Your stack keeps getting acquired. The advice going round this week is to stop renting it.

The 60-second catch-up

The CSS framework under your product now belongs to a commerce company, and that is the smaller half of the story.

Adam Wathan announced that Tailwind Labs is joining Shopify. Tailwind installs over 110 million times a week and styles ChatGPT, X, Cloudflare and Reddit; Wathan's stated reason is that the framework needed a stable long-term home where it would keep being maintained (Adam Wathan). Read that as the good outcome, because it is. But it lands in a week where Sequoia is telling its portfolio to own their models down to the weights rather than rent them, arguing open-weight families now start close enough to the frontier to be worth building on (Sequoia's own-vs-rent framework) — and where Cognition raised $2bn at a $48bn valuation while training its own model specifically to cut its dependence on OpenAI and Anthropic (TechCrunch). Cursor, meanwhile, now lets cloud agents execute on machines you run yourself (Cursor).

→ do this: write down the three dependencies you could not fork or replace inside a month. That list is your actual risk register, and it is shorter and scarier than your vendor spreadsheet.

A reporting clock starts tomorrow, and it does not care how small you are.

From 11 September, the EU's Cyber Resilience Act requires anyone selling a network-connected product into the EU to report an actively exploited vulnerability on a fixed cascade: early warning within 24 hours of finding out, fuller notification within 72 hours, final report within 14 days of a fix (National Law Review). There is no revenue threshold and no grandfathering — it applies to products already on the market, so a five-person team with one EU customer is inside it. The rest of the regulation follows in December 2027.

→ do this: today, write down who makes the 24-hour call, what they send, and to whom. The clock runs from awareness, which means it starts during the confused hour when nobody is sure yet.

Apple's first September keynote under a new CEO put the AI work on the phone rather than in the demo reel.

John Ternus's debut brought iPhone 18 Pro at $1,199 and Pro Max at $1,299, and in October the foldable iPhone Duo — 7.6-inch inner display, 5.4-inch outer, A20 Pro chip, pre-orders 16 October and availability 23 October (Apple). The dated part matters more than the hardware: Siri AI ships as a beta with iOS 27 on Monday 14 September, English only, with French, Japanese, Korean, Portuguese and Spanish following in October (Apple).

→ do this: if you ship an iOS app, the thing to plan against is not the foldable. It is a Siri that arrives in beta, in one language, five weeks before the rest — assume a staggered rollout and do not tie a launch date to it.

Tools

Build & ship

• ⭐ TeamAI — Git-native management of skills, rules, MCP servers, env vars and knowledge across Claude Code, Codex, OpenCode and others. Point a team at one shared repo and every agent session pulls the current setup with no manual sync. · Open source (MIT)
• Vercel Flat Rate CDN — One fixed monthly fee covering CDN requests, fast data transfer, blob transfer and CDN observability events, with spike protection so a viral launch does not become a surprise invoice. · Default tier included with Pro; higher tiers $20 / $100 / $300 per month
• Archyl — Connect a git repo and it derives a C4 model of your systems, containers and components, then keeps the diagrams in sync on every push. Also imports existing ADRs and markdown docs. · Free plan for individual developers, then per-seat

AI & agents

• ⭐ Claude for Microsoft 365 — Claude working inside Excel, Word, PowerPoint and Outlook — ask questions of a spreadsheet, build a model from a brief, draft replies that wait for you to send. Every edit is reviewable and it follows your own templates. Outlook is in beta. · Paid
• Opusfived — A one-screen exercise: make the "Add to Cart" button blue and stop the model touching anything else. Cheap, fast practice at the skill that actually decides whether agent output is usable — scoping the instruction. · Free

Design & create

• tsParticles — Particle backgrounds, confetti and firework effects for React, Vue, Angular, Svelte, Solid, Web Components or plain JavaScript, with slim and full bundles so you can hold the payload down. · Open source (MIT)
• Self-hosted Google Fonts configurator — Pick a family, choose the weights and subsets you actually use, download the files and serve them yourself — so your pages stop making a request to Google's servers on every load. · Free

Resources

Steal the template

• The free money list — 150+ equity-free funding sources across nine categories: government innovation grants, R&D tax credits, revenue-based financing, venture debt, prizes and fellowships, cloud and AI credits, corporate programmes, mission capital and public procurement. Each entry carries stage, region, amount, eligibility, deadline cadence and rough time-to-money. Guillermo Flor pairs it with a Claude agent that interviews you first, sorts the list into eligible and not, then re-interviews you in the evaluator's order to draft the application. The preview is free; the database itself is behind the paywall.
• Sequoia's own-vs-rent framework — a four-step roadmap for deciding which layers of the AI stack to own outright and which to rent, weighted on cost, speed and control.
• Growth is a system — map the whole growth system and find the constraint before you pick tactics or open a headcount req.
• Hire every engineer like you'd hire a VP — executive-search method applied to engineering hiring, on the argument that the shortlist worth building is one where the candidates make each other better.
• Firing underperforming employees (at startups) — Liz Wessel's sequence: nobody should be surprised, discuss performance long before anything happens, get separation documents drafted, offer severance against signature, tell the team with respect.

Learn the craft

• The Critical Design Engineering Manifesto — eleven statements adapting the 2011 Critical Engineering Manifesto for people working with agentic tools: treat generated code as both capability and threat, design seams rather than seamlessness, record the why. Versioned as a public gist under the GNU Free Documentation License, with an influence register crediting each source.
• Nine design fixes for your UX research reports — structure, imagery, hierarchy, contrast, spacing, alignment and templates, for research nobody currently reads.
• .gitignore everything by default — invert the default: ignore everything, allow specific paths, and accidental commits of local junk stop being possible rather than merely unlikely.

Benchmarks you can re-run

• Hyper-τ-bench — Sierra's benchmark drops a developer agent into a sandboxed workspace holding a simulated business's records, with a simulated client it can message, and asks it to recover the spec and build a working customer-service agent that serves within a per-conversation cost budget.
• Pretraining progress is mostly coming from data — a controlled sweep of open recipes and datasets from 2019 to 2025, separating data gains from architecture gains. Small models and pretraining only, and the authors say so.

Reads

☕ Under 5 minutes

• The new moats are the same as the old moats — Josh Elman: single-player AI utility switches the moment the model does; network effects, marketplaces and platforms still don't.
• The Late Software Developer — the shift from flow-state coding to orchestrating twenty-plus agents, and why the factory becomes the product.
• Stealing AI reasoning traces — Bruce Schneier on making a weaker sibling model decode and print a stronger model's reasoning traces, without touching the stronger model.
• Is the 3x AI productivity gain just a computer that never sleeps? — Tomasz Tunguz on parallel machine-hours as the real source of the gain.
• AI can write the memo. It can't sit in the meeting. — where generated documents fall over: the follow-up question.
• Camera app in iOS 27 reportedly includes four pro photography features — histograms, waveforms, focus peaking, zebras, found in beta code.
• Gemini's Android overlay gets a minimisable bubble — small change, real multitasking difference.
• My biggest takeaways from the Grok Bot product lead — Lenny Rachitsky on a small isolated team going from first commit to internal product in four weeks, and to public launch three weeks after that.

🍵 5–10 minutes

• Cyber Resilience Act: 11 September 2026, key starting point for reporting obligations — the deadline, the cascade, and who is in scope. Read this one first if you sell into the EU.
• Founders are coming back to run their pre-AI B2B companies — Daniel Dines at UiPath, Aneel Bhusri at Workday, and the argument that a foundational rebuild is the one thing a hired CEO structurally cannot do.
• I asked 100 agents to hack me — Shrivu Shankar ran roughly a hundred self-hosted, guardrail-stripped agents at his own accounts for five hours and writes up exactly what got through.
• I've factored the RSA keys of a certificate authority from the '90s — Matthew McPherrin found two 512-bit roots shipped with Netscape in 1999, factored each on a desktop, and built a period-correct TLS server to prove the point.
• Anthropic researcher quits over 'out-of-control' AI fears — Jacob Coxon is leaving the industry over self-improving systems. Paywalled.
• What OpenAI's Astra means for AI security teams — if a model can discover and chain zero-days, a quarterly pentest is a snapshot of a moving target.
• The coming product retention crisis — Andrew Chen on novelty-seeking, visible AI slop, and infinite supply meeting finite demand.
• How I advertise malicious software on Google Ads — the ad-review gap, walked through end to end.
• Understanding the recent DDoS attack against Read the Docs — an honest incident write-up from a small team carrying a lot of the ecosystem.
• A response to Bill Gates's essay — a direct argument with the institutions-and-taxes framing.
• Progressive Point Matching — partial credit for long-horizon RL that leaves the optimal objective alone.

📚 Longer, worth it

• Building Codex with Tibo Sottiaux — Gergely Orosz interviews one of Codex's creators for an hour and a quarter: why Rust when the models were worse at Rust, why open source when the biggest competitor isn't, and why the harness shrinks each time the model improves.
• Perceptual issues in dynamic interfaces — 48 minutes on inattentional blindness and change blindness, with testing on a UK government site where users caught a content update and completely missed a menu expanding at the same moment.
• Inside the megakernel serving engine for North Mini Code — Cohere folds an entire decoding pass into one persistent GPU kernel, with continuous batching, paged attention and ragged sequences behind an OpenAI-compatible endpoint.
• >10x more efficient pretraining — Magic's argument that a small lab's only lever is algorithmic efficiency, and its recipe for it.
• What makes inference nondeterministic? — why the same prompt at temperature zero returns different text: floating-point addition order, batching and server load.
• Hitting once, hitting often: the anatomy of a great VC career — Ilya Strebulaev on a dataset where the returns concentrate far harder than the folklore admits.
• Why your best early investors won't always follow you into the Series A — fund maths, not a verdict on you.
• AI in product teams: the growing impact on collaboration — governance and structured experimentation beating "everyone please use AI", with the role boundaries blurring underneath.
• #317: Selling Smart Passive Income — Pat Flynn and Matt Gartland on eight years of deliberately building a creator business that could be sold: spinning out a new entity, taking the founder's face off the site, making the community the hero, and turning down VC and PE offers worth more than the eventual sale.
• It was just a game of catch — not a business read. Sahil Bloom on his father at seventy, an old catcher's mitt, and impermanence. Seven minutes.

Numbers

• 110 million — weekly installs of Tailwind CSS at the point Tailwind Labs agreed to join Shopify, across nine years of the project (Adam Wathan, Tailwind Labs).
• $2bn at a $48bn valuation — Cognition's new round, four months after it raised at $26bn; annualised run-rate revenue went from $492m in May to $900m (TechCrunch).
• 972 — vulnerabilities fixed in Microsoft's September Patch Tuesday, 112 of them rated critical, including two zero-days. A record month, after 570 in July and 620 in August (Microsoft).
• 1.06 billion — ChatGPT monthly active users in August, a fourth consecutive record month (Similarweb).
• 3.14 — agent-workdays a single OpenAI researcher now supervises per eight-hour shift, with median daily inference spend up from $14 to over $600 (Tomasz Tunguz).
• 23.9% → 82.2% — Hyper-τ-bench pass rate on held-out tasks for a frontier model building a customer-service agent alone, versus the same class of model paired with an engineer carrying deep context (Sierra).
• 60% — share of the pull requests Cursor merges internally that its cloud agents already write (Cursor).
• £136.7bn — the UK design economy's contribution in 2023, 5.5% of gross value added, growing at nearly twice the rate of the wider economy and now ahead of retail (Design Week).
• ~30 hours — desktop time to factor each of two 512-bit certificate-authority root keys that shipped inside Netscape in 1999 (Matthew McPherrin).
• $210 — the GPU bill for running roughly 100 guardrail-removed agents against one person's accounts for five hours; five lower-tier accounts fell and sixteen social-engineering attempts were made (Shrivu Shankar).
• 3% — share of venture investors with ten or more successful investments, against 38% who have at least one; the top 1% account for over half of all net profits in the industry (Ilya Strebulaev).

What happened

Models & math

• Magic published a pretraining recipe it says is more than ten times more compute-efficient than leading open-weight base models, arguing that algorithmic efficiency is the only lever a small lab has (Magic).
• Cohere detailed a decode megakernel reaching 292 tokens per second at batch size one on a single H100 — 1.58× vLLM — holding that margin out to 256K of context (Cohere).
• A controlled study of open recipes from 2019 to 2025 found data improvements delivered a 12× compute-efficiency gain at a 10^19 FLOPs budget, against 3.7× from model improvements, with the two largely independent (Dwarkesh Patel).
• Sierra released Hyper-τ-bench, which scores a developer agent on recovering a spec from business records and shipping a working customer-service agent inside a cost budget (Sierra).
• Preston Fu published Progressive Point Matching, which hands long-horizon reinforcement learning partial credit without shifting the optimal objective (Preston Fu).

Safety & policy

• The EU's Cyber Resilience Act reporting obligations take effect on 11 September: a 24-hour early warning, a 72-hour notification and a 14-day final report for actively exploited vulnerabilities, applying to products already on the market (National Law Review).
• Microsoft shipped a record Patch Tuesday — 972 fixes, 112 critical, two zero-days, one in the Windows Update service itself (Microsoft).
• The NSA, FBI and CISA warned that Chinese labs including DeepSeek, Moonshot and Alibaba are distilling Western AI systems at industrial scale, raising the prospect of tighter export controls and cloud-access rules.
• Jacob Coxon left Anthropic and the AI industry, saying the race to build self-improving systems could spiral beyond control (WSJ).
• Bruce Schneier wrote up an attack that gets a weaker model from the same provider to decode and emit a stronger model's reasoning traces in plaintext, with no jailbreak of the stronger model (Bruce Schneier).
• Read the Docs published a post-mortem of the distributed denial-of-service attack it absorbed (Read the Docs).

Business moved

• Shopify acquired Tailwind Labs. Adam Wathan framed it as securing a maintained long-term home for a framework installed over 110 million times a week (Tailwind Labs).
• Cognition raised $2bn at a $48bn valuation, led by Andreessen Horowitz, Accel, Founders Fund, General Catalyst and Avenir, and is training its own model to cut its bill from third-party providers (TechCrunch).
• Automattic's board placed chief executive Matt Mullenweg on a leave of absence (TechCrunch).
• Smart Passive Income was sold to email-marketing operator Liz Wilcox, in a deal that had quietly closed five months before the announcement — during which she ran the community publicly as its director and it doubled in size (Pat Flynn and Matt Gartland).
• Blizzard workers ratified a union contract (GameSpot).

Platforms shifted

• Apple debuted iPhone 18 Pro at $1,199 and iPhone 18 Pro Max at $1,299 — the first keynote led by John Ternus, who succeeded Tim Cook as chief executive on 1 September (Apple, CBS News).
• Apple announced the foldable iPhone Duo — a 7.6-inch inner display and a 5.4-inch outer one — with pre-orders on 16 October and availability from 23 October (Apple).
• Apple introduced AirPods 5 with open-ear active noise cancellation and Apple Watch Series 12 with a new health-sensing system (Apple).
• Cursor made it possible to run cloud agents on machines a team manages, with workers holding only an outbound connection so Cursor never reaches into the network (Cursor).
• Anthropic put Claude inside Excel, Word, PowerPoint and Outlook, with every edit reviewable before it lands (Anthropic).
• Vercel introduced Flat Rate CDN, folding requests, data transfer and CDN observability into one predictable monthly fee for Pro teams (Vercel).

We left out a handful of stories with nothing in them for someone building a company, plus one video-editor release whose own announcement page never actually describes the release.