<p><strong>TLDR:</strong> Cognition closed over $1B at a $26B valuation with $492M ARR and a customer list that includes Goldman Sachs, NASA, and Mercedes-Benz. OpenAI’s Codex had a rough day — reports of a full outage circulated while a malicious npm package called <code>codexui-android</code> was caught silently stealing auth tokens from 27,000 weekly users. Google I/O '26 dropped a wave of agent infrastructure including Gemini 3.5 Flash, Antigravity 2.0, and a unified ADK 2.0. Temporal’s Replay 2026 conference revealed OpenAI’s Temporal usage grew 60x in 2025, with Cursor reporting 50M+ Temporal actions per day.</p>
<hr>
<h2>Cognition raises $1B, reports $492M ARR</h2>
<p>Cognition raised over $1B at a $26B valuation — more than double its $10.2B valuation from eight months ago. Revenue grew 13x in 12 months from $37M to $492M ARR, with enterprise usage up 50% month-over-month for six consecutive months. The company claims 90% of its own internal code is now written by Devin, and its customer list now includes Goldman Sachs, NASA, Mercedes-Benz, and Santander. Cognition also picked up remaining Windsurf assets after Google took the top talent, positioning itself as an orchestration layer above foundation models rather than a model lab.</p>
<h2>Codex outage and a serious supply chain attack</h2>
<p>Developers reported Codex going fully down today, with OpenCode separately patching stalling issues caused by Codex subscription endpoint problems over the past week. More seriously, a polished npm package called <code>codexui-android</code> — 27,000 weekly downloads, active GitHub repo — was caught exfiltrating Codex auth tokens to an attacker-controlled server for over a month. The malicious code was injected only into the published npm artifact, not the GitHub source, making it invisible to source audits. The same author ships an Android app on Google Play that automatically pulls and runs the malicious package on launch. This is a textbook supply chain attack: build something genuinely useful, establish credibility, then weaponize it.</p>
<h2>Google I/O '26 agent platform announcements</h2>
<p>Google announced a unified agent development toolkit centered on the Gemini Enterprise Agent Platform. The stack has four layers: Agent Studio (low-code builder), Managed Agents API (agent-as-a-service), Antigravity 2.0 (desktop app and CLI for orchestrating coding agents), and ADK 2.0 (code-first framework for custom agent meshes). New models include Gemini 3.5 Flash optimized for agentic and coding tasks, Gemini Omni for multimodal video, and Gemini Spark — a persistent 24/7 personal agent for Workspace users. All layers share the A2A protocol for interoperability. The breadth of the release is notable; Google, Anthropic, and AWS all shipped nearly identical managed agent runtimes within six weeks of each other, which tells you something about where the industry thinks the floor needs to be.</p>
<h2>Temporal Replay 2026: OpenAI usage grew 60x</h2>
<p>Temporal’s Replay 2026 conference at Moscone Center had a few numbers worth paying attention to. OpenAI’s head of applied infrastructure said their Temporal usage grew 60x in 2025, scaling 20x in Q2 alone, covering ChatGPT agentic workflows, infrastructure control planes, and data pipelines. Cursor reported 50M+ Temporal actions and 7M+ unique workflows per day, with one-third of internal PRs now coming from Cloud Agents — up from a fragile homegrown runner-node architecture that was essentially a bad Temporal clone. New product announcements include Temporal Serverless Workers (Lambda/Cloud Run), Workflow Streams for real-time observable output, and Standalone Activities as a durable job processing primitive.</p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>Starlette CVE-2026-48710 (BadHost):</strong> A host-header bypass in Starlette affects FastAPI and a wide slice of AI infrastructure including LiteLLM, vLLM, and MCP servers — upgrade to Starlette 1.0.1 now, especially if you’re running anything without a reverse proxy in front.</li>
<li><strong>Snowflake $6B AWS deal:</strong> Snowflake committed $6B to AWS over five years, its largest cloud spend ever, covering Graviton ARM instances and GPU compute for Cortex AI inference and agent workloads.</li>
<li><strong>Meta AI subscriptions:</strong> Meta launched paid AI chatbot tiers at $7.99 and $19.99/month, initially in Singapore, Guatemala, and Bolivia, with roughly 1 billion monthly active users as the potential conversion base.</li>
<li><strong>Robinhood agentic trading:</strong> Robinhood opened a beta platform letting AI agents trade stocks and use virtual credit cards via MCP, becoming the first major retail brokerage to do this — regulatory questions around FINRA Rule 3110 remain open.</li>
<li><strong>Cognition customer list:</strong> Organizations building with Devin now include Goldman Sachs, NASA, Mercedes-Benz, Ramp, Modal, Rivian, and both the US Army and Navy.</li>
<li><strong>ITBench-AA benchmark:</strong> All frontier models score below 50% on this new enterprise SRE benchmark from Artificial Analysis and IBM — Claude Opus 4.7 leads at 47%, GPT-5.5 at 46%, with longer agent trajectories correlating with worse scores.</li>
<li><strong>Malicious npm targeting Claude:</strong> A package called <code>mouse5212-super-formatter</code> was caught stealing files from Anthropic’s Claude user directory and uploading them to a GitHub account; the malware leaked its own private token, suggesting AI-generated malicious code with poor opsec.</li>
<li><strong>Remote hits $300M ARR:</strong> The payroll startup credits a 50% revenue-per-employee increase to company-wide AI adoption, with 85% of code now AI-written and no headcount added.</li>
<li><strong>NVIDIA Dynamo Snapshot:</strong> A checkpoint/restore solution for inference on Kubernetes that reduces cold-start times up to 21x for large models by combining CRIU with CUDA state serialization.</li>
<li><strong>DeepSeek V4:</strong> Released with two new attention mechanisms (CSA and HCA) enabling a 1M token context window at 10% of V3.2’s KV cache cost; API pricing is 75% cheaper than V3.2.</li>
<li><strong>Qwen3.7 Max:</strong> Alibaba’s new closed-weight flagship ranks #5 on the Artificial Analysis Intelligence Index at $2.50/$7.50 per 1M tokens, though it generated 4x median output tokens during evaluation, narrowing the real cost advantage.</li>
<li><strong>Stack Overflow forum traffic:</strong> Question volume has collapsed to 2008 levels as developers route queries to AI tools, but the company doubled revenue to $115M by pivoting to enterprise AI products and data licensing.</li>
<li><strong>AI coding agent adoption:</strong> A Stack Overflow survey of 1,100 developers shows agent adoption nearly doubled from 31% to 59% since 2025, but 63% still rarely or never let agents run unsupervised.</li>
<li><strong>Tokenmaxxing backlash:</strong> Uber’s CTO publicly admitted blowing through the Claude Code budget; Lanai launched Token Tuner to map token spend to business outcomes rather than raw usage metrics.</li>
<li><strong>Cursor Composer 2.5:</strong> Early testing shows task completion under 47 seconds versus 3+ minutes for Claude Opus 4.7, at an average cost of $0.55 per task versus $4–11 for competing models.</li>
<li><strong>ClickHouse tops $250M ARR:</strong> More than tripled year-over-year, with new launches including Claude-powered ClickHouse Agents with MCP integration and Managed Postgres in public beta.</li>
</ul>


AI coding assistants, code generation tools, and vibe coding workflows.

Agentic Digest

Cognition raised over $1B at a $26B valuation with $492M ARR, more than doubling its valuation in eight months, with customers including Goldman Sachs, NASA, and Mercedes-Benz. OpenAI's Codex suffered a full outage while a malicious npm package called `codexui-android` stole auth tokens from 27,000 weekly users via a supply chain attack hidden in the published artifact. Google I/O '26 announced a unified agent platform including Gemini 3.5 Flash, Antigravity 2.0, and ADK 2.0. Temporal's Replay 2026 revealed OpenAI's usage grew 60x in 2025, with Cursor logging 50M+ Temporal actions per day. Additional highlights include a Starlette CVE affecting FastAPI and AI infrastructure, Snowflake's $6B AWS deal, DeepSeek V4's 1M token context window, Stack Overflow question volume collapsing to 2008 levels, and AI coding agent adoption nearly doubling to 59% among surveyed developers.

Cognition raises $1B at $26B valuation, Codex hits supply chain and outage trouble