefit of exploiting it at scale is, and the cost-benefit just changed in the attackers' favor.

Disclosure

This post was researched and drafted with AI assistance. Primary sources are listed in the Sources section above. Every numerical claim, direct quote, and timestamp is taken from a fetched and cached source — the synthesis, the framing, and the "what this means" angles are this post's own. The 70-repository TechCrunch count vs. 73 in StepSecurity is a 6/8 vs. 6/5 snapshot difference (StepSecurity's 73 is the API-verified count); the "more than 120" other affected repositories across dozens of accounts is SafeDep's prose figure, with a 123 floor in their code-search table.

Sources

Saturday, June 6, 2026

Microsoft Just Put a Workflow Engine Inside Postgres

Microsoft Just Put a Workflow Engine Inside Postgres

Disclosure: This post was researched, drafted, and edited with AI assistance. Microsoft's pg_durable GitHub repository and README were the primary source; the HN announcement thread (281 points, 72 comments at time of writing) was the secondary source. Opinions, framing, and analysis are the author's.

Microsoft open-sourced pg_durable on June 5th and most coverage will focus on the SQL DSL, the ~> and |=> operators, and the question of whether writing workflows as SQL strings is a good idea. That's the wrong story. The real story is that the author of pg_durable is the same person who built the orchestration layer for Durable Task Framework — the framework that has been running Microsoft-internal workflows and Azure Durable Entities for close to a decade — and the team is now putting that capability inside Postgres. If you've ever told someone "we need a workflow engine for this," and the answer was Temporal, or Airflow, or Step Functions, that answer just got weaker.

What pg_durable actually does

A pg_durable function is a graph of SQL steps that Postgres executes and checkpoints as it goes. If the database crashes, restarts, or a step fails, execution resumes from the last durable checkpoint instead of forcing you to reconstruct state by hand. You start one with a one-liner:

SELECT df.start(
  'SELECT id FROM documents WHERE processed = false LIMIT 100' |=>
  'batch' ~>
  'UPDATE documents SET processed = true WHERE id = ANY($batch)'
);

The runtime checkpoints between steps, so a restart in the middle of a long job doesn't rerun work that already succeeded. Status and results are queryable from standard Postgres tables (the README points to df.instances) — same auth model, same backup model, same observability tooling. There is no Redis, no Temporal cluster, no separate queue service. It installs as a PostgreSQL extension and ships as a Debian package for PG 17 and 18 on amd64.

Under the hood, pg_durable is built on duroxide, a Rust-based durable execution runtime that handles deterministic replay, checkpoints, sub-orchestrations, and timers. pg_durable is the Postgres-flavored wrapper (PostgreSQL License); duroxide is the engine (MIT). The two components carry different licenses.

The "Postgres is enough" thesis just got real

There's been a persistent argument in the Postgres community for years — most visibly at postgresisenough.dev — that you can replace a lot of operational machinery with Postgres if you reach for the right extensions. pg_durable is the most ambitious version of that argument yet: it claims that durable execution, the thing that has historically required a separate orchestrator like Temporal, is just another primitive the database should provide.

The README's own list of "what you're probably doing today" makes the displacement target explicit:

  • pg_cron plus a jobs table, status columns, retry counters, and a polling worker
  • An external orchestrator (Airflow, Temporal, Step Functions, Argo) calling back into Postgres
  • A queue plus workers plus a separate state table to coordinate retries
  • A plpgsql procedure that works until a crash or long-running transaction forces you to start over

That's the menu. If pg_durable works as advertised, several of those menu items become the same thing, and the "we need Temporal for this" justification gets harder to make.

The maintainer of postgresisenough.dev is already asking for a PR to add pg_durable to the site. That's the tell — the people who've been arguing "Postgres is enough" see this as a real entry in the catalog, not a marketing stunt.

The Microsoft stake is bigger than it looks

Two things are easy to miss. First, the lead committer, affandar, is also the author of Durable Task Framework, the orchestration library that has powered Azure Durable Functions and Durable Entities. This isn't a new team learning the durable-execution category. It's the same team shipping their next move in the open.

Second, the same repo's documentation points at Azure HorizonDB, Microsoft's new PostgreSQL cloud service, as the place to try pg_durable — and notes that it's "engineered for performance and built with pg_durable inside." This isn't a one-off OSS contribution. It's a positioning move. Microsoft is betting that the database is the right substrate for workflow orchestration, and the database they want to bet on is Postgres, not a proprietary service they control end-to-end. That tells you something about where they think the leverage is.

The honest counterargument: the SQL DSL is awkward

The most consistent pushback in the HN thread is that the workflow syntax is hard to read. One commenter, looking at the README example, called it "bizarre." Another pointed out that embedding SQL strings inside other SQL strings — which is what the df.start(...) syntax essentially is — is a maintainability hazard waiting to happen.

Both criticisms are fair, and the maintainers know it. gdecandia, a contributor, said: "Agree that the DSL ergonomics can be improved. Our pipelines use a higher level language and therefore simplified, but pg_durable is meant to solve a wider array of problems. We're happy to take suggestions for improvements." A committer also noted that the state-provider layer is an extensibility point — they're open to alternative backends like a pgmq-based state provider, rather than the default PostgreSQL one.

The DSL awkwardness is the price you pay for putting workflows inside a SQL-shaped runtime. The tradeoff is real: pure SQL workflows are more constrained than Temporal's TypeScript SDK, but they force the architecture into a shape that survives database restarts, which is the whole point. If you've been writing Temporal workflows in TypeScript and never worrying about the underlying state store, you may not feel the pain pg_durable is solving. If you've been writing plpgsql procedures and losing work to transaction timeouts, you will.

What it's not

  • It's not a replacement for Airflow if your workflows fan out across heterogeneous systems (S3 + Spark + Slack + a database). The README explicitly says: "if the workflow mostly lives outside Postgres and spans many heterogeneous systems," reach for a general-purpose orchestrator.
  • It's not a sub-millisecond request handler. It's for durable background work, not synchronous request paths.
  • It's not available everywhere. The first-class deployment is Azure HorizonDB. If you're on AWS RDS, Aurora, Supabase, or Neon, you'll need to install the extension yourself and check whether your provider's PG build allows it.
  • It's not the first durable-execution project on Postgres. pg-boss, pg-workflows, and several others have been filling this niche for years. pg_durable is the most ambitious and the first with a major-vendor seal.

The performance and architecture story that's still developing

The README lists workloads (vector embedding pipelines, ingest pipelines, scheduled maintenance, fan-out aggregation, external API workflows) but doesn't publish benchmark numbers as of the v0.2.2 release. That's reasonable for an early OSS drop, but it means the "is this faster than my current setup" question is one you'll have to answer with your own load tests. The engine is Rust (duroxide) and the integration is in-PG, so there's no obvious reason it should be slow — but the early numbers will tell.

The architectural claim most worth testing is the parallel-fanout story. The README says pg_durable supports "fan-out aggregation: run independent queries in parallel, then join the results." If this works inside a single Postgres connection without an external worker pool, it's a real differentiator from the queue-plus-workers pattern.

The original take: the orchestrator is being absorbed into the database

pg_durable doesn't beat Temporal feature-for-feature today — Temporal has sub-orchestrations, versioning, signals, queries, and a TypeScript SDK that a generation of developers have already learned. pg_durable has none of those. The interesting question is what happens if a category of workflow tools gets pulled into the database itself over the next three to five years. Microsoft shipping pg_durable as a PG extension, embedded in their new cloud Postgres, is a strong signal that the answer to "where does the orchestrator live?" is shifting from "separate service" back to "the database." If this pattern holds, expect to see competing extensions in MySQL, MariaDB, and DuckDB within 24 months. The durable-execution category as a standalone product category gets thinner with each one.

The counter-trend is the continued rise of general-purpose orchestrators with mature SDKs (Temporal, Restate, Inngest) and the assumption that workflows will increasingly be written in application code, not SQL. If you're betting on that future, pg_durable is a 2026 data point, not a trend reversal. If you're betting on the database-absorbs-orchestration future, this is the most significant open-source release of the year so far.

What to do this week

# Check what your current workflow stack actually is
SELECT count(*) FROM information_schema.tables
WHERE table_name IN ('jobs', 'job_runs', 'workflow_state', 'scheduled_tasks');
# If you have more than 2 of these, you have a homegrown orchestrator.

# Look at what extensions your Postgres allows
SELECT name, default_version, installed_version
FROM pg_available_extensions
WHERE name IN ('pg_cron', 'pg_durable', 'pgmq');
# If pg_durable shows up with a version, your provider has built it in.
# If it doesn't, ask them when it will.

If you have a Temporal deployment that's mostly doing "fetch some rows, update some rows, wait, update some more rows" — that's exactly the workload pg_durable is for, and it's worth a one-week prototype to see if you can drop the orchestrator from your architecture diagram.

If you're on Azure and you've been waiting for "modern" Postgres features to land on Azure, the HN commenter who said "I'm trapped on Azure" is the user you should be listening to. Azure HorizonDB is the response to that complaint, and pg_durable is one of the first things it ships with.

If you're a maintainer of an existing pg-boss or pg-workflows-style project: now is the time to make sure your README has a "how this compares to pg_durable" section. The displacement question is going to come up in every HN thread for the next quarter.

What this means for you

The story of pg_durable is that the most valuable open-source workflow orchestration capability — the kind that was, until now, the reason to deploy a separate service — is now an install command away from every team that already runs Postgres. The deployment cost of "I need durable execution" just went from "spin up a cluster" to "apt install pg-durable-postgresql-17." That's the same kind of leverage shift that Redis 8.8's array data type brought to in-memory data structures, and the same pattern Cloudflare applied in acquiring VoidZero — own the substrate, and the layers above it become someone else's problem to defend. (For more on what "owning the substrate" looks like on the model side, see how Gemma 4 12B dropped the multimodal encoder — different substrate, same play.)

The next time someone tells you "we need Temporal for this," the better question is: do you need a workflow engine, or do you need Postgres to remember what it was doing?