Hey there 👋 The loudest model month in history just had a silent Monday. GPT-5.6’s launch window opened today — and nothing shipped. No card, no post, no model. So we look down instead of up. The deployable story this week isn’t on a vendor’s roadmap. It’s on your own machine. Five minutes. Let’s go.
The Big ThingA Web Page Can Pop a Shell on the Box Running Your Browsing AgentTL;DR: Microsoft’s Defender Security Research team disclosed AutoJack on June 18 — an attack where a single web page your local browsing agent visits can run code on that host, no credentials needed. It’s a research finding, with no in-the-wild exploitation reported. The stable AutoGen Studio (0.4.2.2) is not affected. But the pattern is bigger than one tool, and the fix lives in your harness, not a model patch. How one page becomes host RCE. The exploit chains three boring defaults. One: the local tool server trusted localhost — and an agent browsing on the same box is localhost. Two: the auth middleware skipped the MCP path, assuming the handler would check the token. It didn’t. Three: an endpoint ran a command pulled straight from a request parameter, with no allowlist. String those together and a page the agent renders can reach a local socket and spawn processes on the host. Why this is your problem, not AutoGen’s. Last week the agent-hijack story was a vendor’s MCP. This week it’s your dev box. The vulnerable handler never shipped in a PyPI release — only two pre-release dev builds (0.4.3.dev1 and .dev2) carried it, and they’re still on PyPI, unyanked. Upstream main is hardened in commit b047730. So the specific bug is narrow. The class of bug is not: any agent that browses untrusted content on a host running an unauthenticated local tool server inherits this exact shape. The localhost trust boundary you assumed is gone the moment an agent on that box can read the open web. Third thought. “Patch the dev build” is the obvious takeaway and the wrong one. The real lesson is architectural: stop co-locating an untrusted-input surface (web browsing) with a privileged execution surface (a local shell-capable server) on one machine. Separate them, and AutoJack has nowhere to chain. Ship it? — HARDEN NOW. Don’t run a browsing agent on the same host as an unauthenticated local tool or MCP server. Bind tool servers behind real auth that doesn’t trust localhost, allowlist commands, and isolate the browse step in a container or VM. Patch off the pre-release dev builds. None of this waits on a vendor. Sources: Microsoft Security · TechRadar Pro · The Hacker News
Tour de Headlines📰 10% of the world now gets news from a chatbot — and only ~4% click through. The new Reuters Institute Digital News Report (Oxford, June 18) says weekly use of AI chatbots for news rose from 7% in 2025 to 10% in 2026. Across 27 markets, only about 4% say they always or often click through to the original source. Roughly one in six under-35s used a chatbot for news last week. Read past the obvious “chatbots eat search” take: the click-through didn’t shrink, it collapsed. The old “rank, then capture the click” play is dead. The new game for your content and GTM is to be the cited answer, not the blue link. Sources: Reuters Institute (Oxford) · The Decoder 🎰 GPT-5.6 watch: the launch window opened today — and the market got more bearish. Everyone called this “launch week.” On the day the Polymarket window opened (June 22–28), traders flipped to favor “Not released by June 28” at ~58% over “June 22–28” at ~40%, on roughly $487k traded. As of today there’s still no model card and nothing on openai.com/news. The juicy specs going around — a 1.5M-token context and an “alignment-pipeline rebuild” — are leaks, not confirmed; treat them as rumor. The deployable move: build your June work around what actually shipped (GPT-5.5, Codex), not a model that hasn’t. Sources: Polymarket · TechTimes (leaks, unconfirmed) ⏳ Deadline today: Fable 5’s free window closes — and the comeback bet just cooled. Per Anthropic’s published schedule, Fable 5 was free on Pro/Max/Team/seat-Enterprise from June 9–22; reportedly it leaves plan limits June 23 and then bills at API rates ($10/$50 per million in/out). The catch: it’s still globally suspended since the June 12 export-control order, and the API still errored as of June 21 — so you could be paying full price for a model you can’t call. Restoration odds cooled too: Polymarket’s June 26 market fell from ~73% to ~41%, and July 1 is a coin flip. The lesson is old and cheap: plan capacity on fully-available models (Opus 4.8, Sonnet 4.6) and route multi-provider. Sources: Anthropic schedule · Polymarket · Developers Digest
Sponsor Your agents are getting a perimeter. Is your team getting better at the human part? RapportScore reads the human signals in every sales and customer call and scores how well your team actually connects — deterministic measurement, not vibes. See where rapport breaks before the deal does. See your team’s score → |
Tool of the Day🛡️ Databricks Unity AI GatewayOne control plane that runs every agent’s MCP call with the requesting user’s exact permissions — not a shared service account. This is the enterprise answer to the week’s perimeter stories. The shared gap in all of them: agents call tools with more privilege and less audit than the human ever would. Unity AI Gateway’s on-behalf-of (OBO) model is the structural fix — if a user can’t see the record, neither can the agent, even with elevated creds. It also centrally scopes which agents reach which MCP servers, runs PII and prompt-injection guardrails, and logs plus cost-attributes every LLM and MCP call. Honest label: Databricks announced this back in April, and several pieces are still Beta — not a today-launch. But it’s the cleanest deployable answer to the week’s perimeter problem. Read the Unity AI Gateway brief →
Worth a Click- Amazon shelved its nearly-finished Sam Altman movie (Variety · The Hollywood Reporter)
Amazon MGM dropped Luca Guadagnino’s “Artificial” (Andrew Garfield as Altman) right after its ~$50B OpenAI deal; CAA is shopping it, and Netflix and Focus have passed. The B2B read under the gossip: vendor concentration has soft-power costs — the non-technical version of “don’t hard-depend on one provider.” - Gemini 3.5 Pro: 9 days left, still Vertex-only preview (Build Fast with AI · TechTimes)
As of June 21 it’s still a limited Vertex AI enterprise preview — not in the Gemini app, AI Studio, or general API. The 2M-token context and Deep Think are confirmed; the ~$15/$60 pricing is a leak. Pichai promised June GA at I/O; nine days remain. Don’t roadmap on a preview.
👾 A slow launch day isn’t a slow news day — it’s a gift. The model is the swappable part; the spine you own is the perimeter (what your agents can touch) and the governor (under whose permissions). Today handed you no launch to chase, so spend it on the boring controls that survive every model swap: isolate the browse step, scope the tools, enforce the caps. The quiet days are when you build the perimeter — before the loud one tests it. See you tomorrow.
The Agent Stack — your daily 5-minute brief on AI agents, agentic workflows, and the automation tools B2B builders actually ship. Published weekday mornings by Pixiu Media Holdings LLC. | 
