Hey there 👋 I spent the weekend scrolling for the big launch. Between Friday and Sunday, no lab shipped a new frontier model. So I went back through what did land, braced for filler, and got the opposite. In one 48-hour stretch, OpenAI open-sourced the engine behind Codex and cut the price of its flagship Sol model. The model got cheaper. The scaffolding around it went free. Same company, same weekend, two moves in the same direction. That direction is the whole story today. When the model and the harness around it both slide toward commodity, the value stops living in either one. It moves up to whatever a rival can't copy from a repo: your data, your identity layer, your guardrails. Everything else starts to look like plumbing you rent by the month. I kept waiting for one of these to be the throwaway story you skim and forget. None of them were. A quiet Sunday turned out to be the clearest signal of the month, because when there's no shiny model to stare at, you can see where the labs are quietly moving the money. Six items below, one theme running through all of them. Grades below. Ron
The Big ThingOpenAI gave away the engine behind CodexOn Aug 20, OpenAI open-sourced Harness, the machinery that turns a raw model into a working coding agent. It shipped under Apache-2.0 and comes in three pieces: codex exec (the CLI), the Codex SDK, and app-server, the execution engine that runs the loop. Long-conversation memory, tool use, approval gates, structured output: the parts you would otherwise rebuild by hand, now free to embed in your own product. Read the timing next to what OpenAI published about it. Two changes at the harness level, retained reasoning and context compaction, lifted GPT-5.6 Sol's ARC-AGI-3 score from 13.3% to 38.3%. Same model. Same weights. The jump came entirely from the scaffolding around the model, and OpenAI says it did that while burning roughly 6x fewer tokens. Sit with that for a second. The company spent two years telling us the model was the product. This weekend it showed the model barely moved while the wrapper tripled the score, then handed the wrapper to everyone. When DeepSeek open-sourced its dsh harness last month (issue #68), it read like one lab's bet. Two labs in four weeks reads like a direction. So where does the money go once the scaffolding is a commodity? Up the stack, to the things a competitor can't pull off GitHub: your data, your tools, and the governance around what the agent is allowed to touch. The honest catch: this is scaffolding, and the model that runs inside it is still yours to bring and pay for. The 6x and the ARC-AGI-3 figures are OpenAI's own, run on OpenAI's setup, with no outside replication yet, so hold them as a claim until someone else reruns the test. And Harness is built around Codex and OpenAI's own patterns. Whether it drives a non-OpenAI model cleanly is the first thing a builder should check, because that gap is the difference between a free tool and a quiet leash. Ship it? Worth embedding if you build coding or agent tooling. Pull the engine into your product, keep paying for whatever model you prefer, and measure how far it travels off OpenAI's rails before you commit anything to it. Portability is the whole ballgame here. Sources: OpenAI Codex Harness announcement (openai.com/index), OpenAI Developers blog (codex-as-a-platform).
Tour de Headlines💸 OpenAI cut the price of its flagship, then put a timer on it. Sol developer pricing dropped from $5/$30 to $4/$20 per million tokens in and out, a bit over 20% off, and the price war finally reached the top tier after months of cuts aimed only at the cheap models. The catch sits right in the announcement: the discount runs for the next three months and reverts around Nov 21. It covers the API plus Codex and ChatGPT Work credits, while consumer Pro, Plus, and Business plans stay put, and $4/$20 is the short-context standard tier, so long-context and batch jobs price differently. Model the cliff into your unit economics. Treat this as a lever to pull now rather than a floor to build on, and set a calendar reminder for late November so the reversion doesn't surprise your finance lead. Sources: Reuters via The Star, Reuters via Investing.com. 🛡️ Fortinet bought its way into agent security. It acquired Virtue AI (announced Aug 17, picked up across the weekend) and is folding the startup's automated red-teaming, continuous validation, and runtime guardrails into FortiAIGate. Virtue had raised around $30M and ran its red-teaming across hundreds of attack vectors and more than a thousand risk categories, so this is a real capability going in, even if the deal itself is small. Terms went undisclosed and the company called it immaterial, which marks it as a tuck-in, and the integration is promised rather than shipped. Same pattern as Okta buying Permiso (#50) and Zenity's $125M raise (#70): agent security keeps turning out to be a feature of the platform you already run, billed as a line item you can skip. Gartner sizes the AI-security market at $2.8B this year, growing to $16.4B by 2030, which is why the incumbents are shopping. Before you sign a standalone red-teaming vendor, ask whether your security platform is about to absorb one. Sources: Fortinet newsroom, SecurityWeek, Help Net Security. 🩹 Patch Monday: two NoSQL-injection holes in LangGraph's MongoDB memory. If your agents persist state through the LangGraph MongoDB checkpoint or store packages, two disclosed flaws (CVE-2026-48121 and CVE-2026-55253) let a crafted filter smuggle Mongo operators like $gt or $ne past the thread scoping and pull back other tenants' checkpoints. Cross-tenant leakage in the agent's memory, not the prompt. The fixes are already out: move the checkpoint package to 1.3.1+ and the store to 0.3.0+, then add strict type and operator validation on any filter input. Not every LangGraph deployment is exposed, and this is a patch-and-validate job rather than a live 0-day, so no fire drill. It is a clean thing to close before the week starts. The lesson keeps repeating across these agent-memory bugs: the store where your agent keeps its long-term state is a multi-tenant database, and it inherits every classic injection risk a database has. Treat filter inputs the way you would treat a raw SQL string from a user. Sources: GitLab Advisory CVE-2026-48121, GitLab Advisory CVE-2026-55253.
Sponsor Your team ships with AI. How do they sound on the call? RapportScore measures how your reps communicate on real calls, then coaches the behavior that builds trust. Deterministic signals you can coach against. See where your team stands. See your team’s score → |
Tool of the Day🏭 Snowflake, the warehouse that runs the agent for youFor the recurring report or reconciliation that should run itself, sitting next to the data it reads. The question nobody answers cleanly is where an agent runs once you close your laptop. Snowflake's answer: inside the warehouse, on a schedule, in a managed sandbox. You define the task once, it re-runs on a cron, and every run leaves an inspectable Cortex thread of messages, tool calls, and results you can open and audit later. Picture the month-end reconciliation that one analyst babysits every cycle, or the Monday pipeline report someone rebuilds by hand: those become a governed, data-native job that lives beside its source instead of on a laptop that has to stay awake. The audit trail comes for free, which is the part your security lead will care about more than the automation. Be precise about what you can touch today, because the labels carry weight. CoWork Automations, the piece that turns a one-time report or prompt into a recurring emailed run, is in public preview. The Cortex Code (CoCo) Automations variant, the unattended CLI-style job, is in private, limited-access preview open to selected accounts only. So one half is yours to try this week and the other you have to be let into. It is also Snowflake-locked, and the whole thing only pays off if your data already lives there. Set the glamour aside and this is the most deployable shape an autonomous agent takes right now: a scheduled job that runs where its data lives and leaves a paper trail behind it. Read the docs → Sources: Snowflake CoWork Automations docs, Snowflake Cortex Code Automations (limited access) docs.
Worth a Click- Z.ai delayed GLM-5.3's open weights because it got too good at finding bugs This is the first GLM release gated over emergent cyber skill rather than the usual refusal-jailbreak worries. Z.ai says it scored 84.5% on CyberGym and 54.4% on ExploitBench, roughly double GLM-5.2, turned up 1,097 medium-to-high-severity vulnerabilities across 269 real projects, and, per a company advocate, a "potentially serious" file-write flaw in Cursor. Every one of those figures traces back to Z.ai, unreplicated, and the Cursor finding is a single X post rather than a confirmed CVE. Z.ai also shipped OpenVuln, a GLM-5.3-based scanner, so defenders get a gift out of the same capability. Believe the direction more than the digits: an open coding model on a cheap plan is reaching frontier-grade at offensive security, and the weights are due at the end of August. That drop is the moment worth watching.
- Google brought Antigravity to VS Code, JetBrains, and Zed Google conceded that developers won't leave their editor, so its coding agent now runs as an extension inside the big three, with spend caps and access controls handled through Gemini Enterprise. For an eng lead, the choice between Copilot, Codex, Claude Code, and Antigravity is drifting toward admin controls and cost routing more than which IDE the thing lives in. That is the same move OpenAI made with the harness: stop fighting over the tool, compete on what the enterprise buyer signs off on.
- Anthropic is watermarking Claude's output worldwide To meet the EU AI Act's Article 50, text from newer Claude models now carries an invisible, machine-readable mark, applied globally instead of only for EU users, with C2PA provenance metadata on supported files. It is one region's rule quietly re-plumbing everyone's stack, since non-compliance can run up to EUR 15M or 3% of global turnover. One caveat to know before you lean on it either way: the mark survives copy-paste but vanishes the moment someone reformats the text or takes a screenshot. Read it as a soft provenance signal rather than tamper-proof detection, and don't build a policy on top of it that assumes the mark will still be there when the content reaches your buyer.
The Bottom LineCall it commoditization weekend. On a quiet Sunday the labs didn't ship a new frontier model; they made the expensive parts cheaper and more open. OpenAI open-sourced the Codex harness and cut Sol's price in the same 48 hours. Snowflake turned the warehouse into the place the agent runs. Fortinet folded agent security into a platform you already buy. And an open model got good enough at finding bugs that its own maker held the weights back. When the model and the scaffolding around it both drift toward free, the durable value moves up to what only you own: your data, your identity, your guardrails. So does the liability, and that part is easy to forget while everyone celebrates the cheaper bill. That is the quiet lesson in this week's LangGraph CVEs. The clever part was never the model. The exposure was in the boring memory store, the layer you run and own, and that is exactly where value and risk are pooling now. If I had to bet, the next year of this newsletter is mostly stories about that top floor: whose data, whose identity, whose guardrails, whose audit trail. The models will keep getting cheaper and the harnesses will keep getting handed out. What you wrap around them is the only part nobody can commoditize for you. |
More tomorrow,
Ron |
