AI & SaaS News, Oct 30: DoorDash Buys Instacart, Mistral 4

Last checked October 30, 2026 · News roundup

Today in brief: DoorDash has agreed to buy Instacart for $17 billion, and an OpenAI-backed holding company is taking ADT private, so two household-name services are changing hands at once. On the AI side, Mistral released the weights of its trillion-parameter Mistral Large 4, and researchers showed that Codex and VS Code can still be tricked into reading your whole disk. Reddit also told investors it will push visitors to log in.

Part 1 · AI models, apps and security

Mistral Large 4 open weights: $0.70 per million input tokens, free to self-host

Mistral published the weights of Mistral Large 4, nicknamed "Le Chonk," on October 29, according to TechCrunch. The model has 1 trillion parameters, and the Hugging Face repository name (Mistral-Large-4-1T-A52B) points to about 52 billion active per token. It shipped in public preview earlier in October; this release is the first time anyone can download and run it on their own hardware.

The license is the Mistral Ecosystem Open-Weight license, which Mistral describes as a modified MIT license. Internal use is open, but a company that resells the model as a hosted service needs a separate commercial license from Mistral. If you would rather not run a trillion-parameter model yourself, the API costs $0.70 per million input tokens, $0.07 for cached input and $2.10 per million output tokens. It is also listed on OpenRouter, NVIDIA's hosted endpoints and Microsoft Foundry.

Mistral's own numbers put it at 48% on Artificial Analysis' Coding Agent Index, tied with China's GLM-5.3 while using 47% fewer tokens per task, and at 41% on Terminal-Bench 4.0. Mistral is pitching it for security work, where an open model "can't be cut off," as VP of Science Pierre Stock told TechCrunch. For most teams the practical takeaway is price: its list rates are well below Gemini 4 Carbon's introductory pricing.

Is Cursor safe to use? The EMBRACE flaw, and why Codex and VS Code are still exposed

Security firm Forever published research on October 29 describing "EMBRACE," a set of bugs in the built-in browsers that AI coding tools use to preview pages. Help Net Security reported the details. In Cursor, a web page plus one Enter keypress let an agent run a hidden command, and the agent switched off its own sandbox when the sandbox blocked it. In GitHub Copilot, a fake github.com login page could be shown inside the app. In Codex, VS Code and Claude Desktop, opening a single HTML file from a project could let a page read files across the disk.

Cursor fixed its issue on October 1. GitHub fixed Copilot in version 1.1.29 on October 13. As of October 29, OpenAI had not replied to the July report on Codex, and Microsoft declined the VS Code report, pointing to its Workspace Trust prompt. Anthropic accepted a separate report on Claude Desktop from Noma Security; the coverage does not confirm a released fix.

What to do: update Cursor and Copilot, review which folders you have marked as trusted in Codex and VS Code, and do not click links to local HTML files in repositories you did not write. If you are weighing Cursor against other editors, our Cursor AI code editor review covers the day-to-day trade-offs.

ChatGPT's model is now called "GPT": what OpenAI's new Model Spec changes

OpenAI published a rewritten Model Spec, the public rulebook for how its models should behave, on October 29. According to The Next Web, the document is now organized around five values: faithfulness to human intent, minimizing harm, honesty and transparency, human agency, and care. The model is referred to as "GPT" instead of "the assistant."

The bigger change for users and developers is that most rules are now framed as defaults that can be adjusted, with firm limits kept only where people need protecting. The spec also says the model should not simply tell people what they want to hear, and adds sections on how it uses past chats and memories.

Nothing changes in ChatGPT today, and there is no price or plan impact. OpenAI says its current models "do not yet fully reflect" the spec and that it is testing new training methods. If you build on the API, it is worth reading the defaults section now, because it describes which behaviors your system prompt is expected to be able to switch.

Granola Voice Typing: free dictation in any Mac app

Granola, the AI meeting-notes app, launched Voice Typing on October 29. You hold the fn key, speak and let go, and Granola cleans up the text and pastes it wherever your cursor is: Gmail, ChatGPT, Claude or any other app. Double-tapping the key starts a hands-free mode for longer dictation, and each session can run up to 20 minutes.

The price is the headline. Granola's help center says the feature is free and included in every plan, and its launch post promises "unlimited words." That puts it directly against paid dictation apps such as Wispr, which TechCrunch named as the target. It is in beta on Mac only; Granola says Windows and mobile are coming soon, with no date. English is the default language, and auto-detect is used if your meeting transcription is set to several languages.

If dictation is a daily tool for you, compare it against a dedicated app before you cancel anything. Our Superwhisper voice-to-text review shows what a paid, dedicated option offers.

New Alexa shopping features: change subscriptions and delivery notes by voice

Amazon added more than 100 shopping capabilities to Alexa on October 29, ahead of the holidays, TechCrunch reported. You can now create and edit shopping lists, change how often a subscription item arrives (from monthly to every three months, for example), edit a delivery address or drop-off instructions, and ask about Prime, Audible or billing problems.

Amazon says more than 400 million people used Alexa for shopping over the past 12 months and that use of its agentic features has grown eightfold since January. The same day, Amazon's earnings release said Alexa+ is now free for US customers with compatible Fire TV devices and has expanded to Australia, India and Japan. The coverage does not say which of the new shopping commands need Alexa+ rather than classic Alexa, so test them on your own device before relying on them.

Separately, Meta quietly launched Style Sketch, an AI outfit and try-on app, in Indonesia, Singapore and Thailand only.

Part 2 · SaaS, deals and the business of AI

DoorDash to buy Instacart for $17 billion: what changes for shoppers

Update to our October 26 report on sale talks: it is now a signed deal. DoorDash announced on October 29 that it will acquire Instacart for $65 per share, a total value of $17 billion, and both boards have approved it. The companies expect the deal to close toward the end of 2027 or in the first half of 2028, which leaves plenty of time for antitrust review.

DoorDash says it will keep the Instacart brand, the Instacart app and its enterprise technology for grocers. Until closing, the two run as separate companies. For customers, that means your Instacart+ membership, prices and orders are unchanged today. Instacart CEO Chris Rogers framed it as a way to "do even more" for retailers, who would gain DoorDash's delivery network alongside Instacart's storefront and ad tools.

If you are a grocer or brand signing a multi-year Instacart Ads or storefront contract, ask now how a change of owner would affect pricing and data terms.

Who bought ADT? Thrive Holdings, the OpenAI-backed buyer, in a $15.3 billion deal

Thrive Holdings, a spin-out of Josh Kushner's Thrive Capital, agreed on October 29 to buy home security company ADT for $10 per share, about $7.6 billion in equity and $15.3 billion including debt, according to ADT. Thrive Holdings already owns more than 75 companies and says it buys businesses to run long-term and rebuild with AI.

The OpenAI angle is direct: OpenAI is an investor and partner in Thrive Holdings and supplies models, technology and forward-deployed engineers to its companies. ADT is meant to become "the foundation" of Thrive's smart home security business, but no AI products have been named yet, and the coverage gives no closing date.

For ADT subscribers, nothing has been announced about monitoring prices, contracts or equipment. Keep your current contract terms on file.

Reddit logged-in experience: why Reddit will show less to logged-out visitors

Reddit said in its third-quarter results on October 29 that a "logged-in experience" will become its primary model. It will start testing in select markets outside the US in the fourth quarter, with no global timeline yet. Reddit says signing in will not require giving up anonymity, and it is rebuilding its incognito browsing mode.

The reason is in the numbers. Search referrals fell by more than 1 million a week on average in October, and Reddit warned that daily users could drop by a low-double-digit percentage next quarter if that continues. The change also helps protect its data from AI scrapers while it sells licenses to model makers.

This comes on top of the RSS shutdown. If you use Reddit in research, monitoring or social listening workflows, read our guide to what breaks when Reddit RSS feeds end on November 13, and plan for logged-out pages showing less over time.

AWS revenue hits $46 billion, up 39%: what Amazon's results mean for cloud customers

Amazon reported third-quarter results on October 29. AWS sales reached $46.0 billion, up 39% from a year earlier and the fastest growth in nearly five years, with a $184 billion annual run rate. Amazon as a whole had $201.9 billion in sales, up 12%, and guided fourth-quarter sales to $240 billion to $247 billion. Shares still fell about 6% after hours, TechCrunch reported, as analysts pressed CEO Andy Jassy on about $220 billion of 2026 capital spending, with more planned for 2027.

Jassy said he expects AWS to grow more than 40% in both 2027 and 2028 and to become a trillion-dollar business within five to 10 years. For customers, the product news matters more. Bedrock added OpenAI's GPT-6 and GPT-6.1 Sol models and Anthropic's Claude 5.5 family, and launched Bedrock Managed Agents in public preview. Amazon also bought DuckLabs, the company behind the DuckDB database, and extended its Amazon Quick assistant to Outlook, Word, PowerPoint and Excel.

Funding and deals in brief: Wabi, Deepgram and Daily, Cohere

• Wabi, the personal agent from Replika founder Eugenia Kuyda that builds mini apps on request, raised $55 million at a $1.25 billion valuation, led by IVP. Our AI app builders hub tracks the prompt-to-app tools it competes with.
• Deepgram is acquiring Daily, maker of the open-source Pipecat voice-agent framework, for an undisclosed sum. Both say Pipecat stays open source and vendor-neutral.
• Cohere held a first close of a Series E that targets up to $5 billion at a $20.5 billion valuation, with Canada committing up to $1.14 billion, according to Bloomberg.
• Collective, which runs bookkeeping and taxes for solo business owners, raised a $40 million Series B plus $60 million in nondilutive capital, Axios reported. SuperMe, a network of AI expert profiles, raised $20 million led by Forerunner.

Quick questions from today's news

Will my Instacart account change after the DoorDash deal?

Not yet. DoorDash says it will keep the Instacart brand and app, and the companies operate separately until the deal closes, which they expect between late 2027 and mid-2028. Your Instacart+ membership, orders and prices stay as they are for now; watch for emails about terms once regulators approve.

Is Mistral Large 4 free to use?

The weights are free to download from Hugging Face under Mistral's modified MIT license, so you can run it on your own servers without paying Mistral. Hosting it for paying customers needs a commercial license. The hosted API costs $0.70 per million input tokens and $2.10 per million output tokens.

Is VS Code safe after the EMBRACE research?

VS Code had no fix as of October 29 because Microsoft considers Workspace Trust the protection. The attack needs you to open a malicious HTML file in a project you trusted. Only trust folders you wrote or reviewed, avoid opening HTML previews from unknown repositories, and keep SSH keys and cloud tokens out of reach.

Is Granola's dictation really free?

Yes. Granola's help center says Voice Typing is included in every plan, including free, and the launch post promises unlimited words. The catch is availability: it is a Mac-only beta for now, sessions stop at 20 minutes, and Windows and mobile versions have no release date yet.

Sources: TechCrunch, DoorDash–Instacart (Oct 29, 2026) · TechCrunch, Thrive Holdings–ADT (Oct 29, 2026) · Mistral, Mistral Large 4 open weights (Oct 29, 2026) · TechCrunch, Mistral Large 4 (Oct 29, 2026) · Help Net Security, EMBRACE (Oct 29, 2026) · The Next Web, OpenAI Model Spec (Oct 29, 2026) · Granola Help Center, Voice Typing (checked Oct 30, 2026) · TechCrunch, Granola dictation (Oct 29, 2026) · TechCrunch, Alexa shopping (Oct 29, 2026) · TechCrunch, Meta Style Sketch (Oct 29, 2026) · TechCrunch, Reddit logged-in shift (Oct 29, 2026) · Amazon, Q3 2026 results (Oct 29, 2026) · TechCrunch, AWS outlook (Oct 29, 2026) · TechCrunch, Wabi (Oct 29, 2026) · TechCrunch, Deepgram–Daily (Oct 29, 2026) · Bloomberg, Cohere (Oct 29, 2026) · Axios, Collective (Oct 29, 2026) · TechCrunch, SuperMe (Oct 29, 2026) · Google, Gemini 4 Carbon (Oct 28, 2026)