An agent can cause damage before the model makes its first decision.

On September 1, 2026, Manifold described coding agents that invoked Git while gathering workspace context, allowing repository-local Git configuration to run a program on the host. Some affected agents performed that work before a user typed a prompt or approved workspace trust.

In Manifold's GitSpawn research, the relevant path was a repository received as files, with a .git directory inside a ZIP archive. Git read repository-local configuration while the agent gathered context. An ordinary Git clone, fetch, or pull does not transfer repository-local .git/config from the remote.

The model did not choose a harmful tool call. The runtime acted while preparing to use the model. That is why an agent review needs three boundaries: the runtime that starts processes, the gateway that holds credentials and routes requests, and the tool that makes a sensitive change.

AGENTS.md is a Markdown file you keep in your repository to tell coding agents how to work on the project. It can explain where the code lives, which commands to run, and which decisions the agent should leave to you. The open format has no required fields or schema.

Imagine asking an agent to add a page on Monday. You explain the project's colors, where the source lives, and why the navigation must stay as it is. On Friday, a contributor picks up the work in another coding tool. Their agent proposes a new color scheme and reorganizes the navigation. The decisions are still in Monday's conversation, but they never made it into the repository.

That is the gap this file is meant to close. Write the ground rules down once, keep them with the code, and give the next agent a place to start.

GPT-6 Astra does not prove that OpenAI has reached AGI. What it does prove is that the harness can no longer be treated as plumbing.

Astra scored 54.8% on ARC-AGI-3 at high reasoning in the standard harness. The same model scored 99.9% when the harness preserved its reasoning state and compacted long conversations. That is a 45.1-point difference without changing the model.

My takeaway is simple: if you evaluate only the model name, you are evaluating the wrong product. For long-running agent work, the product is the model, memory, tools, context management, and control loop together.

That is why Astra matters even if you are not interested in arguing about AGI.

Calling an LLM provider's SDK directly is a good way to build a prototype. Letting every product feature call that SDK directly is how a provider detail becomes an application architecture.

The distinction matters. “Stop calling LLM APIs directly” does not mean every team needs to install a commercial gateway. It means production code should call a boundary your application owns. Behind that boundary, you can make explicit decisions about providers, deadlines, errors, data policy, and degraded behavior.

Without it, adding a second API key gives you another provider. It does not give you a fallback.

MCP's own roadmap says the quiet part out loud: "MCP authorization assumes a person with a browser at consent time." Then, one sentence later, it admits that assumption is already wrong. "Increasingly the caller is an agent: a cloud workload with its own identity, acting for a user who isn't present, or spawning sub-agents that should get narrower authority than their parent." That's not a footnote. It's one of five priority areas the Core Maintainers named for the next spec release, published August 22, 2026, and it's the only one with a working group that doesn't exist yet.

MCP's HTTP transport has worked like a phone call since Streamable HTTP shipped in March 2025: a client dials in with initialize, the server answers and hands back an Mcp-Session-Id, and every request after that stays pinned to whoever picked up. Hang up on the wrong server instance and the whole conversation is gone with it. Sixteen months later, the 2026-07-28 spec revision rips the phone call out entirely. MCP is now stateless. Every request carries everything it needs, and any healthy server behind a load balancer can answer it cold.

DeepSeek-V3.2 gets hijacked into an unauthorized tool call 75% of the time under its worst attack framing. GPT-4.1 hits 75.6%. GPT-5, the strongest model in the lineup, still gets hijacked 59% of the time under a different framing. These aren't obscure or under-trained models. They're the frontier, tested by a new benchmark called ToolHazard, and none of them come close to holding.

A 2026 survey of 100 enterprise CIOs found 37% now run five or more AI models in production, up from 29% the year before. A separate Zapier survey of enterprise leaders, published the same year, found 81% at least somewhat worried about depending too heavily on one AI vendor, and 47% said losing their primary vendor would disrupt a real business function. That fear is exactly what "model platforms" like Amazon Bedrock, Azure OpenAI Service, and Google's Vertex AI Model Garden are sold as the fix for: one integration, many models, switch providers without rewriting your app.

It's a good pitch. It's also not quite true. Routing your calls through a hyperscaler's managed layer doesn't remove a dependency, it relocates one. You stop depending on a single model provider and start depending on a single cloud provider instead, and that second dependency is usually stickier than the first.

Every year OWASP's LLM Top 10 has been built the same way: ask hundreds of practitioners what scares them, rank by the vote. For the 2026 release, published August 4, 2026, they did something new. They pulled 7,714 real incidents from public vulnerability databases and an AI-harm database, classified 6,639 of them, and checked whether what practitioners fear actually matches what goes wrong in production. It mostly did. Where it didn't is the interesting part.

For the last two years, open-weight model releases have mostly been a China story: DeepSeek, Alibaba's Qwen team, Moonshot AI's Kimi, Zhipu's GLM, MiniMax, all shipping frontier-class open weights on a cadence Western labs haven't matched. This week Meta broke that pattern, twice, in one release. It shipped Muse Glimmer, a 30-billion-parameter model with Apache 2.0 weights on Hugging Face, alongside Muse Spark 1.2, a hosted sibling built for long coding sessions. The interesting part isn't that Meta released open weights again. It's that, by Meta's own benchmarks, Glimmer beats two other well-known open-weight models roughly its own size at the kind of multi-step, tool-using tasks that used to separate the labs with the biggest budgets from everyone else.