Legora Raises $550M at $8.8B Valuation as AI Security Patches and Agent Tooling Accelerate

Key Takeaways

1. Legora raised a $550M Series E at an $8.8B valuation, led by Atreides, with ARR reportedly growing from $1M to $100M in under 18 months.
2. A single day brought a wave of critical patches and exploit activity across PHP, Node.js, NGINX, Go, and GitLab, with Vercel deploying mitigations ahead of official fixes.
3. Perplexity's Aravind Srinivas detailed JOLT, a post-training method that matches GRPO accuracy with 6.5x fewer training tokens.
4. Tesla reported Q3 results including 174万 FSD active subscriptions, a 75%+ FSD attach rate in North America, and record deliveries in several markets.
5. Shop Pay opened to agentic commerce inside Claude Duet, its first availability for non-Shopify stores.
6. Basecamp shipped a ChatGPT plugin and documented agent workflows, while Vercel expanded backend capabilities including generally available WebSockets.

1. Funding and AI Business Models

1. Legora closed a $550M Series E at an $8.8B valuation, led by Atreides, with existing major investors following on and Baron Capital, Capital Group, Fidelity, Glade Brook, and J.P. Morgan joining. The company said the capital will fund a shift from AI assistants to legal AI agents that execute multi-step work, plus hiring across North America, Europe, Latin America, and Asia-Pacific and deeper work on Legora aOS. Garry Tan's account added that more than 140,000 legal professionals use its agentic operating system, ARR went from $1M to $100M in under 18 months and the next $100M in under 6 months, and more than half of the AmLaw 50 are customers — via 1 2 3 4
2. Podium was cited as a middle case between mature companies that can at most adapt to AI and startups that are AI-native from the start, having rebuilt itself as an AI-native company through substantial effort. The cited post said Podium reached $150M in AI annual recurring revenue, taking 2.5 years for its second run at that scale versus 8 years the first time, with 20,000 AI agents generating over $13B for customers and the company profitable with free cash flow — via 1

2. Security Patch Wave and Agent Infrastructure

1. A same-day security summary counted 2 PHP, 10 Node.js, 5 NGINX, 1 Go, and 12 GitLab CVEs, plus a compromised CA certificate from eMudhra, which one account called "the craziest day in cybersecurity in a long time." Vercel said it deployed WAF mitigation rules for php2shell before disclosure and blocked attack attempts against PHP origins, and it pushed firewall-level mitigation for a Node.js RCE in the Brotli decoder affecting Node.js 22, 24, and 26 before the official patch. Cloudflare recorded thousands of php2shell exploitation attempts 10 hours before public disclosure, rising to hundreds of thousands within 2 hours and millions currently — via 1 2 3 4
2. @levelsio argued AI-assisted exploits will hit every language and framework, not just PHP, noting Node also patched a high-severity flaw this week and describing a new phase of an endless AI-assisted cat-and-mouse game. He also relayed that Railway was hacked, while GREG ISENBERG said the Railway attack targeted stored AI keys, since API keys now function as credit cards for compute; his advice was to rotate all keys that night, set monthly hard spend caps in each AI console, give each agent a separate key with usage alerts, and he floated a $99/month tool that auto-discovers and rotates AI keys weekly — via 1 2 3
3. Japan's National Cybersecurity Office urged operators of PHP-based sites to check whether they are affected and prepare for a fix scheduled for October 21 at 23:00 JST, applying it promptly, or consider temporarily taking sites offline if patching quickly is difficult — via 1

3. AI Models, Agents, and Developer Tooling

1. Aravind Srinivas and NVIDIA AI collaboration proposed JOLT, a post-training method where the same model acts as both teacher and student; the teacher gets extra information the student lacks and is trained with rewards while being penalized for drifting from student behavior, and JOLT+ adds outcome-based rewards for the student. On MATH, JOLT matched GRPO accuracy with 6.5x fewer training tokens, and the authors said JOLT+ clearly beat GRPO on math, coding, terminal tasks, and tool-use benchmarks — via 1 2
2. Perplexity Computer added a /graphify skill that visualizes a codebase as an interactive map of files, functions, and dependencies, with 5,000 credits per user and free tasks through October 31, plus a PHP2Shell skill that checks PHP sites and GitHub deployment configurations for exposure risk and ranks fixes, also free through October 31 with up to 5,000 credits — via 1 2
3. Vercel said DeepSeek v4.1 Flash (1017) is in Vercel Token Pass, described as fast, very cheap, and offering zero data retention, suited to running sub-agent tasks planned by larger, more expensive models; the cited post said it uses new DeepSeek weights, a 1M context window, requires no config changes, and $30/month yields $80 in credits. Vercel also listed WebSockets, Queues, Workflows, Cron, Services, Containers, Python, Daemons, long-running functions, Blob, Drives, and Sandbox as backend capabilities, with Vercel Functions WebSocket support generally available at 15 million WebSocket connections per day — via 1 2
4. Basecamp shipped an official ChatGPT plugin for viewing and creating projects, converting notes to to-dos, and searching across projects, while Jason Fried highlighted agent workflows: a café uses Basecamp as its operating backbone with Claude, ChatGPT, and bots, connecting Basecamp via CLI so an agent can run persistently without a local MacBook, and Cloudflare webhooks enabling an agent named "Alpy" inside projects. One example had the agent build equipment tracking tables for stores and download all 133 invoices via shared 1Password logins or email, and another user created a Basecamp user for Claude Code to handle software to-dos and mark them complete — via 1 2 3

4. Tesla, SpaceX, and Optimus Updates

1. Tesla's Q3 shareholder update, cited by Elon Musk, reported North America new-vehicle FSD Supervised attach rate above 75%, the next-gen Roadster reveal, record deliveries in Canada, Australia, Japan, and Taiwan, and Semi production with a fully loaded 82,000 lb configuration achieving 500 miles at 1.7 kWh/mile, about one-third the energy of comparable diesel trucks. Financial data cited included non-GAAP EPS of $0.48 versus $0.45 expected, revenue of $28.05B versus $28.3B expected, 1.74 million FSD active subscriptions up 67% year over year, and $1.53B free cash flow — via 1 2
2. Tesla's Model Y was cited as Germany's best-selling model in September with 8,038 registrations versus 6,580 for the VW Golf, while Tesla's German registrations rose 268.7% year over year; another item said Tesla took the top two European September sales spots with 40,971 Model Y and 25,057 Model 3 — via 1 2
3. Optimus began early production at the Fremont high-volume line, with most of a million-unit-per-year line installed, though design, AI, and reliability need about another year; a V3 demo video may come in one to two months and AI5 chip integration is planned for April 2027. Another post said 10,000 to 20,000 Optimus units are needed first for self-play training, compared to a child learning through play — via 1 2 3

5. Agentic Commerce and Startup Tactics

1. Shop Pay is now usable for every purchase inside Claude Duet, its first opening to agentic commerce for non-Shopify stores, and Claude Duet connected to Shopify on day one for designing stores in chat and tracking performance. Stripe's John Collison cited work with Anthropic letting users run a business inside Claude Duet, including purchases via Link and refunds and business trends via Stripe MCP — via 1 2 3
2. GREG ISENBERG laid out nine stages of enterprise AI-agent adoption, placing companies at stage one where large firms like Amazon and Delta block agents because they skip ads and upsells; later stages include agents posing as humans, markets splitting by business model, a trusted intermediary layer for agent identity and payments, agent-accepting companies taking customers, blockers reopening on their terms, competition on price and checkout speed, ads returning as "agent top picks," and selling to agents becoming as routine as having a website — via 1
3. Replit Agent was summarized as "prompt -> corporation" for incorporating a company through Stripe MCP integration, while Monaco launched Agent Matrix for multiple agents coordinating toward revenue growth and opened early access — via 1 2
4. Grok Bot was promoted as protecting and repairing credit scores, generating reports, memos, and dashboards, and integrating with X Chat and Runway MCP; one user said it reads X lists to build a personalized news page, replacing $6,000/month in API costs. A cited item said Grok's new-user share is 40.91%, above ChatGPT, Gemini, Claude, and DeepSeek — via 1 2 3 4 5 6 7