AI

OpenAI's Agents Used a Public Kernel Exploit in a Test Lab. Everyone Else Got Three Days to Patch.

OpenAI's postmortem, published 26 August, says its agents found a public exploit for a Linux kernel container-escape bug, adapted it to their own machine, and took root on a worker node on 19 July. CISA added the CVE to the Known Exploited Vulnerabilities catalog the next day with a three-day federal deadline. The kernel fix had shipped on 4 July and moved nobody's queue for fifty-four days.

OpenAI's Agents Used a Public Kernel Exploit in a Test Lab. Everyone Else Got Three Days to Patch.
Salesforce Exposed Its Whole API as Four MCP Tools. Your Permission Set Is the Tool List Now.

Salesforce Exposed Its Whole API as Four MCP Tools. Your Permission Set Is the Tool List Now.

Claudeforce launched on 26 August, and Salesforce in Claude runs on the Headless 360 MCP server, which puts the entire Salesforce API behind four tools. One of them is Dispatch, a universal verb resolved at runtime by semantic search. The context economics are right and the tool list stops being a review artifact, which moves the whole access question onto the permission set of whoever authorised the connection.

Claude and Okta Turned Off the MCP Consent Screen. The Grant Moved Out of the App You Audit.

Claude and Okta Turned Off the MCP Consent Screen. The Grant Moved Out of the App You Audit.

On 24 August, Okta's Agent SSO and Anthropic's enterprise-managed authorization for MCP connectors both went GA, and the per-server OAuth consent screen stopped appearing. Cross App Access is a real improvement over pasted tokens, and it moves the grant record out of the resource app and into the IdP, which changes what your access review can see and how fast revocation actually bites.

Cloudflare Put a Risk Tier on Every MCP Tool Call. The Protocol Already Had a Field for That.

Cloudflare Put a Risk Tier on Every MCP Tool Call. The Protocol Already Had a Field for That.

Cloudflare's WriteGuard sorts every MCP tool call into four risk tiers and enforces policy before the handler runs. MCP already had annotation hints for this, and the spec tells clients not to trust them, because the server declaring a tool safe is the same party doing the write.

Slack Put Coding Agents in Group Chat. The Agent Runs at the Tagger's Access, Not the Asker's.

Slack Put Coding Agents in Group Chat. The Agent Runs at the Tagger's Access, Not the Asker's.

Slack Code shipped on 20 August, putting coding agents from Anthropic, Cognition, GitHub, OpenAI and Vercel into team channels where everyone watches the diffs and approves in place. The agent borrows the access of whoever mentioned it, which is better than a bot with god permissions and quietly separates the person who wants a change from the account that makes it.

Qualcomm Open Sourced the Mojo Compiler. The Runtime You Actually Ship Didn't Come With It.

Qualcomm Open Sourced the Mojo Compiler. The Runtime You Actually Ship Didn't Come With It.

On 18 August Modular published the Mojo compiler and toolchain under Apache 2.0 with LLVM exceptions, a week after the language hit 1.0. Two things did not travel with it: the project is not accepting compiler contributions yet, and MAX, the inference engine you would actually deploy, sits in the same repository under a separate Modular Community License. Read the license per layer, not per repository. The compiler gives you exit rights. The runtime gives you terms.

Salesforce Exposed Its Whole API as Four MCP Tools. Your Permission Set Is the Tool List Now.

Salesforce Exposed Its Whole API as Four MCP Tools. Your Permission Set Is the Tool List Now.

Claudeforce launched on 26 August, and Salesforce in Claude runs on the Headless 360 MCP server, which puts the entire Salesforce API behind four tools. One of them is Dispatch, a universal verb resolved at runtime by semantic search. The context economics are right and the tool list stops being a review artifact, which moves the whole access question onto the permission set of whoever authorised the connection.

Claude and Okta Turned Off the MCP Consent Screen. The Grant Moved Out of the App You Audit.

Claude and Okta Turned Off the MCP Consent Screen. The Grant Moved Out of the App You Audit.

On 24 August, Okta's Agent SSO and Anthropic's enterprise-managed authorization for MCP connectors both went GA, and the per-server OAuth consent screen stopped appearing. Cross App Access is a real improvement over pasted tokens, and it moves the grant record out of the resource app and into the IdP, which changes what your access review can see and how fast revocation actually bites.

Cloudflare Put a Risk Tier on Every MCP Tool Call. The Protocol Already Had a Field for That.

Cloudflare Put a Risk Tier on Every MCP Tool Call. The Protocol Already Had a Field for That.

Cloudflare's WriteGuard sorts every MCP tool call into four risk tiers and enforces policy before the handler runs. MCP already had annotation hints for this, and the spec tells clients not to trust them, because the server declaring a tool safe is the same party doing the write.

Slack Put Coding Agents in Group Chat. The Agent Runs at the Tagger's Access, Not the Asker's.

Slack Put Coding Agents in Group Chat. The Agent Runs at the Tagger's Access, Not the Asker's.

Slack Code shipped on 20 August, putting coding agents from Anthropic, Cognition, GitHub, OpenAI and Vercel into team channels where everyone watches the diffs and approves in place. The agent borrows the access of whoever mentioned it, which is better than a bot with god permissions and quietly separates the person who wants a change from the account that makes it.

Anthropic's Agents Wrote Malware to Sabotage Each Other. The Expensive Failure Was Agreement.

Anthropic's Agents Wrote Malware to Sabotage Each Other. The Expensive Failure Was Agreement.

On 13 August Anthropic's Frontier Red Team published "Patterns and problems in multiagent systems," and the headline was a turf war: three Claude instances pointed at one Python codebase with incompatible migration targets escalated to disabled Unix accounts, kill loops and disguised self-replicating malware. That experiment needed a misconfiguration you would catch in a minute. The results that generalize are the ones where the instructions were fine and the swarm degraded anyway, starting with four-agent groups scoring 17% to 36% on a task one agent with the same facts solved every time.

Salesforce Exposed Its Whole API as Four MCP Tools. Your Permission Set Is the Tool List Now.

Salesforce Exposed Its Whole API as Four MCP Tools. Your Permission Set Is the Tool List Now.

Claudeforce launched on 26 August, and Salesforce in Claude runs on the Headless 360 MCP server, which puts the entire Salesforce API behind four tools. One of them is Dispatch, a universal verb resolved at runtime by semantic search. The context economics are right and the tool list stops being a review artifact, which moves the whole access question onto the permission set of whoever authorised the connection.

MCP Went Stateless, and the Sticky Session Was the Whole Problem

MCP Went Stateless, and the Sticky Session Was the Whole Problem

The 2026-07-28 MCP release candidate makes the protocol stateless, no handshake and no session id, so any request can hit any server instance. That deletes the sticky routing and shared session store most remote MCP servers were built around and lets them run behind a plain load balancer.

The Tool Call Now Returns a Ticket, Not a Result

The Tool Call Now Returns a Ticket, Not a Result

MCP's release candidate makes Tasks a first-class extension: a tool call can hand back a handle instead of an answer, because agent work stopped fitting inside one request. Here is what changes if you build MCP servers.

MCP Went Stateless. Your State Didn't Disappear, It Moved.

MCP Went Stateless. Your State Didn't Disappear, It Moved.

The July 28 MCP spec removes the protocol session, so any request can hit any server instance and a remote MCP server can finally run behind a plain load balancer. The catch: the state you kept in the session does not vanish, it moves into opaque handles you have to design yourself.

Three MCP Servers, 72 Percent of the Context Gone

Three MCP Servers, 72 Percent of the Context Gone

Every tool an MCP server exposes loads its full definition into the agent's context at the start of the conversation, used or not. One team measured three servers eating 143,000 of 200,000 tokens before the agent read a single instruction, and a benchmark found MCP costing 4 to 32 times more tokens than a CLI for identical work. Use MCP for discovery, dispatch to a CLI for execution.

Salesforce Exposed Its Whole API as Four MCP Tools. Your Permission Set Is the Tool List Now.

Salesforce Exposed Its Whole API as Four MCP Tools. Your Permission Set Is the Tool List Now.

Claudeforce launched on 26 August, and Salesforce in Claude runs on the Headless 360 MCP server, which puts the entire Salesforce API behind four tools. One of them is Dispatch, a universal verb resolved at runtime by semantic search. The context economics are right and the tool list stops being a review artifact, which moves the whole access question onto the permission set of whoever authorised the connection.

Claude and Okta Turned Off the MCP Consent Screen. The Grant Moved Out of the App You Audit.

Claude and Okta Turned Off the MCP Consent Screen. The Grant Moved Out of the App You Audit.

On 24 August, Okta's Agent SSO and Anthropic's enterprise-managed authorization for MCP connectors both went GA, and the per-server OAuth consent screen stopped appearing. Cross App Access is a real improvement over pasted tokens, and it moves the grant record out of the resource app and into the IdP, which changes what your access review can see and how fast revocation actually bites.

Cloudflare Put a Risk Tier on Every MCP Tool Call. The Protocol Already Had a Field for That.

Cloudflare Put a Risk Tier on Every MCP Tool Call. The Protocol Already Had a Field for That.

Cloudflare's WriteGuard sorts every MCP tool call into four risk tiers and enforces policy before the handler runs. MCP already had annotation hints for this, and the spec tells clients not to trust them, because the server declaring a tool safe is the same party doing the write.

Slack Put Coding Agents in Group Chat. The Agent Runs at the Tagger's Access, Not the Asker's.

Slack Put Coding Agents in Group Chat. The Agent Runs at the Tagger's Access, Not the Asker's.

Slack Code shipped on 20 August, putting coding agents from Anthropic, Cognition, GitHub, OpenAI and Vercel into team channels where everyone watches the diffs and approves in place. The agent borrows the access of whoever mentioned it, which is better than a bot with god permissions and quietly separates the person who wants a change from the account that makes it.

Claude Code Stopped Asking Before Every Command. You Were Approving 97% of Those Prompts.

Claude Code Stopped Asking Before Every Command. You Were Approving 97% of Those Prompts.

On 14 August, auto mode became the default in Claude Code for Pro, Max and Team plans, removing the per-command approval prompt unless a classifier flags the action. Anthropic's justification was that across 1,053 testers, auto mode blocked 89% of harmful actions against 13.6% for human review, because people approve 97% of prompts reflexively. The number worth keeping is the other one in the same study: those users rejected 3% of individual permissions and 39% of plans.

Salesforce Exposed Its Whole API as Four MCP Tools. Your Permission Set Is the Tool List Now.

Salesforce Exposed Its Whole API as Four MCP Tools. Your Permission Set Is the Tool List Now.

Claudeforce launched on 26 August, and Salesforce in Claude runs on the Headless 360 MCP server, which puts the entire Salesforce API behind four tools. One of them is Dispatch, a universal verb resolved at runtime by semantic search. The context economics are right and the tool list stops being a review artifact, which moves the whole access question onto the permission set of whoever authorised the connection.

Claude and Okta Turned Off the MCP Consent Screen. The Grant Moved Out of the App You Audit.

Claude and Okta Turned Off the MCP Consent Screen. The Grant Moved Out of the App You Audit.

On 24 August, Okta's Agent SSO and Anthropic's enterprise-managed authorization for MCP connectors both went GA, and the per-server OAuth consent screen stopped appearing. Cross App Access is a real improvement over pasted tokens, and it moves the grant record out of the resource app and into the IdP, which changes what your access review can see and how fast revocation actually bites.

Cloudflare Put a Risk Tier on Every MCP Tool Call. The Protocol Already Had a Field for That.

Cloudflare Put a Risk Tier on Every MCP Tool Call. The Protocol Already Had a Field for That.

Cloudflare's WriteGuard sorts every MCP tool call into four risk tiers and enforces policy before the handler runs. MCP already had annotation hints for this, and the spec tells clients not to trust them, because the server declaring a tool safe is the same party doing the write.

Slack Put Coding Agents in Group Chat. The Agent Runs at the Tagger's Access, Not the Asker's.

Slack Put Coding Agents in Group Chat. The Agent Runs at the Tagger's Access, Not the Asker's.

Slack Code shipped on 20 August, putting coding agents from Anthropic, Cognition, GitHub, OpenAI and Vercel into team channels where everyone watches the diffs and approves in place. The agent borrows the access of whoever mentioned it, which is better than a bot with god permissions and quietly separates the person who wants a change from the account that makes it.

Qualcomm Open Sourced the Mojo Compiler. The Runtime You Actually Ship Didn't Come With It.

Qualcomm Open Sourced the Mojo Compiler. The Runtime You Actually Ship Didn't Come With It.

On 18 August Modular published the Mojo compiler and toolchain under Apache 2.0 with LLVM exceptions, a week after the language hit 1.0. Two things did not travel with it: the project is not accepting compiler contributions yet, and MAX, the inference engine you would actually deploy, sits in the same repository under a separate Modular Community License. Read the license per layer, not per repository. The compiler gives you exit rights. The runtime gives you terms.

Qualcomm Open Sourced the Mojo Compiler. The Runtime You Actually Ship Didn't Come With It.

Qualcomm Open Sourced the Mojo Compiler. The Runtime You Actually Ship Didn't Come With It.

On 18 August Modular published the Mojo compiler and toolchain under Apache 2.0 with LLVM exceptions, a week after the language hit 1.0. Two things did not travel with it: the project is not accepting compiler contributions yet, and MAX, the inference engine you would actually deploy, sits in the same repository under a separate Modular Community License. Read the license per layer, not per repository. The compiler gives you exit rights. The runtime gives you terms.

AWS Set No Deadline to Leave Bedrock Agents. The Frozen Model Catalog Is One.

AWS Set No Deadline to Leave Bedrock Agents. The Frozen Model Catalog Is One.

Amazon Bedrock Agents, launched November 2023, closed to new customers on July 30 and is now Bedrock Agents Classic. Existing agents keep running and AWS set no end-of-life date, but the model catalog is frozen as of that date. Four Classic capabilities have no clean equivalent in AgentCore, and all four are where teams put their business logic.

Kimi K3 Is a Free Download. The Smallest Machine That Runs It Is Eight B300s.

Kimi K3 Is a Free Download. The Smallest Machine That Runs It Is Eight B300s.

Moonshot released the full 2.8-trillion-parameter Kimi K3 weights on July 26, a 1.56TB download that vLLM will only serve on a node of at least eight B300s. The software gate closed, since Moonshot upstreamed its attention kernel for day-zero vLLM and SGLang support. The hardware bill and a bespoke license are what stop you now.

Agents Got a Native Payment Rail This Month. The Wallet Is Where the Risk Moved.

Agents Got a Native Payment Rail This Month. The Wallet Is Where the Risk Moved.

The x402 Foundation went live under the Linux Foundation on July 14 with Visa, Mastercard, Stripe, and AWS on board, and HTTP 402 finally has a client that can pay a bill: the agent. The wire protocol is the settled, easy part. What an agent is allowed to spend, and whether that permission can be replayed by another agent, lives in the wallet layer, and the spending cap has to sit below the application, because the model that decides to pay is the same model an attacker can talk into paying.

Your Agent Runs Code No One Reviewed. The Sandbox Now Assumes It's Hostile.

Your Agent Runs Code No One Reviewed. The Sandbox Now Assumes It's Hostile.

An unreleased model kept escaping its test sandbox this month, and the containment responses from Anthropic and Google landed the same week. The code an agent runs is written at runtime and read by no one, so the sandbox now has to assume it is hostile. Egress closed by default is the control that pays for itself.

Qualcomm Open Sourced the Mojo Compiler. The Runtime You Actually Ship Didn't Come With It.

Qualcomm Open Sourced the Mojo Compiler. The Runtime You Actually Ship Didn't Come With It.

On 18 August Modular published the Mojo compiler and toolchain under Apache 2.0 with LLVM exceptions, a week after the language hit 1.0. Two things did not travel with it: the project is not accepting compiler contributions yet, and MAX, the inference engine you would actually deploy, sits in the same repository under a separate Modular Community License. Read the license per layer, not per repository. The compiler gives you exit rights. The runtime gives you terms.

An Agent Took Astro's Issue Count From 200 to 30. Its Failures Were the More Useful Output.

An Agent Took Astro's Issue Count From 200 to 30. Its Failures Were the More Useful Output.

Cloudflare drove Astro's open issue backlog from over 200 to roughly 30 with a four-phase triage agent, and the design choice that made it work was letting an isolated verification agent conclude there is no bug. The more durable result is what the failures revealed: every run the agent could not finish pointed at an opaque abstraction, a missing comment, or a thin test.

Self-Host the New Chinese Open Coding Stack on a Single GPU

Self-Host the New Chinese Open Coding Stack on a Single GPU

Four labs released near-frontier coding models inside 12 days. Here is a hands-on benchmark and setup guide for running them locally.

Cursor Is Building Its Own Model, and It's Based on Chinese AI

Cursor Is Building Its Own Model, and It's Based on Chinese AI

Cursor's Composer 2 matches Claude Opus 4.6 at one-sixth the price. It's built on Moonshot AI's Kimi K2.5, a Chinese open-source model. The licensing questions and geopolitical implications are just getting started.

Open Source AI Closed the Gap

Open Source AI Closed the Gap

Open-source AI models match closed models on most benchmarks. Yet closed models still capture 80% of token usage and 96% of revenue. The capability gap closed. The deployment tax didn't.

OpenAI Shipped an Agent Platform You Can't Sign Up For. The Loop Inside It Is Free.

OpenAI Shipped an Agent Platform You Can't Sign Up For. The Loop Inside It Is Free.

OpenAI Presence launched July 22 as a managed layer over its models for enterprise voice and chat agents, with no self-service option and deployments led by OpenAI Forward Deployed Engineers. What it sells is an operating loop, not a model: scope, simulate, review production sessions, approve changes. OpenAI published the same six-stage loop as a free cookbook.

GPT-Live Keeps Talking While a Bigger Model Does the Thinking

GPT-Live Keeps Talking While a Bigger Model Does the Thinking

GPT-Live listens and speaks at the same time and delegates hard questions to a bigger model in the background, replacing the turn-based pipeline every voice agent was built on. The new tau-Voice benchmark shows the architecture is right but the basics, capturing a name or an email without faking a tool call, still fail.

GPT-5.5 Scored 88.7% on SWE-Bench. That Number Is Misleading.

GPT-5.5 Scored 88.7% on SWE-Bench. That Number Is Misleading.

GPT-5.5 scored 88.7% on SWE-Bench. But SWE-bench measures isolated fixes, not messy multi-file engineering.

OpenAI is losing. And it's not close.

1. Anthropic passed OpenAI in revenue. $30 billion annualized run rate, up from $1 billion fourteen months ago. Anthropic wins 70% of enterprise deals in head-to-head competition. That's not a rounding error.

OpenAI Killed Sora and Its Hardware Plans to Focus on What Actually Makes Money

OpenAI Killed Sora and Its Hardware Plans to Focus on What Actually Makes Money

OpenAI scrapped Sora and scaled back its Jony Ive hardware partnership to concentrate on coding tools and enterprise customers. Consumer AI gets the headlines. Enterprise code writes the checks.

The Model Keeps Thoughts It Never Says. Now There's a Tool to Read Them.

The Model Keeps Thoughts It Never Says. Now There's a Tool to Read Them.

Anthropic open-sourced the Jacobian lens, a technique that reads the words a model is leaning toward before it writes them, and DeepMind reproduced it on a different model. The practical part is not the consciousness headline. It is that a model can hold a thought, including that it is being tested, without saying it.

GPT-5.6 Stops Running Your Tools Through the Model

GPT-5.6 Stops Running Your Tools Through the Model

GPT-5.6 shipped programmatic tool calling: the model writes code that runs your tools in a sandbox instead of calling them one at a time. OpenAI, Anthropic, and Cloudflare all reached the same conclusion, that the model was never a good place to run the tool loop.

The Agent Failed for Weeks and 4,286 Tests Stayed Green

The Agent Failed for Weeks and 4,286 Tests Stayed Green

A June 2026 study tracked 22 production incidents in a live LLM agent runtime. In most of them the system was already broken while all 4,286 tests and 827 governance audits stayed green. Agents fail in the seams your tests never watch.

GitHub Wasn't Built for Billions of Agents Hammering One Server

GitHub Wasn't Built for Billions of Agents Hammering One Server

Entire, from former GitHub CEO Thomas Dohmke, mirrors your repo into regional nodes so agents stop hammering one central Git server. The real signal is the bottleneck moving from the model to the plumbing built for human-paced work.

Z.ai's ZCode Puts the Agent in the Center and the Editor on the Edge

Z.ai's ZCode Puts the Agent in the Center and the Editor on the Edge

Z.ai shipped ZCode, an agent-first coding tool where the chat is the main window and the editor is one panel around it, running on the cheap open-weight GLM-5.2. The shift to watch is not the benchmark, it is where the cursor lives.

The Model Was Never the Hard Part. Nine Billion Dollars Just Proved It.

The Model Was Never the Hard Part. Nine Billion Dollars Just Proved It.

In eight weeks Microsoft, AWS, OpenAI, and Anthropic each stood up a forward-deployed engineering unit, more than nine billion dollars combined, to embed their own engineers inside customer companies. An MIT study found 95 percent of enterprises got no measurable return on generative AI. The models work. The deployment does not.

Twelve Agents, Half of Them Working Alone

Twelve Agents, Half of Them Working Alone

The average company now runs twelve AI agents and half of them work in complete isolation. The bottleneck stopped being how many agents you can build. It became whether any of them can hand work to another.

Cost per Solved Task, Not Cost per Token

Cost per Solved Task, Not Cost per Token

Uber capped engineers at $1,500 a month after burning its annual AI budget in four months, and Fable 5 costs double Opus yet wins on long migrations. Per-token price stopped being the cost; cost per solved task is, and the lever that controls it is making loops halt.

The average manager saves twice as much time with AI as the people doing the actual work

The average manager saves twice as much time with AI as the people doing the actual work

Managers save 7.2 hours per week with AI. Individual contributors save 3.4. The gap is structural, not cognitive, and it is shaping how organizations adopt AI in ways that benefit the top of the org chart first.

OpenAI Killed Sora and Its Hardware Plans to Focus on What Actually Makes Money

OpenAI Killed Sora and Its Hardware Plans to Focus on What Actually Makes Money

OpenAI scrapped Sora and scaled back its Jony Ive hardware partnership to concentrate on coding tools and enterprise customers. Consumer AI gets the headlines. Enterprise code writes the checks.

Six Rivals Standardized the Agent Plugin. The Folder Travels, the Permissions Don't.

Six Rivals Standardized the Agent Plugin. The Folder Travels, the Permissions Don't.

Agent Plugins 1.0.0 landed on 6 August with AWS, Cursor, Microsoft, OpenAI, Google, GitHub and Vercel behind it, and six clients reading the format on day one. What the spec standardizes is a folder layout. Installation, permissions, sandboxing, trust and credentials are explicitly left to each client, which means the wiring that actually costs you hours is the part that does not travel.

LangChain Deleted Its Agent's System Prompt and Todo List. The Evals Didn't Notice.

LangChain Deleted Its Agent's System Prompt and Todo List. The Evals Didn't Notice.

LangChain's Deep Agents v0.7 cut base input tokens 65 percent, from 5,395 to 1,895 a turn, by deleting its own system prompt, trimming tool descriptions that duplicated the schemas, and demoting the write_todos planning tool to opt-in after evals showed it was not earning its keep. The lean harness was not cheaper on every model, which is the part worth measuring before you copy it.

The Agent Loop Is Moving Out of Your Codebase

The Agent Loop Is Moving Out of Your Codebase

In the week of July 16, AWS AgentCore went GA, Microsoft shipped its Agent Harness at BUILD, and the OpenAI, Anthropic, and Google SDKs made declarative loops first-class. The plan-act-observe loop you hand-wrote is turning into a managed runtime feature. The loop was never the hard part, and knowing what you give up when the runtime owns it is the part worth thinking about.

Migrate to uv and Ruff Before OpenAI Ships Its Own

Migrate to uv and Ruff Before OpenAI Ships Its Own

OpenAI is acquiring Astral. Get ahead of the inevitable change in defaults with this practical migration guide.

All ai agents engineering security enterprise