Reading

Shalev Hulio, former CEO of the Israeli spyware company NSO Group, now runs an AI cybersecurity firm called Dream, which he co-founded in 2022 with former Austrian Chancellor Sebastian Kurz. Dream sells 'sovereign AI' solutions to various governments—using narrow, specialized models that run on one to three GPUs, trained on customer-specific data, without relying on external cloud infrastructure.

Hulio’s core argument is straightforward: AI is critical infrastructure, and governments should not risk the scenario where 'someone wakes up one day and shuts off your model.' In an interview with the UK’s Financial Times, he said, 'Every government should have its own model.' This statement comes from someone actively selling models to governments, making the conflict of interest obvious, but the argument points to a genuine procurement concern—if national security data runs on US companies’ clouds, the supplier’s willingness and availability become external dependencies.

Dream’s market data supports the existence of demand in this sector: the company has raised $400 million in funding and was valued at $3 billion earlier this year, having sold products to more than twelve countries across Europe, Asia, and the Middle East. Dream also gained attention for detecting the 'world’s first end-to-end autonomous AI attack,' reportedly involving Chinese hackers using open-source AI models to discover and chain vulnerabilities to breach Taiwan government systems, including those of the nuclear safety agency.

However, actual government procurement logic does not always point toward self-building. At the Singapore International Cyber Week on October 13, Singapore’s Coordinating Minister for National Security K. Shanmugam explicitly stated: 'We do not need to develop our own AI models for every use case. What we really need is the capability to evaluate the best available models and adapt them.' Singapore is exploring models such as Anthropic’s Claude to strengthen cyber defenses and has signed a memorandum of understanding with Anthropic.

The divergence between these two approaches represents the core supply-demand tension in the sovereign AI track. Hulio’s argument holds if governments truly cannot bear the risk of service interruption by external suppliers and if the cost of building narrow models internally is lower than relying on external platforms. Shanmugam’s stance suggests that for most governments, evaluating and adapting existing models is more pragmatic than building from scratch. Who is closer to real-world needs depends on each country’s statutory requirements for data sovereignty, available GPU budgets, and ability to recruit sufficient AI engineering talent—conditions that vary significantly across nations. Dream’s client base of over twelve countries illustrates that at least some governments have chosen the path Hulio recommends.

On October 26, 2026, OpenAI published a video detailing how the major U.S. law firm Sullivan & Cromwell LLP utilizes its technology to build internal legal tools. In the video, John Savva from the firm demonstrates the workflow for a tool named 'Agreement Analyzer'.

According to the episode description provided by OpenAI, Agreement Analyzer brings together draft agreements, selected precedents, and playbooks that reflect both the firm's and the client's positions. The tool is designed to identify potential legal issues and automatically returns a memo along with proposed tracked changes for a lawyer to review.

This workflow emphasizes the importance of human-in-the-loop processes. Lawyers can inspect the sources and explanations behind the findings, then accept, revise, or reject the proposed changes before advising the client. For readers interested in the practical application of AI in professional services, this video offers a concrete case study of how a top-tier law firm embeds large model capabilities into rigorous legal practice.

Samsung SDI's Michigan-based subsidiary recently signed a 1GWh supply agreement with Alpha Omega Power (AOP), a US utility-scale energy storage developer. Combined with an initial 0.5GWh order from late 2025, the cumulative supply volume reaches 1.5GWh, with the contract value estimated at hundreds of billions of South Korean won.

Samsung SDI will provide its Samsung Battery Box (SBB) 1.7 integrated energy storage system solution, featuring nickel-cobalt-aluminum (NCA) prismatic batteries. All cells and modules will be produced at the StarPlus Energy plant in Kokomo, Indiana, with delivery scheduled by year-end. AOP plans to deploy these systems in large-scale power projects starting construction in Texas next year.

The SBB 1.7 has obtained NFPA 855 fire safety installation standards and UL 9540 energy storage system safety certification, incorporating Samsung SDI's proprietary direct-injection extinguishing technology within modules. As the only non-Chinese prismatic ESS battery manufacturer in North America, Samsung SDI is leveraging local production and safety certifications to capture demand driven by AI data center expansion and grid modernization.

At TechCrunch Disrupt, Alexander Embiricos, who leads OpenAI’s enterprise product team, explained the design philosophy behind dots, summarizing the product team's work in one sentence: "A lot of that isn’t building some new piece of tech into the product; it’s how you frame it to the user and how it feels." This may sound like public relations boilerplate, but it points to a specific design decision—defining dots as "one entity, one conversation," rather than a collection of many different conversations.

Embiricos said, "There’s kind of this convergent evolution happening," referring to the efforts by various companies to build AI assistants. He noted that the OpenAI team realized if they could frame the product as "an entity and it’s a single conversation, not many different conversations… it starts to become intuitive." This choice was cognitive rather than technical—the underlying model did not change—but it meant users were not facing a system requiring them to manage multiple session windows, but rather a "person" that continuously understands them and proactively thinks about how to help.

The evolutionary path of dots also confirms this logic of prioritizing framework over technology. Embiricos pointed out that users could actually achieve most of dots’ functionality using Codex, OpenAI’s coding tool released earlier in the year, "but that requires more work and hand-holding." What the product team did was repackaging the underlying capabilities of Codex so that non-engineers could use it. This path aligns with OpenAI’s move to spin ChatGPT Work out of agentic coding tools built for software engineers: the technology already exists, and the product team’s job is to make it intuitively accessible to more people. Even the name itself—derived from the negative space in OpenAI’s logo—is intended to "feel like just something that could eventually be ubiquitous."

"Proactive research" is the core mechanism distinguishing dots from traditional chatbots. Embiricos described its operation: "On a cadence, it will think about what it knows about you, what is the conversation that it’s had, and then what have you given it access to that it can think about, and then it will go and research, ‘What could I do to be more helpful to you?’ And then, basically, it will propose that." This means dots works even when the user is not asking questions, implying more token consumption for OpenAI and an assistant that is "thinking about you and thinking how to help you" for the user.

However, testing by TechCrunch found that while this proactive thinking ability is apparent and often useful, it is not yet mature. Embiricos cited his own example: the first time dots alerted him to a calendar conflict, it was only three minutes before the event. "It’s like, ‘Hey, this thing is coming up. You might want to do something about it.’ I only have three minutes!" He expects timing precision to improve, but emphasized that being "proactive" is key to the product. Another example he cited came from an engineer at a drone delivery startup: during a service outage, dots had already noticed the issue, analyzed it, and come to the engineer with a solution.

Telefónica and Nokia recently released a video conversation focusing on how telecommunications operators are transforming network infrastructure into platforms for AI agents. In the episode, Marcelo Madruga from Nokia and Alexandre Harmand from Telefónica explore the evolution of network platforms, particularly around automation, cloud-native operations, GitOps, and network exposure.

The core of the discussion centers on leveraging APIs, Model Context Protocol (MCP), and Agent-to-Agent (A2A) communication protocols to make underlying network capabilities more accessible to developers and AI agents. This strategy aims to lower technical barriers and create new B2B service revenue streams for telcos. Additionally, the speakers mention the application of IMS Data Channel, suggesting it brings new value to traditional voice services, starting with enterprise use cases and expanding as the device and application ecosystem matures.

For professional readers interested in the commercialization of AI infrastructure and telecom industry transformation, this resource offers a first-hand perspective on how network capabilities are adapting to Agentic AI architectures. Although a full transcript is not provided, the publisher explicitly lists these key topics, illustrating the strategic shift from connectivity services to intelligent platform services.

US aerospace startup Poseidon Aerospace announced it has closed a $60 million Series A financing round led by TQ Ventures. The funds are dedicated to supporting the development of Egret, an autonomous cargo aircraft currently under construction by the company.

Egret is a uniquely designed unmanned freighter featuring a 50-foot wingspan and a payload capacity of up to 4,000 pounds. Unlike conventional cargo planes adapted from passenger or piloted designs, Egret was conceived without a cockpit, dedicating all internal space to cargo rather than flight controls and pilot accommodations. This design choice aims to reduce weight and maximize freight volume.

The project is led by David Zagaynov, a former Amazon engineer specializing in logistics, and Parker Tenney, a mechanical engineer previously at Lockheed Martin. Zagaynov describes the concept as "the autonomous trucks of the sky," intended to move shipments between locations as cheaply as possible. Although there is no human pilot onboard, initial testing involves remote operators managing flight via live camera feeds and ground control stations.

Key performance metrics such as range, cruising speed, fuel consumption, and operating costs have not been disclosed, meaning actual freight efficiency remains unknown pending upcoming test flights in Oregon. This financing highlights continued investor interest in large-scale autonomous aviation logistics, though commercial viability depends on future technical validation and regulatory approvals.

Australian tech media outlet iTnews reported that the recently patched high-risk vulnerability in Node.js, known as Node2Shell (CVE-2026-111497), actually stems from Google's Brotli compression library. While Node.js is affected because it embeds this component, Paul McCarty, co-founder and CTO of security firm OpenSourceMalware, discovered that libraries and applications in Python, Go, .NET, and Perl ecosystems also use Brotli, as do browsers, desktop applications, and infrastructure software. This indicates the vulnerability's impact extends far beyond Node.js itself.

McCarty noted that the Python packages Brotli and brotlicffi have been confirmed to use the affected decoder, with patched versions released on October 22 and 23, respectively. Products like Chrome, Firefox, and Envoy have also addressed related issues. However, since some products embed the Brotli library directly, enterprises may still have other software using unpatched versions even after updating Node.js or OS packages. Whether a system is affected depends on the specific version of Brotli used and whether it decompresses untrusted data.

The vulnerability lies in the decoder responsible for decompressing data in Brotli. If an attacker can trick an application using an affected version into decompressing specially crafted data, it could trigger an out-of-bounds write, leading to memory corruption or even remote code execution. The CVSS 4.0 risk score is 9.2. Security firm Miggo traced the vulnerability history and found that the problematic code was added to Brotli on February 26, 2018. Although the upstream project corrected the relevant code on February 27, 2026, it was not identified as a security vulnerability at the time, and the official release containing the fix was only published on October 21. This time gap demonstrates that fixing upstream code does not mean dependent software has automatically received the patch.

Node.js released security updates on October 21 to patch the out-of-bounds write vulnerability in the Brotli decoder, with updated versions including 22.23.4, 24.22.1, and 26.12.1. The Taiwan Computer Emergency Response Team / Coordination Center (TWCERT/CC) also issued a security advisory, reminding enterprises to audit backend services, container images, web frontend toolchains, and Node.js versions used by some AI agent command-line tools, and to complete updates promptly. For other software embedding the Brotli library, enterprises should confirm whether they use affected versions and apply patches according to product security advisories.

Arsalan Tavakoli-Shiraji is the co-founder and Senior Vice President of Field Engineering at Databricks. Databricks is currently valued at $190 billion, with more than 70% of Fortune 500 companies as customers. However, in his speech at TechCrunch Disrupt, his core argument was not about how powerful the technology is, but rather that technological superiority alone is not enough.

He recalled an early experience: after finally securing a meeting with a potential client, he discovered that the person had just signed a major deal with his primary competitor.

Tavakoli-Shiraji categorized the core concerns of enterprise clients regarding AI into four categories, which he calls the "four Cs."

The first is Context: Can AI be trained like a new employee to learn the company's terminology, processes, and priorities? The second is Choice: Can enterprises freely switch AI models rather than being locked into a single vendor? The third is Cost: Is the operating cost of AI products controllable? The fourth is Control: Are there sufficient safety guardrails to constrain AI behavior and protect sensitive information?

Regarding the actual level of enterprise AI adoption, Tavakoli-Shiraji offered a candid assessment. He jokingly asked CIOs on a scale of one to five where their company stands: a one means employees merely have access to ChatGPT, while a five means the company has already transformed its business processes using AI.

He believes the biggest opportunity today is not for enterprises to create flashier AI demonstrations, but to modernize those expensive legacy systems.

In terms of distribution strategy, Tavakoli-Shiraji shared a key turning point in Databricks' early days: they initially tried to secure a meeting with the Swiss bank UBS directly but failed. Later, they established a partnership with Microsoft, becoming an Azure cloud partner, which meant sales agreements were covered under Microsoft's terms. More importantly, Microsoft's sales team proactively booked meetings and advocated for Databricks.

Tavakoli-Shiraji also recalled that early deals often fizzled not because the technology was inadequate, but because startups were unprepared to address legal, contractual, or security issues.

These insights stem from Tavakoli-Shiraji's personal enterprise sales experience. He frankly estimates that 99% of the enterprises he has spoken with remain at level one or two, noting that "it will take many, many years before people can actually properly deploy AI in a very meaningful way in the enterprise."

The framework of the four Cs is itself testable: any team selling AI products to enterprises can use these four dimensions to benchmark their sales materials and identify exactly which 'C' causes customer rejection. Tavakoli-Shiraji was responsible for helping secure Databricks' first major clients in its early stages, and this classification method derives from his practical enterprise sales experience.

Anthropic disclosed a set of easily overlooked figures in its S-1 filing: during the three months ended September 30, 2026, over 80% of its revenue was generated from model versions released within the previous six months. This implies that Anthropic’s current revenue is heavily dependent on its most recent models, while the development costs for these latest models are entirely expensed as research and development (R&D) and do not enter the cost of goods sold (COGS).

The logic for traditional software companies differs. A company develops a product once and can benefit from the same codebase for subsequent years; R&D is a one-time investment, while COGS primarily consists of hosting, support, and minor maintenance. Consequently, gross margin can truly reflect the economics of unit delivery. In Anthropic’s case, models have a shelf life; today’s revenue requires tomorrow’s R&D to sustain it. Here, R&D is not an investment in the future but a necessary expense to maintain current revenue.

OnlyCFO performed a sensitivity calculation: if 50% of R&D expenses were allocated to COGS, Anthropic’s gross margin for the first half of 2026 would be approximately 55.5%. While still respectable, the gap between this figure and the reported number is sufficient to demonstrate that the two metrics are not calculated on the same basis. The author also notes that if Anthropic achieves recursive model training in the future—requiring less R&D to produce new models—this issue might diminish, but this remains an unfulfilled condition.

Practical implication for readers: When comparing Anthropic’s gross margin with that of listed software companies, one cannot rely solely on reported numbers. An AI model company reporting an 80% gross margin may have a true unit economic closer to 55%–60%, whereas a traditional SaaS company reporting a 75% gross margin may be closer to its actual delivery costs. This does not imply that Anthropic’s business is poor—its positive free cash flow ($3.4 billion in the first half), 900% net revenue retention, and $6.6 million revenue per employee remain outstanding—but rather that the meaning of the gross margin metric differs between these two types of companies.

The S-1 also exposes another structural risk: Anthropic disclosed that 5%–7% of its year-to-date revenue comes from companies violating its usage policies. Using a midpoint of 6%, this equates to approximately $4 billion in annualized revenue coming from current or potential competitors using Anthropic’s models for distillation. This revenue stream itself helps fund future competitors.

In June 2026, when AlixPartners took control of Shimao Group’s 1,219-room hotel complex in Tung Chung, Hong Kong, it faced not just a building to be sold, but an active hospitality business. Una Ge, a managing director at AlixPartners serving as joint receiver, told the South China Morning Post that the mandate was to protect this live hotel operation from liabilities linked to Shimao’s broader debt while managing a transaction involving more than 1,000 contracts. Ultimately, the asset package, comprising the Sheraton Hong Kong Tung Chung Hotel and the Four Points by Sheraton, was sold to Oceanfront Hong Kong, controlled by Malaysia’s ParkCity Group, for HK$2.7 billion (approximately US$344 million). This represents a 40% discount against the HK$4.5 billion syndicated loan facility.

However, Ge emphasized that the core of the deal was not 'selling buildings to pay down debt.' The receiver team coordinated with Marriott International to ensure uninterrupted hotel operations even before formal court orders were issued.

Hotels are operating businesses, not passive real estate assets.

Maintaining 'business as usual' is critical for prospective buyers and for lenders deciding whether to support the sale.

Specific operational steps included working with Eversheds Sutherland and Marriott’s regional M&A team to draft two interconditional agreements separating physical assets from operating entities, allowing the Malaysian buyer to assume control without inheriting Shimao’s wider corporate debt; novating more than 1,000 commercial agreements and securing consents under Marriott’s long-term management contract; and directly managing the adjacent T Bay shopping mall by renewing retail leases, upgrading signage, and launching guest-discount programs. Ge stated that monthly hotel revenue posted year-on-year gains throughout the entire sale process.

The return on these efforts was evident during the bidding phase. The tender attracted formal interest from buyers across nine markets, including mainland China, Singapore, Malaysia, Japan, Australia, Europe, the Middle East, and the United States. Following the initial tender, the receivers asked shortlisted parties to revise their terms, and all submitted higher offers. Ge said that decisions in such processes are not based solely on price; execution certainty, financing commitments, and board approvals also carry significant weight.

From a broader perspective, Shimao initially sought between HK$6 billion and HK$6.5 billion for the two hotels in 2023, lowering its expectations to HK$4.5 billion late last year, before finally settling at HK$2.7 billion. This discount magnitude reflects the steep concessions banks are making to reduce balance-sheet pressure and limit provisioning. The gap between Shimao’s initial seek of HK$6 billion and the final HK$2.7 billion also illustrates that even with operational preservation, asset prices remain constrained by overall liquidity in a frozen market.

As a restructuring veteran with 18 years of experience, Ge pointed out that while the legal tools available to advisers remain broadly unchanged, the scale of Chinese developer defaults has expanded the network of offshore stakeholders beyond anything seen in previous cycles. Shimao demonstrated cooperation during the receivership—proactively providing information and agreeing to confirm in Hong Kong Stock Exchange disclosures that the hotels would continue normal operations—which is uncommon in offshore receiverships. Ge noted that most borrowers resist creditor enforcement.

A button disappears under an iPhone viewport. Static code review would not catch this issue—the code logic is correct, the developer’s intent is met, but the rendering result is wrong. Daksh Gupta, co-founder and CEO of Greptile, believes this marks the boundary of AI code review: reading code can check logic, but some defects must be exposed by actually running the application.

Greptile is a company that builds AI agents for code review and testing. Gupta says validating a pull request involves multiple layers: whether the code logic is correct, whether it implements the developer’s intent, whether there are security vulnerabilities, and whether it breaks existing functionality. Some of this validation can only be done by running the application.

GPT-6 Astra’s computer use capability gives Greptile a new path. The specific approach is: start a development server for a pull request, resize the browser to an iPhone-sized viewport, and then simulate a user moving through the application. The model’s visual understanding allows it to inspect screen content and spot hidden buttons.

"A QA firm testing all your changes is just impractically slow considering how fast we’re able to ship code with these models," Gupta says. His judgment is that computer use capability has reached a level where it can automate the process of "a user experiencing your application and trying to break it," thereby giving large companies more confidence in shipping.

Greptile also provides codebase documentation to Codex via a Model Context Protocol server. Gupta states that providing context reduces the fallback rate of AI-generated code, saving customers time and inference costs. However, this metric is based on internal tracking, with no public methodology or third-party verification.

Overall, Gupta’s core argument is a shift in capability boundaries: when AI models’ visual understanding and interaction simulation capabilities are strong enough, the object of defect detection expands from code text to application behavior. This judgment comes from Greptile’s actual usage experience, and independent benchmark tests verifying its coverage and false positive rates have not yet been conducted.