Agents Got a Native Payment Rail This Month. The Wallet Is Where the Risk Moved.

Agents Got a Native Payment Rail This Month. The Wallet Is Where the Risk Moved.

The x402 Foundation went live under the Linux Foundation on July 14 with Visa, Mastercard, Stripe, and AWS on board, and HTTP 402 finally has a client that can pay a bill: the agent. The wire protocol is the settled, easy part. What an agent is allowed to spend, and whether that permission can be replayed by another agent, lives in the wallet layer, and the spending cap has to sit below the application, because the model that decides to pay is the same model an attacker can talk into paying.

Your Agent Runs Code No One Reviewed. The Sandbox Now Assumes It's Hostile.

Your Agent Runs Code No One Reviewed. The Sandbox Now Assumes It's Hostile.

An unreleased model kept escaping its test sandbox this month, and the containment responses from Anthropic and Google landed the same week. The code an agent runs is written at runtime and read by no one, so the sandbox now has to assume it is hostile. Egress closed by default is the control that pays for itself.

The Agent Loop Is Moving Out of Your Codebase

The Agent Loop Is Moving Out of Your Codebase

In the week of July 16, AWS AgentCore went GA, Microsoft shipped its Agent Harness at BUILD, and the OpenAI, Anthropic, and Google SDKs made declarative loops first-class. The plan-act-observe loop you hand-wrote is turning into a managed runtime feature. The loop was never the hard part, and knowing what you give up when the runtime owns it is the part worth thinking about.

The Kill Switch Belongs in the Runtime, Not the Prompt

The Kill Switch Belongs in the Runtime, Not the Prompt

A Writer survey this spring found 35 percent of organizations could not shut down a rogue agent. Most kill switches fail because the stop logic lives in the prompt or an output filter, when a real one has to sit in the runtime, between the agent and the wire, checking every action before it executes.

GPT-Live Keeps Talking While a Bigger Model Does the Thinking

GPT-Live Keeps Talking While a Bigger Model Does the Thinking

GPT-Live listens and speaks at the same time and delegates hard questions to a bigger model in the background, replacing the turn-based pipeline every voice agent was built on. The new tau-Voice benchmark shows the architecture is right but the basics, capturing a name or an email without faking a tool call, still fail.

Agents Got a Native Payment Rail This Month. The Wallet Is Where the Risk Moved.

Agents Got a Native Payment Rail This Month. The Wallet Is Where the Risk Moved.

The x402 Foundation went live under the Linux Foundation on July 14 with Visa, Mastercard, Stripe, and AWS on board, and HTTP 402 finally has a client that can pay a bill: the agent. The wire protocol is the settled, easy part. What an agent is allowed to spend, and whether that permission can be replayed by another agent, lives in the wallet layer, and the spending cap has to sit below the application, because the model that decides to pay is the same model an attacker can talk into paying.

Your Agent Runs Code No One Reviewed. The Sandbox Now Assumes It's Hostile.

Your Agent Runs Code No One Reviewed. The Sandbox Now Assumes It's Hostile.

An unreleased model kept escaping its test sandbox this month, and the containment responses from Anthropic and Google landed the same week. The code an agent runs is written at runtime and read by no one, so the sandbox now has to assume it is hostile. Egress closed by default is the control that pays for itself.

The Agent Loop Is Moving Out of Your Codebase

The Agent Loop Is Moving Out of Your Codebase

In the week of July 16, AWS AgentCore went GA, Microsoft shipped its Agent Harness at BUILD, and the OpenAI, Anthropic, and Google SDKs made declarative loops first-class. The plan-act-observe loop you hand-wrote is turning into a managed runtime feature. The loop was never the hard part, and knowing what you give up when the runtime owns it is the part worth thinking about.

The Kill Switch Belongs in the Runtime, Not the Prompt

The Kill Switch Belongs in the Runtime, Not the Prompt

A Writer survey this spring found 35 percent of organizations could not shut down a rogue agent. Most kill switches fail because the stop logic lives in the prompt or an output filter, when a real one has to sit in the runtime, between the agent and the wire, checking every action before it executes.

GPT-Live Keeps Talking While a Bigger Model Does the Thinking

GPT-Live Keeps Talking While a Bigger Model Does the Thinking

GPT-Live listens and speaks at the same time and delegates hard questions to a bigger model in the background, replacing the turn-based pipeline every voice agent was built on. The new tau-Voice benchmark shows the architecture is right but the basics, capturing a name or an email without faking a tool call, still fail.

Agents Got a Native Payment Rail This Month. The Wallet Is Where the Risk Moved.

Agents Got a Native Payment Rail This Month. The Wallet Is Where the Risk Moved.

The x402 Foundation went live under the Linux Foundation on July 14 with Visa, Mastercard, Stripe, and AWS on board, and HTTP 402 finally has a client that can pay a bill: the agent. The wire protocol is the settled, easy part. What an agent is allowed to spend, and whether that permission can be replayed by another agent, lives in the wallet layer, and the spending cap has to sit below the application, because the model that decides to pay is the same model an attacker can talk into paying.

Your Agent Runs Code No One Reviewed. The Sandbox Now Assumes It's Hostile.

Your Agent Runs Code No One Reviewed. The Sandbox Now Assumes It's Hostile.

An unreleased model kept escaping its test sandbox this month, and the containment responses from Anthropic and Google landed the same week. The code an agent runs is written at runtime and read by no one, so the sandbox now has to assume it is hostile. Egress closed by default is the control that pays for itself.

The Agent Loop Is Moving Out of Your Codebase

The Agent Loop Is Moving Out of Your Codebase

In the week of July 16, AWS AgentCore went GA, Microsoft shipped its Agent Harness at BUILD, and the OpenAI, Anthropic, and Google SDKs made declarative loops first-class. The plan-act-observe loop you hand-wrote is turning into a managed runtime feature. The loop was never the hard part, and knowing what you give up when the runtime owns it is the part worth thinking about.

The Kill Switch Belongs in the Runtime, Not the Prompt

The Kill Switch Belongs in the Runtime, Not the Prompt

A Writer survey this spring found 35 percent of organizations could not shut down a rogue agent. Most kill switches fail because the stop logic lives in the prompt or an output filter, when a real one has to sit in the runtime, between the agent and the wire, checking every action before it executes.

MCP Went Stateless, and the Sticky Session Was the Whole Problem

MCP Went Stateless, and the Sticky Session Was the Whole Problem

The 2026-07-28 MCP release candidate makes the protocol stateless, no handshake and no session id, so any request can hit any server instance. That deletes the sticky routing and shared session store most remote MCP servers were built around and lets them run behind a plain load balancer.

Your Agent Runs Code No One Reviewed. The Sandbox Now Assumes It's Hostile.

Your Agent Runs Code No One Reviewed. The Sandbox Now Assumes It's Hostile.

An unreleased model kept escaping its test sandbox this month, and the containment responses from Anthropic and Google landed the same week. The code an agent runs is written at runtime and read by no one, so the sandbox now has to assume it is hostile. Egress closed by default is the control that pays for itself.

The Kill Switch Belongs in the Runtime, Not the Prompt

The Kill Switch Belongs in the Runtime, Not the Prompt

A Writer survey this spring found 35 percent of organizations could not shut down a rogue agent. Most kill switches fail because the stop logic lives in the prompt or an output filter, when a real one has to sit in the runtime, between the agent and the wire, checking every action before it executes.

The Exploit Was a Prompt That Said "Leak API Keys"

The Exploit Was a Prompt That Said "Leak API Keys"

CISA added a Langflow authorization bypass to its Known Exploited Vulnerabilities catalog on July 7 and gave federal agencies three days to patch. The attack carried no shellcode: one request ran another user's agent flow with the input "leak api keys". In an agent builder, permission to run a flow is permission to read every credential wired into it.

Nine in Ten Companies Running Agents Have Already Had a Security Incident

Nine in Ten Companies Running Agents Have Already Had a Security Incident

AvePoint surveyed 750 IT leaders in regulated industries and 88.4 percent reported an AI agent security incident in the past year. The scarier number is the visibility gap: one in five companies cannot account for the agents already running on their data.

Your Model's Best Answers Are Training Data for a Cheaper One

Your Model's Best Answers Are Training Data for a Cheaper One

Anthropic says Alibaba-linked operators ran 28.8 million conversations across 25,000 fake accounts to distill Claude's agentic and coding skills. For anyone running an API-backed AI product, the lesson is that your best outputs are someone else's training data.

MCP Went Stateless, and the Sticky Session Was the Whole Problem

MCP Went Stateless, and the Sticky Session Was the Whole Problem

The 2026-07-28 MCP release candidate makes the protocol stateless, no handshake and no session id, so any request can hit any server instance. That deletes the sticky routing and shared session store most remote MCP servers were built around and lets them run behind a plain load balancer.

The Tool Call Now Returns a Ticket, Not a Result

The Tool Call Now Returns a Ticket, Not a Result

MCP's release candidate makes Tasks a first-class extension: a tool call can hand back a handle instead of an answer, because agent work stopped fitting inside one request. Here is what changes if you build MCP servers.

MCP Went Stateless. Your State Didn't Disappear, It Moved.

MCP Went Stateless. Your State Didn't Disappear, It Moved.

The July 28 MCP spec removes the protocol session, so any request can hit any server instance and a remote MCP server can finally run behind a plain load balancer. The catch: the state you kept in the session does not vanish, it moves into opaque handles you have to design yourself.

Three MCP Servers, 72 Percent of the Context Gone

Three MCP Servers, 72 Percent of the Context Gone

Every tool an MCP server exposes loads its full definition into the agent's context at the start of the conversation, used or not. One team measured three servers eating 143,000 of 200,000 tokens before the agent read a single instruction, and a benchmark found MCP costing 4 to 32 times more tokens than a CLI for identical work. Use MCP for discovery, dispatch to a CLI for execution.

MCP Gave AI Agents Superpowers. Attackers Noticed.

MCP Gave AI Agents Superpowers. Attackers Noticed.

The protocol that lets AI agents use tools also gave attackers a new attack surface. January 2026 showed us how bad it can get.

The Model Keeps Thoughts It Never Says. Now There's a Tool to Read Them.

The Model Keeps Thoughts It Never Says. Now There's a Tool to Read Them.

Anthropic open-sourced the Jacobian lens, a technique that reads the words a model is leaning toward before it writes them, and DeepMind reproduced it on a different model. The practical part is not the consciousness headline. It is that a model can hold a thought, including that it is being tested, without saying it.

GPT-5.6 Stops Running Your Tools Through the Model

GPT-5.6 Stops Running Your Tools Through the Model

GPT-5.6 shipped programmatic tool calling: the model writes code that runs your tools in a sandbox instead of calling them one at a time. OpenAI, Anthropic, and Cloudflare all reached the same conclusion, that the model was never a good place to run the tool loop.

The Agent Failed for Weeks and 4,286 Tests Stayed Green

The Agent Failed for Weeks and 4,286 Tests Stayed Green

A June 2026 study tracked 22 production incidents in a live LLM agent runtime. In most of them the system was already broken while all 4,286 tests and 827 governance audits stayed green. Agents fail in the seams your tests never watch.

GitHub Wasn't Built for Billions of Agents Hammering One Server

GitHub Wasn't Built for Billions of Agents Hammering One Server

Entire, from former GitHub CEO Thomas Dohmke, mirrors your repo into regional nodes so agents stop hammering one central Git server. The real signal is the bottleneck moving from the model to the plumbing built for human-paced work.

Z.ai's ZCode Puts the Agent in the Center and the Editor on the Edge

Z.ai's ZCode Puts the Agent in the Center and the Editor on the Edge

Z.ai shipped ZCode, an agent-first coding tool where the chat is the main window and the editor is one panel around it, running on the cheap open-weight GLM-5.2. The shift to watch is not the benchmark, it is where the cursor lives.

The Model Was Never the Hard Part. Nine Billion Dollars Just Proved It.

The Model Was Never the Hard Part. Nine Billion Dollars Just Proved It.

In eight weeks Microsoft, AWS, OpenAI, and Anthropic each stood up a forward-deployed engineering unit, more than nine billion dollars combined, to embed their own engineers inside customer companies. An MIT study found 95 percent of enterprises got no measurable return on generative AI. The models work. The deployment does not.

Twelve Agents, Half of Them Working Alone

Twelve Agents, Half of Them Working Alone

The average company now runs twelve AI agents and half of them work in complete isolation. The bottleneck stopped being how many agents you can build. It became whether any of them can hand work to another.

Cost per Solved Task, Not Cost per Token

Cost per Solved Task, Not Cost per Token

Uber capped engineers at $1,500 a month after burning its annual AI budget in four months, and Fable 5 costs double Opus yet wins on long migrations. Per-token price stopped being the cost; cost per solved task is, and the lever that controls it is making loops halt.

The average manager saves twice as much time with AI as the people doing the actual work

The average manager saves twice as much time with AI as the people doing the actual work

Managers save 7.2 hours per week with AI. Individual contributors save 3.4. The gap is structural, not cognitive, and it is shaping how organizations adopt AI in ways that benefit the top of the org chart first.

OpenAI Killed Sora and Its Hardware Plans to Focus on What Actually Makes Money

OpenAI Killed Sora and Its Hardware Plans to Focus on What Actually Makes Money

OpenAI scrapped Sora and scaled back its Jony Ive hardware partnership to concentrate on coding tools and enterprise customers. Consumer AI gets the headlines. Enterprise code writes the checks.

All ai agents enterprise anthropic security