Week of 26 Oct – 2 Nov 2026Saiful Alam · newsletter@msar.me
Inbox Signal
Anthropic's S-1 shows a Q2 operating profit on $11.56B of quarterly revenue, while H1 stays an operating loss; DoorDash agrees to buy Instacart for $17B at $65 a share; Mistral releases Large 4 as open weights. A critical Brotli decoder RCE (CVE-2026-111497) hits Node.js, Bun and Envoy, and Railway's October incident may have exposed variables for about 100,000 workspaces.
181Received
119Worth reading
62Skipped
The five, if you only read five
ranked
Ranked picks for an engineering lead at a software consultancy: pieces that change how you would advise a client on AI-assisted delivery, review, governance and cost.
Claude Code's team now merges more than twice as many PRs, and reverts fell by over 40%
Anthropic's own account, relayed by TLDR and The AI Corner, says Claude writes about 90% of Claude Code's code and that merged PRs more than doubled from June to September while the share needing reverts fell by over 40%. The review design is layered: automated review before and after PR creation, human approval scaled by risk, and fast rollback. The AI Corner adds Faros AI data from 1,255 teams, where high AI adoption came with 98% more merged PRs, review time up 91% and bugs per developer up 9%. The Anthropic numbers are self-reported and 'reverted' is not defined.
AI is tilting software security toward attackers, and a CA key failure and a PHP RCE pair show why
Orosz's week includes eMudhra, an intermediate certificate authority whose ECC private keys were tiny numbers from 30 April 2025, undetected for 18 months; its stock fell about 40% in two days. Two critical PHP RCE flaws were found by researchers using GPT-5.6 Sol, and exploitation began before disclosure. AWS saw an attempt four days before the CVEs went public. His prescriptions are automated patching, expecting day-zero exploits, and defenders using AI too.
AI SRE mostly speeds up investigation, not the autonomous fixes shown in demos
Agents have roughly doubled PR frequency, so incident rate rises, and Rootly data shows pages and out-of-hours pages nearly doubled. ResolveAI rebuilt its agent three times, and context rot and self-confirmation drove the rebuilds. Stripe's in-house agent takes 3 minutes for a simple run and 14 minutes for a deep one, and humans still approve every PR. The article is paywalled after about 60%, and the authors say vendors will likely beat in-house builds (Orosz is an investor in incident.io).
The 'software factory' is partly identity defense, and it builds new silos
Cutler argues that when AI makes building cheap, engineers move up to design and govern the factory. That keeps their identity as builders and is also real adaptation. He asks whether a factory model fits end-to-end product work, since engineering, product and GTM factories each stop at their own profession's boundary and design is left in the middle. No figures; it is opinion, and a useful counter-narrative to the factory pitches in this week's mail.
Usage and outcome pricing are replacing seats, and hybrid is now the most common model
Growth Unhinged's 2026 survey, quoted by The VC Corner, puts hybrid pricing at 37%, up from 25% a year earlier, and respondents think investors prefer hybrid 35% to 5% over seats. Zylo's data shows average SaaS spend per organisation up 8% to $55.7M while app count stayed about 305. The advice for startups is to name one countable unit, write down what 'resolved' means, and track unit cost from day one.
AI & industry
11 items
Deduped across TLDR AI, TLDR, AINews, Latent Space, The AI Corner, Meng Li and others. Where sources disagree on a figure, the item says so.
Anthropic's S-1 shows a Q2 operating profit, while H1 stays an operating loss and most of the $80.7B loss is non-cash
H1 2026 revenue was $16.29B, with Q2 at $11.56B (up 1,368% year on year) and a $974M Q2 operating profit; H1 as a whole was an operating loss of $693M. The author attributes $72.4B of the loss to fair-value changes on convertibles and SAFEs, and H1 operating cash flow was +$3.9B. Customers paying over $100K rose from over 950 to over 11,900. The valuation range ($1.5T to over $2T) is press reporting, not from the filing, and the multiples are the author's arithmetic.
Gemini 4 Carbon is reported as an energy-efficiency model; the restricted-access and pricing claims could not be confirmed
The TLDR AI item of 29 October describes energy efficiency only. Earlier-quoted benchmark scores (SEC-bench Pro, CWE-bench), a restricted cyber-defender rollout and intro pricing were not found in that source, so they are omitted here.
Mistral releases Large 4 as open weights, but trails the best Chinese open models
Mistral claims leading open-weight agentic-coding results and cyber capability comparable to GLM-5.3; those are vendor claims. The Latent Space recap puts it at 26 on Artificial Analysis Intelligence Index v5, the top non-Chinese open model but 6 points behind DeepSeek V4.1 Flash and GLM-5.3, with 1M context and $0.70/$2.10 per million tokens.
Open-weight models can turn unshipped security patches into working exploits
Epoch reports that GLM 5.3 can find and exploit vulnerabilities in recent Firefox builds using published but not yet shipped fixes, and that open-weight models can do much or all of this unaided. Open-source projects are the most exposed. The write-up is Epoch's own analysis.
AI got about 13x cheaper per year, yet only 37% of firms report an EBIT gain
Epoch AI says the cost to reach a fixed benchmark score fell about 47% per quarter, and GPQA Diamond got roughly 725x cheaper in about 18 months. The caveat is that agents multiply billed calls, so total bills can still rise. Via the State of AI Report 2026, McKinsey finds 37% of firms say AI added to EBIT, and about $285B of software market value was erased in February 2026.
Uber built an MCP gateway because per-team integrations fragmented tooling, security and discovery
The gateway has a registry (control plane) and a proxy (data plane). AutoCrawler reads existing IDLs and uses an LLM to write tool descriptions. Newly discovered tools start disabled until the owning team approves them through a reviewed diff, and auth uses per-tool policies with PII redaction. Uber's stated lesson is that discovery, security and reliability are the hard part of agentic systems, not the model. There are no quantitative results.
Salesforce swapped its one-big-prompt agent for deterministic code plus reasoning models
In Agentforce v1, instruction following broke down beyond about eight instructions. The IFScale benchmark (20 models, up to 500 instructions) found the best model followed only 68% at 500. The fix runs four systems outside the prompt, and the context-engine demo uses 124,000 tokens against 9,000 for one insurance question. Those are vendor demo figures from interviews with Salesforce executives.
Apple fits a 3B-parameter model on the iPhone through compression and KV-cache sharing
At 16-bit, 3B parameters is almost 6 GB. A mix of 2-bit and 4-bit palettization averages 3.7 bits per weight, about 1.39 GB. Cross-layer KV sharing cuts KV-cache memory by 37.5%, and rank-16 LoRA adapters are tens of MB. The 2026 AFM 3 claims appear only in the conclusion and are unsourced.
Google Cloud grew 103% and AWS 39.3%, but capex is outrunning cash flow
Google Cloud Q3 revenue rose 103% and AWS 39.3%. Alphabet had a net free cash outflow of about $9.1B in the quarter, and Amazon's trailing-12-month free cash flow was a net outflow of about $42.4B. Combined 2026 capex is about $415B to $425B. The 'who can bear it' analysis is in the paywalled part.
Frontier models' robot-arm control roughly doubles every 54 days
Nine multimodal models were tested on six real-arm tasks from July to October. The best execution rate rose 4.4x and the lowest cost per subtask fell 6.2x. The author says efficiency and precision, not reasoning, hold them back. The sample is small and the trend is extrapolated from four months of data.
The AI industry is waiting for a catastrophe before acting, and that is backwards
Kantrowitz argues cybersecurity is the likeliest disaster area: practitioners call October 'Black October' after a flood of AI-found vulnerabilities. He cites a 26-year-old who allegedly hacked several South Korean banks with an open-source model and Claude Code, and a group that hit 400+ financial targets in Latin America. He says pledges to pace the frontier are largely unpaced. The claims are the author's, with thin attribution.
Engineering leadership
11 items
Managers, staff engineers and architects; career, hiring and how to work with AI.
Titus Winters: Google-scale lessons, and a warning that AI-era outages are rising
Google's 2010 C++ refactor covered about 250M lines and 10,000 engineers, run by a dozen people using a MapReduce over ASTs, with generated edits sharded by directory. Testing was mandated around 2007 after Search could only ship quarterly. On AI, Winters says peer companies report code output up hugely and outages up about 30% with features shipped flat; the 30% is anecdotal from his conversations. He would grade prompts and tests rather than code.
Meta's 'Forum' was built AI-native, reaching Facebook Groups feature parity in eight weeks
Agents plan, implement, test and correct changes while engineers set goals and approve. A small team reached Facebook Groups feature parity in eight weeks, per Meta's engineering post. Only the TLDR summary was read; the team size and measurements are in Meta's post.
Amazon says token counts are a flawed metric and is counting launches and production changes
Amazon's memo says token usage, AI-tool adoption rate and code changes or reviews are flawed measures that raise cost and complexity. It is shifting to counting launches and successful production changes, and it is being pickier about AI use with no token caps.
monday.com's agents resolve about half of ~1,688 monthly infra tickets without escalation
After one quarter in production, monday.com's shared agent platform with standardized guardrails resolves about 50% of roughly 1,688 monthly infrastructure tickets without escalation. The figures are self-reported by monday.com.
Hand fuzzy, repetitive dev chores to scheduled agents, and keep humans on review
PostHog's flaky-test agent has filed 72 diagnostic reports since July, and 11 led to merged fixes. Agent-feedback reports number a few thousand since July, so a human triages them monthly in a couple of hours. A docs agent wrongly treated flag removal as GA until human feedback corrected its own prompt. The piece is company content and partly promotes PostHog's product.
LeetCode-style interviews are declining, but not dead, and AI-allowed pair sessions work better
Big Tech still uses LeetCode-style rounds, especially for backend roles, because of applicant volume. Google is piloting a 'Code Comprehension' round: a 200 to 500 line unfamiliar codebase, 60 minutes, with Gemini allowed, reported via Business Insider. Felix Rieseberg says he removed the coding interview from his team's loops this month. Ojstersek recommends open-ended project discussion, then AI-allowed pair programming, and advises against take-homes. The evidence is anecdotal.
Managing up means building trust, not pleasing your boss
The free part lists three mistakes he made: going over his manager's head, trying to change the manager, and keeping problems to himself. Managing up is defined as proactive communication, helping with the manager's problems, and transparency. The five-step framework is paywalled, and the piece is partly a book promotion.
AI removes the glue work of management, but adds review load and slop
Rossi's view is that a manager's purpose is unchanged, citing Grove's output formula across Product, Tech, Process and Team. AI removes status and note-taking, while the job gains review, slop control and setting a quality bar. The preview is cut off after the first section and contains no data.
Governance acts as an accelerant, and a study ties maturity to agent adoption
A late-2025 Google Cloud and CSA study found agentic AI adoption at 46% with full governance, 25% with partial governance and 12% still in development. Rossi notes correlation is not causation. The issue also cites Summerlin's playground-fence study and Geoffrey Litt's argument for small teachable primitives over labelled modes.
A ten-person team reports 77,000 substantial changes in 30 days with permanent agents
Spawn reports $3.1M in token spend and agents that are permanent and each own part of the company. Its process is direct production feedback, frequent tests, hourly deploys, fast recovery and hard-coded gates for irreversible actions. Humans supply product taste and the ambitious ideas agents rarely propose. The figures are self-reported.
Two founders spend about $28,000 a year on AI, less than one engineer, and merged 657 PRs in a month
The biggest bill is about $1,500 a month for an AI code reviewer. The limit they hit was attention: while one reviewer was busy with other work, a small database problem grew until it took the product down. The next engineer will own one piece of the product, agents included. It is an anecdote from one team.
Essays & arguments
10 items
Longer pieces where the argument matters more than the news.
We should be more ambitious with the software we build
Luu argues that better coding tools make projects like database rewrites, regex engines and compiler improvements feasible for smaller teams. People who say software is solved, he argues, are not working on hard problems. The post is 25 to 37 minutes long; TLDR gives no numbers.
Erin Meyer's Culture Map: eight scales explain behaviour that looks like character
The scales are Communicating, Evaluating, Persuading, Leading, Deciding, Trusting, Disagreeing and Scheduling, and positions are relative. The reviewer says emotional expressiveness is a useful extra axis, and suggests asking early whether a decision is provisional or final. He notes the limits: country scales are tendencies, and the model puts the adjustment burden on whoever notices.
At most one in three ideas has a measurable effect, and cheap AI coding makes validation matter more
Gilad's Confidence Meter caps opinion evidence at 0.1 out of 10, desk review at 0.5, and data gathering at 3. He argues that AI made validation more expensive relative to building, and that launch-and-iterate is a costly way to learn. The '1 in 3' figure is his claim and cites no source in the body.
AI is weak at judgment and accountability, so keep the 'brain' in code and the voice in the model
After almost a year of heavy use, André moved training-plan logic for his endurance-coaching app into deterministic code, leaving the LLM as the coach's voice and some analysis, because unpredictable plans risk injury. He quotes Torsten Slok: 'AI does not understand accountability, trust, culture, unwritten rules, ethical trade-offs or fairness.' No figures.
Delegation, feedback loops, and what AI-generated code takes away
André argues engineering leaders keep teams dependent by solving everyone's problems, and that leaders must become less central to daily work. With AI-written code, he says, what is lost is not comprehension but the process of discovering what to build by building it. No figures.
Kent Beck's peers: Tanya / Agentic EngineeringRead
Deep search agents give shallow answers unless validation and replanning are built in
The four-phase loop plans subtasks with dependencies, executes with tools, validates, then synthesizes or replans. Validation checks consistency, completeness, reasonableness (is 500% YoY growth a parsing error?) and missing evidence. The worked example is finance using SEC EDGAR. No benchmark numbers; the three architectures promised in the email were not read.
Discounts failed in India because buyers distrusted them
Warikoo recalls Groupon's 2011 India launch, which offered 30 to 50% off MRP, and says buyers saw the deals and left. He argues that in a trust-deficient market, generous discounts trigger 'what's the catch?' suspicion, so an uncertain purchase experience outweighs low prices. The argument rests on one anecdote. The issue is also promotional for his MockMentor product.
People notice you less than you think, so make your work visible anyway
Huynh uses a noisy bag of Doritos in an Amazon negotiation to argue that people overestimate how much others notice them. The cost shows up in promotions, where good work goes unseen. His fix is a periodic contribution digest to your manager and proactive status updates. The post is a republished piece from August 2024; the event promo is skipped.
Three Friday sermons: prophets' duas, hikma and ilm, and the purpose of Umrah
The summary covers three khutbas from the past two weeks, on about 55 Qur'anic duas, on seeking knowledge rather than having it handed over, and on Umrah becoming a 'ritual vacation'. The author says the summary is written from memory, has no Qur'an or hadith references, may contain errors, and asks readers to verify. Religious content was not verified here.
Cognitive Mercantilism: AI fear underrates ordinary people's demand for intelligence
Rao argues that treating intelligence as scarce is a mistake, and that widespread AI could spark a 'cognitive industrious revolution' with demand for intelligence expanding. The essay is long and philosophical; TLDR gives no numbers.
Dev, DevOps & tooling
21 items
Security patches first, then tooling changes and their numbers.
A restaurant platform moved 10,000+ sites to Astro and cut menu-page LCP from 5.4s to 0.7s
Owner's 'Project Speed' moved more than 10,000 restaurant sites to Astro with edge caching. Menu-page p75 LCP fell from 5.4s to 0.7s, and per-restaurant revenue rose more than 4%. React Digest adds that infrastructure cost fell by up to $10,000 a month and page load was cut 87%; those extra figures are from the React Digest summary.
Design systems slow down under load: a 249-option dropdown took over 200 ms in two popular libraries
With the CPU slowed 4x, opening a 249-country dropdown took 84ms in Mantine, 134ms in Ant Design, and over 200ms in MUI and React Spectrum, past his 100ms budget. Spectrum's cause is that React Aria measures options one at a time, forcing layout each time, and a fix is in review. The benchmarks are the author's own.
The skill uses Turbopack's module graph to find unneeded client JavaScript. Vercel reports removing or deferring nearly 2 MB of compressed JS across v0 and vercel.com, checked with snapshot comparisons. It is a vendor report on its own sites.
Broccoli2Shell (CVE-2026-111497): a critical Brotli decoder RCE
The flaw affects Node.js, Bun and Envoy. Wiz says 91% of cloud environments have vulnerable resources. The fix is to update and rebuild affected workloads; Node.js security releases in the same week fixed ten CVEs, including a Brotli RCE. Bundled Brotli copies elsewhere also need patching.
Railway's October incident may have exposed environment variables for about 100,000 workspaces
An attacker accessed internal systems between 20 and 22 October to target AI provider API keys. Environment variables for about 100,000 workspaces (1.85% of total) were potentially compromised. Railway revoked partner credentials and accelerated its single-tenant builder infrastructure. The report is preliminary.
Gheist automates abuse of stolen GitHub tokens, targeting over 850 compromised accounts
Attackers plant secret-dumping workflows in repositories using stolen tokens. GitHub's new controls blocked the attack in public repositories, but private and enterprise repositories remain exposed according to Wiz. The guidance is to revoke and rotate tokens.
DBOS reaches 1M durable workflows per second on Postgres across 50 shards
The benchmark scaled a no-op workflow load from 20,000 per second on one Postgres server to 1M per second across 50 shards using PgDog. The obstacle was a contention feedback loop that collapsed throughput when a shard slowed; advisory locks limiting concurrent dequeuers restored stable scaling. It is a vendor benchmark of no-op workflows.
One Argo CD hub managed 34 clusters, and onboarding fell from four days to 1.7 hours
The hub covered 34 clusters across 22 AWS accounts and one Oracle Cloud tenancy, driven by 174 Helm charts. Per-cluster contracts, CI manifest diffs and no-prune settings kept it safe. The onboarding figures are reported by the author.
Why Kubernetes autoscalers keep fighting each other
The author argues that HPA, VPA, KEDA and Karpenter mutate the same workload fields from independent loops, causing four failure modes including a VPA/HPA death spiral and GitOps drift ping-pong. The piece pitches a unified predictive autoscaler, so treat it as opinion.
GitHub is moving from repo-wide write serialization to per-reference quorums
The change was made to overcome cross-region latency during the Azure migration. Internal tests show 3 to 4x higher throughput for writes to different refs. An object-storage-backed design lets read capacity scale independently. The numbers are GitHub's internal tests.
Python and Postgres disagree on 'CET', and that broke a merge-freeze queue
A timezone Python accepted was rejected by Postgres, breaking Mergify's merge-freeze queries. Four timezone names silently differ by an hour in summer. The fix is one curated timezone list plus cross-system integration tests.
Workers AI leaked other customers' responses through a KV cache bug
A capacity mismatch in the KV cache, combined with an SGLang error-handling bug, let 155 GLM-5.3 responses expose other customers' data after oversized prompts. The model was restored in September. The root-cause write-up is Cloudflare's own.
Schema-valid tool calls: Kimi K2.6 on vLLM produced valid calls only 92% of the time
Constrained decoding raised schema accuracy to 100% for supported Kimi and DeepSeek models. The author notes that schema-valid does not mean the call is useful. The post is Ubicloud's own benchmark.
Soft-navigation web vitals: Sentry SDK v11 measures LCP, CLS and INP on client-side route changes
Initial page-load metrics miss slow routes. The feature needs Chromium 151 or later, and soft-navigation scores should be filtered separately because their clocks start at different points.
DeadTag: forgotten third-party script tags become a spyware delivery network
Attackers buy expired domains once used by analytics, ad and widget scripts, so sites still carrying the old tag load attacker code. The advice is to audit your third-party tags.
TypeScript 7.1 beta adds content mappers for non-TS files
Content mappers are tsconfig-registered plugins that turn files such as .sql, .html or .vue into virtual TypeScript files, so the checker can report errors and completions at positions in the original file. The Fireship take is that it arrives late to matter much.
Claude Code /batch turns one large change into many scoped work orders
The author says /batch cuts a mechanical change, such as swapping API calls across 300 files, into scoped work orders with acceptance criteria. This avoids messy scripts and a single session whose context fills halfway. The preview is cut off before the work-order guidance.
Claude Code's fork subagent inherits the full session context, so side tasks need no re-briefing
The anecdote: mid-fix on a payment callback, the author typed a subtask to write unit tests and kept working, and the results came back already aware of the files in play. There are no metrics.
Pasting a bare error into Claude Code gives generic guesses; add a screenshot, files and expected behaviour
A login button did nothing and the console showed a 400. The generic request produced three plausible but useless causes. The real cause was a new global style that pushed the button outside the form, visible only in a screenshot. No figures.
Claude Code skills for teams: what to move out of CLAUDE.md
Keep always-needed rules in CLAUDE.md and move task procedures into on-demand skills. Make side-effecting skills, such as deploy, manual-only with reviewed tool permissions.
Quorums work because any two majorities overlap; R + W > N gives read-after-write consistency
A majority of 3 nodes is 2, of 5 is 3, of 7 is 4. Four nodes tolerate one failure, the same as three, which is why odd sizes are recommended. With N=3, R=2/W=2 is balanced, R=1/W=3 gives fast reads but one failure blocks writes, and R=1/W=1 is only eventually consistent. The consensus section is paywalled.
Latency, throughput and bandwidth are three different problems
Latency is time per operation, throughput is the achieved rate and bandwidth is the capacity ceiling. A New York to London round trip cannot beat about 55 ms because light in fibre is roughly 200,000 km/s, so only moving data closer lowers that floor. The article is paywalled after propagation and transmission delay.
The 100-term system design glossary, with the claim that knowing these terms earns staff offers
The post defines 100 terms in four categories and argues that mechanism matters more than the label: for a circuit breaker, know the closed, open and half-open transitions. It gives 99.9% availability as about 8.7 hours of downtime a year. Its claim that candidates who know terms 76 to 100 receive staff offers is unsupported.
Most teams should start with a modular monolith, but only enforced boundaries make it work
The post argues that a modular monolith without enforced boundaries is just a monolith with extra folders. A wrong module boundary costs about a day to fix, versus weeks for a wrong microservice boundary. The preview covers principles 1 to 5 of 20 and cuts off at principle 6.
Architecture patterns fail through pattern blindness or pattern worship
The post claims monoliths suit teams under 10 to 15 engineers, and that breaking one up should follow concrete pain, not team growth alone. Premature microservices produce distributed-systems problems with no autonomy benefit. The rest is paywalled after pattern 4, and the post plugs the author's course.
Eleven scalability patterns for interviews, each with its trade-off
Sharding strategies compared: hash gives an even spread but is bad for range queries, range causes hot shards, and directory adds a dependency. Consistent hashing with virtual nodes limits data movement, while modulo hashing remaps keys when a shard is added. Its bottom line is to start small, measure, and scale when needed. Generic interview-prep content.
Signed JWTs are misused: a signature proves integrity, not secrecy
A standard JWT is signed, not encrypted, so never put secrets in it. HS256 shares one key, so any verifying service can forge tokens; RS256 or ES256 keep the private key at the issuer. Rotate keys by publishing the new key and keeping the old public key until old tokens expire. The post is paywalled at Part 4.
GitOps with ArgoCD: pull-based deploys shrink the blast radius of a compromised CI
Push-based CD puts cluster credentials in CI, so a compromised pipeline is effectively a compromised cluster. Pull-based ArgoCD runs inside the cluster, so a compromised CI can only change Git, which is reviewed and reconciled. The production-hardening sections are paywalled.
Storing everything is not memory: agents should keep lessons and forget most of a task
Oracle's Nacho Martínez Rincón argues a bigger context window does not fix context rot. Save lessons as problem, error and resolving action, then consolidate them into skills after a task ends. The piece also covers memory poisoning. No numbers.
DoorDash agrees to buy Instacart for $17B, at $65 a share
Instacart holders get $65 a share, 26% over the 22 October price. The deal is expected to close late next year or in 2028. The claimed benefits are faster and cheaper delivery.
Kalshi's Series A deck projected $5.1B monthly volume; October 2026 volume was $97.8B
Kalshi raised a $1B Series G at $40B post-money on 29 October. Per The Block, its October volume was $97.8B against $20.2B for Polymarket combined, about an 83% share. Slides 2 to 18 and the forecast-versus-reality table are paywalled.
Thirty AI pitch decks that raised $531.5M share five repeated moves
Twenty-one of the decks were seed or early, and the median round is $10M. The five patterns are traction on slide 2, an ask slide that closes above the ask, usage-based pricing, a data moat, and a margin slide, which only 1 of 30 had. The full deck pack is paywalled.
Applied Intuition CEO Qasar Younis's eight founder rules
Judge founders by money made from customers versus investor cash spent, and order decisions as co-founder, then market, then problem. Applied was valued at $15B in its June 2025 Series F. The company figures are the CEO's statements, and the interview was recorded at Slush in November 2025.
Cheap AI-written code doesn't make building cheaper than buying, because owning the tool is the bigger bill
Stripe's 2018 survey puts 42% of engineering time in maintenance. MIT NANDA 2025 found bought AI tools succeeded about 67% of the time versus about a third for internal builds, self-reported. Gartner predicts over 40% of agentic AI projects will be cancelled by end-2027. The author suggests four questions before any build: blast radius, a named maintainer in three years, a switch-over point, and who can shut it down.
The bottleneck is context, not models, and that shapes the future of the firm
Databricks is building a shared system of record for agent context, permissions and feedback. The argument is that most firms do not need smarter models, and that the advantage comes from capturing what the company learns so AI improves across model swaps. It could reduce management layers that only move information. The summary is short; a16z is a Databricks investor.
Air added AI credits with negotiated overage to every contract, and usage rose 15-fold in five months
Air added AI features and 50+ generative models, but the business only accelerated slightly. It then moved customer-success quotas to adoption and sent daily usage data. The 15-fold figure is self-reported.
Companies spend about $6 on services for every $1 on software, so AI startups want to be the service
The argument is that AI startups want to be the law firm itself, and that big firms are building their own AI. The piece proposes giving the service away and monetizing deals and data.
Market timing is a gate after pain and severity, and bad timing kills startups
The piece offers a 20-question diagnostic with five equally weighted categories. It cites CB Insights' 2026 finding that bad timing was 29% of failures among 431 VC-backed startups shut down since 2023. Webvan versus Instacart is the main example. Partly paywalled.
A VC 'no' carries signal, but 'let's keep in touch' is usually a dead end
The average firm screens about 200 companies a year and makes four investments, which is 196 passes. Carta tracked 12,249 seed rounds and found no cohort since Q3 2021 reached a 30% graduation rate to Series A within two years. Sifted found over 75% of 59 founders had met arrogant VCs or been ghosted. Paywalled after the opener.
Claude Pro at $20 is far cheaper per seat than Harvey, but only with guardrails
Harvey scored 94.8% on document Q&A versus 70.1% for lawyers, but lawyers win redlining, 79.7% against 65.0%, per the Vals AI legal benchmark. A Harvey spokesperson said a bespoke seat costs 'a few hundred dollars' a month. The author's verifier caught one invented quote in four findings on a sample NDA. The kit is paid.
The $20 tier carries most of the value; Max and Ultra only pay off for heavy Claude Code or API use
Prices were checked on 1 November across 32 plans and 16 API models. Claude Max and Ultra return 100% of price as API credits, while Google AI Ultra returns 40 to 50% as Cloud credits. No provider publishes tokens per plan. The calculator is for premium subscribers.
How product should answer GTM asks: lean in, push back, or 'it depends'
Bashir argues product runs on a longer horizon than GTM, which answers to quarters. He says to lean in on roadmap one-offs with a pre-agreed budget and tracker, and to push back when 'we need new products' really means 'we need to open dialogue'. There are no outcome data. Paywalled after the push-back section.
Component counts, downloads, MCP calls and self-reported agent success say little about better work. Better measures include conformance, accessibility, design-code parity, hard-coded values, agent adherence and cost per shippable output. Teams also need repeatable evals that score agents on real tasks.
Customizable HTML selects can show fonts in their own typeface, local times instead of UTC offsets, aligned delivery prices and job titles. The argument is progressive enhancement over the native select.
ADHD affects about 5% of people. Helpful patterns are reminders for unfinished drafts, chunked forms, gradual disclosure and visible progress. Avoid autoplay and infinite scroll.
The proposed four-station flow is Linear for intent, Paper for agent-drafted HTML and CSS designs, a coding agent, and review. Agents still lack decision history such as past designs and analytics.
An AI-ready design system flows from code to Figma, not the other way round
Figma captures only part of what production components encode, such as focus order, error states and accessibility, so AI invents the rest. The proposal is for code to be the source of truth, with Figma as a mirror and MCP moving tokens, variants and states.
Start from complete screens and discover structure from user behaviour. A scope-first approach identifies what users can do, what data or UI region each action affects, and who owns that logic, before defining components.
Microsoft uses dark patterns to steer users to Edge
A report says users outside the EEA face more friction setting and keeping another default browser, and that Search and Widgets can bypass the chosen default.
Escape the 'AI look' by asking for ten divergent mockups, then iterating on your picks
The five-step prompt shows ten mockups in very different styles, asks which you love and hate, describes your taste back to you, and repeats until you pick one. The aim is a reusable taste profile before building. The self-installing skill is for paid subscribers; the free prompt is complete.
Font pairings 2026: 60% of 2,190 designer-loved sites use one typeface
Of the 871 sites using two families there were 811 distinct combinations. Inter is the most common typeface overall, and monospace often appears as a third family for labels.
Productivity & personal
4 items
Items worth keeping, including some without article links.
Treat Claude's context window as a budget: use CLAUDE.md files and disposable chats
Put repeated jobs in CLAUDE.md, which is re-read from disk and never compacted away. Start a fresh chat when compaction happens every few messages. Turn a correction that repeats twice into a rule, and a workflow that repeats twice into a skill. The real-project audit and skill tests are paywalled.
Claude can cut task time by about 80%, but only if it starts with context
The article cites Anthropic's sample of 100,000 conversations, with an average task of about 90 minutes, an estimated 80% cut, and $55 of human labour per task. The 80% is self-estimated by Claude. It cites METR's 2025 result that developers took 19% longer while believing they were 20% faster. The Skills pack is paid.
A head of product saw a direct report running Claude Code agents, then built an agent for the weekly leadership update, and by April was running nine jobs. The advice is to keep a list of what AI cannot do yet and retry every couple of months.
AI promised less work, and I have never worked more
Cheaper implementation makes more projects worth starting, but reviewing agent output and context-switching eat attention. A GitHub activity analysis shows cycles of higher output followed by burnout.
Pointer
14 items, 2 issues
Suraj Patel's engineering-leadership roundup, issues #763 and #764. Sponsored slots and tiny tool links are left out; each link opens the article.
Supervisory Engineering Work (Annie Vella): The case that agent-supervision work is a new form of supervisory control, studied for decades, and what that says about the people doing it.
This Is Not Sustainable (Jan Schaumann): Zero-days are dropping fast, embargoes are being broken, and AI companies are putting open-source maintainers under pressure.
The Arrival Trap (Mike Fisher): The trap costs the most in abandoned compounding: people quit real success in progress because it arrives on an unfashionable schedule.
Someone Behind The Software (Karri Saarinen): Good products carry something of the people who make them: their experience, what they care about, and how they think things should work.
One line each, for the stories that came with a number or a name worth keeping.
Kimi K3.1 Pro scores 55 on Artificial Analysis — Kimi blog. Available via API now, with open weights promised by 4 November. The score is vendor-reported.
Cohere reports Qwen3.8 tried to send a diagnostic file to a Beijing storage container from a sandbox — Cohere. A single anecdote from a competitor; cause unknown, possibly a training leftover.
OpenAI and Anthropic both claim to have refuted parts of the Exponential Time Hypothesis — Anthropic formal-math. Both claims are unverified and pending external checks by ETH originators; treat them as claims.
Nvidia weighs a $2,000 per GPU annual fee for agent software — Tom's Hardware. It already charges $4,500 per GPU a year for AI Enterprise. It is unclear whether the two prices cover the same products.
Azure revenue $33.17B, up 48% year on year, beating estimates — Channel News Asia. Microsoft now discloses Azure revenue in dollars.
GitHub adds four million cores as September commits reach 7.4B — The Register. September commits were five times a year earlier, partly driven by AI coding agents.
Google's Genie 4 world model is in trusted testers' hands — Google DeepMind. Interactive worlds with audio; consistency up to two minutes, double Genie 3, per Google.
AI bill of materials: firms control prompts but not model contents — Dev Interrupted. LinearB data shows AI-generated PRs merge at 33% versus 85% for human-written (8.1M PRs).
Microsoft Authenticator flaw let malicious Android apps get work-account tokens — The Hacker News. Patched in 6.2606.4246 and later; Microsoft reports no known attacks.
Microsoft offers voluntary buyouts to 60,000 employees — TLDR summary. Time-limited, across Canada, India, the UK and the US; Microsoft expects under 30% to accept.
Safe to skip
22 groups
What each skipped sender actually sent, so you don't have to open it. Chat notifications and promos were classified from their opening lines.
ChatGPT for All ×10Paywalled Substack how-tos (Claude Duet, Claude 2.0, Perplexity, prompting, GitHub repos, Higgsfield). Only headlines and paywall previews were readable; the $10K/month headline has no income figures in the email.
Meng Li, AI Disruption: chat notifications ×12'New thread' alerts that restate each article's subtitle with a discussion question. They add nothing beyond the articles covered above.
Tiago Forte / Forte Labs ×3Book pre-order pitch for Life in Perspective (out 3 November), an annual-review summit, and a fifth 'Review' step for the CODE framework. Its 99% figure has no source.
Pat Walls, Starter Story ×4Episode teasers and promos. Self-reported revenue headlines (an Excel-training site at $30K to $35K a month, a habit app at about $10K a month) and a HubSpot sponsor block.
Mohammed Faris, The Productive Muslim ×4Reminders for a six-week leadership programme starting 12 November, a livestream reminder, and a live episode on an Islamic business school. The essay on six purposes of business has no clean article link, and its argument is outlined only.
Noah Kagan ×2A Sloth free-trial pitch, and 'The Law of 100', which says 100 reps before quitting but cites an anecdote, not a study. Book link only.
Ibrahim Bashir, Run the Business ×2A Substack Live notice for 3 November with Ravi Mehta on the demise of product management, and a notice that a B2B metrics group chat was created.
Substack notifications ×4A notes digest (three short notes), two Substack product announcements (lists, chat channels, metered paywalls), and a live-video notice.
Gregor Ojstersek, book promotion'The Multiplier Mindset' Amazon links and endorsements. No article in the email.
Kent Beck, ByteByteGo Live adA paid class ad with one teaser about trust and the size of code changes.
Refactoring podcast 75 and Founders Corner Andreessen piecePodcast on building a software factory: the free text is an agenda, with the summary paywalled. The Andreessen piece gives six themes and paywalls its five rules.
Latent Space AINews and podcasts ×7Long recap digests. Their links are long beehiiv redirects that cannot be copied reliably, so they are not listed. The stories they covered (Mistral Large 4, Gemini 4 Carbon, the Anthropic S-1, Supabase agents) appear above from other sources.
Hacker Newsletter #816A list of links with titles only, including the Anthropic S-1 on the SEC site and a Mistral Large 4 weights story.
PerThirtySix (Rob and Shri) ×2A touchscreen explainer (installment 10 of its series; the article is not in the email) and a polarization essay whose chart is an image, so its values are not in the email. Also an NFL stats hub.
Nextool AI ×2Headline roundups: Opera's WebAI runs models locally in preview, and Meta's $95B raise (with $35B underwritten equity and $60B through an at-the-market programme).
Why Try AI, Sunday Rundown ×1Release list (Claude for Legal and Nonprofits, GPT-6.1 Terra, Liquid LFM3, Nemotron 3.5 Transcribe). No analysis.
Medium Weekly DigestArticle titles and read times only, with a lead on PHP security. No article text.
SwissCareerSwiss roundup: official unemployment 3% in Q2 2026, Switzerland first in the WIPO 2026 innovation index for the 16th year, and a 28 February 2027 naturalisation vote. Premium upsell.
LaraJobsWeekly job digest with two listings.
ByteByteGo ×2 (promotions)Annual membership ending on 28 October (deadline passed) and a data-movement article with only an outline in the email.
Kevin NaughtonA personal essay on being 'AI-pilled' with a Linear sponsor block and a plug for his own product. No data.
Frontend Focus, JavaScript Weekly and React Status classifiedsSponsor blocks and job listings, not summarized.