Three things in Pydantic AI v2.61.0: (1) structured citations — `TextPart` can now carry citations, normalized across Bedrock, OpenRouter, and xAI, and replayed back to whichever provider originally produced them across turns; (2) the durable execution engine's extension surface is now public (operation types, `ParameterTransports`, `DurableRunContext`, run identity hooks), so third parties can wire in their own durable backend; (3) several compatibility notes: `thinking=False` now sends the least thinking a model will accept instead of silently misbehaving, and `CohereModel` raises instead of silently dropping a file returned by a tool.
Pathos AI closed a $237M Series E led by Bristol Myers Squibb, pushing its valuation to $3B — just 17 months after Series D valued it at $1.6B. The signal: BMS isn't making a purely financial bet. It's trading equity for portfolio-wide access to the Pathos Foundry platform plus a three-year exclusive in neuroscience — pharma is starting to treat investing in AI biotech as a shortcut to acquiring in-house agent capability.
Nanbeige4.3-33B: a 33.1B dense model open-sourced by Nanbeige, the AI team under Kanzhun (parent company of Chinese job app BOSS直聘), with a 524,288-token (512K) context window under Apache 2.0. It scores 80.9 on Terminal-Bench 2.1 (vs. Qwen3.8-27B's 73.0), 65.5 on DeepSWE (vs. 42.5), and 44.8 on JobBench (vs. 34.5), but trails Qwen3.8-27B on SWE-Bench Pro (60.3 vs. 61.7) and Gemma4-31B on GPQA Diamond (89.5 vs. 91.3). There's no official API pricing — it's open weights only. Nanbeige positions it as the flagship teacher model for the Nanbeige4.3 series, meant to distill smaller models such as Nanbeige4.3-3B down the line.
Behavioral interviews rarely fail because candidates can't produce a story — they fail because abstract words like 'trust' and 'influence' get asserted instead of shown. Today's framework keeps STAR as the outer timeline but swaps in SBI (Situation-Behavior-Impact) for the Action step, forcing you to replace vague lines like 'I talked it through with them' with 'in this specific setting, this person did this specific observable thing, which had this specific effect.' The practice question is a real Amazon interview prompt: tell me about a time the team's trust was damaged — by you or by someone else — and how you fixed it. The walkthrough shows how to pick which role you're playing in the story, then use SBI to make both the damage and the repair concrete. The case is Kim Scott at Google: after a presentation to Sergey Brin and Eric Schmidt where she said 'um' too many times, her manager Sheryl Sandberg bluntly told her she'd sounded unsure and people would start doubting her competence. That line didn't break trust — it became the origin story of Scott's book Radical Candor — because Sandberg had already proven, through a long string of concrete actions, that she genuinely cared about Scott personally. That's the real version of today's question: why direct feedback repairs trust instead of damaging it. The post closes with this week's seven-topic review and a preview of next week.
photoshop-mcp is an MCP server that lets Claude (or Cursor, Codex) drive the Photoshop running on your Mac over AppleScript — layers, grading, cutouts, export. Install: `git clone` then run `./scripts/install.sh --client claude-code`. It solves the question every 'AI edits Photoshop for you' idea has to answer eventually: what happens to your original file when the agent gets it wrong — built-in checkpoints, document pinning, and step-by-step rollback.
MAS-Guard cuts attack success rate by 71.5–86.3% across six benchmarks and three different providers' agent LLMs while holding benign-task utility; Agent Mosaic shows that even a single-document, benign question can make an agent disclose a forbidden composite conclusion — with both classification headers and aggregation rules enabled, 32.37% of simulated answers still leak; AMV-Guard turns 'is this memory safe to act on' into a question that tracks the action's consequence, cutting verification cost by 33.9% on ToolSandbox while keeping 100% safe-proceed recall and 0% harmful proceeds
Storm-0940 used the open-source agentic pentest framework ARTEX to go from password spraying to a full ConnectWise supply-chain identity takeover in five days, with the same tool's infrastructure also turning up in Japan and South Korea; METR/Redwood's OpenAI audit found six ways around internal monitoring, with only 75–94% of agent traffic covered; Anthropic ships personal agent "Claude Duet" and donates the Agent Skills standard to the Linux Foundation; OpenAI is negotiating a $30B raise toward a $1.25T valuation; Meta's personal agent Muse launches in Japan; Walmart opens an agent shopping gateway as Amazon locks agents out
**ifixai-ai/ifixai** (34k★) turns 'auditing an agent' into a standalone open-source CLI — it drops your agent into a simulated version of your business, sends it the kind of requests a real day brings (including ones that push past its role), and has a different model judge every reply; **shiyu-coder/Kronos** (43k★, accepted at AAAI 2026) is the first open-source foundation model trained specifically on financial candlestick data; **mcp-use/mcp-use** (11k★) is a fully-TypeScript MCP framework that binds tools directly to React Views, so you can ship interactive ChatGPT/Claude Apps instead of plain text replies; **crestalnetwork/intentkit** (6.5k★) turns a team of agents into a self-hosted cloud service where the agents themselves never touch your API keys. Releases: crewAI 1.15.29 folds an eval/guardrail runner straight into its core commands; Pydantic AI v2.60.0's compatibility notes now require any two MCP servers sharing a host to carry an explicit id, or startup fails outright.
Today's paper is MAS-Guard (arXiv:2610.28397, published 2026-10-20). Its core move is splitting agent protection into a local A-Guard layer and a system-level Control Plane, replacing binary allow/block with four graded interventions — allow, reflection, confirmation, block. The practice question simulates an interviewer handing you the abstract and asking how you'd apply it to an existing multi-agent system that includes a third-party black-box agent — practicing the 'define boundaries → layer the design → weigh trade-offs → pick metrics' structure for paper-discussion questions, instead of reciting the conclusion.
Three things in CrewAI 1.15.29: (1) `AgentExecutor` graduates out of experimental status to a stable API; (2) a new Azure DocumentDB vector search integration, plus `crewai eval` gains evaluation export and a single command to run the whole crew for a verdict; (3) the CLI picks up platform application search and an organization picker at login. No breaking changes — just upgrade.
Two things in Inngest v1.49.0: (1) a new v2 API for function replay, which replays a specific run by time range and status, callable from the API, CLI, or MCP; (2) a new v2 API for resuming a function, letting a paused workflow recover straight from the control plane without hand-rolled polling. No breaking changes for SDK users; self-hosted teams should follow the migration notes' deployment order.
AuxoAI raised a $20.7M Series A led by NTTVC. The signal: anyone can now rent a frontier model, but turning that model into something that actually runs inside a specific company's workflow still takes heavy, custom, people-intensive work — Forward Deployed Engineer job postings jumped more than 1,000% in the first eight months of 2026, and AuxoAI, Distyl AI, and Arrakis are all turning that bottleneck into a business.
Blacksmith raised a $66M Series C led by Sequoia Capital at a $1B valuation, just two months after its last round. The signal: as Cursor, Claude, and Codex make writing code "extremely easy," the bottleneck has shifted to validating it — Blacksmith's ARR grew 17x in a year and its CI job volume grew 18x, proof that this new bottleneck is already being priced.
Qualitate raised a $25M Series A led by Insight Partners, just six months after a $7M seed. The signal: primary market research is shifting from a one-off project to infrastructure agents can query continuously — Qualitate exposes its research database to Claude and Codex via MCP, and its 12-month net revenue retention tops 300%.
Fibo 2.0 Dev: an 8B flow-matching diffusion model that merges generation and editing into one checkpoint, with masked edits and up to four reference images. It ranks #1 on Artificial Analysis's open-weights image-editing leaderboard (1087 Elo) and #2 on text-to-image, statistically tied with Qwen-Image-2.1. Pricing runs $0.04/image on fal.ai and $0.032/image on Bria's own API. Released under CC BY-NC 4.0 — non-commercial only; commercial use needs a separate agreement with Bria.
Cursor switched new-signup pricing to The X Subscription on 10/12: Free, Plus $8 (Grok only), Premium $30, Super $100, Ultra $200. The old $20 Pro plan is grandfathered for existing subscribers only. New users who want Claude/GPT/Gemini now need Premium at $30 (up 50% from Pro's $20); third-party model token rates are unchanged, still billed separately at API list price.
A Technical PM system-design question isn't scored on whether you can draw boxes and arrows — it's scored on whether you scope the problem first, turn the user journey into requirements, name the system attributes that matter (accuracy, speed, privacy), and then volunteer the trade-offs yourself. That's the five-step sequence from Aced's 2026 Technical PM guide, and it's the same discipline as last week's RFC/decision-matrix drill applied to a different setting. Today's question: design a system for Gemini to answer a single user query. The crux is deciding when to run retrieval (RAG) and whether the latency it adds is worth the factual grounding it buys. The case is Discord's real migration from Cassandra to ScyllaDB — 177 nodes down to 72, p99 latency from the 40ms range down to a steady 15ms — driven not by chasing a shinier database but by operational pain crossing a threshold engineers could finally quantify and take to leadership.
Microsoft disclosed on 2026-10-21 that China state-aligned actor Storm-0940 used ARTEX — an open-source agentic AI pentesting framework (made closed-source after the South Korean bank incident, but already leaked and reused by other attackers) — to automate attacks against hundreds of organizations across defense, energy, finance and other sectors since September. Between Oct 10-14 it password-sprayed 327 accounts at 8 organizations, generating 151,000+ failed logons; from Oct 15 it used stolen credentials for ConnectWise's multi-tenant Cloud Backup app to sign in to 2,250+ tenants at up to 2,900 attempts/minute, with some organizations reaching privileged cloud access in under 3 hours and modifying identities and roles for persistence. Wiz's Oct 23 update found the campaign expanding to other software vendors. Defense: audit and rotate any credentials ever authorized for ConnectWise apps, review Entra service-principal sign-ins and directory-change logs, and apply least privilege to multi-tenant apps.
broll-mcp is a stdio MCP server that lets an agent search, preview and cut public-domain b-roll from the Internet Archive, writing a provenance record next to every clip. Install: `claude mcp add broll -- uvx --from git+https://github.com/edigeh/broll-mcp broll-mcp`. It solves the problem of agents cutting public-domain footage without a clear, auditable answer to whether the licensing actually checks out and whether the cut is the length you asked for.
Across 205 tasks adapted from real 'I wish I'd backed that up' moments, frontier models complete 86.1% of tasks on average but back up beforehand only 15.2% of the time; a plug-in BackUpper layer closes the gap, restoring state to 92.2% average similarity at just $0.014 extra per task; writing policy into the prompt still lets 13-15% of violating tool calls through, while a trained standalone guard cuts attack success rate by 40-44%; PerMIT proposes Lean 4 machine-checked integrity theorems to defend persistent memory against poisoning, reporting zero attack success on Trojan Hippo, though this article could only verify abstract-level evidence