This was the week everybody’s self-report ran into somebody else’s measurement. OpenAI published a careful post about deliberately slowing down for safety. In the same 48 hours it was disputing a Financial Times report that it had dissolved the team responsible for catastrophic risk, and a nonprofit founded by former OpenAI staff graded five frontier labs on containment and gave out one F, one D-, one D+, and two C+s.

That pattern repeats all the way down this issue. GitHub Copilot reviewed a pull request and called it all-clear; an autonomous security agent found the hole it missed. Anthropic closed the most-requested feature in Claude Code’s history as “completed” by pointing at a workaround instead of shipping the feature. And a week of “look at these tokens per second” posts turned out to be a week of single-configuration numbers on hardware most readers don’t own.

So we did the obvious thing and put the speed claims on our own bench. That section is the one to read.

🛡️ OpenAI Spent 48 Hours Arguing With Itself

An open-ended hold, a denial, and a report card from the alumni

On August 18, OpenAI published “Pacing model development in an era of cyber-critical capabilities”. The load-bearing sentence is this one: “Our largest planned frontier RL run remains on hold while we conduct smaller-scale training and evaluations to assess model behavior, validate our safeguards, and establish more evidence of alignment before proceeding.” Not paused for a fixed window, and the post states no resumption date.

The post names two triggers, both of which TNG has covered: the OpenAI-Hugging Face incident, and preliminary evidence that its upcoming Astra model “may meet the Critical cybersecurity capability threshold” under the Preparedness Framework, a determination it dates to August 7 (that’s the pause we ran in #026). It also describes a two-week halt on reinforcement learning for deployment-bound models, and says that “a significant number of workloads remain paused” for Astra until they migrate to a higher security bar.

The monitoring architecture is the genuinely new detail. OpenAI describes activation classifiers “that run at every sampled token,” escalating to automated investigators that examine tool actions and reasoning for unauthorized access, data theft and attempts to defeat safeguards. Target: an alert within 30 minutes, and if the safety, security and research teams cannot rule out a false positive within another 30 minutes, “those teams are expected to pause the activity.” That is a real operational commitment, written down, with a number attached.

Now read it against August 18’s other OpenAI story. The Financial Times reported that OpenAI had dissolved its Preparedness team, the group assessing catastrophic risk, at the end of July as part of pre-IPO streamlining. OpenAI pushed back directly: “We have not disbanded the Preparedness team. We have strong research leaders across cybersecurity, biological and chemical, and AI self-improvement capabilities, all reporting to Saachi Jain, our head of safety.” The one change nobody disputes is that Dylan Scandinaro no longer leads Preparedness. Engadget appended a correction the same day.

Then on August 18, Guidelight, a nonprofit founded by former OpenAI employees, published letter grades for five labs across six safety practices including containment, monitoring and third-party review. Meta got an F (0.67). xAI a D- (0.83). Google a D+ (1.50). Anthropic and OpenAI a C+ (2.50) each. Its finding is that companies have “few containment protocols ready for an emergency.” Read the methodology before you read the grades: Guidelight states that “assessment is based only on publicly available information,” so a lab running strong controls it has never published scores the same as a lab not running them at all. It is assessing implementation through public evidence, not auditing the labs. TechCrunch wrote it up on August 22.

Why it matters: For two issues running we’ve reported the brake pedal as a story about capability. It isn’t anymore. It’s a story about who gets to say whether the brake works. OpenAI’s post is a self-report, and a detailed, credible one. Guidelight is a new external assessment of that question, scored from public evidence rather than an audit, and its highest grade was a C+. If you’re building on these platforms, the gap between “here is our 30-minute alerting SLO” and what the containment sub-scores show is the actual risk surface, and it is not one you can audit yourself. Guidelight scored containment planning separately, and OpenAI took the top mark at 3 of 5, with Google at 2, xAI at 1, and Meta at 0. So did Anthropic, which tied OpenAI for the best overall grade while scoring zero on the one practice that matters when something is already loose.

One more receipt worth keeping: the August 18 post repeats, in a footnote, that OpenAI “will publish a technical report of our learnings in the coming weeks.” That is verbatim the same promise, in the same words, that the July 21 incident post made. Four weeks, same sentence, no report. We’re still counting.

Hype vs. Reality: 7/10. The hold and the monitoring commitments are real and documented. The framing that this is a lab voluntarily slowing down is OpenAI’s, and it lands differently in a week when the company is also arguing about whether its risk team still exists and scoring a C+ on a public-disclosure scorecard built by people who used to work there.

⚡ The Day the Stack Wobbled

GitHub was degraded for nearly eight hours, Cursor shipped a competitor the same day, and an AI code review waved through the bug an AI security agent then exploited

August 17 was a bad day to depend on other people’s infrastructure.

GitHub was degraded for 7 hours and 47 minutes, 13:28 to 21:15 UTC. Its own writeup is blunt about the cause: “Traffic reached a new peak, and a critical infrastructure component in our Central US data center failed to scale with it.” Down or degraded: github.com, authentication, Actions, the APIs, pull requests, issues, and Copilot. The status-page postmortem adds the numbers: web and API error rates peaked around 20%, archive and raw-content downloads around 50%.

Here is the detail builders should sit with, and it is worth quoting exactly. Per that postmortem, “delayed replies to a single internal endpoint triggered a latent retry bug in VS Code that amplified traffic by approximately 10x and caused delayed recovery for the Copilot Token Service.” So the editor’s retry behavior turned a slow endpoint into a tenfold traffic multiplier against the platform it depends on, and the AI service was the thing left broken longest: most services were back by 16:36 UTC, Actions by about 18:03, the Copilot Token Service not until 21:02. GitHub’s broader reliability and capacity response is correspondingly large: 3 million-plus additional CPU cores, 120 petabytes of high-speed storage, Azure expanded to serve 58% of platform load, and consistent retry limits and budgets across services.

The same day, Cursor shipped Origin, its own code hosting platform: repos, pull requests, full PR management, two-way GitHub sync, and agents that can “answer, make changes, update PRs, or push a branch,” pre-wired to Vercel, Depot and Buildkite. It rolled out in early beta to paid plans.

Be careful with the order of events. TechCrunch ran it as Cursor “capitalizing on GitHub frustration”, and SiliconANGLE had the launch written up the same day. What the records actually support is that both landed on August 17 and that GitHub’s incident opened at 13:28 UTC. A launch of this size is planned weeks out, and Cursor is not claiming the throne anyway: “Pushes keep going to GitHub, which stays the source of truth.” Read it as a collision, not as opportunism, and note that we could not establish the precise ordering from a primary either way. (Context from #027: this is SpaceX’s first week owning Cursor after closing that $60 billion deal.)

The third thing that landed on August 17 is the one that should change a habit. Wiz disclosed a compromise of Snowflake’s Jira that started as a refactor. A GitHub Actions workflow moved from a safe pattern (an env: block feeding jq --arg) to direct shell interpolation of ${{ github.event.issue.title }}. A single quote in an issue title breaks out and runs commands.

Per Wiz, “Copilot was a co-author that checked the merged PR and code change, identified it as all-clear without noticing the critical vulnerabilities.” GitHub Advanced Security also failed to flag it. Then Wiz’s autonomous Red Agent, working as authorized research through Snowflake’s HackerOne program, built a payload, hit a bash syntax error using #, adjusted its own approach to ; echo ', and exfiltrated a Jira token with read access across Snowflake’s engineering, security compliance and bug bounty projects.

Timeline, because it’s the fair part: the flaw merged June 18, Wiz reported it June 23, Snowflake patched the same day and rotated the token on June 24. Snowflake’s statement says its investigation “found no evidence of unauthorized access.” Only the disclosure is this week’s news. One more caveat that matters: Wiz says it is unclear whether AI authored the vulnerable refactor itself. The documented AI failure here is the review that cleared it, not the writing of it.

Why it matters: Both halves of that loop were automated and exactly one of them worked. The attacker here was on Snowflake’s side; next time that is not guaranteed. If your review process now includes an AI reviewer, note what it is good at: this was not a subtle logic bug, it was a textbook shell injection introduced by a refactor, and the reviewer said all-clear. Treat AI review as a second pair of eyes that has never been tired, not as a gate.

Hype vs. Reality: 6/10. Wiz is marketing its own Red Agent and the framing serves them. The workflow diff, the timeline and Snowflake’s on-record statement are all checkable, and the “Copilot cleared it” line is Wiz’s characterization, which is why we’ve attributed it every time.

💰 Two Bets on the Routing Layer in One Week

Stripe agreed to acquire OpenRouter, and Ramp gave away a competitor the same week

August 19, OpenRouter announced it is joining Stripe. The neutrality pledge is the whole post: “OpenRouter will continue to operate as it is: same mission, same name, same product, same roadmap,” and “Routing decisions will remain driven by one thing: what’s best for you, the user… That commitment is core to how we operate, and it doesn’t bend to any model, any provider, or any parent company.”

Scale, self-reported by OpenRouter: 10+ trillion tokens per day across 400+ models for over 10 million developers and companies. Stripe’s own announcement describes 400+ models from 80+ providers and names NVIDIA, Zoom and Lovable as users. Patrick Collison’s line: “Tokens are the central currency for companies building with AI.” Financial terms were not disclosed by either party. You will see $7 billion to $8 billion reported; every one of those numbers is secondary sourcing, not a company statement. And this is an agreement to acquire, not a completed acquisition: it remains subject to customary closing conditions, with OpenRouter saying it expects to close “in the coming weeks.”

Inside the same 48 hours, and almost nobody connected the two, Ramp launched Router (Wednesday evening, written up the 20th): one endpoint across OpenAI, Anthropic, DeepSeek, Moonshot, Minimax, Nvidia, xAI and Z.ai, routing each request to the cheapest model that clears your quality and latency bar, with automatic failover. Ramp says customers already on it cut inference costs 40% on average, which is a vendor number from a company selling cost control. It’s free through 2026 and passes token costs through at provider list prices.

Read the data terms before you route production traffic through it. Router logs inputs, outputs and tool calls for one year by default, on an opt-out basis, and Ramp says it strips personally identifiable information before using that content to improve the product. A free gateway that retains your prompts and completions for a year is a different procurement conversation than a paid one that doesn’t, and it is the detail most of the coverage skipped.

Why it matters: The routing layer stopped being a neutral utility and became a strategic asset in the same week, from two directions. A payments company agreed to buy the incumbent because tokens look like a payments problem. A fintech gave away a competitor because routing looks like a cost-control problem. Both readings are probably right, and neither is “a neutral middleman that answers only to developers.” Nothing changes about your integration today. The thing to actually do: make sure your routing layer is a config value and not a hard dependency, because this is the year that layer gets contested, and check what each option retains.

Hype vs. Reality: 5/10. The agreement is confirmed by both parties and the neutrality pledge is explicit and specific, which is more than most acquisitions offer. It is also a public statement of intent rather than anything a customer could independently enforce, and the deal has not closed.

🛠️ Anthropic Took the Agent Stack Out of Beta

Computer use went GA, a browser tool shipped, and the Python SDK will quietly blind your tracing

August 19 was the biggest platform day Anthropic has had in months, and it went almost uncovered. From the platform release notes, all in one day:

The computer use tool went GA as computer_toolset_20260801: no beta header, batch actions (several actions per turn), zoom on by default. A new browser use tool shipped as browser_toolset_20260801, which is not the same thing: it drives a browser your application hosts, works inside a viewport instead of a whole desktop, and reads the page’s accessibility tree, elements, forms and tabs rather than only screenshotting and clicking. It adds element references, form input, tab management and download reporting. The Files API went GA, with file expiration and pagination. Agent Skills and the Skills API went GA. The Admin API user-management endpoints for Claude Enterprise organizations (members, invites, groups, custom roles) came out of beta. Managed Agents got allowed_domains / blocked_domains on web_search and web_fetch, and self-hosted sandboxes can now attach memory stores.

Read the migration note before you celebrate: upgrading computer use “changes the request shape and tool handling.” Earlier beta versions still work.

Then August 20, Python SDK v1.0, and this is the item most likely to cost you a bad afternoon. The HTTP layer moves from httpx to httpx2, a Pydantic-team fork, because the original “is no longer actively maintained.” Anthropic’s own migration guide flags the trap plainly: tooling that hooks httpx itself, meaning tracing, APM instrumentation and HTTP mocking libraries, “keep working but silently stop seeing the SDK’s requests” until you point them at httpx2 or call httpx2.alias_httpx() at startup.

That failure is silent by design of the mismatch, not by intent: the affected integrations keep running while observing nothing. Other incompatibilities do fail loudly, and that is the easier case. Passing an old httpx.Client through http_client=, for instance, raises rather than silently misbehaving. Also in v1.0: Python 3.10 minimum, the legacy Text Completions API removed, temperature/top_p/top_k dropped from the generated Messages signatures (Anthropic documents extra_body for legacy parameters), and AnthropicBedrock now raises instead of defaulting to us-east-1 when no region is set.

Why it matters: The GA wave means the agent runtime primitives you’ve been assembling from third-party frameworks are becoming first-party surface, with the migration costs that implies. The SDK change is a smaller story with a sharper edge: pin your provider SDKs, upgrade in a branch, and after any major bump assert that at least one mocked request and one traced request are still actually observed. That is now a real test, not paranoia.

Hype vs. Reality: 2/10. Shipped API changes with dated release notes. The unglamorous kind of news that costs you money if you skip it.

🧪 We Measured the Speed Everybody Was Posting About

One 27B model, a week of viral tokens-per-second claims, and a bench in our own basement

Half of what crossed our feed this week was people posting inference speeds for Qwen3.8-27B. 381 tokens per second on a single 3090. 193 on two. New drafters, new quants, new engines, every one of them a screenshot. So we ran it ourselves on an RTX 5090, and the honest report is more interesting than the screenshots.

Start with the trap, because it’s the most useful thing we found. SGLang v0.5.18 shipped to real fanfare, 710 PRs from 212 contributors, tagged 00:09 UTC on August 22 which is the evening of the 21st in US Central. DFlash 2, inco.ai’s new parallel drafter, shipped August 18 claiming “2.7 to 3.4x the throughput of autoregressive decoding” on this exact model, and says it runs on SGLang. Those two do not work together. v0.5.18 ships only the v1 DFlashDraftModel. Getting DFlash2 running required a local retag of the SGLang dev image at commit f825d72, the first build carrying DFlash2DraftModel. If you read the blog post, pulled the release, and wondered why your drafter wouldn’t load, that’s why.

Once it loaded, DFlash2 was good: 295 tokens/sec single-stream against DSpark’s 227, a 30% gain, and it removes DSpark’s hard two-request concurrency cap.

Now the number that reframes every screenshot you saw this week. Aggregate tokens/sec on one 5090, same model, same prompt, N concurrent requests:

NGGUF Q5+MTPvLLM+MTP3SGLang no-specSGLang+DSpark
113614585227
2185275167505
4320613327520 (capped)
84291080n/an/a

What flips is which speculative stack wins, not whether to run one. Look at that table again: the N=8 winner, vLLM at 1,080 tok/s, is itself doing speculative decoding with MTP-3 draft heads. Speculation won at every concurrency level we measured, and SGLang with no drafter never won anything. What collapses is DSpark specifically, for a mundane reason: the SGLang build we ran clamps DSpark to two concurrent requests by design, so its curve ends rather than degrades. DSpark dominates through N=2, then tuned vLLM+MTP3 takes the aggregate from N=4 up.

Do not let us generalize that into “drafters don’t scale,” because DFlash 2’s own model card reports 2.3x to 2.9x over autoregressive decoding at concurrency 8, and still 1.0x to 1.5x at 32. Those are vendor numbers on vendor hardware, and they measure against autoregressive decoding rather than against tuned continuous batching, which is a different question than the one we asked. Both results can be true at once. The lesson worth carrying is narrower and more useful: benchmark conclusions do not transfer between speculative methods, never mind between engines and GPUs. Every viral benchmark we collected this week was an N=1 number, and if you fan out agents the ranking can invert on you.

We also got this wrong once, which is the part worth sharing. An earlier run of that same bench concluded GGUF llama.cpp beat vLLM by 2.4x single-stream and vLLM wasn’t worth standing up. That verdict was wrong. vLLM had been launched without --kv-cache-dtype turboquant_4bit_nc and --speculative-config mtp. Re-run with the tuned recipe, every number moved and the conclusion flipped. The generalizable rule: engines differ in how much of their performance is opt-in. llama.cpp ships most of its speed in the defaults; vLLM parks a large fraction behind flags you have to know about. A naive side-by-side can systematically flatter llama.cpp, which is worth knowing before you trust the next one you read, including ours.

Three more things the screenshots leave out.

The quant tax is real, it just doesn’t show up where you look for it. A viral claim said Qwen3.8-27B’s quantization tax is near zero, and on a 25-task suite plus seed-matched long-context probes to 110k tokens, unsloth’s UD-IQ3_XXS (11.1 GiB) really was indistinguishable from Q5_K_M, and faster. Then we ran a harder discriminator, an aider polyglot slice, twice per side. Across two replicate runs per side the solve counts overlapped (Q5 scored 26 and 29, IQ3 scored 23 and 26) but IQ3 burned 35% more completion tokens in both runs: longer thinking, more repair rounds, for slightly-worse-leaning results. That erases the smaller quant’s speed advantage. Check “near-lossless” claims on token economy, not just solve rate. That was the first degradation we could measure. And note the Q5 baseline swung 26 to 29 between identical runs, so our observed run-to-run variation was three exercises: a single run at non-zero temperature did not distinguish a gap that size.

The 3090 recipes don’t transfer. Both of the repos behind this week’s viral single-card numbers are Ampere-only. NInfer explicitly excludes Blackwell NVFP4. On a 5090 they are unusable, and the working paths were different projects entirely.

And chasing this costs something. Standing up a long-context vLLM lane on August 22 took the whole machine down. Not VRAM: a cold boot with new kernel shapes missed the JIT cache and triggered a parallel CUDA recompile, 16 nvcc and 16 cicc processes totalling 78.3 GB of RSS on a 60 GB box. Global host-RAM OOM, an unrelated service killed, hard power cycle. An uncapped kernel compile is a host-RAM hazard that has nothing to do with your GPU.

Full disclosure on our numbers: one box, one GPU (RTX 5090, sm_120), n=25 capability suites and 34-exercise aider slices, 800 max_tokens, one shared prompt, aggregate measured as total completion tokens over batch wall-clock. Directional, not a published ranking. Since this section spends its length asking other people to show their configuration, ours is published: the two working reports and all five raw run outputs are at thenewguard.ai/bench/028/, unedited, including the run where we got the verdict wrong. Per-N aggregate and per-request tok/s, p50 and p95 latency, wall-clock, the SGLang commit (f825d72), the launch flags, and the specific NVFP4 checkpoints, which are not interchangeable. A screenshot from us is worth no more than a screenshot from anyone else unless the recipe comes with it.

The context that makes all of this sting: while the local stack got genuinely good, the hardware got brutal. DDR5 prices are up 355% to 485% in twelve months. A 128GB DDR5-6400 kit that bottomed at $329 now lists at $3,399, ten times its record low. A 64GB kit that was under $200 last summer is over $1,100. DDR4 is up 120% to 180%. A major driver is straightforward: HBM for AI accelerators needs many stacked DRAM layers, and the memory vendors are steering wafers toward the far more lucrative AI datacenter market, so fewer standard memory chips get made. Tom’s Hardware notes all four vendors (SK hynix, Samsung, Micron and China’s CXMT) have doubled or tripled revenue inside a year. Pricing has other inputs, but that is the big one, and the people making the chips do not see it easing: SK hynix CEO Kwak Noh-jung has warned that 2027 will be the worst year for memory supply in the industry’s history. Tom’s argues a meaningful contraction in AI demand may be what it takes for consumer prices to come back down.

Why it matters: Running frontier-adjacent models on your own hardware got dramatically more practical this week and dramatically more expensive to buy into, at the same time, for the same underlying reason. If you already own the card, this is the best week local inference has ever had. If you’re speccing a new box, you missed the window.

Hype vs. Reality: 5/10. The artifacts are real and dated. Every throughput number in circulation, including ours, is a single-configuration measurement on somebody’s specific hardware, and Artificial Analysis independently rates this model slow and verbose (54.4 tok/s, 61st of 137) which cuts hard against the excitement. Simon Willison’s read, “excellent, but it defaults to wildly overthinking things,” is still the fairest one-line summary.

📊 The Money Got Structural, Again

A $65 billion run rate, a $6 billion license that isn’t an acquisition, and eight gigawatts in Ohio

Anthropic told investors its annualized revenue run rate topped $65 billion at the end of July, first reported by Bloomberg on August 17. CNBC said it confirmed the figures with three sources, Reuters cited a source familiar with the numbers, and Axios subsequently reported them. That’s up from $47 billion in May and about $9 billion at the end of 2025. Preliminary Q2 revenue was reported at $11.5 billion. Read the words carefully: a run rate extrapolates a short recent period across a year. It is not booked revenue, it is not audited, and it reached the press through investors rather than the company.

Newcomer reports Nvidia is paying Poolside $6 billion to license Model Factory, the tooling behind Poolside’s open-weight Laguna coding models, plus $1 billion in equity at a $12 billion pre-money valuation and job offers to roughly 109 Poolside employees. First reported by Newcomer from an investor letter and subsequently reported by Bloomberg and The Information, both of which credit Newcomer for the terms. Poolside’s founders are staying and insist it is “not an acquisition and not an acquihire.” The license is non-exclusive, so Poolside can license the same software elsewhere. No party issued a press release, so treat the whole thing as reported rather than announced. The structure is the interesting part: license the model-building technology rather than acquire ownership of it, hire a large slice of the team, and leave the company standing, all without a conventional acquisition or change of control.

August 17, SB Energy announced a 20-year lease with OpenAI for roughly 8 IT-GW at the PORTS-Pike campus in Pike County, Ohio, with NVIDIA as exclusive AI compute provider and investing $1.5 billion into SB Energy. NVIDIA is providing credit support on land, power and shell capacity for the initial 4.25 IT-GW, with phased deployment starting 2028. Reuters put NVIDIA’s total credit support and guarantees on the project as high as $105 billion; the primary announcement states no dollar figure for the guarantee, so that number is Reuters’ reporting, not SB Energy’s.

And prices moved. OpenAI cut GPT-5.6 Sol developer pricing for three months on August 21, from $5/$30 per million input/output tokens to $4/$20: 20% off input, 33% off output. Reuters reported it as a response to competition from Anthropic and Chinese models. Pro, Plus and Business subscription pricing is unchanged. This follows Terra down 20% and Luna down 80% in late July.

Why it matters: Three different shapes of the same bet in one week. Anthropic is proving demand with an unaudited run-rate number outsiders cannot independently verify. Nvidia is buying the ability to make coding models without buying a company. OpenAI is locking in twenty years of campus and infrastructure capacity before the compute exists. The price cut is the only one of these you can act on today, and its explicitly temporary framing is consistent with a competitive response rather than a cost breakthrough.

👀 The Most-Requested Feature in Claude Code Got Closed as “Completed”

AGENTS.md, 6,392 reactions, one year, and an answer that is a workaround

On August 17 at 03:37 UTC, issue #6235 in anthropics/claude-code, “Feature Request: Support AGENTS.md,” was closed as completed. It was opened on August 21, 2025. As of August 24 it carries 6,392 reactions and 376 comments, which makes it comfortably the most-reacted issue in the repository: a reactions-sorted search of every issue in the repo puts the runner-up at 3,286.

One second before the close, Claude Code lead Boris Cherny posted this:

Claude Code reads CLAUDE.md, but you can share one file with other agents: create a CLAUDE.md containing just @AGENTS.md (an import), or symlink CLAUDE.md to AGENTS.md. Claude then loads your AGENTS.md at session start.

So there is an answer, it came from the person who runs the product, and it links to the docs. If you saw this issue framed as Anthropic silently retiring its most-wanted request, that framing is wrong on the record.

Here is what the answer is not: native support. AGENTS.md appears nowhere in the Claude Code changelog (we grepped the whole file), and Anthropic’s own memory docs still describe Claude Code as reading CLAUDE.md. The request was for the tool to read the cross-vendor file directly. What shipped is a documented way to make CLAUDE.md point at it. A one-line import or a symlink is a genuinely fine workaround, and it is still a workaround, closed as “completed.”

The friction is real and specific: you cannot add a CLAUDE.md to a shared upstream repo you do not control, and in a shared repo the import file is one more Anthropic-branded artifact to justify in code review. That is exactly what the 435-reaction successor issue, #31005, is about. It catalogues six separate AGENTS.md requests going back to August 2025, closed by bot, closed as duplicates, or marked stale.

Why it matters: AGENTS.md is the de facto cross-tool convention. Codex, Cursor, Copilot and Amp read it directly. If you run more than one agent against one repo, you are maintaining a pointer file for exactly one vendor, and the most-reacted request in that vendor’s tracker has now been answered rather than built. Worth knowing before you standardize a monorepo on it.

Disclosure: TNG runs on Claude Code. That is why we went and read the closing comment instead of just the issue state.

Hype vs. Reality: 4/10. A closed issue with a documented workaround is not a scandal, and anyone framing it as Anthropic ignoring its users is wrong on the record. The legitimate criticism is narrower: the most-requested native feature in the tracker was resolved by recommending a workaround, and “completed” is doing some work in that sentence.

🔥 What Builders Actually Argued About

Agents as teammates, and the repos appeared overnight. Three GitHub repositories created on August 17, with these counts read on August 24: yetone/cumora hit 2,989 stars in a week, a team chat where humans and agents share conversations, task boards and calendars, with stale-message suppression and atomic work claims as application primitives. CopilotKit/OpenBot hit 2,553, giving each “AI coworker” its own browser, files and tools, with actions decided before execution and recorded after. browser-use/macos-harness hit 715 with the opposite bet: six low-level primitives (see, key, type, click, accessibility, scripting) and no per-app tool catalog at all. That last one is a real design argument, not a product, and it’s the one worth reading.

The backlash cluster got loud. Four separate high-scoring Hacker News posts in one week on the same nerve (scores read August 24): “AI;DR (AI; Didn’t Read)” at 1,113 points, “Don’t paste the AI, please” at 1,047, “I’m becoming AI-blind” at 499, and a 353-point tool called Claudette whose entire pitch is making Claude stop writing like a BuzzFeed article. No single event, which is what makes it a signal. The Economist also covered an observational study of 26,811 Chinese pupils in which AI-assisted homework scores rose roughly 18% while exam scores fell about 20%, with much of the negative effect concentrated among students who rushed the homework. Tracked outcomes, not a randomized trial, so read it as a correlation with a plausible mechanism rather than a proven cause.

Mojo became fully open source on August 18, when Modular opened the compiler and toolchain under Apache 2.0 with LLVM exceptions, joining a standard library that has been open since 2024. Modular is explicit that it is not ready to accept compiler contributions yet and aims to by year end.

llama.cpp adopted semantic versioning. After thousands of b#### nightly tags, v0.2.0 is its first stable-tagged release, landing August 21. vX.Y.Z now means stable, b[NUM] stays bleeding edge. If you package or ship llama.cpp downstream, this is the change you’ve been waiting for.

Google said Gemma had surpassed a billion downloads on August 20, and the more interesting number in Google’s post is over one hundred thousand community-published Gemma variants.

Mistral shipped Agentic Search on August 20: five filesystem-shaped tools (search, open, navigate, read, grep) so a model iterates instead of retrieving top-k once. Mistral reports FinanceBench accuracy going from 26.7% to 86% and OfficeQA Pro from 6.3% to 51.9%, with up to 39.6% lower p90 latency. Vendor benchmarks, so weight accordingly, but the architecture shift from one-shot RAG to navigational primitives is the right direction and worth stealing regardless of whose implementation you use.

Cerebras announced the CS-4 on August 18 at its Supernova event: three WSE-3 Turbo wafers per rack, 750 PFLOPS, 4 trillion transistors and 900,000 cores per wafer. The “up to 30x faster inference than GPUs” headline is Cerebras’s own; the transistor counts are specs and the 30x is marketing. First shipments this quarter.

⚖️ On the Policy Desk

Pennsylvania put data-center permitting on two tracks. Governor Shapiro signed Executive Order 2026-05, “Protecting Pennsylvania Consumers from Data Center Impacts,” on August 18. It applies to data center projects with peak demand over 25 MW, and the mechanism is a fast lane rather than a gate.

Developers who execute a project-specific Consent Order and Agreement implementing the Governor’s Responsible Infrastructure Development (GRID) requirements get rolling review from the Department of Environmental Protection, with GRID terms written into the permits as conditions. Developers who do not sign get reviewed too, just slowly and last: DEP will not begin reviewing until the applicant documents consistency with the local comprehensive plan, all local or municipal approvals, and any required water withdrawal or wastewater authorization; then no rolling review, no permits issued until every application has been received and reviewed, and the project is excluded from the PAyback and Permit Decision Guarantee programs that otherwise put a clock on the state.

Two more provisions. Data center projects are removed from the PA Permit Fast Track Program and are no longer eligible for it. And nondisclosure agreements are declared impermissible for all agencies under the Governor’s jurisdiction in connection with a data center project, which constrains the Commonwealth rather than banning NDAs between private parties. Reuters covered the signing.

Why it matters: Read precisely, this is a state using scheduling as leverage rather than a veto, and that is the more durable design. Nobody is told no. Unsigned projects simply lose rolling review, lose the permitting clock, and cannot get DEP review started until local approvals are already in hand. That’s a state making local approval a sequencing precondition in the same week NVIDIA and OpenAI committed to eight gigawatts one state over. Power and land were already the constraint on frontier compute; the order of operations is now stacked on top.

An Israeli government contractor built a think-tank-style site that appears aimed at chatbots. Responsible Statecraft reported on August 17 that the Israeli Government Advertising Agency commissioned Piro, Inc. to create the “Hanover Institute for Public Policy,” which has published over 100 unbylined reports since August 6. GPTZero rated 11 of 12 sampled articles AI-generated with high confidence and the twelfth at moderate confidence. Piro’s own site advertised “AI Story Optimization.” Be precise about which part is documented and which part is inferred: the FARA filing with the Justice Department records the client relationship, while the AI-influence purpose is an inference Responsible Statecraft assembles from that filing, the site itself, NewsGuard analysis and Piro’s own marketing. The filing does not state it. If your product cites web sources, this is the threat model: not poisoned training data, poisoned retrieval.

🎯 The Playbook

Your moves this week

  1. Audit your AI code reviewer’s blind spot. Take the Snowflake pattern (shell interpolation of ${{ github.event.* }} in a workflow) and plant it in a test PR. If your reviewer clears it, you now know exactly what tier of bug it misses, and you can stop treating its approval as a gate.
  2. Pin your provider SDKs and test the telemetry path. Anthropic’s Python v1.0 moves transports and silently blinds httpx-based tracing and mocks. After any major SDK bump, assert one mocked request and one traced request are actually observed. Add it to CI once and never think about it again.
  3. Re-bench your inference stack at your real concurrency. Every speed number this week was single-stream. On our box the DSpark lane lost to tuned vLLM+MTP3 around N=4, and that crossover is a property of those two configurations, not a law. Measure at the N you actually run, with each engine’s tuned recipe rather than stock flags.
  4. Make your model router a config value. Between Stripe agreeing to acquire OpenRouter and Ramp giving away a competitor, this layer is now contested. You want a one-line switch, not a migration project.
  5. Check whether you run Ray or MLflow, right now. Both landed in CISA’s exploited-vulnerabilities catalog this week. The federal deadline for the Ray flaw was August 20 and has already passed, and MLflow’s is September 2. If you are not a federal agency, nobody set you a deadline at all, which is exactly why this one slips. See below.

🔐 Security Corner

Two AI frameworks entered CISA’s exploited list in one week. On August 17, CISA added CVE-2025-62593 in Ray, a code-injection flaw allowing remote code execution, with a federal remediation deadline of August 20. Three days. CISA’s own entry notes that “developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari,” which means the attack surface is a developer’s local dashboard, not just a hardened cluster. Two days later CISA added CVE-2026-64849 in MLflow, a server-side request forgery that “can allow attackers to reach internal or cloud metadata services.” MLflow versions before 3.15.0 are affected, with a September 2 deadline. Note the Ray CVE ID: it is a 2025 identifier, so the flaw is not new. What happened this week is the KEV listing, which means CISA now has evidence of active exploitation. Ray and MLflow are not exotic; they are the distributed-execution and experiment-tracking layers under an enormous amount of production ML.

A Rust crate shipped malware that runs during cargo build. SafeDep documented arrayref 0.3.10 pulling in proc-macro1, a typosquat of proc-macro2, whose build script downloaded and executed a remote binary at compile time over TLS with certificate validation disabled. On Windows it launched PowerShell through WScript to escape Cargo’s process tracking so the payload outlived the build. The distribution trick is the new part: the attacker yanked the legitimate 0.3.5 through 0.3.9 releases so Cargo’s yanked-version warnings would push developers onto the poisoned one. arrayref has roughly 245 million lifetime downloads and is mostly consumed as a transitive dependency.

Encrypted payloads that decrypt themselves inside the model. Adversa AI published “Cryptographic Context Injection” on August 20: a web page carrying encrypted text plus decryption instructions gets the model to decrypt the payload inside its own reasoning or code-execution runtime, past input filters that only see ciphertext. Against Grok 4.5 Fast it worked in 40% of 20 attempts since June, exfiltrating the user’s name, approximate location, subscription tier and live conversation prompts. Gemini 3 Flash in Deep Thinking mode reproduced five out of five in March testing, with effectiveness dropping by publication. Adversa reported no successful exploitation of GPT-5 or Claude Sonnet 4.5 in those tests. xAI acknowledged the June 3 report without a mitigation timeline. Google was never formally notified, because jailbreaks are out of scope for its disclosure program. If you build agents that ingest web content and hold code execution, this is a specific pattern to test for: static input filtering cannot see through encryption your own model will helpfully undo.

Stay building. 🛠️

— Matt