Daily Digest – 16 October 2026

Morning from Oslo. Today's biggest story is a Citizen Lab report showing spyware delivered through ordinary online ads. Meta also released an open-weight coding model built for agents, and Hacker News took a hard look at OpenCode 2.0.

Tech sector

Spyware delivered through ordinary ad slots ("AdFection")

Citizen Lab traced Candiru spyware infections at Al Jazeera to targeted online ads bought by Israeli firm Discover-Tech. Its platform can fingerprint a device and fire an exploit just by loading an ad. The ads reached about 200k apps and sites. Google, IAB Europe and several ad networks have since cut the company off.

Why it matters: Every ad SDK you ship is now part of your threat model. GDPR regulators like Datatilsynet are already skeptical of adtech, so expect Nordic regulators and publishers to push harder to strip out third-party ad scripts.

Source: Citizen Lab · 15 Oct

Ramp raises $1.85B at a $60B valuation

The expense-management company jumped from $44B to $60B in four months. It claims more than $2B in annualized revenue and 85k customers, and it is building a corporate card for AI agents plus a model-routing service.

Why it matters: Payments made by agents are becoming a real product category. Fintech teams in Oslo and Stockholm should start thinking about spend limits and audit trails for buyers that are not human.

Source: TechCrunch · 15 Oct

Volvo doubles down on Nvidia for hands-free driving

Volvo is extending its decade-long Nvidia partnership to use the Hyperion sensor and compute platform, the Alpamayo driving stack and the Halos safety layer, now beyond its EV lineup. No model or price has been disclosed, and the first car is due "within the decade".

Why it matters: The Nordics' flagship carmaker is betting on a bought-in autonomy stack instead of building its own. That will shape where Gothenburg's software jobs go next.

Source: TechCrunch · 15 Oct

Bluesky's Attie goes "social vibe coding"

Bluesky's experimental Attie app now lets anyone prompt their way to websites, quizzes, games and polls, all tied to their ATProto identity. The launch comes while engagement on the 47M-user network is reportedly sliding.

Why it matters: An open protocol plus AI builders makes it easy to publish on decentralized social media. That is interesting for Nordic developers who prefer infrastructure that no single US platform owns.

Source: TechCrunch · 15 Oct

AI agents

Meta ships Muse Spark Open, an agent-focused open-weight model

It is an 816B-parameter MoE with 42B active parameters and a 1M context, aimed at coding and long-horizon agent work. It runs locally on two M5 Ultra Mac Studios via MLX, and also on vLLM, SGLang and llama.cpp. Demos include it fixing and building an iOS Mastodon client. The license is the custom Muse Model License, which is not OSI open source.

Why it matters: Running a frontier-class coding agent on-prem gives EU and EEA companies a data-residency story without US cloud APIs. Read the license before your legal team does.

Source: Meta AI blog · 15 Oct · HN discussion

Anthropic gives METR employee-level access

Six METR researchers get insider access to Anthropic's models, safety practices and risk management, and they may publish their findings. Anthropic has given up any veto and keeps only narrow, pre-defined redactions.

Why it matters: Third-party audits like this are the kind of evidence EU AI Act conformity work will rely on. It is a template for how vendors could prove agent safety to European buyers.

Source: TechCrunch · 15 Oct

Rivian will host third-party AI agents in its cars

At Disrupt, RJ Scaringe said agents from companies like Anthropic will run inside Rivian vehicles, with braking and steering kept off-limits. Details are coming at Rivian's "AI & Autonomy Day" in December.

Why it matters: The car is becoming an agent runtime with hard permission boundaries. Norway has the world's highest EV share, which makes it a natural early market for in-car agent apps.

Source: TechCrunch · 15 Oct

Hacker News buzz

OpenCode 2.0

The open-source coding agent has been rebuilt around an always-on background server shared by the TUI, web and desktop apps. It adds "Code Mode", a JS interpreter that chains MCP and OpenAPI tools in a single script, along with background subagents and more than 80 hot-reloadable plugins. Plugins written for 1.x break. The release notes are dated 12 Oct.

What commenters argued about: People liked the architecture, but many complained about resource use, a slow installer and security regressions such as hot-reload plugins and sandbox bypasses. Some said they are moving to Pi or OpenChamber.

Why it matters: The agent-as-daemon-plus-SDK pattern is where coding tools are heading. Look closely before you standardize your team on one.

802 points · 345 comments · HN discussion

"I Know Why the Mathematicians Weep" and Simons' $15M AI fund

Derek Thompson writes about mathematicians grieving as AI starts cracking open problems. On the same front page, the Simons Foundation announced $15M to help mathematicians adapt to the AI era.

What commenters argued about: One side said mathematicians should have seen automation coming, as programmers did, and deserve less sympathy for it. The other said machine proofs carry no understanding and that the human process is the actual point.

Why it matters: The same identity crisis is reaching senior developers. It is a useful lens for thinking about craft and what we still own.

206 points · 293 comments · HN discussion · Simons Foundation announcement (147 points · 104 comments · HN discussion)

Steam's client is now faster than Epic's vibe-coded launcher

A day after Epic bragged that its AI-assisted Launcher V2 beat Steam on load time, a Steam update brought cold boot to about 5.2s against Epic's 5.5s. Epic still lacks community features like reviews, forums and a mod hub.

What commenters argued about: Many said Steam's speedup is welcome but long overdue for a bloated client. Others called the benchmark rivalry meaningless and questioned whether vibe coding deserves credit for anything here.

Why it matters: "We built it with AI" does not win users on its own. They still compare on speed and features.

118 points · 139 comments in about an hour · HN discussion