Zach Yadegari has enjoyed an immense amount of success for someone who only recently graduated from high school. Founder of the AI-fueled calorie tracking app Cal AI, Yadegari is only 19 but his company has rocketed to viral fame over the past two years. At TechCrunch Disrupt on Thursday, Yadegari shared details of that surprising rise to prominence.

Cal AI, which was founded in 2024, exploded onto the internet thanks largely to Yadegari’s strategy of deploying a small army of influencers to promote the brand. The company generated over $30 million in revenue in two years and was acquired by MyFitnessPal for an undisclosed amount of money in March.

Discussing his social strategy onstage, Yadegari noted that an early sign of success came when an influencer’s post about them led to approximately a thousand new users over the course of two days.

“From there, we figured out, okay, this can actually work for us, and so we started recruiting influencers as fast as we could — paying as many people as possible to start posting for us,” he said. “What we saw was that it was a clear formula. It was pretty linear, but it was extremely fast. I guess linear in the sense that every post they did would get a certain number of viewers that would convert.”

The Forbes 30 Under 30 alumnus told the audience that part of his company’s strategy was to negotiate rates with influencers, promising them certain payouts for a certain scale of reach. A lot of influencers are “broke college kids” who “just want cash,” Yadegari added. “You just ask them, okay, we’ll pay you this, but we need to get us at least this amount of use and keep posting until you get there.”

Another important component of success was finding the right influencers whose reach can be quantified. “The biggest thing for us was finding influencers that had very tight communities,” the founder said.

Yadegari, whose father was in the audience, also credited his family with giving him the freedom to go after his ambitions. Does he also credit higher education for his success? Not so much.

“I think the only real reason to go to college is if you want to have a fun social time as a kid and be with other people,” he said, to audience laughter.

Earlier this month, Yadegari also launched Persona, a new AI agent startup that has already raised $10 million.

Yadegari said the “overarching mission” with Persona is to “make computing seamless with human life.” The company’s personal AI assistant will “live anyplace with internet connection,” he said, including “iMessage, app, email, phone call.” He added that part of what distinguishes the company’s plans for this AI assistant is to build a “hardware ecosystem around” the app.

One of the singular features of Baotou, an industrial city of 2 million people in Inner Mongolia, is a 10-square-kilometer (4-square-mile) lake that is among the most polluted in the world. The artificial lake, referred to by the name of the dam associated with it, Weikuang Dam (or Baogang Tailings Dam), has for decades collected the effluent from minerals processing for China’s globally dominant iron, steel, and rare-earths industries.

Built in the late 1950s, the lake contains a highly toxic stew of industrial chemicals with substantial amounts of radioactive thorium, the latter resulting primarily from the processing of monazite ores for rare earths. China has since greatly tightened its environmental regulations and restrictions on mining and minerals processing. For example, largely because of the environmental disaster that is Weikuang Dam, the country doesn’t permit the development or operation of stand-alone monazite mines—that is, mines where nothing is mined except monazite ore.

Now, with industrialized nations in North America, Asia, and Europe spending billions to shore up their rare-earths supply chains, and counting on monazite to help them do it, China’s history and experiences with monazite offer important lessons.

Monazite ore is a pillar of China’s rare-earths industry because it is a prime source of some less common but extremely important rare-earth elements, notably dysprosium, terbium, yttrium, and erbium. The country mines and processes vast quantities of monazite ore; it also imports huge amounts of monazite ore for processing.

Most of the domestically mined monazite ore comes from a single mine: the mammoth Bayan Obo complex, 150 kilometers north of Baotou in Inner Mongolia. Bayan Obo, which is primarily an iron-ore mine, also happens to contain the largest known rare-earth deposit in the world. It’s the source of nearly half of all the rare-earth ore mined on the planet in a typical year. Most of the rare-earth ore mined at Bayan Obo is a type called bastnaesite; it’s the mining of that bastnaesite that makes it legal to mine monazite ore at Bayan Obo as well.

Related: Can a Radioactive Ore Break China’s Grip on Rare Earths?

All told, ore from Bayan Obo was used to produce 170,000 tonnes of rare-earth metal last year, according to David Merriman, research director at the minerals intelligence firm Project Blue. Roughly 30 to 40 percent of the rare-earth ore mined at Bayan Obo is monazite. That amount alone would be enough to make China the world’s largest processor of monazite for rare earths.

China’s 2025 Monazite Imports Topped 70,000 Tonnes

But a more detailed picture of China’s interest in monazite emerges when you consider the country’s imports of the ore. Last year they amounted to more than 70,000 tonnes, says Thomas Kruemmer, a Singapore-based consultant on minerals and metals. That figure becomes more impressive when you consider the unique challenges of shipping monazite by sea. Because of its radioactivity, concentrated monazite ore is classified as Class 7 dangerous cargo under the International Maritime Dangerous Goods Code. That means, Kruemmer notes, that the ore can be imported through only four ports in China.

In addition, importation of some kinds of monazite into China is supposed to go through a joint venture consisting of the China National Nuclear Corp. and Shenghe Resources, which are at least partly state-owned. But lots of imported monazite doesn’t go through those organizations, notes Merriman. That’s because heavy mineral sands, which may contain roughly 2 or 3 percent monazite by weight, are not subject to the same import controls as concentrated monazite ore. So companies import the heavy mineral sands; separate out various profitable concentrates, including the monazite mineral concentrate; and then process the monazite concentrate to recover the rare earths.

China has lately stepped up its efforts to secure rare-earth ore around the world. One reason, says Kruemmer, is simply to make up for recently lost supplies. In 2025, the U.S. government invested US $400 million in MP Materials, which operates the Mountain Pass mine and processing facility in California. The deal put an end to longstanding contracts under which MP Materials had been selling tens of thousands of tonnes of rare-earth concentrate annually to a trading affiliate of Shenghe Resources.

But other Westerners speculate that China has strategic reasons for stepping up its efforts to acquire heavy mineral sands or other rare-earth assets abroad. By locking down rights to deposits or projects abroad, Chinese organizations are making them unavailable to non-Chinese developers, according to this reasoning.

Merriman points out that your view of these activities largely depends on where you sit. The U.S. government recently made a conditional loan commitment of up to $725 million to U.S. monazite processor Energy Fuels, which has been aggressively securing substantial monazite supplies in Australia, Brazil, and Madagascar. To a Chinese observer, those moves probably look rather strategic.

China, meanwhile, is doing what it has been doing for decades. “China’s playing its game,” says Merriman.

HP has introduced the ZBook Ultra G3a 16-inch mobile workstation in India. This mobile workstation is designed for professionals working in artificial intelligence, engineering, design, and content creation. The device uses an AMD Ryzen AI Max + PRO processor and enables running large-scale AI models. HP has also designed it with a thin-and-light form factor for easy work in various locations.

HP ZBook Ultra G3a Specifications, Features

The HP ZBook Ultra G3a uses up to the AMD Ryzen AI Max+ PRO 495 processor. It includes a 55 TOPS NPU and supports up to 192GB of unified memory. The system also offers up to 160GB of dedicated VRAM and can run large language models (LLMs) with up to 300 billion parameters locally. HP has included an upgraded thermal design that can support up to 81.8% more TDP and up to 100W of performance. This computer weighs about 1.9 kg and is 17.9 mm thick.

This device features a 16-inch 2.8K OLED display with a 120Hz refresh rate. This display provides excellent visual performance with accurate colors suitable for professional use. According to HP, the device’s 96Wh battery can provide up to 14 hours of operation. The company also offers 140W and 180W chargers using GaN technology. This workstation also supports 5G and HP Wolf Security. It also has a keyboard that you can easily replace yourself. These features support AI development, multi-agent workflows, engineering, design, and high-resolution content creation.

Speaking on the launch, Sanjeev Pathak, Senior Director – HP Solutions, HP India, said:

As AI becomes integral to professional workflows, the need for technology that combines performance, mobility and intelligence is growing. The HP ZBook Ultra G3a 16” bridges this gap by bringing AI at the edge to a mobile workstation, enabling users to run advanced AI workloads and apply agentic AI to complex workflows.

Price in India, Availability

HP has priced the ZBook Ultra G3a 16-inch mobile workstation at Rs 2,89,990 in India without taxes. The ZBook mobile workstation is now available from HP commercial channel partners in India. Customers interested in purchasing it can reach out to their respective authorized partners. HP has not mentioned any other color options in the announcement.

Your next funding round. Your next hire. Your next big product decision. Building a startup means making choices that can shape the business for years. Taking time to question your approach could be one of the most valuable investments you make.

Savings of up to $200 end October 16 for TechCrunch Founder Summit. These savings for Founder and Investor Passes vanish after Friday. Join 1,000 founders and investors on November 4 at Boston’s SoWa Power Station. Bring your toughest questions and make the day count for your business.

Put your next business decision on the agenda 

Where should you focus before raising capital? How do you know you’re ready to scale? Which hire would make the biggest difference? The Founder Summit agenda covers fundraising, hiring, product-market fit, and building an AI native company, with practical guidance to inform your next move.

Speakers include Kent Bennett of Bessemer Venture Partners, Lior Div of 7AI, and Vineet Edupuganti of Cogent Security. Come with a decision you’re working through. Consider which assumptions you need to test, where your plans need strengthening, and what you want to do differently when you return to work.

Make room for the conversations that matter

Founder Summit brings together founders across different stages with investors and experienced entrepreneurs. It’s an opportunity to broaden the circle of people you can learn from. Use that time purposefully. Compare challenges with another founder. Ask for a perspective you haven’t considered. Start a conversation you can continue after Boston.

Book before the October 16 deadline

Founder Passes are currently $199, and Investor Passes are $399. Both include deep-dive roundtables, breakout sessions, and 1:1 and small-group networking. If Founder Summit is on your calendar, now is the time to secure your pass. Book by Friday, October 16, before these savings disappear.

Get your TechCrunch Founder Summit pass

Microsoft announced that Windows Server 2022 has reached the end of mainstream support and will remain in extended support until October 2031.

Microsoft unveiled Windows Server 2022 in March 2021 and made it generally available in September 2021 as a Long-Term Servicing Channel (LTSC) release with 10 years of support.

“As of October 13, 2026, Windows Server 2022 has reached end of mainstream support and transitioned to extended support. The October 2026 security update is the last mainstream support update available for this version,” it said.

“Extended support includes security updates at no additional cost, and Windows Server 2022 will continue to receive monthly security updates through October 14, 2031.”

Microsoft has also extended Windows Server 2022 hotpatching until October 2027, one year after the mainstream end date of October 2026, for systems running the Datacenter: Azure Edition.

Before Windows Server 2022 reaches the end of support, Microsoft advised IT admins to upgrade to Windows Server 2025, which began rolling out to Windows Insiders in January 2024 and reached general availability in November 2024.

“Windows Server 2025 is the latest Long-Term Servicing Channel (LTSC) release for Windows Server. To help keep your environment protected and supported, plan your upgrade path to Windows Server 2025 for full mainstream support,” the company added.

According to Microsoft’s lifecycle platform, Windows Server 2025 will reach its end of mainstream support in November 2029, with an additional five years of extended support until November 14, 2034.

Those who want to test it before deployment can use the free 180-day Windows Server 2025 trial available via the Microsoft Evaluation Center. You can find more information about Windows servicing dates on the Windows Lifecycle FAQ page or using the Lifecycle Policy search tool.

On Tuesday, Microsoft also announced that devices running Windows 11 24H2 Home and Pro editions no longer receive security and non-security preview updates and advised customers to upgrade to Windows 11 26H2 (the latest Windows 11 version, also known as the Windows 11 2026 Update).

Last week, it also warned users to upgrade devices running unsupported versions of Windows because they will stop receiving security updates after next year’s Windows Update certificate rotation.

Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.

Save your seat

With the rise of AI pentesting, a lot of people are wondering if it’s as good as a human. Having started as a pentester twelve years ago, and having moved through similar roles to working on Intruder’s AI pentester,

I’ve come to understand the advantages and disadvantages of both. Here’s how they compare.

The strict methodology was never the good bit

You may expect AI pentesters to follow strict methodologies in the way that many human pentests do.

At Intruder, we experimented with this approach early on – structured systems where each agent had a specific vulnerability type to look for. What we found was that agents would miss things outside their remit entirely, or miscategorize what they did find as the one thing they’d been told to look for, causing confusing reports.

A complete lack of structure also failed to produce good results, as completely free agents without any guidance couldn’t break down and manage large applications properly. They could find interesting things, but at the cost of missing a load of other vulnerabilities in our targets.

We’ve put a lot of testing into finding the balance between these approaches, and settled on giving agents freedom with broadly defined roles to help them approach and manage large applications, and stricter guardrails to stop them causing damage. 

This does mean that our AI pentester doesn’t tick off the parts of a methodology document that you’d typically see in a human pentest. That may make some people uncomfortable – a strict methodology gives people assurance that someone has gone through your application and tested everything on the list. An unauthenticated SQL injection needs to be found, and a checklist is there to make sure it does.

The methodology gives a lot of people the idea that a human pentest is a perfectly repeatable product, as any tester will be able to follow the methodology, and everything important will get found. The reality is a lot more nuanced than that though, as pentesting is a skilled job, and many of the most impactful findings on a pentest will come from the tester being experienced in noticing weird behaviours and following up on them.

For our AI pentester, we ended up with much more interesting and impactful results by not trying to guide our agents through specific vulnerability types. A good example is a complex authentication bypass the agents found that had been sitting in a codebase through five years of pentests without any human testers picking it up.

The mechanics of that issue mean that you’d never think to write a testing guide that could be strictly followed to identify it, and if we’d tried to limit our AI pentester too much it never would have found it either.

You could say that only finding the common things would still be pretty good, but there’s such an array of vulnerabilities that aren’t common that you find during a pentest. And just because they’re not common, it doesn’t mean that an attacker can’t find them too, especially now AI is being used to enable attacks more.

A strict methodology being carried out by a competent tester only ever provided a low baseline of reliability, and it didn’t even do that perfectly. What makes a pentest good is the part that a skilled tester does outside the checklist, and that’s where AI thrives – following its nose through your application and finding the things that were never going to make a list.

What they know, and what they can’t ask

Our AI pentests take a white box approach, which means the agents get the source code. They work through the entire codebase and build a picture of not just what every page is, but how the application is meant to function and what requests can be made. Doing this to the level of detail that the AI is able to isn’t feasible for a human pentester during a typical time window for a pentest.

The AI pentester also builds up a sense of what the application is for, and a good example of this is access control – it doesn’t need to be told that low privileged users shouldn’t be able to reach admin functionality, or that a particular bit of data is sensitive.

You can give them extra information as well, just like a human tester. For example, people often specify that they’re worried about their customers being able to access each others’ data, and the pentester has done a great job of focusing on these issues and identifying a lot of them.

What the agents can’t do is ask you for anything you didn’t already give or tell them. If I don’t understand what a part of an application does while I’m doing a pentest, I can ask my contact, and those conversations can be very useful for testing the application properly, and assessing risk in the final report.

I can also clarify the scope with my contact if needed, or ask for permission to verify something when I’m unsure if there’s a risk of disruption.

We’ve had to deliberately make our AI pentesting agents cautious on this front to avoid going out of scope.

Neither finds everything

The freedom that lets AI pentesting agents find something like a complex auth bypass is the same thing that makes them less predictable. They decide where to dig, and that won’t be identical every time.

But pentest results have always varied with the person doing them. It’s why many consultancies will rotate your tester each year – different people find different things on the same application.

This comes down to people’s experience, specialisms, and incidental knowledge.

I’ve found issues because of a blog post or specification I happened to read years earlier and was left sitting in the back of my head. And even the things on a checklist get missed sometimes. People are fallible, and covering an entire application methodically over multiple days can be hard.

Consistent coverage is something we’re actively working to improve, but it’s not something that was ever offered perfectly from anyone. It’s why every human pentest report comes with a disclaimer saying as much, even though most people read it as a formality.

The remediation I couldn’t have written

Every pentester has strong opinions about what makes a good report. I’ve built up many of my own over the years, as have the rest of the current and former pentesters at Intruder. These opinions are what we built our report around.

The executive summary is the hardest page of a report to get right. For a lot of people it’s their entire experience of your work, and at a good consultancy a lot of effort goes into it. We’ve worked to get to the point where the agents are now writing genuinely good ones, and I often read them first on our own reports to get a good overview before diving into detail.

Where they’re still off is scoring risk. They rate things higher than I would, partly because they can’t have the conversations with you that would bring a rating down, and partly because LLMs err towards caution when you start talking about cybersecurity.

That’s the right direction to be wrong in, but it does mean you’ll see things flagged as more serious than they are, and it’s something we’re working on.

Remediation guidance is where the agents excel. After a long week on a pentest it’s tempting for a human to write generic advice, and you catch yourself and try to do better. Unfortunately, you’re usually limited by time and usually by not having the source code.

The agents don’t have either problem, so they’ll tell you the line of code to change, and what to change it to on every issue. They also write about mitigating controls that can help reduce the impact of the issue, or provide a temporary fix.

We’re seeing that speed up how quickly people actually fix things. We had a customer with 78 issues who fixed all of them within a few days, which as a human pentester I have never seen happen. I couldn’t have written the level of detail that made those fixes possible in the time I’d have had.

So is AI pentesting as good as a human?

AI pentesting and human pentesting are different, and once you stop trying to rank them the comparison gets a lot more useful.

The agents are finding serious issues in applications that human testers have already been through multiple times. They’ll read a whole codebase, work through every path in it, and write up every instance of what they find with the fix down to the line of code.

And you can run one whenever you want. For what a single human engagement costs you can run four AI pentests, which means you can do deep testing on a regular basis rather than once a year.

That’s a key thing that is missed by human pentesting, and often applications have undergone a lot of untested changes in between pentests.

See what Intruder’s AI pentester finds in your application. Learn more. 

Author

Written by Daniel Thatcher, Security Research Engineer, Intruder

Daniel is a security researcher at Intruder with a background in penetration testing, and a focus on exploiting web applications in black-box scenarios.

Sponsored and written by Intruder.

More Information

RF and microwave systems increasingly depend on amplifiers and receivers that perform reliably across wide frequency ranges and demanding signal conditions. Confirming this performance calls for signal sources with wide output power range, low phase noise, and fast switching speed. Amplifier characterization relies on accurately measuring gain, compression, and intermodulation distortion, while receiver verification often involves simulating blockers, calibrating power accuracy, and substituting for local oscillator and clock circuitry during early design stages. This guide walks through these test applications step by step, showing how engineers and technicians can validate RF and microwave hardware across research, development, and manufacturing environments.