company
Mastra is a company building an open-source TypeScript framework for creating and running AI agents, including durable, long-running agent workflows.
No evidence-backed relationships are recorded.
MongoDB rejects the entire write once a document passes 16 MiB, a hard cap that stalls agents keeping every turn in one snapshot. Frameworks can swallow that rejection, so the defence is measuring documents with $bsonSize and moving transcripts out early.
Reality
GHSA-864f-rcv7-6rh4 lets guest code hand the C++ bindings one type on the first read and a different one on the second. Fixes are in 7.0.1 and 6.2.0.
Reality
Fluid compute caps Hobby functions at five minutes and Pro at 800 seconds, so an agent working a long task list needs a queue or a different host. The cheap VPS escape hatches have repriced too.
Reality
Arcjet's new runtime security takes agent activity in through the OpenTelemetry pipelines platform teams already run, then evaluates each tool call against Open Policy Agent rules before it executes and again after.
Reality
Durable state and sandboxed execution now arrive as platform primitives, so a dev.to guide argues the remaining failure mode is undocumented organizational context. It leans on one arXiv paper and one example.
Reality
Salesforce put Data 360, Informatica, MuleSoft, Tableau, Agentforce and Guardian under one new control plane on Thursday. The loops that run agents inside its own tools still belong to Mastra and the Claude Agent SDK.
Reality
A lease-analysis pipeline built on Mastra gates three of its four processing stages behind skip flags read from the database. The fourth is chained unconditionally and re-runs on every resume.
Reality
Wiz says a compile-time payload reached builds through a typosquatted dependency, and the attacker yanked every clean arrayref release so the responsible fix resolved to the poisoned one.
Reality
Wiz says the crates.io compromise executed at build time, so reviewing the library source would have caught nothing. Cargo did the rest.
Reality
Endor Labs says a type confusion in isolated-vm's ExternalCopy turns a single ivm.Reference into host control-flow hijack. The remedy is a version bump to 7.0.1 or 6.2.0.
Reality
Mastra raised $22M led by Spark Capital and launched a hosted platform in the same post. The framework was the cheap part; the runtime is where platform vendors already live.
Reality