Week of 19 – 26 Oct 2026Saiful Alam · newsletter@msar.me
Inbox Signal
Anthropic outgrew Git and rebuilt source control around merges that passed 30,000 a day; agent-written PRs wait about 5x longer and merge at roughly a third the rate of human ones; AI spend is rising faster than measured ROI; and the week's model news is Claude Duet, Clairic and a $1.25T-to-$1.4T OpenAI round. A PHP RCE pair needs patching today on unmanaged servers.
174Received
83Worth reading
91Skipped
The five, if you only read five
ranked
Ranked picks for an engineering lead at a software consultancy: pieces that change how you would advise a client on AI-assisted delivery, review, governance and cost.
Anthropic replaced Git for its monorepo because agent-driven merges outgrew it
Merges rose from about 2,500 a day in May to over 30,000 a day by September, with about 25 million CI checkouts a day. Anthropic built Scion, a centralized source-control system, and TLDR DevOps reports 200x lower source-control CPU and memory than its old Git-mirroring setup. The Pragmatic Engineer adds that a Monoke author alleges copying of its data model, and that Anthropic added attribution only after the complaint.
The Claude Code team reviews by verification first, machine review first, and a human-approved merge
Summarizing Anthropic's October 15 post, the author reports that roughly 90% of Claude Code's code is written by Claude, merged PRs more than doubled from June to September, and the share needing rollback fell by more than 40%. He says the biggest gap is human merge approval, and his PR rules include a 'How was this verified?' field and no AI merge approval.
AI spend is up sharply at most firms, but ROI is still unproven
Across 27 companies, CodeRabbit shows weekly PRs per developer up 113% year over year. Spend runs from a $150 per developer per month cap to $3,000 at a two-person .NET shop, and spend peaked in June and July and roughly halved for API users. The piece is a paywall preview after section four.
Human review is the bottleneck for agent-written code, and the merge data is stark
LinearB data across more than 8.1 million PRs: agentic PRs wait 5.25x longer for pickup, and 33% of them merge against 85% of human-written ones. In a Harness test, GPT-6 Luna went from 3/10 to 10/10 passing, and harnessed Luna cost about a third less than unharnessed Sol. The workshop and ticket promos are skipped.
A per-token price does not tell you what a finished task costs
OpenRouter's figures show open-weight models carry about 60% of weekly tokens but only 26% of spending. The newsletter's illustration: a $1 request that succeeds 80% of the time costs $1.25 per successful result, so budget against successful tasks, counting cache discounts and retries.
AI & industry
9 items
Deduped across TLDR AI, TLDR, AINews, Latent Space, The AI Corner, Meng Li and others. Where sources disagree on a figure, the item says so.
OpenAI is raising up to $30B, led by UAE investors, at a valuation sources put between $1.25T and $1.4T
TLDR AI says the round is a bridge ahead of a potential IPO, with signatures targeted by the end of next week and the final size still being set. Meng Li, citing Reuters on October 19, puts the valuation above $1.4T, with SoftBank and MGX reportedly in talks. The newsletters disagree on the valuation, so treat both figures as reported, not final.
Anthropic's Claude Duet is a proactive agent that watches your connected apps
Powered by Opus 5.5, Duet monitors connected apps, prioritizes tasks and works autonomously, asking approval before certain actions. It is a research preview with a US Pro and Max waitlist. TLDR says it connects to more than 6,000 apps and blocks some actions, such as trading stocks or moving money, even with approval; TLDR IT says it runs in its own virtual machine with its own browser.
Cloudflare's Clairic extracts values without generating tokens
Clairic is a non-generative extraction model that returns extracted, computed or forecast values directly, so it cannot produce a mistyped answer the way an LLM can. Outputs carry confidence scores, and Cloudflare says it can still make mistakes. TLDR IT says it runs as a single forward pass on Workers AI, with open weights promised soon.
AWS's TorchNeuron runs native PyTorch on Trainium, challenging CUDA lock-in
It is an open-source native PyTorch backend with eager execution, released in public beta under Apache 2.0, and TechCrunch reports AWS will upstream code to PyTorch. The emails give no benchmark numbers. Meng Li reads it as part of the AI cloud contest, where migration cost decides how readily buyers leave Nvidia's CUDA ecosystem.
DeepSeek open-sourced DeepInfer, an offline inference stack for DeepSeek-V4.1-Flash
The release runs DeepSeek-V4.1-Flash on NVIDIA SM100 GPUs or Huawei Ascend 950 NPUs, but leaves out the KV-cache system, prefill/decode disaggregation and load balancing a full service needs. A Zhihu write-up reports 155 trillion tokens a day per cluster and $38 revenue per GPU-hour; those are that write-up's figures, not DeepSeek's.
Latent Space / AINews
Kimi K3.1 Pro is a 2.8T-parameter mixture-of-experts model, but its weights are not out yet
The model has 2.8T total parameters, 104B active, and a 1M context. It scores 55 on the Artificial Analysis Intelligence Index against 58 for Opus 5.5, and its hallucination rate on AA-Omniscience falls from 53% to 44%. Weights are promised for November 4, so calling it open today is premature. The email has no article link.
Google is paying for a 1 GW virtual power plant to serve AI load in PJM
Rather than buy more electricity, Google pays Voltus to aggregate flexible demand from homes and businesses in the PJM region, so they draw less when the grid is strained, freeing capacity. The deal is about 1 GW. The article is a paywall preview.
Pichai says recursive self-improvement is 'pretty far' from its end state, and compute is short for everyone
Models already help build models, Pichai says, but the end state is far off. Google Cloud grew 82% last quarter, yet cloud forgoes revenue to fund frontier research. Argon processed about 25 trillion tokens in 72 hours, roughly 3x Gemini 3.0, and Google reports 30% more CLs and one-third fewer rollbacks over four weeks.
Claude text output now carries an invisible SynthID-Text watermark
The latest Claude models embed a SynthID-Text watermark in text output to comply with the EU AI Act. It nudges choices among near-equivalent words, adds no hidden characters or tokens, and carries no information about the user.
Engineering leadership
5 items
Managers, staff engineers and architects; career, hiring and how to work with AI.
Good work does not speak for itself, and managers may see only about 40% of it
Ojstersek's point is that you have to communicate impact deliberately, because silence costs burnout, marginalization and manager disinterest. The five methods are behind the paywall.
Hiring is a default fix that defers the prioritization decision
Stanier argues a hire costs several times salary. He cites Meta cutting 22% of staff, more than 20,000 roles across two rounds in its early-2023 efficiency drive, and Coinbase cutting 14% in May 2026. The article is cut off at the cost section.
AI speeds up building but not learning whether value was created
Output gets optimized because it is measurable, so the CTO's job is to tie engineering capacity to the binding business constraint, such as adoption, and make the allocation trade-offs explicit. The piece has no figures.
Architects should facilitate, not supply the answers
The advice is to show up regularly, ask questions in refinement, and mediate cross-team concerns without taking the decision. The post is free in full; the rest of the email is course promos.
Felix Rieseberg: people under-use AI, so aim at outcomes and challenge assumptions
The lead piece advises aiming at outcomes, building expert depth, drawing ideas across fields and challenging assumptions. The other items argue that AI-written docs erode trust (Steve Huynh) and that AI cost-cutting is a race to the bottom (Seth Godin). No figures.
Essays & arguments
5 items
Longer pieces where the argument matters more than the news.
Kent Beck (Software Design: Today and Tomorrow)Read
Delegate the toil to AI, but keep the struggle, because learning comes from it
Beck reformatted a 2013 essay with an AI 'genie' to show what delegation looks like, then argues the struggle is where learning happens and should be kept. The post ends with a consulting pitch.
Self-sabotage can be protective, and trying harder to fix it can reinforce it
Cutler argues career self-sabotage often protects something, so forcing it away can entrench the pattern, and feelings need not always be regulated away. The issue also includes TBM 446 on how management books and tech 'vibes' blend causal claims; its advice is to treat worldview debates as values, not evidence.
AI is a new instrument, and the value lies in point of view
Rubin argues that rejecting AI outright repeats the 'wah-wah' mistake, and that readers should choose their own filters rather than platform-wide scores. The transcript is free; a Substack feed-control promo is attached.
AI made writing cheap, so documents no longer prove effort, and reading culture is fading too
Huynh argues that when AI makes writing cheap, a document no longer shows the author did the work, and that Amazon's edge came from writing plus reading. He cites a post that drew nearly 1M impressions and says a six-page memo once took at least a week.
The author's rule of thumb is to spend at least half your time on stretch work. He cites a six-month study that reported 84% perceived productivity while the share of engineers reporting worse developer experience rose from 14% to 27%.
Dev, DevOps & tooling
9 items
Security patches first, then tooling changes and their numbers.
Two critical PHP RCE flaws affect every version from PHP 5 onward, and unmanaged servers need the patch now
CVE-2026-109618 and CVE-2026-109619 were disclosed October 21 with proof-of-concept code. The fixed releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12, and there are no patches for PHP 8.1 or earlier. Amazon Threat Intelligence reports exploitation before disclosure, so measure mitigation in hours.
A Cisco Secure Email Gateway zero-day (CVE-2026-76519) is being exploited
The path-traversal flaw, scored CVSS 9.8, lets unauthenticated attackers write files and run root commands through crafted email attachments when File Reputation is enabled. CISA and Germany's BSI have issued warnings with urgent patch deadlines.
LiteLLM's v1.107.0 release was compromised after a leaked key was never revoked
A malicious LiteLLM package was live on PyPI for about two hours before it was pulled. DevOps Bulletin's account is that the key was removed from Git history but never revoked, so the leak stayed usable.
tsrs, Cloudflare and VoidZero's Rust port of TypeScript, is faster but not yet compatible
Built in the Oxc toolchain with the TypeScript team, tsrs reports up to 8x faster checking and about 70% less memory than TypeScript 7.0 on matched configurations. It is an experimental npm release, with compatibility gaps to close before it is stable.
Shopify rebuilt natively rather than staying on React Native, and coding agents made that cheaper
Shopify chose a greenfield native rebuild, starting with the Shop app, with reviewed checkpoints along the way. iOS startup fell from about 3,200 ms to 2,400 ms, Android from 4,400 ms to 2,200 ms, and Android app size from 293 MB to 184 MB. The Shop app shipped in 12 weeks.
Datadog's Scout 1.0 targets frontier-level incident investigation at a fraction of the cost
Scout is reported to match general frontier models on production investigation at an estimated three to eight times lower inference cost. Datadog trained it with reinforcement learning on simulations built from historical incidents.
Uber's support bot answers with cited sources, and its numbers are more modest than the headline
Each retrieved chunk keeps its source URL, so answers cite it, and feedback splits Resolved, Helpful, Not Helpful and Not Relevant. Figures include about 45,000 support questions a month, a 48.9% helpfulness rate and about 13,000 engineering hours saved. The article calls 48.9% a full-resolution rate, which conflicts with its own helpful-versus-resolved split.
Haiku 5.5 is the new default Haiku on the API, with 1M context at $0.10 in and $0.50 out per million tokens
Haiku 4.5 was $1 and $5 per million tokens; prompts over 100K cost $0.50 and $2.50. The same issue covers idle compaction, where sessions over 200K tokens compact after about 54 idle minutes, before the one-hour cache expires.
React Status
Next.js patched two critical RCEs: update to 16.4.1 or 15.5.28
React Status also reports that TanStack Start 1.0 is now stable, handling 2.9x to 8.6x more dynamic requests than Next.js 16.4 in one benchmark. The email has no article link for the patch.
Ten networking concepts, framed by a VPC mistake that took down an app
A 10-byte payload carries 58 bytes of TCP, IPv4 and Ethernet overhead. A /24 gives 256 addresses (254 usable), a /16 gives 65,536, and ephemeral ports run from 32768 to 60999. Facebook's 2021 BGP withdrawal lasted about six hours. Part 2 covers Ethernet framing, switch flooding, DHCP, OSPF and ICMP.
Agentic RAG loops until the evidence is sufficient
Plain RAG retrieves once; agentic RAG picks tools, checks the evidence and searches again. The same issue explains OAuth (authorization) versus OIDC (the id_token). The Linux section wrongly says USB drives mount in 'bin'.
Prompt caching and semantic caching reuse different kinds of work
Prompt caching reuses processed prefix state, so stable content goes first; semantic caching reuses answers by embedding similarity and needs a tuned threshold and invalidation. Anthropic cache reads cost 1/10 of the input price and the 5-minute write costs 1.25x, so a $1 prefix costs $1.35 for one write and one read, against $2 uncached.
Algorithm choice changes performance even on identical hardware
Round robin is safe only with identical servers and similar request durations. Weighted round robin fits capacity gaps (the example uses weights of 3:2:1), and canary weights of 1 to 10 percent are suggested. The piece cuts off before least connections.
CI/CD makes releases boring by shipping small changes often
Release risk scales with change size and the time since the last release. Continuous delivery keeps main releasable with a human release decision, while continuous deployment removes that gate. The preview is cut off at stage five.
A router picks a few experts per token (the illustration uses 2 of 8). Compute falls, but all expert weights stay in memory. The preview also covers LLM-as-judge, DPO, distillation and temperature, and is cut off at concept 42.
Foursquare's end: a 17-year company whose equity ended at $0
The post says Foursquare was acquired about a month ago in a $0 outcome for equity holders, after a leadership change its founder says it could not survive. It is a founder's retrospective on starting, scaling and losing a company.
Moving app checkout to the web saves less than the 15% fee suggests
On a $9.99 subscription, Apple's 15% leaves $8.49 in-app against about $9.33 after Stripe card and billing fees. At equal prices, losing roughly 9% of buyers erases the gain before operating costs, and one app rolled back its test after revenue per paywall viewer fell 9%.
Chesky: the same AI tools widen the gap, and volume of ideas decides who gains
Airbnb ships 80% more features than a year ago. Chesky estimates about 100,000 ideas a year, 99,000 of them bad, and his advice is to test each service in one city first.
Anthropic and Nscale are reportedly in talks on another $45B compute deal
The two companies announced a $45B deal a little over a month ago, and this would be a second one. Nscale faces investor pushback over its proposed $30B valuation. Both companies are reportedly pursuing IPOs; this is reported, not confirmed.
Nvidia's tie to CoreWeave goes beyond supplier and customer
Jensen Huang said on October 15 that CoreWeave does not need an Nvidia financial backstop, but the author argues Nvidia is also a shareholder and a supplier, and has a contractual obligation to buy part of unsold capacity. As of June 30, 2026, CoreWeave had about $35.6B of debt and about $104B of revenue backlog, and the backlog does not convert directly into cash.
A new Head of Product must choose between hands-on decisions and owning the operating system
The essay separates machinery problems (loops and interfaces) from strategy problems (trade-offs), and argues a new head should diagnose which one they face before acting. The preview is cut off mid-essay.
ChatGPT Slides on Windows 10 produces a PowerPoint file, not a collaborative deck
The rollout began October 16 for Pro, Business and Enterprise users with Space access. Decks inherit Space's view-and-edit sharing, and exports reach PowerPoint, PDF or Google Slides. Free, Go and Plus have no release date.
Gemini Notebook adds a review gate before slides and video render
An optional Review toggle lets users request edits, such as an executive summary or reordered scenes, before choosing Proceed. Google announced it October 19 and is rolling it out globally over the following week.
Figma Code Layers enters open beta, with Specs and a backend for Make
Code Layers runs interactive prototypes beside design frames, with generation and editing free on paid plans through November 4. Specs adds shared Markdown documents that pass requirements to AI agents over MCP, and Payload gives Make a database, CMS and admin.
Figma co-founder Dylan Field says MCP is not a perfect protocol
Field argues MCP favors frontier AI labs and needs improvement. Figma wants people to use its data but must limit exposure to reduce abuse, and it has added 20 MCP partners.
Productivity & personal
2 items
Two items worth keeping, both without article links.
Why Try AI (Daniel Nest)
Where chatbots end, agents begin
US chatbot use rose from 33% in 2024 to 49% in 2026. Codex's share of enterprise token usage went from 10% in early 2026 to 64% in June, yet only 0.7% of individual users use Codex. The email has no article link.
Remote Jobs and You
Staying motivated when your work repeats daily
Amabile and Kramer's diary study covers 238 people, 26 teams, seven companies and about 12,000 diary entries. The author proposes three habits; the 'Where this falls short' section is free. The email has no article link.
Pointer
9 items, 2 issues
Suraj Patel's engineering-leadership roundup, issues #761 and #762. Sponsored slots and tiny tool links are left out; each link opens the article.
One line each, for the stories that came with a number or a name worth keeping.
Modal: over $1B annualized run rate and a $750M Series D at $16B — Latent Space. Erik Bernhardsson argues demand is not 'rectangular', so Modal pools customers and sells elastic GPU slices; sandboxes are about one-third of revenue.
Anthropic traced the origins of five NIST prime curves, with no cryptographic break found — Anthropic research. The seeds trace to lrand48 initialized with Unix timestamps; some base-point origins remain unexplained.
Replit makes OpenAI its default over Anthropic, per its CEO; insiders dispute the claim — TechCrunch. Replit's own posts show Anthropic models in use as recently as a few weeks earlier.
Microsoft says AI agents are insider threats because frontier models 'can't be trusted' — TechCrunch. The proposed response is to separate the supply of intelligence from authority over it, with independent monitoring.
Safe to skip
15 groups
What each skipped sender actually sent, so you don't have to open it. Chat notifications and promos were classified from their opening lines.
ChatGPT for All ×9Paywalled Substack how-tos: AI project portfolio, first AI client, chief of staff, ten AI skills, an AI brain in 30 minutes, eight free agent tools, Meta Muse businesses, 58 Claude Skills, 'Forty Rules of AI Love'. Only headlines and paywall previews were readable; no figures taken.
Forte Labs and Tiago Forte ×5A book launch (out November 3), a free annual-review summit on November 4 and pre-order pitches. The book pitch cites 17 years of annual reviews and 500+ beta readers; nothing to act on.
VC Corner ×7Paywalled investor lists and launch promos, with Vanta and HubSpot sponsor blocks. One data point worth keeping: CB Insights puts global VC at $698B through Q3 (2943).
Founders Corner ×4An Ask Me Anything on October 29, an investor-matching tool, and a paywalled Airbnb pitch-deck case study in which seven investors said no.
Starter Story (Pat Walls) ×2Case-study video teasers (a cat app at $18K a month) and a promo.
The AI Corner ×2 (2939, 3091)A paid investor workbook and a perks list with an upsell; promo-only.
Substack live and notes notices ×4Live replays and go-live alerts for Black Babes Abroad, and a Substack notes digest. No articles.
Job boards ×4Remote Jobs Weekly List, two LaraJobs listings, and SwissCareer's market update (ManpowerGroup Q4 outlook +21%) plus a Swiss career toolkit teaser.
WebFX ×1Sponsor-only report on 2.3 billion sessions; the rest is a sales pitch.
Medium Weekly Digest, Hacker NewsletterStory titles and read times only (Medium), and headlines with comment links, no article bodies (Hacker Newsletter #815).
Engineering Leadership ×2, Refactoring ×1Book promos for 'The Multiplier Mindset' (Amazon #1 new release) and a paywalled list of five non-coding AI uses. Refactoring 3030 is the author's own iOS app launch (CI about 15-16 minutes down to about 4); not carried.
React Digest, Frontend FocusInterop 2027 wishlists (CSS functions, scroll features, focusgroup) and JPEG XL and tracking notes; no figures carried.
Nextool AI ×2 (2957, 3059)An NVIDIA simulation note (Isaac Lab, 4,096 parallel environments) and Town's $108M Series B. Their links were tracking-only.
Not synced this runReturned 'not synced' and not summarised; retry next week: 2947 (Kimi K3.1 Pro release mail), 2948, 2965 and 3020 (AI Corner), 3090 and 3098 (TLDR AI and TLDR IT, 19 October), 2986 (TLDR, 23 October), 2971 and 3018 (System Design Nuggets), 3025 (Pragmatic Engineer), 2941 (Leadership in Tech #358), 3102 (A Life Engineered show notes).