AI News Briefing — OpenAI's Assistants API shuts down with no thread migration

Agent frameworks & interop

• [2026-08-26] OpenAI’s Assistants API shuts down today. /v1/assistants, /v1/threads and /v1/runs go away and the Responses API takes over: Prompts replace Assistants, Conversations replace Threads, Responses replace Runs. OpenAI states plainly that there will be no automated tool for migrating Threads to Conversations — the guidance is to route new conversations to the new API and carry old ones across as they come up. Anything still pointed at the beta endpoints has today. (official)

  Carrying old threads across as they come up means both code paths stay live for as long as your longest-running conversation does. That is a maintenance window, not a cutover.

  For Software Developers: OpenAI ships a backfill loop rather than a tool — iterate a Thread’s messages, convert text and image content into items, then create a Conversation from them. Runs collapse the most: responses.create() hands back output items instead of a poll-then-fetch cycle.

Model releases

• [2026-08-25] IBM released Granite 4.2 under Apache 2.0 — dense models at 3B, 8B and 30B that answer with or without a chain of thought, plus a low-effort thinking mode between the two. The 8B and 30B were reinforcement-trained in sandboxes calling tools, running code and driving a terminal. The 30B resolves 57.0% of SWE-bench Verified, with a 131K context window that stretches to 512K. (official, source)

  Three reasoning behaviours in one checkpoint is a deployment simplification: no second model to host for the cheap questions, and no router deciding which one gets them.

  For ML / Data Engineers: Granite exposes the modes as chat-template flags at inference — enable_thinking, low_effort — so a single served 30B covers all three. Run the eval suite at each setting and find where the chain of thought stops paying. Tool calls come back in OpenAI function-calling format, so an existing harness needs no adapter.

Coding agents

• [2026-08-25] Shopify’s CEO is weighing a ban on Claude Code inside the company until it reads AGENTS.md and .agents/skills rather than only CLAUDE.md. The complaint is split brain: teams mixing agents maintain two copies of the same build and test instructions. The request has been open since August 2025 with more than 5,200 reactions, and Anthropic’s standing answer is “not planned for now”. (source, issue)

  Five thousand reactions on an issue open for a year is not a feature request any more. It is a procurement risk that happens to live in a bug tracker.

MCP

• [2026-08-25] A marimo notebook can carry an attacker’s MCP server command in its own configuration, and opening that file in edit mode runs the command as a local subprocess before any cell executes. CVE-2026-75149 at CVSS 8.8, fixed in 0.23.15 back in July; the write-up landed this week. The patch treats notebook metadata as hostile and allow-lists which config sections a file is permitted to set. (source)

  Opening the file is the trigger, so the usual discipline of not running cells you did not write buys nothing here.

  For Security Engineers: Notebooks arrive through pull requests, shared drives and dataset bundles, and this one executes before a cell does — pin marimo to 0.23.15 or later everywhere someone opens a file they did not write. Below that version, reviewing a notebook diff in the editor is code execution.

AI cost tracking & telemetry

• [2026-08-25] Grafana open-sourced the AI SDK for Go its own teams had been rewriting per project: one interface over Anthropic, Bedrock and OpenAI’s Responses API, with streaming, tool loops, structured output, timeouts, retries and model fallback. The part worth stealing is the agent-observability middleware — it records usage, errors, which provider actually served a routed request, and how multi-step calls relate to each other. (official)

  Routing and fallback are where cost quietly moves: a request that failed over bills at somebody else’s rate, and a generic LLM span does not record which provider served it.

Practice & craft

• [2026-08-25] GitHub wrote up how it evaluates an LLM feature before shipping. Success criteria split three ways: the primary outcome, safety constraints that must not regress, and operational guardrails for latency and cost. Evals re-run on every prompt, model or pipeline change, like integration tests. Failures get sorted by source — model, prompt, input, pipeline, dataset, labels — rather than averaged into one number. (official)

  Sorting failures across six sources is what makes an eval actionable. An averaged score tells you something got worse and nothing about which of the six to go and change.

Teaching & learning

• [2026-08-24] Stanford’s Digital Economy Lab re-ran Canaries in the Coal Mine on fresh data. Employment for 22-to-25-year-olds in the most AI-exposed occupations now sits 19% below their peers in less exposed fields: down about 11% since 2022, while young workers in the least-exposed 60% of occupations grew roughly 10%. Headline employment barely moves. The entry door narrows. (source)

  None of this surfaces in a headline unemployment figure, which is why it took a second run on fresh data to see. The effect sits in who gets hired, not in how many people are working.

Research worth reading

• [2026-08-25] Prompt engineering techniques age. A replication across three version pairs — GPT-3.5-Turbo to GPT-4o, Qwen2 to Qwen2.5, Mistral-7B to Mistral-Large — ran five techniques over 218 context-rich Python functions and 19,620 generations. On the GPT pair the marginal gain from structured prompting fell to zero or below; Qwen still benefits from few-shot and contrastive chain-of-thought. A prompting playbook is per-family, not portable. (official)

  Anyone maintaining a shared prompt library across model families is maintaining several of them, whether or not it is versioned that way.

• [2026-08-24] TrustShiftProbe models an MCP server that behaves through a conditioning period, earns the agent’s reliance, then defects. Nine variants across structural violation, semantic corruption and scope expansion reach a 69.5% mean attack success rate over four production domains. Scanning a server before deployment sees a clean one, because the defect is temporal rather than syntactic. The paper’s runtime defence pulls that to 42.7%. (official)

  Vetting a server once before it goes in is the standard MCP control, and a conditioning period walks straight past it. Continuous behavioural checks are a different piece of infrastructure, not a stricter version of the scan you already run.

Watch list

• GLM-5.3 weights, August 28 — two days out. The zai-org Hugging Face page still lists nothing past 5.2, with the date now inside the working week. A checkpoint plus a model card saying what the safety hardening changed is what makes a self-hosted plan possible.

  Weights on their own would not close this out — a checkpoint with no account of what the hardening changed leaves a self-hosted deployment guessing at its own behaviour.

• Qwen3.8-Flash-Next weights. Alibaba’s Qwen team has trailed an early build of the Qwen 4 architecture, and the Qwen org page still shows nothing newer than Qwen3.8-27B from twelve days ago. No benchmarks published, no weights live. The model card is the artifact that turns this from a rumour into something to test.

  Nothing here carries a date, so there is no deadline to miss and nothing to plan around. It stays a watch precisely because a new architecture is being trailed with no numbers attached.

• Mistral’s Knowledge Connectors, August 31 — five days. Google Drive and SharePoint go dark and there is still no answer on whether disabling a connector drops its index. Five days is enough to re-index against the MCP replacements and not enough to spend waiting for one.

  This is the last week in which re-indexing is a plan rather than an incident.

• xAI on the decrypt-then-obey path, day seven. Still no release note, advisory or CVE since Adversa’s August 20 disclosure. At a week of silence this stops being a fix in progress and starts being the working assumption: gate tool calls whose arguments came out of fetched or decrypted text yourself. (source)

  Gate those calls in your own code and the watch stops mattering to your deployment; what is left to track is whether xAI acknowledges it at all, which decides how much the next disclosure gets told to you rather than found.