AI News — August 7, 2026

MCP

• [2026-08-06] Agent Plugins 1.0.0 is out: an open package format that bundles Agent Skills and MCP servers into one directory a client can install. A plugin.json manifest, a skills/ folder, an mcp.json declaring servers with explicit types, and namespaced folders for anything client-specific. Amazon, Cursor, Microsoft, OpenAI and Vercel are core maintainers; Google joined this week. What it closes is the manifest fork — shipping one skill to two clients has meant maintaining two layouts, and the copies drift. (official)

  Namespaced folders for client-specific bits are the compromise that lets one package survive several clients — divergence gets quarantined in a subdirectory instead of forking the whole layout.

  For Solution Architects: A plugin is now a reviewable directory — manifest, skills/, and an mcp.json that names each server’s type — so internal tooling can ship as one versioned package instead of per-client setup notes. Worth settling the layout centrally before each team invents its own.

Model releases

• [2026-08-06] Liquid AI — LFM2.5-2.6B arrives with open weights, a 128K window, and post-training aimed at tool use rather than chat: it emits Pythonic calls instead of JSON, and runs at 220 tok/s on an M5 Max or 113 tok/s on a Ryzen CPU inside 2.5GB of memory. Liquid puts it level with models four times the size on multi-step agentic work. (official, source)

  Emitting Pythonic calls rather than JSON is the same bet the tool-calling paper further down measures, arriving here as a shipped default rather than a finding.

• [2026-08-06] OpenAI — Free ChatGPT accounts get unlimited text chats and a Think button, with GPT-5.6 Luna as the new default; OpenAI reports 62% fewer factual errors than the model it replaces. Files, images, voice and image generation stay capped. Plus and Pro users got an updated Sol the same day. (official, source)

  Anyone reproducing a colleague’s ChatGPT output is now testing Luna by default, which is worth naming out loud before two people compare notes on the same prompt.

Coding agents

• [2026-08-06] GitHub — Kimi K3 is now selectable in Copilot on Pro, Pro+, Max, Business and Enterprise, billed at provider list: $3 per million input tokens, $15 output, $0.30 cached. GitHub hosts it on Fireworks. Business and Enterprise organisations start with the policy off, and the changelog tells admins to check open-weight models against their own data-governance rules before switching it on. (official)

  Billing at provider list rather than a request multiplier means a Kimi K3 session inside Copilot can be checked against calling Fireworks directly, which is rarely possible inside a bundled assistant.

  For Engineering Managers: Business and Enterprise orgs start with the policy off, so this is a decision to schedule rather than discover. Pair the data-governance review with $3/$15/$0.30 against whatever your team defaults to now — the answer may well be that it stays off.

Agent frameworks & interop

• [2026-08-06] CoreBreak — Work presented at Black Hat shows several agent harnesses can be driven to execute tools with no model turn happening at all, by reaching the dispatch path directly. Google’s ADK for Python carries CVE-2026-18236 at 9.3, Bedrock AgentCore’s InvokeHarness 8.6, two Vercel AI SDK harnesses 6.3. Everything but the Strands Python SDK is patched. Resumed conversation history and structured tool-use blocks are untrusted input. (source)

  Guardrails that inspect prompts and completions sit above the layer reached here, so a harness can be driven without any of them ever logging a turn.

  For Security Engineers: Patch inventory first — ADK for Python, AgentCore’s InvokeHarness, the two Vercel AI SDK harnesses — then find every place an agent resumes from stored history and treat that store as attacker-reachable input. Strands has no fix, so it needs a compensating control instead.

• [2026-08-06] LangChain — A post finally draws the line between the three products people keep conflating: LangGraph is a runtime, LangChain a framework, Deep Agents a harness, ordered from most deterministic to most autonomous. Start at the harness when an agent needs memory, subagents and skills; drop to LangGraph when part of the flow has to run in a fixed order. Their own GTM agent handles roughly 10,000 requests a week on it. (official)

  Three product names for one stack is still a vendor’s own map, but it hands teams a shared vocabulary for the deterministic-versus-autonomous argument they were already having in review.

• [2026-08-06] kagent — One pod per agent wastes a cluster, since agents wake, run briefly, then idle. The alternative on the table is a fixed pool of long-lived worker pods with logical agents scheduled onto them, using Google’s Agent Sandbox and Agent Substrate — WorkerPool, Worker, ActorTemplate — as the placement layer. (source)

  Multiplexing logical agents onto shared workers raises the question a pod boundary used to answer for free: what keeps one agent’s filesystem and credentials away from the next one scheduled there.

AI-assisted SDLC

• [2026-08-06] Cloudflare — Cloudflare OS, the internal agent workspace thousands of its own staff use daily, is now on GitHub. Three parts: a chat surface preloaded with company knowledge, a sandbox where agents build and share small personal apps, and Gatekeepers, a per-service broker sitting between an agent and an external system that applies policy there rather than in a prompt. (official, source)

  A per-service broker is the portable part even if the workspace around it isn’t — it works the same whether the agent on the other side is theirs or yours.

AI cost tracking & telemetry

• [2026-08-06] OpenTelemetry — A guide to metric cardinality, and the failure mode is quieter than an out-of-memory kill. The SDK caps a stream at 2,000 attribute combinations and folds everything past that into a single point tagged otel.metric.overflow=true. Totals stay correct; the breakdowns your dashboards and SLOs filter on quietly undercount. Agent telemetry is where this bites, because session ids and raw prompts look like perfectly good attributes. (official)

  Since the overflow point carries its own attribute, one alert on the presence of otel.metric.overflow turns a silent undercount into something that pages before an SLO quietly stops meaning anything.

Practice & craft

• [2026-08-06] Approval fatigue has a number now. A browser game that gives you 60 seconds to approve or deny agent permission requests logged 409,000 decisions across 40,000 runs, and players waved through roughly one malicious request in three. Scope violations such as exposing AWS credentials slipped past 35% of the time. The single most-approved bad command was npm run analyze, at nearly 65%. (source)

  An ordinary-looking npm script topping the approved-anyway list is the part with teeth — approval prompts assume a reader who can tell, and what gets waved through is what resembles the last hundred.

Research worth reading

• [2026-08-06] The Bitter Lesson of Tool Calling compares exposing tools as typed Python stubs against JSON tool calling across 14 models on BFCL v4. The programmatic form matches or beats JSON in 11 of them, with GPT-5.6 up 10.6%, and the gap survives context degradation. Worth an afternoon if your agent’s tool layer is JSON by default rather than by measurement. (source)

  Surviving context degradation is the unusual half of the result — format advantages normally shrink as the window fills, and this one held.

• [2026-08-06] Letting a model retry a failing assertion until it passes optimises for the wrong thing. Escaping the Self-Repair Trap finds repair loops converge on assertions that are easy to satisfy and bad at catching faults. Their single-pass alternative feeds static context plus selected program states instead, and mutation testing shows better fault detection at lower cost. (source)

  Run-until-green is what most agent test-writing loops do by default, and a mutation score is the cheap way to find out whether yours has been optimising for passing rather than catching.

• [2026-08-06] Learning Globally Reusable Skills for Coding Agents takes the other end of that problem: skills an agent picks up on one task rarely transfer to the next. Tracking how skills relate, consolidating clusters of them, and replaying old tasks to catch regressions lifted bug-revealing test recall by 31.8–180%, and F1 by 61.4% in an industrial deployment. (source)

  Replaying old tasks to catch regressions is the piece worth lifting on its own — a skill library grows by accretion, and almost nobody re-runs last month’s tasks after editing one entry.

Watch list

• Qwen3.8-Max weights, day five — the licence looks like the story. Reuters reports Alibaba plans to ask large commercial users of the open-weights release to share revenue, echoing the clause Moonshot put in Kimi K3 for service vendors above $20M a year. No rate is set and Alibaba has not confirmed the terms publicly. The Hugging Face card still settles it.

  Revenue sharing on open weights would change what “open” costs a company to plan around, and a published licence text — not a report of one — is what would settle whether that is the shape here.

• Whether anything actually installs a plugin.json. Six core maintainers ratifying a 1.0 is not six clients reading the same directory. The concrete test is one unmodified plugin installed into two different agent clients with both its skills and its MCP servers live. If that isn’t demonstrable in a fortnight, the format is a document.

  Which client ships install support first tells you more than the maintainer list does — six names on a spec is a promise, one working install is evidence.

• The unpatched half of CoreBreak. AgentCore, ADK and the Vercel harnesses all have fixes; the Strands Python harness SDK has none, and AWS puts the mitigation on the customer. A release note or a documented guard in the Strands repo closes this. Until then the exposed party is anyone resuming agent sessions from stored history.

  Customer-side mitigation with no documented guard leaves every team inventing its own, so a Strands release note would also settle whether this belongs in the SDK or in everyone’s calling code.