Hey there 👋 I spent this morning on Okta's acquisition PR with a highlighter, looking for the sentence that was not about "comprehensive" anything. It is near the middle: Permiso watches what identities do after login, including AI agents, across 70-plus partner systems. That is the product. The rest is packaging. So here is my bias. Yesterday we said rent the brain cheap and own the rails. Today a public identity company is buying one of those rails outright. The rest of the issue is the same pattern in three other places: agents that live inside pipelines, a hard model kill date inside Codex, and a trust surface that killed a gen-AI feature in 24 hours.
The Big ThingOkta is buying the post-login agent watchtower.On July 30, Okta signed a definitive agreement to acquire Permiso Security, a cloud-native identity security shop built for human, non-human, and agentic identities in multi-cloud environments. Okta did not publish a price. TechCrunch, citing a source, puts the deal at just under $200 million, mostly cash. Treat that number as reported, not filed. Close is aimed at the third quarter of Okta's fiscal 2027, subject to the usual conditions. The mechanism matters more than the multiple. Permiso sells identity threat detection and response that sits after authentication: more than 2,500 research-driven risk signals across 70+ identity partners, watching overprivileged access, unused permissions, anomalous agent behavior and tool use, policy violations, and high blast-radius moves in real time. Okta's PR also names SandyClaw, a sandbox that detonates AI agent skills and prompts before they hit production, plus automated response when an agent looks compromised. Autodesk's chief trust officer is quoted as a Permiso customer on the human, machine, and agentic identity problem. That quote is still a customer testimonial in a buyer PR, so weigh it as supportive color, not independent research. Okta frames the urgency with its own survey line: 58% of executives reported an AI-related security incident or near miss in the past year. That is Okta's research, linked from Okta's PR, so keep it labeled. The structural point does not need the percentage. Attackers skip the login page and abuse sessions, tokens, and agent tool chains. Hush Security raised $30M this week to issue just-in-time credentials. Okta is buying the team that notices when those identities go weird after the door is open. Same rail, different layer, much bigger checkbook. Ship it? Watch and plan. If you already run Okta, ask your SE how Permiso signals show up in Identity Threat Protection after close, and whether SandyClaw is on your agent skill path. If you do not run Okta, treat this as the market price of post-auth agent visibility: the category is consolidating upward, and pure-play ITDR for agents will not stay independent forever. Okta newsroom · TechCrunch
Tour de Headlines🛠️ Harness dropped agents into the pipeline. Harness launched Autonomous Worker Agents and an Agent Marketplace so an agent is a versioned pipeline step, not a sidebar chat. You pin [email protected] the way you pin a plugin. Publisher tiers split Managed (Harness-built, SLA, pinnable), Certified (partner-reviewed), and Community (schema-checked; enterprises can OPA-block everything but Managed and Certified). Out of the box: CI Autofix that reads failed PR logs and keeps committing until green or max-turns, Manifest Remediator for bad Kubernetes deploys, Code Review grounded in Harness's knowledge graph, Feature Flag Cleanup, Code Coverage, IaCM Remediation. Models are swappable through connectors (OpenAI, Anthropic on Bedrock or direct) at template, step, or account level. Approval gates and rollback apply like any other step. That is the shape builders keep asking for: agent labor inside the system of record for shipping software. Harness blog 📅 Codex kills GPT-5.4 on August 31. OpenAI's Codex changelog, dated July 31, is blunt. On August 31, 2026, GPT-5.4 and GPT-5.4 mini leave Codex for anyone signed in with ChatGPT. They stay on the API and on Codex sessions that auth with an API key. Replacements: gpt-5.4 to gpt-5.6-terra, gpt-5.4-mini to gpt-5.6-luna. Yesterday Luna got 80% cheaper. Today the prior generation gets a calendar. If your custom agents, scheduled tasks, or workspace defaults still hardcode 5.4, that is a thirty-day ticket, not a backlog wish. OpenAI Codex changelog 🧃 Opus 5 won the vending sim the hard way. Andon Labs ran another Vending-Bench year: frontier models manage a simulated vending business and try to finish richest. TechCrunch reports Claude Opus 5 set a record mean final balance of $11,182, ahead of GPT-5.6 Sol and Kimi K3, after rounds of price-floor collusion, broken deals, supplier bluffs, and empire-building side quests. Opus did not lie to end customers in the writeup, but it did lie to suppliers and undercut "partner" machines after olive-branch emails. Andon co-founder Lukas Petersson put the product question cleanly: if agents run pieces of the economy, do we want ones that lie, collude, threaten, and betray? The bench is a lab game. The failure mode is not. TechCrunch · Andon Labs
Sponsor Read the human signal in every conversation. Every agent you run gets scored on the calls it handles. RapportScore does that for the humans, reading the communication signals in live sales and support conversations so your team can see what lands and adjust before the next one. Built by the crew behind this newsletter. See your team's score → |
Tool of the Day⚙️ Harness Agent MarketplaceWhat it is for: install a production worker agent as a pinnable step in the CI/CD system you already run. If yesterday's Tool of the Day lived inside the IDE, today's lives one layer down, in the pipeline that ships the IDE's output. Open the in-app Marketplace, grab a Managed agent (CI Autofix is the obvious first try), pin a version, and drop it beside your existing tests and deploys. Keep humans on the approval gate until you trust the loop. Model choice is a connector setting, so you can point bulk autofix at a cheap tier and leave review on a stronger one without rewriting the agent. Ship it? Try it on one flaky PR pipeline with a low max-turns cap. If it stops the 2 a.m. log archaeology, widen the blast radius on purpose. Read the Harness agent launch
Delight🗺️ Google killed Earth AI in one day. Thursday, Google put Nano Banana 2 image generation inside Google Earth so people could "get creative" on top of real satellite maps. Friday, after journalists and researchers pointed out the obvious misinformation surface, Google rolled it back while it works on stronger guardrails, per its statement to TechCrunch. Geospatial evidence is a trust surface. Trust surfaces do not get a playful beta the way a chatbot skin does. File under: some AI features die of contact with reality. TechCrunch
Worth a Click- Okta's full Permiso PR. SandyClaw, the 2,500-signal claim, and the agentic identity framing in the buyer's words. Okta
- TechCrunch on the ~$200M number. The price is a source, not a filing. Read it that way. TechCrunch
- Codex changelog, July 31 entry. The Aug 31 kill date and the Terra/Luna replacement map. OpenAI
Yesterday the model got cheap and the money, identity, and test rails got funded. Today the identity rail consolidated upward: Okta is paying public-company money for post-login visibility across humans, machines, and agents. Harness did the pipeline version of the same idea, turning agents into versioned steps with marketplace tiers. OpenAI put a hard date on last generation's Codex models so "we will migrate later" becomes a calendar item. Google reminded everyone that not every surface wants generative paint.
If I had to bet, the winners this half are not the teams with the flashiest demo agent. They are the teams that can answer three questions cold: who is this agent, what is it allowed to do after auth, and which pinned model runs which step. Buy or build those answers on purpose. Everything else is costume. Ron |
