News from Thursday, 15 October 2026
43 articlesAI Models, Industry and Business
- Anthropic told investors its third-quarter revenue rose about 45% from the prior quarter to $16.8 billion, ahead of a possible IPO that could value it at $2 trillion [1]. Its distillation clampdown accounted for 5% to 7% of revenue-related usage, and it reported 11% adjusted operating margins [2].
- Anthropic gave METR employee-like access to evaluate its models and will publish the results of its risk assessments, while also working with SecureBio, Accenture and early talks with Hugging Face [3].
- Modal says it has crossed $1B in annualized run rate and raised a $16B Series D, with usage and valuation tripling in five months [4].
- Cohere announced a proposed agreement to acquire AISLE, an autonomous vulnerability-finding company, to strengthen its sovereign AI platform and European presence [5].
- Meta released the weights of Muse Spark Open, an 816B total / 42B active parameter MoE model under the Muse Model License, optimized for SGLang and vLLM on NVIDIA, AMD and Intel, with a 1M-token context window [6]. It is available in limited preview on GroqCloud, where Meta reports 350+ tokens per second per user [7].
- Mistral released Timestral, a family of time-series foundation models in four sizes (5M to 209M parameters); the largest ranks first on GIFT-Eval, TIME and fev-bench with two-thirds of the prior state-of-the-art parameter count [8].
- Google’s Harness² lets agents iteratively improve prompts, tools, memory and orchestration without changing model weights, carrying evidence-backed lessons forward to future tasks [9].
- A Substack analysis says more than half of businesses now pay for AI and growth will increasingly come from deeper adoption rather than new customers [10].
LLM Tooling, RAG and Agents
- Jev’s team reports it picked the right page first 88% of the time across 168 test questions, versus 70% for embedding search, and cut irrelevant results from 33% to 3% by answering "none" when no page fit [11].
- Phoenix is an open-source, self-hosted observability platform that captures OpenTelemetry traces and offers retrieval and response evaluations, datasets, experiments and prompt replay for LLM applications [12].
- LangChain’s agent eval guide recommends starting with 10 to 20 examples drawn from traces, combining code evaluators with LLM judges and human review, and using offline and online evals at different stages [13].
- Google’s Evaluating AI agents guide argues that agents can loop or burn tokens while still looking fine, and builds an eval pipeline for a LangGraph agent [14].
- XERJ is an Apache-2.0, Elasticsearch-compatible local search engine that auto-indexes code, logs, PDFs and CSVs for agent retrieval and RAG, with optional reranking that can send text to an external provider [15].
- A proof of concept shows row-level security for Claude Dashboards via MCP, with an MCP server authenticating users and querying DuckDB so access rules apply before data reaches Claude [16].
- Docker’s guide describes agent risks such as prompt injection, tool misuse and excessive autonomy, and argues for containing what an agent can reach and overseeing its actions [17].
- Addy Osmani recommends agentic verification: end-to-end tests as ground truth, property-based testing to hunt for forbidden states, and fast deterministic tests so agents can retry reliably [18].
- Google’s adk-recipes repo organizes ADK resources into core/, plugins/ and contrib/ layers, with installable vertical skills for coding assistants and deployment patterns on Google Cloud [19].
- Anthropic’s Code Review is now generally available for Team and Enterprise; most reviews now finish about 3x faster (about 20 minutes down to 6 to 10 minutes), with admins able to tune reviews per repository [20].
- GitHub’s agentic autofix for code scanning alerts is generally available: Copilot explores the codebase, proposes a fix, reruns CodeQL to validate it and opens a draft PR [21]. AI Scan for pull requests is also generally available, covering languages CodeQL does not yet support, as advisory findings [22].
Model Serving and Inference Infrastructure
- Meta describes using opportunistic idle inference capacity to rank more ads or route requests to stronger models, scaling back quickly when that capacity disappears while protecting normal latency and reliability [23].
- vLLM introduces a push-based NIXL connector that moves post-prefill KV transfer coordination off the critical path for disaggregated inference, improving TTFT and TPOT at high request rates [24].
- Netflix described how it detects faulty GPUs and network hardware, automatically remediates unhealthy machines, and keeps distributed training jobs alive through hardware failures [25].
- ExecuTorch now runs PyTorch models directly on Arm Cortex-M CPUs with CMSIS-NN acceleration; four MLPerf Tiny models run in 21.5 ms or less under 90 KiB of RAM on a Cortex-M55, with a core runtime under 20 KiB of flash [26].
- Pinecone BYOC added on-demand capacity mode, where indexes share a capacity pool with dynamic sharding instead of up-front shard sizing [27].
Data, Databases and DevOps
- A logical-replication walkthrough reports a PostgreSQL major upgrade with 181 ms of write interruption and 179 ms during rollback, with no data loss, using parallel old and new clusters [28].
- SQLBuild is an open-source SQL and Python framework that checks contracts and lineage before execution and supports safe renames and production diffs across Snowflake, Postgres, BigQuery and Databricks [29].
- pg_vectorsearch is a PostgreSQL extension for approximate nearest neighbor search [30].
- Benchmarks on 1,000 IDs found IN, ANY and VALUES joins performed similarly in PostgreSQL, so teams should verify with EXPLAIN on their own data [31].
- GitHub’s Evergreen app automates quarterly outside-collaborator access reviews and repo archival in a shared org, a pattern teams can adapt [32].
- GitHub retired email notifications for repository push events on October 15, 2026; teams that need them can use a GitHub Actions workflow with their own SMTP provider [33].
Security
- Ivanti warned of actively exploited Connect Secure zero-days, an authentication bypass chained with two others to run commands as root on vulnerable devices [34].
- Weaviate fixed a medium-severity authorization flaw in nearObject search (v1.39.3 and later) that let callers learn distances to protected vectors in other collections; a CVE is pending [35].
- Discourse resolved CVE-2026-55420, an ImageMagick-based upload flaw allowing arbitrary file read and write, by making a default-deny policy for ImageMagick delegates [36].
- Chrome 155 fixed 37 flaws, including seven critical memory bugs, with at least 15 reported by Anthropic with Claude’s help [37]. XBOW’s agents built a Chrome full chain in six days for about $40,000 in API costs; defenders should update to builds with the V8 and Chromium fixes [38].
- Meta says hackers took code and personal data of about 1,500 people in a GitHub breach, 99% of the stolen data being source code; it is rotating exposed secrets [39].
Developer Practices and Tooling
- Google’s DPoP support for OAuth sender-constrains refresh tokens, mitigating infostealer malware and adversary-in-the-middle attacks, and Google Cloud STS can handle token delegation across agent chains [40].
- A benchmark processed 7.6 GB of JSON in about 0.12 seconds using fastsimdjson on free-threaded Python across 64 cores, roughly 66 GB/s, by parallelizing and building Python objects only for needed fields [41].
- Jared Palmer argues that recognizing clean code remains useful, but knowing the right program shape before writing it is something AI cannot yet do [42].
- Rust 1.99.1 fixes regressions including a missing wcslen symbol that broke some targets, notably UEFI projects using std [43].
Sources
- Anthropic Says Revenue Jumped 45% to $16.8 Billion in Third Quarter nytimes.com
- Anthropic tells investors quarterly revenue up nearly 50% to $16.8bn ahead of IPO simonwillison.net
- An update on independent evaluators anthropic news
- [AINews] Modal’s $1B ARR, $16B Series D makes it NYC’s newest AI Infra Decacorn, 3x usage and 3x valuation in 5 months, 15x in 1 yr latent.space
- Cohere and AISLE sign letter of intent to advance cyber-resilient sovereign AI cohere
- Muse Spark Is Now an Open-Weights Model pytorch.org
- Meta’s Muse Spark open-weight release Is Now in Limited Preview on GroqCloud groq
- Introducing Timestral mistral
- Google Harness² for Recursive Self Improvement github.com
- Cracks in the AI Thesis Part 3 econlab.substack.com
- Jev handed our LLM the wrong page a tenth as often as our embeddings sayora.ai
- Phoenix github.com
- The Most Common Questions About Agent Evals, Answered langchain.com
- Evaluating AI agents: moving past the vibe check google ai
- XERJ github.com
- Need to Know: Implementing row-level security for Claude Dashboards via Model Context Protocol thedatavist.substack.com
- AI Agent Security Risks: What Can Go Wrong When Agents Act on Their Own docker.com
- Agentic Verification addyo.substack.com
- Three layers, one repo: a tour of google/adk-recipes google ai
- Code Review is now generally available claude
- Agentic autofix for code scanning alerts general availability github.blog
- AI Scan for pull requests generally available github.blog
- Turning Opportunistic AI Inference Capacity Into Better Ads Recommendations engineering.fb.com
- Push-Based KV Transfer to Improve TTFT and TPOT for Disaggregated Inference in vLLM vllm.ai
- How Netflix Keeps Large GPU Jobs Running netflixtechblog.com
- Bringing ExecuTorch to Arm Cortex-M CPUs pytorch.org
- On-demand mode for Pinecone BYOC pinecone
- Zero-downtime Postgres upgrades with logical replication tapoueh.org
- SQLBuild: safe refactoring for warehouse SQL github.com
- pg_vectorsearch github.com
- Four PostgreSQL arguments that came out even explainmeasured.com
- Staying Evergreen: How we automated secure access and repo hygiene in a shared org github.blog
- Email notifications for repository push events have been retired github.blog
- Ivanti Warns of Connect Secure Zero-Days Exploited in Attacks bleepingcomputer.com
- Weaviate security release - Medium severity fix for a cross-collection vector disclosure in nearObject (CVE pending assignment) weaviate
- Discourse ImageMagick Vulnerability Enables Arbitrary File Read Through Malicious Image Uploads gbhackers.com
- Chrome, Firefox Updates Patch 114 Flaws as Mozilla Unveils Firefox Enterprise securityweek.com
- Zero to Calc in Six Days: Inside XBOW’s Chrome Full Chain xbow.com
- Meta Says Hackers Took Code and Personal Data of 1500 People in GitHub Breach securityweek.com
- Announcing DPoP Support for Google OAuth: Securing Refresh Tokens google ai
- Parsing JSON at tens of gigabytes per second… in Python lemire.me
- Code you didn’t write jaredpalmer.com
- Announcing Rust 1.99.1 blog.rust-lang.org