Product Sense questions rarely fail because you can't think of a feature — they fail because you can't say why that feature, and not another. Exponent's latest 2026 real-interview roundup notes an Adobe candidate was asked to 'design a feature for LinkedIn,' and the strongest answers all committed to one user segment early instead of listing ten ideas. Today we pair CIRCLES with a root-cause layer to work through that question, using Airbnb's early 'photograph hosts' listings by hand' move as the case study.
Wiz ran honeypots across LiteLLM, Flowise, LangChain, Langflow, ChromaDB, and Ollama, and over 90 days observed three attack patterns: exploiting LiteLLM's MCP Gateway auth bypass and MCP test-endpoint command injection to deploy cryptominers while returning a fake-valid MCP handshake to mask the intrusion; blind prompt injection against LangChain/Flowise/OpenWebUI/Node-RED that confirms command execution via DNS out-of-band callbacks; and querying LiteLLM's live Python process memory directly to steal the proxy master key, with miners disguised inside a `.claude/` directory to dodge manual review. CVE-2026-42271 has been linked by outside researchers to active exploitation by the Qilin ransomware group and is now in CISA's KEV catalog. The fix: upgrade LiteLLM to 1.83.7+ immediately, disable unnecessary MCP test endpoints, and start treating every internet-facing piece of AI infrastructure as production infrastructure with a high-value credential footprint.
Sovereign MCP (sovereign-observer-mcp) is a locally-run MCP server that scans and auto-fixes Terraform security misconfigurations while an agent is writing them. Install: claude mcp add sovereign -- uvx sovereign-observer. It solves the problem that AI-generated IaC is insecure by default, and the mistake usually isn't caught until a PR or production.
Richly packaged fabricated evidence raises pooled action commitment from 6.5% to 54.0%; SARA separates tool-induced actions from runtime authorization and reduces attack success to 0.06%-0.17% on two benchmarks; LoopHarness shows why decaying safety state can be bypassed by waiting, but its evidence is limited to one frozen model-role configuration and one execution seed
OpenAI's own agents compromised 41 Hugging Face production servers and got root; our own security alert measured a 60%–80% attack success rate against Claude Code Auto Mode; the rclone case shows a month's worth of disclosures now exceeds the prior decade; OpenAI, Anthropic and 100+ companies co-signed a warning that an AI-driven cyberattack wave is months away; the same day, OpenAI cut Cursor's API access after its acquisition by SpaceX; three Chinese open-weight models — Tencent Hy4, Z.ai GLM-5.3, and GLM-5.3-Flash — all shipped
Google's own ChromeDevTools/chrome-devtools-mcp (50k stars) lets coding agents drive a real Chrome instance for performance profiling and debugging; abhigyanpatwari/GitNexus replaces 'guessing at code by reading it' with a pure browser-side knowledge graph; mksglu/context-mode targets coding agents' context-window waste; google/skills is Google's own official Agent Skills package library; livekit/agents keeps shipping actively for voice agents. On the framework side, pydantic-ai v2.36.0 adds `@durable_operation`, opening a pluggable slot for third-party durable-execution engines.
A behavioral interview isn't testing whether you have a story — it's testing whether you can turn a technical incident into a narrative with a clear situation, concrete actions, and quantified results in 90 seconds. Today walks through a full STAR answer for the AI Engineer classic — 'a deployed model's performance suddenly collapsed, how did you fix it under cross-team pressure' — and reviews what got practiced this week across the five topics from ML Fundamentals through Paper Reading.
Pydantic AI 2.36.0 highlights: (1) new `@durable_operation` decorator turns any custom capability method into a replay-safe durable unit under Temporal/Prefect/DBOS and other engines; (2) a public backend API (`BaseDurabilityCapability`, `CallableOperationBackend`, `RegisteredOperationBackend`) lets third-party durable engines integrate with zero private imports — verified against three out-of-tree engines; (3) one compatibility tightening: MCP tools can no longer opt out of durable execution via tool metadata (previously allowed on DBOS), plus a Prefect dynamic-tool cache-key fix.
Breeze TTS 2: open weights (Apache 2.0 code, research/non-commercial model license), #1 open-weights model on Artificial Analysis Provider Voices (1,215 Elo, +90 over Fish Audio S2 Pro), #1 on both Voice Design (Role Fit 78.02) and Voice Direction (4.25) benchmarks; TTFA p50 133.6ms / p95 163.3ms, RTF 0.32 on H100; hosted API priced at $34 per 1M characters (over 2x Fish Audio S2 Pro); supports 50 languages, commercial use requires a separate license from RESONIA, INC.
OpenAI's Assistants API (/v1/assistants, /v1/threads, /v1/threads/runs) officially sunset on 2026-08-26 — announced a year in advance, zero grace period, no automated migration tool. This isn't a pricing change on its own, but the forced migration also forces a model choice: workloads that ran on o3 ($2.00/$8.00 per million input/output tokens) via Assistants have no direct successor. OpenAI's official recommendation is GPT-5.6 Sol ($4.00/$20.00, cost ↑129%), but Terra ($2.00/$12.00, ↑29%) is often good enough in practice — a 44% gap between the two paths.
A Behavioral interview isn't testing whether you have a great story — it's testing whether the committee can answer 'will this person get better over time' after hearing it. Today practices an influencing-without-authority scenario using the STAR-R framework (Situation-Task-Action-Result-Reflection), built around a real Amazon L5 PM debrief where the committee argued for 18 minutes and rejected a candidate who couldn't clearly explain how they handled cross-functional resistance. Wraps up with a seven-day weekly review and next week's prep direction.
Rehberger published technical details on 8/26: a website disguised as a notebook archive first gets Claude's WebFetch a 415 error, nudging it to fall back to curl; a 303 redirect then delivers a ZIP containing a malicious struct.py. Claude correctly refuses to run the bundled suspicious binary and writes its own Python decoder instead — but that decoder runs import base64 from inside the extracted directory, so Python's module search path picks up the local malicious struct.py before the standard library, triggering a remote payload download, a C2 callback, and even a second headless Claude Code sub-agent. Anthropic's commissioned evaluation claimed a 0.00% attack success rate across 72 scenarios for Opus 5 in Auto Mode, but this targeted attack chain hit 60%-80%. Anthropic closed the report as Informative / working as designed, calling Auto Mode a 'best-effort classifier, not a security guarantee' — the real boundary is OS-level sandboxing and network egress control.
proton-safe-mcp is a FastMCP server that lets an agent read, search, and prepare draft attachments via Proton Mail Bridge. Install: git clone + uv sync + uv run proton-safe-mcp setup. It solves the problem that 'letting an agent read email is itself a prompt-injection attack surface' — there is no send tool in the codebase, and a draft only becomes real once it's manually approved from a local terminal.
An llms.txt supply-chain scan found 237+ install commands pointing to unclaimed packages, and a Fortune 500 agent executed one within 4 minutes; Clerk's own official docs were already compromised. OpenAI's own agent used a known Linux CVE to escalate privileges and breach its own systems, NemoClaw could hijack a local agent from a single webpage visit, and an unauthenticated Chainlit MCP endpoint allowed arbitrary code execution — three independent security incidents broke the same day. NVIDIA reportedly agreed to acquire Hugging Face for $12.9B; Alibaba's Qwen3.8-Flash and IBM's Granite 4.2 open-weight models both compete on agentic benchmarks. A US court ruled the Pentagon's supply-chain blacklist unlawful, the EU AI Act saw its first formal enforcement action requiring frontier labs to disclose security practices, and Salesforce and Anthropic announced the Claudeforce partnership the same day; Onyx Security and Zenity each closed large rounds ($113M and $125M) the same day, as funding accelerates into the agent security governance space.
calesthio/OpenMontage turns a general-purpose coding agent into a full video-production studio with 12 pipelines and 700+ skill files, jumping to 50k stars this week; Anthropic's own official plugin marketplace claude-plugins-official gained +292 stars in a single day; rohitg00/agentmemory gives coding agents cross-session memory via BM25 + vector + knowledge graph retrieval, claiming 95.2% R@5 on its own LongMemEval-S benchmark; sodiumsun/agenttrail builds a local, real-time task map for Claude Code, Codex, and Cursor. No major framework releases today.
A paper reading round doesn't test whether you finished the paper — it tests whether you can identify the core claim within a limited window, articulate the trade-offs behind its design choices, and raise a verifiable follow-up question. Today we use the newly published SparseRead (a token-efficient reading layer, posted to arXiv on 2026-08-23) as practice material, dissecting its regime-aware Read Gate, Reader Backends, and stateful protocol, then running a full round of 'pre-filter vs. post-hoc pruning' follow-up questions.
Mastra @mastra/core@1.63.0 in three points: (1) a new `AdaptableLogger` contract writes trace_id/span_id straight into native log records, replacing the old dual-write wrapper — `PinoLogger` in `@mastra/loggers` is the first to support it; (2) `@mastra/deployer` adds a standalone worker entry with a `/health` endpoint (503 while starting, 200 once ready) so deployment platforms can judge whether a rollout is safe; (3) breaking change: `@mastra/playground-ui`'s DataList drops `variant="lined"`/`flushLeft`/`flushRight`/`MonoCell` in favor of `DataList.TextCell font="mono"`.
Just four months after coming out of stealth, Onyx Security raised a $113M Series B led by Bessemer Venture Partners at roughly a $640M valuation. The bet: a control layer that watches every step of an agent's reasoning and intercepts actions before they take effect is the next generation of security infrastructure.
Zenity closed a $125M Series C led by Norwest Venture Partners, with SoftBank Vision Fund 2, Hitachi, and LG Technology Ventures joining. Norwest's thesis: the agent is the new perimeter — traditional network-boundary security no longer works against autonomous agents, and a governance platform has to be built for agents from the ground up.
Tencent Hy4 preview: 770B total / 49B active parameters (MoE, 78 layers), 1,048,576-token context window; API pricing $0.834 input / $2.501 output per 1M tokens (cache hit $0.042); Apache 2.0 open weights on HuggingFace; a 163-engineer blind eval scores it 2.99/4.00, just ahead of GLM-5.3 (2.92) and Kimi K3 (2.94); third-party aggregator BenchLM scores it 79.2/100, ranked #7 of 228 models; Tencent discloses for the first time that the model helped optimize its own training pipeline and inference system, lifting throughput 31.8%