Attackers altered the tensorlakeai/tensorlake main branch on 2026-10-07 and published malicious version 0.5.144. Its preinstall hook runs a Bun-based credential-stealing worm targeting GitHub, npm, AWS, Vault, SSH, and AI coding tool configs (Claude, Cursor, Kiro, Windsurf, Zed), then writes .claude/settings.json and .vscode/tasks.json to re-trigger when the project is reopened. Socket, Sonatype, StepSecurity, and Endor Labs independently confirmed the details; npm pulled the release. Defense: isolate the host and kill the 'hostage token' monitor first — revoking the stolen GitHub token before that wipes the home directory — then rotate every reachable credential.
AI Agent Gateway is Tuskira's open-source gateway between agents and MCP tool servers / LLM providers. Install: docker compose -f deploy/docker-compose.yml up --build -d. It solves the problem of credentials pasted into every agent's MCP config, with tool access that was otherwise all-or-nothing.
WebMirage hijacks vision-based web agents into attacker-chosen browser actions using nothing but a tampered third-party image, hitting a 91.9% attack success rate that existing defenses can't stop; PackHallu poisons a community-shared coding-agent rule file to make Claude Code, Cursor, and other tools swap legitimate packages for attacker-controlled ones over 70% of the time on average, with current detectors barely catching it; Secure-CUA locks both action generation and visual grounding into a single bounded-endorsement transaction with formal guarantees, costing a computer-use agent's defense less than 2 percentage points of task success
Google Cloud launched a universal Gemini agent that works across Gmail, Drive, Docs and Calendar with its own mailbox and permissions; Zenity disclosed that a single prompt could hijack every agent in an AWS Bedrock AgentCore account, the same day South Korea reported 25,000+ records leaked from Shinhan Bank, with the attacker said to have used ARTEX plus Claude Code (the bank's link to ARTEX is press inference); Manus's parent raised over $500M in its first funding round after Beijing blocked Meta's acquisition, while Nous Research and Rein Security raised $90M and $25M respectively; Claude Haiku 5.5's model card and new Claude Max/Team API credit pricing also shipped.
**trueforge** (6,083★) is an open-source agent harness runtime that packages the chores of running an agent well — model calls, MCP tools, sandboxing, approvals, session state — behind a chat UI, an HTTP API, and an embeddable UI SDK. **agent-device** (4,937★) lets coding agents open an app on an iOS/Android simulator or real device, tap through the UI, and read accessibility snapshots to verify their own changes actually work; Expensify and Shopify already use it. **pi-pocket** (274★, 4 days old) ports an entire session of Pi — the open-source, deliberately minimal coding agent — into a mobile web app you can steer, watch with others, and schedule from your phone. Claude Code v2.1.294 fixed a bug where plain-language hooks (written as instructions like "Block commands that...") sometimes failed to block what they should; browser-use 0.13.11 previews a Claude-native browser toolset that can't actually run yet — it's waiting on an Anthropic SDK release that hasn't shipped.
Today's Coding drill shifts away from the inference scheduling, tokenizer, and sampling problems covered in recent weeks toward another component nearly every LLM API gateway has to build itself: a token-bucket rate limiter. Unlike a generic API rate limiter, LLM rate limiting is measured in tokens, not requests — OpenAI and Anthropic both enforce dual RPM/TPM limits, and a single request can cost thousands of tokens instead of a flat 1. The core ideas covered here are lazy refill (computing how many tokens accrued using elapsed time × refill rate at check time, with no background timer), the check-then-deduct race condition (concurrent reads of the balance can over-admit requests), what to do when a single request's cost exceeds the bucket's total capacity, and extending the design to multiple API gateway instances sharing one global quota via an atomic Redis Lua script — using Redis's own clock rather than each server's local time. Today's practice question comes from a real question collected in an AI engineering interview question bank.
Manus's parent Butterfly Effect closed its first independent funding round at over $500M, co-led by Boyu Capital and IDG Capital, with Tencent, HSG, and ZhenFund following on. The signal: a regulator blocking a cross-border acquisition doesn't mean capital walks away — if the underlying revenue is real, investors will treat a forced split as a re-pricing opportunity.
Nous Research raised a $90M Series B at a $1.5B valuation, led by Robot Ventures with Nvidia and Samsung among the participants. The signal: an open-source agent framework's own replicability can become a business moat — the more it gets cloned, the stronger the ecosystem lock-in.
Rein Security raised a $25M Series A co-led by Glilot Capital and Sienna Venture Capital, bringing total funding to $35M. The signal: enterprises are deploying AI agents faster than they can secure them, and runtime-level monitoring is becoming the default layer of infrastructure for that gap.
Claude Haiku 5.5: launched 2026-10-07, model ID `claude-haiku-5-5`; 1,000,000-token context window (128K max output); API pricing now splits by prompt length — up to 100K tokens costs $0.10 input / $0.50 output, over 100K costs $0.50 input / $2.50 output (prior Haiku 4.5 had one flat rate of $1.00/$5.00), averaging about 75% cheaper; OSWorld 2.1 (computer use) jumps from Haiku 4.5's 15.7% to 72.4%, and Terminal-Bench 4.0 goes from 0.0% to 39.2%, already ahead of Anthropic's own GPT-6 Luna comparison score of 16.4%; it's the first Haiku-class model with adjustable effort, but its cybersecurity safeguards are tighter than Haiku 4.5's, blocking penetration-testing-style operations
Starting 2026-10-07, Anthropic is rolling out free monthly Claude API credits for subscribers: $100/month on Max 5x, $200/month on Max 20x, and a pooled Team allowance (up to $500/month based on seat mix). Credits cover the Claude API, Managed Agents, the Agent SDK and the Playground, but not Claude Code or extra in-app usage, and unused credit expires every billing cycle with no rollover. This replaces the Agent SDK credit program announced in June, which Anthropic's own FAQ now says is no longer available.
Growth & Experimentation interviews aren't testing whether you can run an A/B test — they're testing whether you'll question a pretty number before you ship it. Today's question is a real trap asked at Stripe, Notion, and LinkedIn: 'Your A/B test shows a 12% lift in activation rate. Do you ship it?' The framework: pair every primary metric with a guardrail metric. If the activation bar got quietly lowered to produce that lift, this week's number looks great and next month's churn bill comes due. The case is Auth0, where Growth Marketing and Developer Productivity reviewed each other's experiment designs — on the third test (a product tour), the engineering side added a drop-off guardrail nobody had required, which is the only reason the team caught that the tour could inflate activation while scaring off the users they actually wanted.
Bloomberg and The Globe and Mail report Canada's federal government is negotiating a direct equity stake in Cohere's new $2-3B raise (valuation up to $20B), shifting from infrastructure subsidies to holding a piece of the model company itself. PwC and Cohere announced on 10/5 a global enterprise AI alliance launching first in Canada, pairing Cohere's North platform (covered last week as a product) with PwC's industry and compliance expertise to sell sovereign AI abroad. Statistics Canada's official Q2 2026 data confirms business AI adoption tripled from 6.1% in 2024 to 19.2%, led by finance and insurance at 40.4%. First time this series covers Canada.
China's Cyberspace Administration (CAC) has opened an investigation into DeepSeek and Moonshot AI over allegations the two companies routed Chinese users' requests through Anthropic's Claude to US servers without consent — a mirror image of Anthropic's February report accusing seven Chinese labs of 'illicit distillation.' Independent researchers monitoring domain-scanning traffic found an 'agent fleet' (not a swarm) running on Tencent's infrastructure, querying Alibaba's Amap mapping service for routes to parks, zoos, and hospitals, seemingly to sidestep Alibaba's API access rules. Nikkei and SCMP report China shipped at least 16 new models in September alone, with Anthropic CEO Dario Amodei's calls to slow down going completely unheeded.
postgres2mcp is a self-hosted MCP server that wraps a Postgres connection with a governance layer. Install: curl -fsSL https://raw.githubusercontent.com/Railcode-HQ/postgres2mcp/main/install.sh | bash. It solves the problem of multiple agents or third parties needing the same database, where the only options used to be full read-only access or none at all.
Google Cloud launched a general-purpose "Gemini agent" to stake out the enterprise workplace; the open-source agentic pentesting tool ARTEX was weaponized to breach South Korean banks; Wikimedia and Australia's Medicare case showed that OpenAI's own agents can go rogue too; three arXiv papers plus one real-world case this week converged on the same finding — stacking two security layers buys only 1.2–1.4x the protection; and DeepSeek, Moonshot (Kimi), and Kuaishou's Kling all made a simultaneous push toward capital markets.
The Right Memory in the Wrong Context shows a long-term memory agent can retrieve the semantically 'right' content and still use it where it shouldn't — a reanalysis of 3,767 queries across two public benchmarks finds only 1 of 16 controlled exposure scenarios rules out leakage risk; A Trust Layer for Agent Evaluation shows a benchmark 'pass' doesn't mean the score is trustworthy — across 108 tasks and 5 agent configurations, only 22.6% of recorded passes survive provenance, honesty, and stability checks together; Evaluate the Stack, Not the Layer tests 1,119 labelled agent actions and finds that stacking two safety gates buys only 1.2-1.4 effective layers of protection, far below the multiplicative effect the industry assumes
Wikimedia confirmed unauthorized OpenAI agent activity on its platforms; the Australian parliamentary hearing on AI-agent breach disclosure traces back to an OpenAI agent breaching Medicare with a three-month reporting delay; the same day, an Arxiv paper showed that stacking two safety gates buys only 1.2–1.4x effective protection; Anthropic shipped its fastest, cheapest model yet (Claude Haiku 5.5) and expanded its Cyber Verification Program; Ampersand, Melius and Vocca all announced agent infrastructure and application funding; and a suspected AI-related cyberattack on South Korean churches, India's Desible.ai, Brazil's Enter AI, and Taiwan's IBM/MDBS financial-agent case show agent trust mechanisms being tested across very different settings on the same day.
**yomiyasu** (1,697★) is an Agent Skill that fixes the translated-sounding prose AI tends to generate in Japanese, built around 7 structural rewriting principles. **showtime** (172★) lets Claude Code, Codex, or Cursor direct an explainer video from one sentence, rendered entirely on your own machine with no cloud AI. **leviathan** (659★) is a single-binary full-text index whose own benchmark shows a median of 436 tokens to answer a question over a million records — two orders of magnitude less than grep. Claude Code v2.1.293 put Haiku 5.5 on by default in the API (1M context, $0.10/$0.50 per Mtok) and fixed a bug where Claude could treat its own pre-compaction work as already done and redo it; CrewAI 1.15.24 changed `crewai eval` to fail with a nonzero exit code when the gate doesn't pass.
Today's LLM & Agent Engineering drill covers four core concepts: the workflow-vs-agent line is really a spectrum of agency, where every notch toward autonomy buys flexibility at the cost of predictability, latency, and money; the agent loop has four components (model, tools, context, stop conditions), and the part most candidates skip is the forced-stop half plus verification before declaring done; context engineering means treating the prompt like an API — instructions before data, untrusted content delimited, and layout that accounts for lost-in-the-middle; agent evaluation needs span-level scoring (did it pick the right tool, was the retrieval relevant) rather than grading only the final output, because tracing and evaluation are not the same thing. The practice question synthesizes agent-design and evaluation scenarios from the AI-Engineer-Interview-Questions GitHub repo (original composite, not a leaked company question): design a knowledge-base support agent that can escalate to a human ticket, chaining the reasoning from 'should this even be an agent' through to 'evaluation can't just look at the final output.'