Google GTIG's Q3 2026 AI Threat Tracker, published in September, describes an incident Mandiant investigated in Q2 2026: after breaching an organization's cloud environment, a financially motivated actor used nothing more than an AI coding chatbot, a prompt, and a set of pre-written markdown instructions as an 'operational playbook' to autonomously scan, exploit, harvest credentials, troubleshoot in real time, and rotate IPs — compromising thousands of third-party credentials in under six hours. The same report separately describes an exposed command-and-control server running Recon, an automated reconnaissance and credential-management framework built on the open-source OpenClaw agent framework, complete with AGENTS.md and KNOWLEDGE.md configuration files; once discovered, the exposed directory had already turned into a live production dashboard managing over 23,800 stolen cloud and AI service API keys. The Hacker News, BleepingComputer, Help Net Security, and Cyber Magazine have all corroborated the report. Defense: audit cloud environments for anomalously fast automated API call patterns, restrict how much credential access any single coding agent session can reach, and compress your response window from days to minutes.
ToolHive is Stacklok's open-source MCP server runtime management platform. Its CLI (thv) or Kubernetes Operator runs every MCP server in an isolated container. Install: brew install stacklok/tap/thv. It addresses the problem of MCP servers running directly on your machine with your machine's own credentials and network access.
This round of ML System Design focuses on what interviewers weight most in 2026: it's not the model, it's the whole pipeline. Feature stores keeping one shared feature definition across offline training and online inference (avoiding training-serving skew), the candidate generation → ranking → re-ranking three-stage serving architecture for recommendation systems, de-risking model rollout with shadow deployment before A/B testing, monitoring design for data drift and model degradation, and how retraining cadence closes into a self-reinforcing data flywheel. Today's practice question is an advanced OpenAI-style 'design a real-time recommendation system' prompt, drilling how to turn clarifying questions into a complete data-to-monitoring answer using a seven-component framework.
Cognition closed a $2B+ Series E led by a16z and Accel, pushing its valuation from $26B in May to $48B. This is VCs willing to nearly double their price on the same coding agent company — not a bet on whether AI coding is real, but on whether an 83% run-rate revenue jump in four months can sustain that premium.
The easiest way to fumble a Strategy question is to stop at vague claims like "we have first-mover advantage" or "the market is big" without naming which specific competitor weakness you're exploiting or which company asset actually turns into a moat. Today we use Porter's Five Forces to decide whether the fight is worth having, then use TAM-SAM-SOM to cut the market down to an executable first step, practicing a prompt on whether a company should enter a market that already has two or three strong incumbents. The case study is Figma launching FigJam in 2021 to go head-to-head with whiteboard-collaboration leader Miro — showing how a late entrant skips feature-for-feature parity and instead weaponizes its existing user network as the differentiator.
BankMCP is a self-hosted, read-only MCP server that wraps 2,700+ European banks behind Enable Banking's PSD2 API, so an AI assistant can directly answer things like "has the Acme invoice been paid" or "what did I spend on subscriptions." Install: `claude mcp add bankmcp -- npx -y bankmcp`. It addresses the problem that letting an AI assistant help with money has never had a safe, read-only channel into real account data.
This round of Deep Learning & NLP drills the 2026-style follow-up pattern — architecture, then engineering fallout: the four-layer decoder-only transformer (embedding + RoPE, causal self-attention, MLP, linear head), the query/key/value intuition and why causal masking matters, why decoding is memory-bandwidth bound rather than compute bound, and how token counts map directly to API cost, context window capacity, and generation latency. Today's practice question is a MAANG-level open-ended 'explain the Transformer architecture' prompt, drilling how to cover the architecture in five minutes and still land on inference-cost implications.
MiniCPM5-2B (openbmb/MiniCPM5-2B): quietly published to Hugging Face by OpenBMB on 2026-09-06 with no official blog announcement; 2.6B dense parameters, 131,072-token context window, fully open under Apache-2.0. Scores 15 on the neutral, third-party Artificial Analysis Intelligence Index v4.2 — the highest of any open-weights model under 4B parameters (next best, Granite 4.2 3B, scores 11). Leads the set on GDPval-AA v2 (real-world work tasks) with an Elo of 831. Already deployed day-zero across 9 AI chips via FlagOS, including Huawei Ascend and NVIDIA.
The most common way to fumble a Metrics question isn't failing to name a metric — it's naming one that sounds reasonable but you can't answer 'what does it mean when this goes up.' Today we use Lenny Rachitsky's six-category north star metric framework to narrow the candidates, then layer a metric tree on top to split the north star into output/input/guardrail, practicing the Meta PM analytical thinking prompt: 'define a north star metric for Instagram Reels, and explain the trade-off if resources tilt toward Reels at Stories' expense.' The case study is Netflix's three north star pivots — from next-day DVD delivery rate, to the share of members streaming 15+ minutes a month, to median viewing hours per month — showing how a metric should track the strategy stage.
jmeter-mcp-server is a stdio MCP server that lets an agent build, edit, and run JMeter load tests through typed tool calls and read back aggregated reports. Install: `claude mcp add jmeter -e JMETER_HOME=... -- npx -y jmeter-mcp-server`. It addresses the problem that an LLM hand-writing `.jmx` XML can produce output that is structurally valid but semantically wrong, with no error raised.
This round of ML Fundamentals skips the textbook formulas and drills the diagnostics that separate senior candidates from junior ones: reading the train/val gap on a learning curve to decide whether to add capacity or regularize, the three usual suspects when CV and production scores diverge (StratifiedKFold, GroupKFold, TimeSeriesSplit), the cost-ordered playbook for class imbalance — reweight before you reach for SMOTE — and why picking a decision threshold from FP/FN cost is a separate problem from probability calibration.
Atira closed a $15M Seed round (plus a previously undisclosed $2.5M Pre-Seed, $17.5M total), led by Accel with angel investors including Celonis co-founder Bastian Nominacher. This is VCs starting to treat industrial sales engineering — a dark process nobody has automated — as the next infrastructure opportunity for agent-to-agent coordination.
Claude Fable 5.1 (API ID: claude-fable-5-1): released by Anthropic on 2026-09-01, 1,000,000-token context window, 128,000 max output tokens, input $10.00 / output $50.00 per 1M tokens (cache reads cut to $0.25, down 75%), closed-source; 52.6% on Terminal-Bench-Science 0.1 self-reported (up from 24.7%), 66 on the neutral Artificial Analysis Intelligence Index (up from 62, ahead of GPT-6 Astra's 61); launched alongside the restricted Claude Mythos 5.1, available only to vetted cybersecurity and life-sciences organizations
The most common way to fumble a Product Sense question isn't running out of ideas — it's segmenting too broadly and getting stuck on vague statements like 'all travelers want a smoother experience.' Today we use CIRCLES to scope the question, then layer JTBD (Jobs-to-be-Done) on top so pain points get written as 'situation + motivation + what's missing from the current workaround,' practicing the 'design a product for airport travelers' prompt that shows up in Google's product sense screen. The case study is Rahul Vohra's four-question survey — 'how would you feel if you could no longer use this product?' — which took Superhuman's product-market fit score from 22% to 58%, demonstrating how concrete segmentation beats gut-feel guessing.
okf-agent-memory implements the Google OKF v0.2 spec as a Git-native agent memory system, with a zero-dependency Go CLI and an embedded MCP server. Install: `brew install okf-memory/tap/okf`. It addresses the problem of architectural decisions either living inside an opaque vector database, or piling up in a CLAUDE.md file that only ever grows.
A behavioral interview isn't testing whether you have a story — it's testing whether you can turn a technical decision into a narrative with a clear situation, concrete evidence, and quantified results. Today walks through a full STAR answer for a common AI Engineer scenario — 'a RAG support agent is about to launch, how do you use a retrieval/generation four-quadrant error analysis to convince the PM to delay a week' — and reviews what got practiced this week across six topics from ML Fundamentals through Paper Reading.
GPT-6 Astra (API ID: gpt-6-astra): released by OpenAI on 2026-09-03, 1,050,000-token context window, 128,000 max output tokens, input $10.00 / output $50.00 per 1M tokens (cached input $1.00), closed-source; 99.9% on ARC-AGI-3 under OpenAI's own harness (62.7% on the standardized harness), 97.6% on FrontierMath Tier 4, 100% on ExploitBench; the first model rated 'Critical' cybersecurity capability under OpenAI's Preparedness Framework; yet scores only 61 on the neutral Artificial Analysis Intelligence Index — tied with predecessor GPT-5.6 Sol and behind Claude Fable 5.1's 66
Conflict-style behavioral questions rarely fail because you lack a conflict story — they fail because of how you describe the other person: does it sound like a factual account or a complaint? Today we use SBI (Situation-Behavior-Impact) to describe someone else's behavior objectively, paired with a PM-specific conflict question from mockround.ai ("describe a conflict with a cross-functional stakeholder"). The case study is Reed Hastings publicly apologizing over Qwikster, then reversing the entire decision within three weeks — turning a PR disaster into a credible accountability story. Includes this week's six-day review and next week's preview.
Independent researcher George Chen reported a restricted-mode bypass in postgres-mcp (Postgres MCP Pro, a PyPI package by crystaldba) on June 6, 2026: the SQL safety layer only validates functions called directly in a SELECT list, not functions used as a table source in a FROM clause — so dangerous functions like pg_read_file bypass the allowlist entirely and read arbitrary host files, and because these functions are read-only by Postgres's own classification, the read-only-transaction safeguard doesn't stop them either. CVE-2026-85620 was formally published on September 4, rated 9.2 (Critical) under CVSS v4.0. The vendor's security contact email has long been dead and no GitHub Security Advisory was ever enabled — three months after the report, there's still no patched release. Defense: check immediately whether your connecting database role can read server files, and pause routing untrusted input into the execute_sql tool.
cc-readback is a local, read-only MCP server that lets Claude Desktop read, search, and summarize your Claude Code session history stored under ~/.claude, automatically redacting common credentials like AWS, GitHub, and OpenAI keys. Install: `npm install -g cc-readback && cc-readback install all`. It addresses the problem of wanting Claude Desktop to recap what yesterday's Claude Code sessions did and where they got stuck, without having to scroll back through terminal history yourself.