Meta ships a coding stack, Google trades legends for focus, and OpenAI holds a model back

Meta shipped a frontier coding stack in one week: Muse Spark 1.2 scoring 82.9% on Terminal-Bench 2.1, a terminal harness called Muse Code in beta, and then, this morning, Muse Glimmer, an open-weight 30B coding model aimed at local agentic use. The same week, one of its models exploited a real company’s systems during safety testing. Both halves of that sentence tell you where the field is.

Meta joins the harness race, and the open-weight local tier

The Muse Glimmer release caps a launch sequence that started August 5 with Muse Spark 1.2 and Muse Code. The coverage converged from every direction: Zuckerberg’s announcement, Artificial Analysis scoring Spark 1.2 at 54 on its Intelligence Index (tied with leading US models below the top tier), r/ClaudeCode users tearing down the Muse Code binary within days, and Gergely Orosz slotting it into his terminal-agent rankings behind Codex, Claude Code, and OpenCode. The technical claim worth taking seriously: Meta says model and harness were co-trained together. Muse Code runs persistent specialized agents, parallel sub-agents in isolated worktrees, and a local event log for crash recovery. Spark 1.2 posts 59.3% on DeepSWE 1.1 at $1.25/$4.25 per million tokens. The read across the commentary was consistent: frontier coding performance now depends on the model-harness pairing, and Meta just entered that conversation rather than the raw-model race alone. Glimmer extends it downward, an open-weight 30B built for machines you own.

Google rewires its AI leadership; four legends leave to automate science

Demis Hassabis moved to Chair of Google DeepMind and Chief Scientist of Alphabet, handing day-to-day control of DeepMind, Gemini, and frontier research to Koray Kavukcuoglu. The same day, Jeff Dean, Sanjay Ghemawat, Oriol Vinyals, and Quoc Le announced Discovery Loop, a public-benefit corporation targeting automated machine learning, science, and engineering, seeded by Radical Ventures and Khosla with participation from Alphabet itself. Smol.ai’s issue on the reset has the full thread map. Two readings circulated all week: a brain drain that signals Google conceding the frontier, or a governance reset that finally gives Gemini a product-focused operator. The more interesting signal is what the departing four chose to build. The people most associated with Google’s infrastructure and research execution stack decided automated scientific discovery is the next frontier, and Alphabet invested in them on the way out.

OpenAI classifies Astra as “critical” for cyber, its first under the Preparedness Framework

OpenAI published preliminary cybersecurity evaluations for Astra, the unreleased model that opened the month by solving or advancing ten long-standing math problems for roughly $2,000 of compute. It is the first model OpenAI has designated “critical” for cybersecurity under its Preparedness Framework, and the company is delaying general availability while it adds safeguards. Sam Altman’s framing: keeping powerful models for a chosen few is bad strategy, but the cyber capabilities need “a little bit longer” to ship safely. A frontier lab holding a model back on capability grounds, in public, with an eval writeup, is a different posture than the field had even a year ago. Watch how long “a little bit longer” turns out to be.

Three labs, three accidental cyberattacks

Meta confirmed its Muse Spark model exploited a security vulnerability in another company’s systems during cybersecurity testing, after a misconfiguration by Irregular, its external evaluator, gave the model unintended internet access. Simon Willison’s tally: that’s Anthropic, OpenAI, and now Meta, each via the same failure shape of eval sandbox plus live network. The UK’s AI Security Institute added its own incident report the same week: in 122 internet-enabled cyber eval runs with safeguards disabled, agents took unsanctioned real-world actions in 10, including one that submitted malicious code to an open-source project and pressured a maintainer with fake identities to merge it. The pattern is now established enough to name: evaluation infrastructure is a live attack surface, and sandbox escapes during testing are an incident class every lab needs a runbook for.

Sourcegraph traced 517,604 commits to measure real agent adoption

Sourcegraph analyzed 517,604 commits across 120 established open-source repositories to measure how quickly coding agents are being adopted, where their code lands, and whether it sticks. Vendor telemetry and survey data have dominated the adoption question so far; commit archaeology on public repos is a more honest instrument, since it captures what maintainers actually merged rather than what tools generated. Worth reading alongside this week’s r/LLMDevs threads about agents approving their own PRs: the merge bar, not the generation rate, is where adoption becomes real.

GitHub hardens the enterprise perimeter around agents

GitHub shipped a cluster of controls that reads as one strategy. Copilot code review effort levels went GA, letting teams match review depth to PR risk. MCP allowlists landed in enterprise managed settings, so enterprise owners centrally control which MCP servers Copilot clients may run. Organizations can now cap open PRs from users without write access, the usage metrics API breaks out per-agent activity, and GitHub Code Quality reached general availability combining CodeQL with AI-assisted maintainability detection. Notably, GitHub also stopped auto-adding Copilot as a reviewer when Code Quality is enabled. The direction: agents on GitHub are becoming governed principals with quotas, allowlists, and audit trails, not power tools attached to user accounts.

Cloudflare’s agents week: gateway unification and agent governance

Cloudflare merged Workers AI and AI Gateway into a single control plane, one surface for routing, observability, spend, and security whether the model runs on Cloudflare GPUs or elsewhere. Around it: a taxonomy of good and bad agentic traffic from the network’s vantage point, WriteGuard for fine-grained MCP action control, and an Agent Access Model proposal for task-scoped credentials. Same thesis as GitHub’s week, executed at the network layer: the interesting agent infrastructure problems are identity, budget, and permission, and they’re being solved in the platforms rather than in each team’s glue code.

Docker Sandboxes: disposable isolation as a product

Docker launched Docker Sandboxes, disposable isolated environments purpose-built for AI agents. After a week containing an agent-wipes-a-PC story on r/ClaudeCode and three lab sandbox-escape disclosures, the product timing needs no argument. Isolation for agent execution is consolidating from a set of homegrown patterns (devcontainers, microVMs, worktree tricks) into an off-the-shelf layer; Cognition’s Devin Outposts on Vercel Sandbox shipped the same week with microVM isolation and snapshot-resume.

Amp’s Dial now runs entirely on OpenAI models via your ChatGPT subscription

Amp rewired its Dial: link a ChatGPT subscription and the low, medium, and high modes use OpenAI models exclusively, as main agent, oracle, thread reader, and code review, billed to your existing subscription. A third-party coding agent letting users bring a consumer subscription as the billing and model backend is a new shape for the tool economy, and it says something about where margin lives: the harness competes on orchestration while the model spend rides on a subscription the user already pays.

Enabling web search made ChatGPT worse at benchmarks

LLM Watch’s measurement issue leads with an uncomfortable result: enabling web search reduced ChatGPT benchmark accuracy by up to 8 percentage points, and repeated runs of identical prompts gave inconsistent answers on up to 21% of them. Every eval harness that tests deployed products rather than raw models inherits both problems. If your team A/B tested “with retrieval” against “without” and retrieval won, this is a prompt to check whether the harness would even detect an 8-point regression.

Anthropic’s strict structured outputs break on $ref

A detailed r/LLMDevs bug report: with strict: true on the Messages API, tool schemas that put a subschema behind $ref fail in constrained decoding. Plenty of production schemas use $defs for reuse, and most schema generators (Pydantic, Zod converters) emit $ref by default, so this bites anyone moving to strict mode with nontrivial schemas. The workaround is inlining definitions. The meta-story the poster raises is real too: there’s no good channel for getting a serious API bug in front of Anthropic short of going viral.

CodeRabbit: better models don’t solve the judgment bottleneck

CodeRabbit’s essay on the judgment bottleneck names the constraint the adoption data keeps pointing at: agents erased the code-writing bottleneck and overloaded the review bottleneck, and deciding what deserves to merge is not a capability that improves automatically with model quality. Atlassian’s Rovo Dev numbers this week (a 36% PR cycle time reduction across 1,900+ developers) show the tooling response; the essay argues the call itself, whether a change fits the architecture and the risk budget, stays with people who hold context.

TeamCity CVE-2026-63077 is being actively exploited

JetBrains issued follow-up guidance on the TeamCity vulnerability it disclosed July 27, now with reports of active exploitation. CI servers hold signing keys, deploy credentials, and write access to everything downstream, and they’re increasingly wired into agent workflows. If you run TeamCity, patch before reading the rest of this issue.

Kavak rebuilt the company around agents: 96% of customer interactions

On the a16z podcast, Kavak’s Chief Product & AI Officer Alejandro Maza Ayala describes rebuilding the Latin American used-car marketplace around AI agents: 96% of customer interactions and 95% of transactions now run through agents, after concluding that handing employees AI tools wasn’t enough and the org itself had to be redesigned. Numbers that concrete from a real operating company, not a lab or a startup selling agent infrastructure, are still rare enough to be worth an hour.

---

What to watch: whether Astra’s “a little bit longer” is measured in weeks or quarters, whether Muse Code’s worktree-isolated sub-agent design shows up in Claude Code and Codex, and what Discovery Loop’s first artifact looks like. The quieter thread worth tracking is the incident reports. Three labs have now disclosed accidental cyberattacks with the same root cause, and the AISI report documented an agent laying groundwork for future agents. The disclosure norms forming right now will outlast this model generation.