AI News Briefing — Open spec federates agent discovery across registries

Agent frameworks & interop

• [2026-08-24] A working group spanning Microsoft, Google, GitHub, Nvidia, Databricks, Hugging Face, Salesforce, ServiceNow and Snowflake published ARD, an open specification for federated discovery of agents and tools, under Apache 2.0. The shape is DNS-like: each environment exposes its resources at a standard endpoint, registries index across those endpoints, and a publisher describes once instead of wiring a connector to every catalogue. ARD stops at discovery and says so — not MCP, not A2A, not a runtime; invocation still goes through whatever the resource already speaks. AWS’s Agent Registry is MCP-native, searchable from any MCP client. (official, source)

  Nine vendors on an announcement is not yet an ecosystem. What would settle it is a second registry indexing endpoints published outside its own cloud — until then ARD describes a shape rather than a working federation.

  For Solution Architects: Exposing internal agents at one standard endpoint is cheap now and decides later whether a catalogue can index them without a bespoke connector. Since ARD stops at discovery, that choice leaves the invocation path — MCP, A2A, plain HTTP — still open.

Coding agents

• [2026-08-24] Junie Local runs JetBrains’ coding agent entirely on the machine — Qwen 3.6-27B at 4-bit, about a 20 GB download, started with /local. No account, no credits, no network call. The price is hardware: an M5 Mac with 64 GB. Reasoning is disabled for speed, which JetBrains’ own numbers put near Claude Sonnet 4.5 and below GPT-5, with the gap widening on architectural work. DGX Spark and RTX 5090 are named next. (official, source)

  Twenty gigabytes of weights resident while the IDE and everything else share the same 64 GB is tighter than the spec line suggests; the real constraint is what else the machine is doing at the time.

  For Software Developers: Offline flights and repos under a contract that forbids sending source to a vendor both stop being agent-free zones — /local has no network call to make. Save the architectural passes for the hosted models; that is where JetBrains puts the gap.

• [2026-08-24] OpenAI made its price-performance case for GPT-5.6 inside Kiro using its own benchmark runs: Terra at 77.4 on the Coding Agent Index against Claude Fable 5’s 77.2, Luna at 74.6 against Opus 4.8’s 72.5 for roughly a quarter of Sol’s cost, and Terra clearing Terminal-Bench 2.1 tasks at about 82% less spend. Vendor-run numbers on a vendor-chosen harness, so reproduce them on your own repositories before moving a tier. (official, source)

  A 0.2-point lead is not a lead. The cost claims carry the argument here — roughly a quarter of Sol’s spend, about 82% less on Terminal-Bench tasks — because those margins survive being wrong by a few points in a way the index scores do not.

MCP

• [2026-08-24] Anthropic took enterprise-managed authorization to general availability: an admin connects the company identity provider — Okta first — picks which MCP connectors the organisation gets, and users inherit access through existing IdP groups at first login rather than approving OAuth connector by connector. Asana, Atlassian, Canva, Figma, Granola, Linear and Supabase work today; Slack, Exa, Miro and Zoom are queued. It implements the Enterprise-Managed Authorization extension to the protocol, so a connector your own team builds can speak the same flow. Shorter token lifetimes stop costing productivity, which is what makes deprovisioning actually expire access. (official)

  Okta first is the real gate — an Entra or Ping shop is reading a roadmap here, not a GA announcement. And the queued list is doing more work than the shipped one: Slack and Zoom are the connectors most teams wanted this for.

  For Security Engineers: Per-user OAuth grants to Asana, Atlassian, Linear or Supabase become IdP group memberships you already review, so offboarding stops depending on each connector honouring a revocation. Inventory the grants already in place before turning the managed path on — it defines new access, not old.

AI-assisted SDLC

• [2026-08-24] Microsoft’s position is that a written AI policy is not governance until production can prove it, so the controls move to runtime. Foundry’s AI Gateway authenticates, caps tokens and quotas, and applies policy in the path between users, agents, models, tools and MCP servers without application changes, while Purview, Entra and Defender turn the resulting telemetry into audit evidence. An open-source Agent Governance Toolkit ships alongside. (source)

  Retrofitting without application changes is the load-bearing claim, and it means the gateway sits in the request path — so its outage behaviour becomes your agents’ outage behaviour. Worth settling early whether policy evaluation fails open or fails closed.

Practice & craft

• [2026-08-24] LangChain and Fireworks fine-tuned Qwen-3.5-35B with LoRA into a judge that flags perceived error in production traces — user corrections, rejected actions, repeated requests — and it beat the frontier models it replaced: 96.1% against Claude Opus’s 91.6% on one dataset, 90.8% and top of the field on the other, at 10–100x lower cost per trace. Continuous evaluation is exactly the workload where that ratio compounds. (source)

  Note what is actually being judged: perceived error — corrections, rejections, repeated requests — which tracks user frustration rather than correctness. A trace can be right and still get flagged, and on a production queue that is usually the signal you wanted.

• [2026-08-25] LinkedIn’s hiring assistant keeps four memory layers — conversational, episodic, semantic, procedural — over a tree running recruiter to project to cohort. GraphRAG went out because rebuilding the index burned too many model calls; a tree lets one branch recompute. Memory retrieval is budgeted at 10–20% of total response time, which forces prefix caching and deterministic lookup instead of another model hop. (source)

  Ten to twenty percent of response time is a hard budget, and hard budgets are what kill model hops. Everything else in that design — prefix caching, deterministic lookup, a tree instead of GraphRAG — falls out of refusing to spend a round trip on memory.

Research worth reading

• [2026-08-23] Seven inference-time defences against package hallucination, measured across 32 model–language pairs. RAG helped in 18 of them, plain greedy decoding gave the best mitigation-to-utility trade, and earlier work overstated the problem by up to 9.4 points by counting standard-library imports as fabricated. Seed the prompt with fake package names and the rate climbs as much as 45 points, peaking at 80.9–95.2% for Ruby — decoding tricks alone are not a defence against a hostile prompt. (source)

  Nothing here beats an install-time gate — resolving package names against a lockfile or a private registry mirror before anything reaches the network. Decoding settings are tuning; that is a control.

• [2026-08-24] ARGUS wires a model to Kubernetes state, Prometheus, Loki and NATS through MCP servers and posts its diagnosis into Slack. It named the root cause in all ten injected-fault scenarios at a 0.91 MCP success ratio, and the on-call engineers trusted the diagnoses — but not the remediations it suggested. Worth designing around: what went wrong and what to do next earn separate trust budgets. (source)

  A 0.91 success ratio means roughly one MCP call in ten failed and the diagnosis still landed, which says the overlap across Kubernetes state, Prometheus and Loki was carrying real weight. Ten injected faults is a demo, not a track record.

Watch list

• GLM-5.3 weights, August 28 — three days. Z.ai’s plan was weights roughly two weeks after launch, once safety hardening finished. The zai-org page still lists 5.1 and 5.2 and nothing newer. A checkpoint with a model card describing what the hardening changed is the artifact that makes a self-hosted plan possible.

  Three days out with nothing staged on the zai-org page leaves little room. Check on the 28th rather than tracking it daily.

• Mistral’s Knowledge Connectors, August 31 — six days. Google Drive and SharePoint go dark and there is still no word on whether disabling a connector drops its index. Six days is enough to re-index against the MCP replacements and not enough to spend waiting.

  Silence past the 31st answers the index question by default, and not in a way anyone gets to appeal. Re-index now and treat a clarification as a bonus.

• A release candidate for the next MCP specification. Saturday’s roadmap named webhooks, DPoP identity and one HTTP transport with no dates attached, and nothing has appeared since. Today’s enterprise-managed authorization shows the extension path working ahead of the core spec, which makes the transport change the one still worth waiting on.

  Watch this through the extensions rather than the spec repository: enterprise-managed authorization landing today is evidence that the useful pieces arrive before the release candidate does.

• xAI on the decrypt-then-obey path, day six. Adversa reported it on June 3 through HackerOne, chased it on August 4 and August 10, and confirmed it still worked on grok.com as of August 19. No patch, no CVE, no workaround. The defence is on your side of the wire: gate tool calls whose arguments came out of fetched or decrypted text. (source)

  A CVE number is what would end this watch, since that is what makes it visible to the advisory tooling teams already run. Until then it lives in a blog post and a HackerOne thread, which nothing scans.