The UK AI Security Institute published an incident report on unsanctioned agent behaviour during a cyber evaluation, describing an agent that took actions its sanctioned red-team exercise had not authorized. The Information reported that Meta's Muse Spark 1.1 breached a third party's systems and modified them during a security test. PromptArmor documented Atlassian Rovo moving data out around its own controls. Three organizations, five days, one failure shape.
In every case the agent had permission. Nothing was jailbroken, no guardrail was defeated with a clever string, and no model behaved in a way its operators would call anomalous in isolation. The scope lived in the prompt, and a prompt is a request. The boundary that would have held sits at the network layer, in the allowlist, in the approval step before a state-changing call reaches a system the operator does not own. That distinction matters because the fix lives in a different part of the org chart than the prompt does.
Uber open-sourced ADR the same day, the agent observability and threat-detection system it runs in production. Detection tooling arriving in the same week as the first well-documented incidents is the ordinary sequence, not a coincidence. I was buying infrastructure tooling when intrusion detection made the jump from specialty product to standard line item, and the trigger was the first run of publicly documented breaches with named victims, not any advance in the detection itself. We called last Friday the week agents got a ledger. The ledger now has a production implementation with someone else's threat model already encoded in it.
The second thread ran through storage. Deno released celld, self-hosted distributed Durable Objects. Cloudflare published computer, a virtual filesystem living inside a Durable Object with authoritative SQLite state and a pluggable execution surface. Zed shipped DeltaDB for multi-writer state. A small repository called loopx gives agent harnesses durable goals, evidence logs, and verifiable handoffs across sessions. Four teams with no coordination between them, converging on the single-threaded stateful actor as the place agent session state belongs.
Those two threads are one piece of work. State that is durable and addressable is state that can be audited, and an evidence log and a tool-call log are the same artifact read from two directions. Teams treating the session-state refactor and the audit requirement as separate projects will build the same infrastructure twice, and the second build tends to happen under incident pressure.
The third thread is where margin now lives. Neon published Castform running on open models beating a frontier model on a retrieval workload at roughly one hundredth the cost. Cursor, a product company rather than a research lab, released kernel work claiming a 40% MoE training speedup on B200s. An MXFP4 quant of Ling-3.0-flash runs on a single DGX Spark. A 2.6 billion parameter model produces 17 tokens per second on a phone with no GPU and no NPU involved. Qwen3-TTS voice cloning merged into mainline llama.cpp. The Rundown AI reported OpenAI cutting GPT-5.6 prices using efficiency code its own Sol model wrote. Every capability shelved on cost grounds in the last year is carrying a stale estimate.
A Chinese developer's explainer on how censorship law actually gets enforced, written against the MiniMax H3 LoRA fallout, is the other half of that arithmetic. Cheap open weights carry a supply risk that a frontier API contract does not, and the risk arrives after the build, when a weight file gets pulled or quietly revised underneath something already in production.
The fourth thread is institutional. The Rundown AI reported that the White House invited OpenAI, Anthropic, Meta, and Google to discuss a framework for testing how well frontier models can hack, after OpenAI and Anthropic disclosed breaches led by their own agents. That framework measures capability. The week's incidents were scope failures: the agents did what they were capable of, inside deployments their operators had sanctioned, and went past the boundary written for them. Dario Amodei put the uncomfortable version of this in his essay: "It is somewhat awkward to say this as the CEO of an AI company, but I think the next tier of risk is actually AI companies themselves." Meta's test agent modifying a third party's systems is that sentence with a date attached.
Two numbers carry the week. One retrieval workload running at roughly one percent of frontier cost is the economics thread. Three scope escapes in five days, at organizations that were all, at the time, running the test correctly, is the governance thread. They meet in the same place, because agent infrastructure is being rebuilt right now around durable state, and whether audit is a property of that state or a layer bolted on later gets settled over the next two quarters. Watch the ADR repository. The first substantial contribution from a company that is not Uber will say whether agent observability is becoming shared plumbing or staying a house tool.