Three things in Inngest v1.46.0: (1) after running `inngest login`, a local workflow can connect directly to a Cloud sandbox to run agent code, with no need to deploy a full app or configure an SDK sandbox token (experimental); (2) API keys move from one all-powerful credential to versions scoped to the v2 API, CLI, or MCP, with optional expiry; (3) a Dashboard dependency, TanStack Start, is patched for CVE-2026-102989, a reflected XSS. No breaking changes — just upgrade.
Hadrian raised a $40M Series B co-led by Forgepoint Capital International and SmartFin, bringing total funding to $65M. The signal: both sides of the security fight are swapping humans for agents — the next battlefield in cybersecurity isn't human vs. AI, it's agent vs. agent.
Siena raised a $17M Series A led by York IE, bringing total funding to $29.7M. The signal: customer-service agent startups are no longer content owning one vertical function — they want to become the shared memory and governance layer for all of a brand's customer interactions across support, social, shopping, and voice.
Vinci raised a $250M Series B co-led by Advent, Temasek, and Xora at a $1.5B valuation. The signal: AI-native physics simulation tools are challenging the moats of chip-design incumbents like Cadence and Synopsys, and capital markets are pricing this kind of AI infrastructure far faster than they ever priced traditional hardware tooling companies.
Mistral Large 4 (ML4, nicknamed Le Chonk): public preview announced 2026-10-06, a 1.05T-total-parameter granular MoE multimodal model; the official active-parameter count is inconsistent (the launch post says 49B, the docs model card changed to 52B a few hours later with no explanation); list pricing is $1.36 input / $4.18 output per 1M tokens (cached $0.14), though the docs card currently shows exactly half that with no explanation; the docs card claims a 1M-token context window, but third-party trackers Artificial Analysis and Vals.ai both list 512K (524,288 tokens) with a 256K output cap; scores 93% on Cybench and 82% on Artificial Analysis Cyber Index's vulnerability-reproduction task (self-reported, the highest of any model — Claude Opus 5.5 and GPT-6 Astra score near zero by refusing); but on the independent Artificial Analysis Intelligence Index v4.3.2, it scores only 38, trailing MiMo-V2.6-Pro (46), GLM-5.3 (45), and Kimi K3 (44) by 6-8 points; Vals.ai ranks it 6th of 75 models (1st among open models) on Harvey's Legal Agent Benchmark, one of its few independently-verified strengths; open weights and a named license are still pending, expected by end of month (reporters were told October 27)
On 10/6, Anthropic expanded Claude for Startups from a vague "we provide credits" offer into three concrete, dollar-denominated benefits: 5 free Claude Team Premium seats for a year (worth $7,500 at the official $125/seat/month rate), a one-time $1,000 API credit (expires in 6 months), and up to $45,000 in partner tool discounts. Eligibility is unchanged: founded within 5 years, or funded within the last 2.
The easiest way to lose points in a Strategy & Execution interview isn't failing to analyze the market structure — it's finishing the five-forces analysis and then proposing a plan that attacks the market leader head-on anyway. Today's drill is a real Google Product Strategy interview question: 'As the Bing PM, Google has overwhelming search market share — how do you grow Bing's share?' The framework starts with Porter's Five Forces to find which structural constraints actually matter in search — barrier to entry (data plus distribution) and threat of substitutes (AI chat assistants bypassing search entirely) — then uses TAM-SAM-SOM to turn 'grow market share' into 'which users, on which channel, does Bing already hold a structural edge on.' The case is Avis: as the 1960s number-two player in car rental, Avis didn't compete on fleet size or locations — it ran 'We're No. 2. We try harder,' turning a structural disadvantage straight into proof of service motivation, a positioning that carried two decades of share growth. That's the live version of what the question is testing: as a market challenger, asymmetric positioning beats a head-on fight.
Researcher Syed Anas Mohiuddin proved that the SSRF bug common in MCP servers isn't a one-off coding mistake but a structural flaw in the protocol itself: five unrelated organizations — Google, JPMorgan, the French government, Weaviate, and the city of Tangerang — each independently made the same mistake. He coined 'Protocol Pivoting' for the technique of smuggling malicious instructions across protocol boundaries (MCP into A2A). Google's bug (CVE-2026-14540, CVSS 8.0) is fixed, but five US federal systems under the GSA — including a veterans' benefits server — reported on September 2 are still unpatched, and one of them writes veterans' names, Social Security numbers, and birth dates into unredacted error logs. Defense: audit every MCP tool that accepts an agent-supplied URL or path parameter, add destination allowlisting and IP validation, and treat any content relayed between agents as untrusted input.
SpecStory CLI is an open-source CLI that wraps terminal coding agents — swap your launch command from claude to specstory run claude and every conversation auto-saves to .specstory/history/. Install: brew tap specstoryai/tap && brew install specstory. It solves the problem of AI coding sessions disappearing the moment you close the terminal, with no way to find or share them later.
GHOST shows GPT-5.5 has an 11.5% chance of forgetting an earlier safety constraint during benign long conversations, which a two-layer defense drives to zero; HackTrace detects reward hacking from the agent's own generation-time internal states (AUC 0.997) and cuts the cheating share during training from 82-91% to 1-5%; Source Preference in the Wild shows 12 agent models pick items by source brand rather than quality — an item from a preferred source wins about two-thirds of the time even when it satisfies one fewer requirement
ZITADEL, Zimbra, Bouncy Castle and MCP OAuth racked up 15 CVEs in three days while AWS patched auth-bypass flaws in Bedrock AgentCore; per Oct 5 reports, the open-source AI agent tool ARTEX was linked to breaches at seven South Korean banks, leaking 65,000 records; the GlassWorm supply-chain attack, disguised as VS Code themes, targets AI coding agent credentials on dev machines; Meta and Microsoft slashed internal Claude/Claude Code usage in favor of their own tools; Cloudflare shipped 46 agent-infrastructure announcements, DeepSeek's V4.1 Flash narrowed the US-China benchmark gap to 3%; and two enterprise agent funding rounds — OneByZero ($20M) and Valon ($150M) — landed the same day.
**replica-skill** (469 stars) is eleven chained Claude skills that reverse-engineer an app, rebuild it, test it, read what its users actually hate and fix that, then deploy your clone live. **qiaomu-codex-imagegen** (91 stars) wraps Codex's built-in image generation — normally usable only inside Codex — into an MCP server, CLI, and skill any agent can call. **mesh-avatar-studio** (228 stars) has a coding agent read an illustration, auto-slice it into layers and rig it, then a local editor lets you fine-tune it into a 2D avatar that blinks, talks, and turns its head. **easyread** (803 stars) is a local paper reader that translates English PDFs into Chinese page by page, keeps equations typeset with KaTeX, and lets you flip back to the original text anytime. On the framework side, Mastra shipped @mastra/core@1.74.0 on 10/5, letting tools read the full conversation mid-execution and reshaping the Playground UI's trace pagination API (a breaking change).
Today's Deep Learning & NLP rotation covers five core concepts: why Self-Attention's scaled dot-product divides by sqrt(d_k); how tokenizer fertility (tokens per word) decides a language's cost and effective context length; why BERT's attention mask and MLM loss label are two independent mechanisms that interviewees often conflate; the trade-offs between CNN and RNN; and the fine-tuning spectrum from full fine-tuning to LoRA to continued pretraining. The practice question comes from a representative Sarvam AI interview question (compiled by the AI-Engineer-Interview-Questions project from public information, not leaked): explain why tokenization is the first performance bottleneck for multilingual LLMs, and how a low-fertility tokenizer like Sarvam-1's changes the underlying cost structure — the breakdown threads 'how fertility is defined' through to 'which three downstream cost lines it determines' into one complete reasoning chain.
Three things in Mastra @mastra/core@1.74.0: (1) agent.getMessages() lets a tool, at execution time, read the full current conversation (including remembered messages and responses already produced in this run) without changing the existing input-only messages field; (2) getObservationalMemoryHistory gains group filtering, ordering, and direct recordId lookup, and memory recall can now page before/after a matched observation group; (3) breaking: @mastra/playground-ui's ThreadViewByTrace/TraceThreadPanel/ThreadTrace drop anchorTraceId, ThreadTrace.LoadMoreSentinel is removed entirely, and pagination now runs through pageSize/onLoadOlder.
OneByZero raised a $20M Series A led by Jungle Ventures, its first external funding in three years. The signal: enterprises don't want more self-serve agent tools — they want someone to embed agents into existing systems, own the governance, and show verifiable results. Consulting and agent platforms are merging into one product.
Valon raised a $150M Series D led by Ribbit Capital, with a16z continuing to add on, doubling its valuation to $2.3B. The signal: a handful of startups are rebuilding entire regulated verticals that outside software companies can barely enter, by getting licensed themselves and building the full stack before layering agents on top, rather than selling tools to incumbents.
Cohere Embed 5: announced 2026-09-30. Pro and Fast tiers, 128K context, text + image + mixed-PDF input, 100+ languages; priced at $0.12 (Pro) / $0.08 (Fast) per 1M text tokens, with image tokens at $0.40 for both; on ViDoRe V3 (visually-rich enterprise document retrieval) Pro scores 85.8, up 8.8 points from Embed 4's 77.0, ahead of Voyage 4 Large (83.7) and Gemini Embedding 2 (83.2); Pro and Fast share one embedding space, so you can index with Pro and query with Fast — cross-model combinations only lose 1.6–2.7% on average and don't require rebuilding the index; all figures are Cohere's own benchmarks, not yet independently reproduced
The easiest way to lose points in a Metrics & Analytics interview isn't failing to name a north star metric — it's stopping right after you name it, without saying where the cost lands if the whole company chases that number. Today's drill is a real Meta PM analytical-thinking question: 'Define a north star metric for Instagram Reels, and explain the trade-off if you prioritize Reels over Stories.' The framework is a three-condition NSM checklist — reflects core value, is a leading indicator, is actionable by the team — used to screen candidate metrics, then paired with a guardrail-metric technique that names the number that breaks first when you over-optimize. The case is Meta itself: according to Sensor Tower data, Reels' share of all Instagram ad impressions jumped from 35% in 2024 to over half in 2025, and Reels' share of U.S. time spent on Instagram rose from 37% to 46%, with daily active users up 2% largely driven by Reels — a live version of the exact trade-off the question is testing: what happens to the rest of the attention pool when you bet everything on one format.
Socket Threat Research found six VS Code theme extensions tied to a GlassWorm-associated cluster (Coca-Cola Christmas, Aurora Borealis Studio Theme, Cosmic Nebula Themes, and others). Two are confirmed malicious — Aurora Nocturne Night Theme and Cosmic Nebula Themes — with the latter's loader sharing the same Solana dead-drop address, AES key, and execution model as GlassWorm, the campaign CrowdStrike, Google, and Shadowserver disrupted together in May. The two confirmed malicious versions have more than 8,000 combined Marketplace installs, with cluster-linked Open VSX listings adding tens of thousands more downloads. Defense: inventory installed theme extensions and match IOCs now; longer term, scan extension runtime behavior (file access, network calls, process launches) instead of trusting the source repository alone.
Brickwise (roblox-logics-mcp) is an open-source MCP server that packages common Roblox development pitfalls into a sourced knowledge base your AI assistant can query. Install with `git clone` + `npm install && npm run build`, then wire it up with `claude mcp add`. It fixes AI assistants writing broken code from outdated Roblox APIs — like calling `PhysicsService` when the engine moved that to `WorldRoot` months ago.