Lifecycle marketing turns into an AI land grab

This was not a quiet fortnight for demand generation. On 21 Sep, ActiveCampaign had 21 new Google ad creatives, with the earliest first shown on 10 Sep, and 40 creatives running in total. Braze also showed 40 new Google ad creatives on 21 Sep, with the earliest first shown on 26 Aug. On 20 Sep, Brevo showed 40 new creatives, earliest first shown on 29 Jul, while Klaviyo showed 40 new creatives, earliest first shown on 16 Sep. Mailchimp had 30 new creatives reported on 19 Sep and 40 running in total, with the earliest first shown on 27 Aug.

The useful signal is the timing, not the count alone. Brevo and Braze had creative already live for weeks before the current noise became visible, while Klaviyo’s burst was much fresher, first shown on 16 Sep and reported on 20 Sep. ActiveCampaign’s ads began appearing on 10 Sep, then landed alongside its 18 Sep Active Intelligence 3.0 press activity. In this category, the surface area now changes before the official story does.

That matters because the vendors are not merely retargeting the same proposition. Mailchimp changed its site on 19 Sep to foreground an interactive product tour and removed the previous heading, “Try our Standard plan for free!” Klaviyo added Shopify email marketing and analytics pages on 21 Sep while removing Composer for Shopify pages. ActiveCampaign added seven integration and consultant directory pages on 20 Sep while removing eight integration pages. Positioning, packaging and channel pressure moved in the same week.

Braze carried the loudest public AI narrative. On 14 Sep, reports said Q2 revenue rose 26% year over year to $227.2 million and noted a guidance boost, alongside concern over soft earnings guidance and a reported 12% stock decline. On 19 Sep, further reports said Braze raised FY27 guidance after positive Q2 performance, while the market reaction was described as a 19% share price drop following the announcement. On 21 Sep, Braze announced the Forge 2026 agenda, and multiple articles again connected its earnings beat to AI-led growth.

The product signals matched the capital markets story. On 12 Sep, Braze appointed an AI-focused product chief. On 15 Sep, its participation in Citi’s 2026 Global TMT Conference was reported with emphasis on an AI push. Braze also posted 23 new roles in the seven days to 16 Sep, including 13 in marketing and nine in engineering and machine learning, then 22 new roles in the seven days to 20 Sep, including six in engineering and machine learning.

ActiveCampaign made the same turn in operator language. On 18 Sep it released information about Active Intelligence 3.0, presenting it as an AI-driven automation upgrade for marketing efficiency. On 14 Sep, its new YouTube videos covered importing contacts using Active Intelligence, creating customer journeys with a single command and configuring WhatsApp workflows.

Klaviyo’s AI story is being framed as a move beyond email and SMS. On 15 Sep, articles analysed Composer AI as part of a shift towards intelligent B2C CRM, and on 11 Sep Klaviyo announced headless capabilities designed to let agents and marketers work across platforms. Iterable’s hiring also joined the same lane: on 19 Sep it listed a Principal Product Marketing Manager focused on AI Innovation.

The fortnight’s developer and commerce updates were unusually dense. On 19 Sep, Mailchimp created marketing SDK repositories in C#, Java, Swift, TypeScript, Python, Go, PHP, Ruby and Rust. On 16 Sep, it released version 6.2 of its WooCommerce integration, adding support for custom order types, an editable newsletter checkbox label, a new OAuth loader UI, GDPR API data caching and optimised CSS enqueuing. On 18 Sep, it added a help page for integrating Yotpo Loyalty & Referrals.

Klaviyo pressed on the same surface. On 16 Sep, it released version 4.5.1 of the klaviyo-android-sdk with automatic push integration for push token registration and push open tracking, and created repositories including SFCC_Klaviyo. On 20 Sep, it released version 5.4.1 of the klaviyo-swift-sdk with a fix for in-app forms session-expiry lifecycle, and created mobile-app-growth-web and klaviyo-campaign-performance repositories.

Braze also moved towards commerce infrastructure. On 17 Sep, it created a GitHub repository called shopify-hydrogen-example. On 19 Sep, it added one new customer engagement page, four blog articles and two product-related pages, while removing seven older blog pages. That cadence looked less like isolated content maintenance and more like a category-wide rewrite around commerce, SDKs and implementation proof.

Iterable’s developer signal was narrower but positive. On 18 Sep, it released version 2.3.1 of the iterable-web-sdk, fixing configurable preferUserId handling through tryUser to setUserID and setEmail. The same day, weekly downloads rose 33% for its web SDK, 43% for its react-native SDK and 49% for its expo plugin.

The category also had a difficult security and uptime fortnight. On 12 Sep and again on 15 Sep, multiple articles reported a Brevo security breach that resulted in phishing emails being sent to 347,000 Trezor users, linked in those reports to a login authorisation flaw. On 19 Sep, further articles reported a supply chain attack affecting Brevo, with malware injected into more than 100,000 websites through ClickFix scripts and WordPress backdoors, reportedly exploiting Brevo CDN and DNS services to deliver malicious JavaScript.

Brevo’s status activity stayed in focus on 19 Sep, when it was investigating a critical incident affecting Contacts and Imports services. The same report said a minor incident affecting multiple services had been resolved after about 100 minutes, and that a ClickFix security incident had also been resolved. On 14 Sep, CVE-2026-85170 was reported as affecting n8n versions before 1.123.73, 2.35.4 and 2.36.2, involving Gmail and Brevo nodes passing message content to the mail composer without verifying it is a string.

Others had smaller operational interruptions. On 19 Sep, Braze reported a critical outage of Support Services lasting around 412 minutes, later resolved. Klaviyo reported event-triggered flow sending delays on 17 Sep lasting around 261 minutes, and another minor flow sending delay incident on 21 Sep lasting about 155 minutes, both resolved. ActiveCampaign had a major incident on 18 Sep in which bulk contact edits were not applying filters, resolved after about 26 minutes.

Mailchimp had security maintenance of a different kind. On 10 Sep, four new CVEs were published identifying vulnerabilities in Mailchimp products, including unauthenticated XSS in MailChimp Subscribe Forms for versions up to 4.3.3 and administrator SQL injection in MailChimp For WooCommerce. In a market selling automation intelligence, the operational floor is still identity, deliverability, integrations and incident response.