CRM splits between consolidation and rewrites

Salesforce had the loudest fortnight. On 25 Oct, it reported that its AI agents had generated $88 million in sales pipeline by reaching leads its staff could not handle. On 28 Oct, it moved to acquire Braze for $5.7 billion to add real-time customer engagement. On 30 Oct, it announced the acquisition of Rune Technologies to expand in the defence industry.

That sequence matters. Salesforce is not treating CRM as a database category. It is attaching engagement, agents and industry depth around the core record. The GitHub trail pointed the same way: on 1 Nov, Salesforce released Zana 2.5.0 with a more focused Studio, separate windows and assistants for each AgentScript, plus recovery controls, and created a zana-marketplace repository. Across the fortnight it also added repositories including agentscript, agentforce-byoc-python-sdk, sf-pi and lwc.

The platform surface also carried risk. On 28 Oct, CVE-2026-117561 was published for a high-severity OS command injection vulnerability in Codefriar sf-mcp through version 1.3.2, involving crafted Salesforce CLI tool flag values. For operators, the lesson is not that ecosystem expansion is optional. It is that the agent and developer layer is now part of the CRM security perimeter.

HubSpot’s fortnight was defined by a public-market question: can AI activity become customer growth. On 27 Oct, reports said HubSpot beat revenue and earnings expectations but missed on customer growth, with the stock falling 20%. UBS downgraded the stock that day citing demand concerns, and on 29 Oct UBS again cited uncertainty around demand and AI monetisation. Citi moved the other way on 29 Oct, raising its price target from $210.00 to $287.00.

HubSpot did not go quiet. On 27 Oct it added an About page for its startup offering. On 29 Oct it created a ChatGPT product page. On 28 Oct it added hubspot-api-php, hubspot-api-ruby and hubspot-api-python repositories, on 29 Oct it added agent-cli-skills, and on 30 Oct it released hubspot-api-nodejs 14.1.1 after fixing a packaging issue that had made the package unusable without the compiled lib directory.

The timing is the tell. The downgrade cycle landed while HubSpot was opening more AI and developer-facing doors, not retreating from them. On 2 Nov, HubSpot also had 40 Google ad creatives running, with 17 new creatives and the earliest first shown on 28 Oct. The company is trying to keep the acquisition machine warm while proving that AI can pull through into customer expansion.

Attio’s fortnight looked less like a launch and more like continuous surface area expansion. On 24 Oct it launched product pages for Cevanos and Gojiberry and added documentation for creating multiple pipelines. On 27 Oct it launched pages for Freelvy and Legacy Customer Terms. On 28 Oct it added six application pages including Call Forges, Chirp, Easy Ringer, Hey Reach, Kondo and Lookupist. On 29 Oct it added Deepline API, Insourcia, Loops SO and Specstream, plus documentation for exporting audit logs. On 30 Oct it added Clean and Postlude AI and introduced a developer changelog. On 2 Nov it added Schema Map, Sendable and a Demo Gift Program.

The product changelog on 31 Oct gave the pattern more substance: Activities for capturing deal movements, workflow updates, a new inbox, redesigned record pages and a live developer changelog. That is a clear push toward becoming the system where customer records, workflow and partner applications meet.

The customer page reinforced the positioning. On 25 Oct, Attio added Taskrabbit’s logo and a case study on scaling partnerships with Attio. On 27 Oct, it added case studies for Granola, Modal, Railway, Passionfroot, USV, Snackpass and Taskrabbit, with Snackpass described as having switched from Salesforce to Attio. At the same time, Attio removed several careers pages across account executive, engineering lead, customer success, technical support, recruiting and senior product marketing roles during the fortnight. The company is expanding its product and proof library quickly, while editing parts of its hiring surface.

Pipedrive’s website changes were the most surgical. On 26 Oct, it removed 206 product pages, 72 blog pages, 49 customer case study pages and one comparison page. On 28 Oct, it introduced 38 new product pages focused on CRM features and data management while again showing large removals across product, case study and blog pages. On 29 Oct, it launched a German CRM system page. On 30 Oct, reports said Pipedrive had announced a major restructuring involving the closure of certain offices.

That is the kind of sequencing a single weekly snapshot can flatten. The content reduction came before the restructuring reports, and the replacement pages were clustered around the core CRM proposition. On 2 Nov, Pipedrive had 40 Google ad creatives running, with 22 new creatives and the earliest first shown on 29 Oct. The public signal is a company narrowing the surface it presents to the market while continuing to buy attention.

Close also changed its front door twice. On 29 Oct, its site added Book a demo and Log in CTAs while removing Explore integrations. On 31 Oct, it added Try for free and Explore integrations while removing Book a demo and Log in. On 30 Oct, it published terminology changes renaming leads to contacts and opportunities. On 31 Oct, it launched AI and integration pages for Insightboard.io, Ready and Solinth, and removed the Chloe product page.

The operational note was less strategic but still material: on 30 Oct, Close reported a critical incident in which the app was unavailable for some customers for around 29 minutes, later resolved. Close also added a customer case study on 26 Oct, titled Big Brands: How Ignite Productions Automated 95% of Event Operations. The company is adjusting language, acquisition paths and integration positioning at speed.