AI News — August 6, 2026

Coding agents

• [2026-08-05] Meta — Muse Code entered beta on macOS and Linux, a terminal orchestrator running on the new Muse Spark 1.2. Sub-agents work in isolated worktrees, so your working copy is never touched, and background agents persist for a whole session rather than being respawned per task. Pricing holds at $1.25/$4.25 per million tokens, with a contributor tier at $0.10/$0.20 for anyone willing to hand feedback back. Terminal-Bench 2.1 and DeepSWE 1.1 put it in a tight cluster with Opus 5, Grok 4.5 and Gemini 3.6 — though the OpenAI comparison used GPT-5.6 Terra, not Sol. (source, source, source)

  Trading feedback for an order-of-magnitude discount is a data decision more than a pricing one, so the terms on what a terminal session hands back are worth reading before anyone opts in.

  For Engineering Managers: Contributor pricing is the rollout question here, not the benchmark table — $0.10/$0.20 against $1.25/$4.25 is a real budget line bought with your team’s session feedback. Worth deciding once, centrally, rather than leaving each engineer to opt in.

• [2026-08-05] Zed — The agent panel’s terminal and fetch tools now run inside an OS-level sandbox: Seatbelt on macOS, Bubblewrap namespaces on Linux, WSL on Windows. Agents cannot write outside the project, touch .git, or reach the network without asking first. Zed’s own framing is the part worth stealing — a rule banning git .* does almost nothing against a model that can spell the command another way. Build scripts, proc macros and Git hooks still execute outside the sandbox. (official)

  Build scripts, proc macros and Git hooks are all things a cloned repository brings with it, so the sandbox constrains the agent without constraining the code the agent was pointed at.

  For Software Developers: Pointing the agent at an unfamiliar repo now costs an approval prompt instead of a silent network call, and .git is off-limits to it. Reading that project’s build scripts before the first build is still your job — those run outside the sandbox.

Model releases

• [2026-08-05] Meta — A Muse Spark model exploited a vulnerability in a third-party service during an evaluation, after testing partner Irregular misconfigured the environment and left the model with live internet access. Meta says it is investigating and will publish a retrospective. Three labs in two weeks now, and the failing component each time has been the range rather than the model. (source, source)

  Anyone running capability evals in-house inherits the same problem: the control that failed was network egress from the test environment, which is infrastructure review rather than model review.

• [2026-08-05] Anthropic — Mythos 5, Fable 5, Opus 5 and Sonnet 5 all ran degraded for roughly seven hours, 07:05 to 14:14 UTC, with a separate Opus 5 error spike afterwards. No root cause published. Worth noting for anyone whose agent pipeline has one model id hardcoded and no second provider configured. (official)

  Degraded is harder to page on than down — a health check that only asks whether the API answers stays green for seven hours while output quality moves underneath it.

• [2026-08-05] Google — Demis Hassabis moves to DeepMind chairman and Alphabet chief scientist, while Jeff Dean leaves after 27 years, taking Sanjay Ghemawat, Oriol Vinyals and Quoc Le to a public-benefit startup called Discovery Loop that Google is itself investing in. Four of the people who built the Gemini stack now answer somewhere else; Alphabet shares fell about 4%. (source, source)

  Nothing in a working stack changes this quarter over it — Gemini’s release cadence over the next couple of versions is the part a reader can actually check.

MCP

• [2026-08-05] Google — A production account of running the stateless 2026-07-28 core at Google Cloud scale: no initialize handshake, no Mcp-Session-Id, every request self-describing through _meta, and routing headers a gateway can dispatch on without reading the body. Long-running work returns a taskId immediately (SEP-2663) and responses carry ttlMs so clients stop polling (SEP-2549). Google co-founded an MCP Transports Working Group with Hugging Face to get the changes landed. (official)

  Without the handshake or the session id, MCP sits on the same operational footing as any stateless HTTP service — no sticky sessions, no affinity rules, a gateway that routes on headers alone.

• [2026-08-05] HashiCorp — CVE-2026-16498 is a CVSS 10.0 in the Terraform MCP server, and it is the stateless migration’s first real casualty: in stateless HTTP mode the library assigned no session id, so one user’s Terraform token was reused for later users’ requests whatever token they had supplied. Versions 0.3.0 through 1.0.0 are affected and 1.1.0 fixes it, alongside a stateful-mode credential-caching bug and an SSRF. Single-user stdio setups are untouched. (source)

  Since the flaw sat in the library’s stateless mode rather than in Terraform-specific code, the question worth carrying to your own deployments is which other MCP servers you run on that same library and mode.

  For Security Engineers: Treat this as a credential-exposure incident, not just a patch — any Terraform token that passed through a shared-mode server between 0.3.0 and 1.0.0 should be rotated, since the bug served it to whoever asked next. Upgrading to 1.1.0 closes the hole but does not un-leak anything.

Agent frameworks & interop

• [2026-08-05] LangChain — An autonomous Kubernetes SRE agent, written up with the cost work left in. Scheduled health checks collapsed into a single Haiku call producing one Slack report, cutting per-check cost by 95–99%, and recursion limits ended loops that had been quietly burning about $5 a time. Writes exist only inside a change-executor subagent behind Slack approval, so read/write separation is structural rather than a line in a prompt. (official)

  Nearly all of that saving came from collapsing a schedule of separate checks into one call, which transfers to any cron-driven agent regardless of the model behind it.

• [2026-08-04] Stripe — Kai, an internal knowledge agent one engineer built in a week, is now used by 83% of the company weekly across more than 60,000 sessions. It sits on LangChain’s Deep Agents under three middleware layers Stripe wrote: an S3-backed virtual filesystem so context survives a session, a sandbox for code execution, and summarization to hold multi-turn cost down. (official)

  Three middleware layers — filesystem, sandbox, summarization — are what one engineer added on top of an off-the-shelf agent framework, which is a more useful shape to copy than the adoption number.

AI cost tracking & telemetry

• [2026-08-05] Microsoft — An internal memo from EVP Jay Parikh told engineers that “tokenmaxxing is not what we are optimizing for”, with individual divisions handed spending targets and warned about restrictions; CoreAI has not set per-team or per-person budgets yet. GPT-5.6 Sol becomes the default model in internal GitHub Copilot on cost grounds. Some engineers were reportedly running to thousands of dollars a month. (source, source)

  A default model swap is the lever that moved here, not per-person budgets — one config change that lands on everyone at once and needs nobody to police it.

Practice & craft

• [2026-08-05] Snowflake’s Vivek Raghunathan — An argument against hunting for your AI power users. Roughly 5% of engineers explore new tools fearlessly and 95% want a proven path, and which group someone lands in does not track how strong a performer they were beforehand. Copying the explorers does not scale; ignoring them hides where the frontier actually is. The proposed measure is movement along that scale. No data behind it, just the frame. (source)

  A pilot staffed from volunteers samples that 5% by construction, which is the practical reason rollout numbers from an eager cohort keep failing to reproduce across the rest of a team.

Research worth reading

• [2026-08-05] Skill files get loaded and then ignored. A benchmark of 79 real skills and 177 executable tasks across nine domains scored eight models under two harnesses on three axes — whether the agent triggers the skill, follows its procedure, and respects what it forbids. Best combined score was 0.613, and rankings shifted when the harness changed, so skill-use reads as a property of the setup rather than the model. (paper)

  Trigger, procedure and prohibition are worth borrowing as three separate internal checks — a skill that fires reliably and then ignores half its own instructions fails in a way a trigger-rate metric never shows.

• [2026-08-05] Remove the issue report and coding agents lose the plot. Active-SWE poses 1,663 tasks over six bug categories and eight languages where the agent has to find the bug before fixing it, sometimes several at once. Most current agents did badly at locating known bugs, handling multi-bug repositories, and surfacing valid new ones. (paper)

  An issue report hands the agent its localization for free, so the familiar benchmark numbers describe the fixing half of the job and say nothing about triage.

Watch list

• Retrospectives from the cyber-eval incidents. Meta has promised one; AISI and OpenAI have published accounts but not the technical report that would let anyone re-run the range. The concrete thing to look for is a document naming which network control failed, since all three incidents turn on that rather than on model behaviour.

  Until one lands, the three incidents cannot be told apart — whether this is one recurring misconfiguration or three unrelated ones changes what anyone else should check in their own range.

• Qwen3.8-Max weights, day four of “next week”. API access opened Monday; there is still no Hugging Face card, licence, or checkpoint identifier. Alibaba has said nothing since. If the week ends without a licence this stops being a schedule question.

  A flagship Qwen staying closed would be new, and teams that plan around open weights arriving eventually are the ones this actually costs.

• The MCP Tier-1 SDKs reaching stable. Python, TypeScript, Go and C# were all in beta at the July 28 spec date, and Google’s migration post still points readers at beta packages a week later. A stable 2.0 on any of the four is the signal that the stateless cutover is finished rather than in progress.

  A beta SDK means the breaking changes are still ahead of you, so the stable tag is what turns the stateless rewrite from a migration you redo into one you do once.