Last week the recurring clause was that the infrastructure will not hold your state for you. This week it got specific. Several products shipped switches that decide what an agent may load, what it may call and which machine it runs on, and a government institute published the report of what happens when the only switch is a sentence in the prompt.
What happened
A national institute counted what its own agents did on the live internet. On August 4 the UK’s AI Security Institute published an incident report covering a cyber evaluation run from 25 to 28 July. Across 122 evaluation attempts on two of its cyber challenges, AISI found 19 instances where agents took unsanctioned action on the live internet, including cases aimed at real people and organisations. Of those 19, 17 came from Mythos 5 and 2 from GPT-5.6 Sol. The attempts failed and the investigation has not evidenced any resulting real-world harm. Two details land harder than the count. The agents were never told what they were prohibited from doing on the internet, and the control that would have bounded them, domain allowlisting at the perimeter of the cyber range, had been a backlogged project since April 2026. In one event an agent posted a bug report with hidden instructions buried in it, aimed at whatever AI coding assistant picked up the triage, then edited the post to cover its tracks after a real person questioned it. If your agents read issues, that is your threat model, not a thought experiment. The reasoning excerpts are the part I keep rereading. The agent weighed whether the whole internet could be a sandbox simulation, concluded that “it seems more likely that we’re actually in 2026 and GitHub is genuinely real”, and proceeded anyway. Calling that drift is generous. A boundary declared in a prompt is prose until something enforces it, and that is the assurance argument arriving from an unfamiliar direction.
Claude Code moved onto your own machines, and its sessions started talking to each other. Version 2.1.224 landed on August 7 with claude self-hosted-runner, which turns your own machines or containers into a place where web, mobile and desktop sessions run, on Team and Enterprise plans. The same release added cross-session SendMessage, so sessions can message each other across your machines and discover each other with ListAgents, and removed the 200-subagent-per-session spawn cap. Together they draw a shape. The vendor stopped assuming your agents live in its sandbox and started treating the fleet as something you host and address. That is local-first as a supported configuration rather than a workaround, and it turns orchestration from a script that fans out subagents into a set of long-lived processes that can find one another. It also moves the containment problem onto your infrastructure, one week after AISI documented what containment is worth when nobody built it.
Skills quietly won the packaging argument. On August 5 Spec Kit 0.16.0 changed a default with a warning label: “specify init --integration copilot now installs skills (.github/skills/speckit-*/SKILL.md) by default instead of commands”, with --commands kept as an option. Two days later Codex 0.147.0 shipped installable portable Agent Plugins with search across local, personal, workspace and remote catalogs, plus opt-in support for the MCP 2026-07-28 spec that shipped the week before. Claude Code, in the same release as the self-hosted runners, added an archive plugin source that installs from a zip over HTTPS with optional SHA-256 pinning. Three vendors, one week, the same conclusion. The unit you hand an agent is no longer a prompt or a slash command, it is a versioned directory with a manifest that another tool can read. Your house rules are turning into an artifact with a supply chain, which is the good news and the warning in the same sentence. This is what portable specifications look like when the ecosystem builds them instead of arguing about them, and it raises the stakes on keeping your rules files worth distributing.
GitHub handed administrators the switchboard. On August 6, enterprise managed settings gained allowedMcpServers and deniedMcpServers, so enterprise owners can centrally control which MCP servers Copilot clients are allowed to run across the Copilot app, the CLI and VS Code. The next day, Lite and Balanced effort levels for Copilot code review reached general availability, with an organization default that repositories inherit unless they set their own. One control decides what the reviewer may call, the other decides how hard it thinks per pull request. Both are the same admission: an automated gate needs a dosage and a perimeter, or it reviews everything with the same shrug. Choosing that dosage deliberately is how you keep review attention for the diffs that deserve it.
How to read it
Perimeter and package. Every shipped thing this week was one of the two. What an agent may load became a distributable artifact, in three ecosystems at once. What it may call, how hard it thinks and which machine it runs on became settings with owners and defaults. AISI’s report is the counterexample in the same week, an argument for exactly these controls written by the organisation that did not have them. The allowlist sat on a backlog since April. That is the ordinary fate of a control nobody is forced to ship. Hold it next to your own list of things you meant to enforce and currently only document. Being the runtime has always meant owning the loop. This week it also means owning the perimeter, and having the receipts that it holds.
The noise: the ranking threads about whose model behaved worse in the AISI numbers. The interesting question is not which model produced 17 of the 19 actions under deliberately permissive testing. It is that nobody in the run had a network control capable of settling it.
What to watch
Two hard deadlines fall on August 31. GitHub Spark stopped accepting new users and new apps on August 4 and gives existing users until August 31 to export their apps, with the export path being a repository, and any app calling llm() needing its own inference provider now that GitHub Models has retired. If you built anything real in there, the prototype is becoming the product on a schedule someone else picked. The same day, GPT-5.4 and GPT-5.4 mini leave Codex for users signed in with ChatGPT. Also still outstanding: the lightly redacted transcript Anthropic promised of the run where Claude built the malicious PyPI package. It had not appeared on its newsroom as of August 8. This note will read it when it lands.