TrustDex is a local-first, zero-runtime-dependency CLI that applies a policy to ALLOW/ASK/BLOCK any MCP server, Skill, or plugin before your agent can see it. Install: git clone, then npm test — no external packages needed. It fixes the default assumption that 'installable means trustworthy' by turning source review into an explicit gate before exposure, not an afterthought.
Today's Coding rotation is a real question from Anthropic's Technical Screen — implement a case-sensitive longest-match tokenizer: greedily match the longest possible vocabulary entry at each position, emit the exact token id and the consumed original text, and support two modes for characters that don't match anything — emit one unknown token per character, or coalesce a whole unmatched run into a single unknown span. Core concepts covered: the greedy longest-match-first strategy behind subword tokenizers like WordPiece, why a growing vocabulary forces you from a linear scan onto a trie (paired with Aho-Corasick-style failure links, the same idea behind Google's LinMaxMatch, to get from O(n²) down to linear), how the unknown-run merge choice actually affects downstream training, and the classic off-by-one traps in Python string slicing.
CrewAI 1.15.22 in three points: (1) a new `llm_overlay` context variable that routes a specific agent role to a different model at runtime, instead of hardcoding the model when the agent is created; (2) CrewAI Platform integration gains an application catalog, connection aliases, setup-time integration validation, and deployment-failure logging; (3) tracing now captures human feedback and pause events; no breaking changes in this release.
Pydantic AI v2.44.0 in three points: (1) four security patches, the most serious being `web_fetch` running both its HTML conversion and charset decoding in superlinear time on the event loop — an attacker-chosen page can stall every agent sharing that process; (2) three compatibility notes: `RunContext.enqueue()` is now safe to call from worker threads, UI adapter requests must carry a JSON `Content-Type`, and a capability's `@durable_operation` invoked from a per-request hook now dispatches properly instead of running inline; (3) a new Vercel AI SDK/Eve migration skill, and `AgentRunResult` now settles into a stable serialized shape.
AIUC closed a $40M Series A led by Ribbit Capital, bringing total funding to $55M. This round signals that the bottleneck for enterprise AI agent deployment has shifted from 'is the model smart enough' to 'can the risk be audited and insured.'
Xing4.0-29B-A4B (China Telecom Artificial Intelligence Technology / XingChen-AGI, successor to TeleChat): 29B total parameters with only 4B active, 256K native context (extensible to 512K), Apache-2.0 open source. Scores 75.0 on SWE-bench Verified (vs. 76.0 for the larger Qwen3.6-35B-A3B and 53.0 for Gemma4-26B-A4B) and 57.5 on Terminal-Bench 2.1, the highest of the three. It's the first model at this scale trained entirely from scratch on Ascend 910C + MindSpore, with training throughput improved roughly 96% over an unoptimized baseline.
The most common way growth PM candidates lose points is jumping straight from a retention drop to a tactic — send a reminder, shorten onboarding, add a loyalty mechanic — without first checking whether the retention metric measures the right unit or which failure mode actually caused the drop. Today's practice is a scenario question: a collaboration tool's week-4 workspace retention dropped, and the CEO wants an experiment plan that proves the intervention is worth the engineering resources. The framework is a retention test brief (define a meaningful return event first, write the competing explanation, then pick the intervention) paired with a metric tree that ties the experiment result back to revenue language. The case is Fanatics refusing to count an experiment result that looked like a win on the surface but whose expected behavior chain never actually moved — they reran it and found the effect was flat.
CVE-2026-85889 is a missing-authentication-for-critical-function bug (CWE-306) in Azure AI Foundry, carrying a perfect CVSS score of 10.0: an attacker with no credentials and no user interaction could reach admin-level privileges over the network, in theory touching models, training data, and every downstream system wired into a Foundry-based application. Microsoft fully patched the flaw server-side on 2026-09-17 — no customer action required — and has seen no evidence of exploitation. The takeaway: once an enterprise hands the 'control plane' of its agent platform entirely to a cloud vendor, the only defenses left are identity-governance audits and log monitoring, since the patch timeline itself is completely out of the customer's hands.
codebase-memory-mcp is an MCP server that indexes a codebase into a knowledge graph, exposing 15 tools for indexing, structured querying, and change-impact analysis. Install: a one-line curl script, then restart your agent and say 'index this project.' It fixes the token blowup and missing cross-file call tracking that come from making an agent grep and read files one by one.
Anthropic disclosed GTG-50014, a crime group that used AI agents to sweep credentials across 40+ enterprise tenants in 34 hours; BragJack hijacked five browsers' built-in AI agents with one extension; Spain's AEPD received the world's first formal report of an 'AI agent-driven' data breach. The same week, Nvidia was reportedly in talks to invest up to $10B in Anthropic's $2T IPO — a stark gap between capital and the widely-signed AI-pacing calls. Salesforce's AI Control Plane, Cathay Financial's 'Agent First' declaration, and a South Korean survey finding 82% of firms harbor unidentified shadow agents all point the same direction: enterprise agent adoption now hinges on governance, not model choice. Factory tripled its valuation to $5B in five months, Profound hit $1.8B across two rounds in seven months, and Temporal's $550M raise pushed durable-execution infrastructure to a $12.55B valuation. Five arXiv papers this week converged on one point: SWE-bench rankings, skill-marketplace stars, CoT monitoring, and peer correction — the very signals we use to judge agent trustworthiness — all fail under scrutiny
Today's LLM Engineering rotation covers: when to reach for a complex agentic system instead of simple RAG (weigh business value, not just the benchmark number), why context engineering isn't the same thing as prompt engineering (lost-in-the-middle, tool scoping, memory management), the three categories of LLM evaluation — offline, guardrails, and online — and what each is actually for, how to layer guardrail defenses (input filtering, output validation, an eval harness, red teaming), and a full breakdown of a question adapted from real OpenAI interview-prep material on RLHF reward overoptimization: the reward model is only a proxy for human preference, PPO will exploit that proxy's blind spots, the real bottleneck is annotation quality rather than compute, and the actual fix is switching to a verifiable reward (RLVR).
Agno v3.0.10 in three points: (1) `CodingTools.run_shell` moves from enabled-by-default to requiring `enable_run_shell=True`, and restricted mode no longer routes commands through a shell at all, closing off interpreter-RCE-style shell injection; (2) `PublicSurface(authorization=True, mcp=True)` now accepts only localhost by default — non-local callers need an explicit `MCPConfig(allowed_hosts=[...])` allowlist; (3) new `AzureOpenAIResponses` model, an Elasticsearch vector database, and a `DocumentationMarkdown` transform that converts Mintlify/Fumadocs docs sites into plain Markdown.
Mastra @mastra/core@1.67.0 in four points: (1) the Studio Workflow Builder backend lets an editor-owned agent generate and persist workflow definitions directly — describe a flow in natural language and get a real, runnable workflow back; (2) the new `@mastra/connect` package wraps Mastra Platform integration connections as agent tools, with credentials injected by the platform's connection proxy so agent code never touches a secret; (3) `Memory.updateThreadResourceId()` lets a thread be transferred to a new `resourceId`, implemented transactionally across every major SQL adapter; (4) breaking: `subscribeQueuedMessages` is renamed `subscribeThreadEvents`, and `ArchilFilesystem.grep()` is renamed `diskGrep()`.
Factory closed a new $200M round at a $5B valuation, more than tripling the $1.5B it carried at Series C five months earlier. This round signals that enterprise buyers now treat autonomous coding agents as a formal line item in the engineering budget, not a demo they're still trialing.
Profound closed a $180M Series D at a $1.8B valuation, just seven months after its Series C. This round signals that optimizing brand visibility in AI answers like ChatGPT and Perplexity has moved from a fringe marketing tactic to a budget line enterprises are willing to fund fast.
OpenAI announced on 2026-09-14 that GPT-5.5 will retire from ChatGPT, ChatGPT Work, and Codex on 2026-10-14 — but calling `gpt-5.5` directly through the OpenAI API is unaffected. This is a product-surface retirement, not an API sunset. On the official pricing page, gpt-5.5's short-context input/output is $5.00/$30.00 per million tokens; the officially recommended Codex replacement, GPT-5.6 Sol, is $4.00/$20.00 — cheaper on both input (↓20%) and output (↓33%). The gap between announcement and shutdown is one month, far shorter than OpenAI's own documented minimum of six months' notice for GA models.
The most common way to lose points on an AI Product Design question is treating human-in-the-loop as a single on/off switch — either the model runs free or a human reviews everything. Today's practice question is a real Sierra PM interview prompt: an enterprise customer wants full control over agent replies, the ML team says over-restricting hurts model quality and containment rate, how do you resolve it? The framework is an autonomy ladder (suggest → confirm → execute) paired with risk-based granular consent, not a blanket restriction. The case study is Gemini's Gmail draft card — the AI can draft, but 'send' is always the human's button to press.
On 2026-09-15, Spain's Data Protection Agency (AEPD) publicly disclosed the first formal notification it has received describing a breach allegedly carried out by an AI agent built on a well-known LLM. The agent reportedly logged into a system, searched for an application-level vulnerability, modified personal data, and accessed invoices — a four-stage chain completed with minimal human steering. AEPD has not verified the details and has not named the model or the affected organization, but frames the filing as a signal that AI-assisted attacks have moved from theoretical risk into real personal-data incidents. Defenses center on writing AI-adversarial risk explicitly into risk assessments, shortening incident-response windows, tightening credential and identity controls, and adopting tooling that can detect agent behavior at machine speed.
Forever Security researcher Gal Weizman found that a browser's built-in AI agent has a 'brain' (the cloud AI) and a 'body' (the browser itself, which can see the screen, read files, and use the camera) that trust instructions from exactly one origin. Browser extensions can't run code on that origin directly, but two permissions nearly every extension already has — content scripts and declarativeNetRequest — are enough to hijack that trusted channel and impersonate the brain. This isn't prompt injection; it's what the researcher calls 'Prompt-Forcing': crafting and sending the entire instruction stream directly. Chrome (CVE-2026-0628, CVSS 8.8) and Edge (CVE-2026-55945, CVSS 4.2) are patched; Comet, Opera Neon, and Claude in Chrome received bounties but no public patch timeline. Defense means treating extensions as high-risk assets and adding runtime monitoring of what agents actually do, since no code here is malicious.
symfony/ai-mcp-tool is Symfony AI's official MCP client bridge, letting a Symfony Agent mount tools from any remote MCP server. Install: composer require symfony/ai-mcp-tool. It removes the need for PHP agent developers to hand-write a tool-schema-to-framework-Tool adapter and to resolve name collisions across multiple servers.