Older issue
CC

CTO Circle

AI and Open Source, SpaceX acquiring Cursor, and Vercel's hack

Reply-To: marco@pullpo.io

Issue 004
Fourth issue
Sponsored

Apr 22, 2026

Hey, this is Marco from CTO Circle. This is the fourth issue of this newsletter. My goal is to deliver the most value in the fewest words, in the simplest way.

Please let me know what you think and how I can improve it. Reply here, I read every reply.

Today: the next CTO event (NEW), one opinionated trend, important news and launches, community reads, and open engineering leadership roles.

Sponsored - SPONSOR CTO CIRCLE HERE

Pullpo AI Impact Dashboard

Understand AI's real impact on engineering delivery

See how tools like Copilot, Cursor and Claude affect speed, review time and developer productivity - with real delivery data, usage trends and built-in developer feedback.

Get a demo

Next community events.

Madrid - Playtomic's office - 20 May. CTO Networking + Tapas + Short talks from CTOs. Applications will open next week!

Short opinionated trend: Is AI killing Open Source?

At least it's messing with it from multiple angles at once.

Flood of "slop PRs." It now costs almost nothing to generate code, but reviewing it still takes human time and attention. That asymmetry is brutal for maintainers. Jazzband is winding down, Godot maintainers have described AI slop PRs as draining and demoralizing, cURL shut down its bug bounty after a wave of low-quality AI-generated reports, and GitHub is now building more granular controls so maintainers can restrict pull requests or disable them in some cases.

Security. Open code has always made auditing easier. Now it also makes automated vulnerability discovery much easier. Anthropic's Mythos Preview says it found and exploited zero-days across major operating systems and browsers, including bugs that had apparently been sitting there for decades. And this is already bleeding into the real world: after Vercel's recent incident, Guillermo Rauch said he strongly suspects the attackers were "significantly accelerated by AI." I think this changes the risk calculation for some companies. Cal.com is a good example: they recently moved their codebase to closed source while explicitly pointing to security as the main reason.

Relevance. A lot of useful open source used to have a built-in moat simply because building it took effort. That moat is thinner now. Small tools, wrappers, UI kits, and straightforward utilities can increasingly be recreated from a prompt in Claude Code. That does not make them worthless, but it does make some projects easier to commoditize, easier to clone, and harder to monetize. Tailwind is the most famous example here, where its business model of selling Tailwind UI components has completely collapsed.

Open source still has some advantages. It creates trust, helps with hiring, generates more word of mouth, more feedback, and more contributions from people who actually care. But I'm not sure it's worth it. It's a hard time for open source right now.

News, reads and launches.

SpaceX has secured an option to acquire Cursor for $60B, while partnering with them to build leading AI for coding and knowledge work.

The Economics of Software Teams: Why Most Organizations Are Flying Blind. Most software teams are absurdly expensive, barely anyone knows what they actually cost or return, and AI is starting to brutally expose how much of modern engineering has been running on vibes instead of economics.

Salesforce unveiled "Headless 360," a major shift that turns its platform into programmable infrastructure for AI agents via APIs, MCP tools, and CLI commands instead of relying on the traditional CRM UI.

Anthropic launched Claude Design, a preview tool for creating and refining visual work with Claude. On this same topic, I recommend this comparison with Figma by Sam Henri Gold.

Apple announced that Tim Cook will become Executive Chairman and John Ternus will take over as CEO on September 1, 2026.

How to hire people who are better than you. The article argues that when you can't truly assess a candidate's domain expertise, the best signal is whether they already teach you, sharpen your thinking, and seem likely to elevate the whole company.

From the community.

De*** asked whether OKRs should define the exact work for the quarter or just guide priorities. The discussion that followed mostly agreed that OKRs should focus on outcomes, not act like a 3-month sprint plan: strategy informs OKRs, and then teams decide which work best supports them. People also noted that tech debt should usually be handled continuously rather than saved for a dedicated week, and that in some companies "OKRs" are really just waterfall planning with a new label. The overall takeaway was to worry less about the name and more about using a planning approach that fits the company's context.

Apply to join the Slack community here.

Open eng. leadership roles.

That's it for today. Please let me know whether this post provided enough value for you.

Best,

Marco

Reply does not work yet. This composer is here for realism and emotional support.