Cursor sells for $60B, GLM-5.3 jumps on post-training alone, and three products ship on the same tiny harness

Cursor closed its $60 billion acquisition by SpaceX on Friday, August 14. The team joins SpaceXAI to work across Grok, Grok Build, Grok Bot, the Grok API, and Cursor, which survives as a product rather than folding into the model org. AINews, which sweeps 544 tracked accounts and 12 subreddits every night, logged the announcement as the highest-engagement technical post of the day, ahead of a frontier open-weights launch that shipped in the same 24 hours. Four years ago the read on Cursor was that it was an IDE with good autocomplete. The price tag says the market now values a coding-agent team as a model and platform asset, on par with the inference stack it runs on.

The week’s biggest capability jump came from post-training, not a new base model

Z.ai shipped GLM-5.3 built on the same 743B base as GLM-5.2, with the gains coming entirely from scaled post-training and RL on longer-horizon executable tasks. The reported numbers: Terminal Bench 3.0 at 28.3, DeepSWE at 66.9, Agents’ Last Exam at 28.5, GDPVal-AA at 1769. Vendor benchmarks deserve the usual discount, so the more interesting datapoint is third-party: Semgrep ran it through their own cyber benchmark and found GLM-5.3 returning Opus 4.8-level cybersecurity results at a fraction of the cost, alongside a comparison against xAI’s recent Grok models. Z.ai gated the cyber capabilities to select partners pending a safety review before the eventual open-weight release, which is the same shape of decision OpenAI made with Astra last month and a sign that “open weights” is becoming a staged release rather than a single event.

If the capability jump really is post-training rather than pretraining, the implication for anyone building on open models is that base-model refresh cycles matter less than they did a year ago, and the RL environment you can’t see matters more.

A 17GB model runs a coding-agent loop, then spends 21 minutes on a bicycle

Alibaba released Qwen3.8-27B under Apache 2.0 on Friday, vision-capable, 262,144 tokens of native context extendable to 1M via YaRN. Simon Willison put it through his usual battery and published the most useful hands-on writeup of the week. Two findings matter for practitioners.

First, the shipped default is reasoning_effort: xhigh, and it is a bad default. Willison’s first pelican-on-a-bicycle SVG took 21 minutes and burned 22,276 reasoning tokens to produce 3,223 tokens of output. The same prompt with reasoning off finished in 137 seconds. Asked to “draw an svg of a circle,” the model deliberated over Bauhaus palettes and prefers-reduced-motion before producing an animated geometric study nobody requested. His recommendation is to start on low or off and dial up only when a task earns it.

Second, and more consequential: the model drove a real agent loop. Willison pointed Pi at a 17GB Q4_K_M build served from an NVIDIA DGX Spark over tailscale serve, asked “how does auth work?” in the Datasette repo, and got a solid multi-file answer through a sequence of tool calls. Then had it write and test a JSONL-to-markdown converter. Throughput is the open problem, at 15-30 tokens/second against 74 for GPT-5.6 Sol and 184 for Luna on Artificial Analysis. Running llama.cpp with --spec-type draft-mtp to use the model’s built-in Multi-Token Prediction heads beat the LM Studio default GGUF by roughly 72%, which suggests the serving story is nowhere near settled.

Sean Goedecke published the counterargument the same week, arguing that local models will not win no matter how good the 27B tier gets. Both pieces can be right: a laptop-class model that reads a repo and calls tools reliably changes what you can do offline without changing where most production inference runs.

Three separate products shipped on the same minimal harness

Pi, Mario Zechner’s open-source minimal coding harness, showed up in three unrelated stories this week, for three different reasons. That is what a layer looks like on its way to becoming infrastructure.

Augment Code rebuilt the Auggie CLI on a fork of Pi, wiring their context engine in as an extension, and cut cost per task 53% at the same SWE-bench Pro pass rate: $1.27 per task against Claude Code’s $2.70. Their stated lever is counterintuitive and worth testing on your own stack: fewer tools. One bash tool plus three file tools beat a wide specialized toolset, because every schema in the tool list is paid for on every call, and orchestration overhead compounds per turn.

Fred Schott shipped Flue 2 on top of Pi and told Latent Space why he rebuilt the API around React-style hooks. A Flue agent is a JavaScript function that re-renders before every model call, with 16 built-in hooks including useSkill(), useTool(), and useSubagent(). Schott’s earlier bet on file-based routing died on contact with customers: the big ones have exactly one agent and no interest in routes, they want composition. His framing of the harness is the sharp part. “Our early bet was that the harness is actually not a feature, but it’s fundamental to what you think an agent is. There is no agent without a harness.” He positions Pi beneath Flue the way Vite sits beneath Astro.

And Willison chose Pi for the local Qwen experiment specifically because its system prompt is short enough to leave room for a small model. Three different reasons, one substrate.

The same theme ran through the DeepSeek Harness discussion, which drew more engineering attention than DeepSeek-V4-Pro itself. The harness is a pluginized runtime where the agent loop, tools, sessions, filesystem, and providers are all swappable, with Cordis handling lifecycle, reactive dependencies, and reversible effects. Hot-swapping runtime components while preserving an auditable event log points at agents that modify their own runtime without a restart. vLLM shipped day-zero support for V4-Pro under MIT with integrated drafting, and Ollama added local launch for the harness.

VS Code moved agent sessions out of the editor and published the protocol

Microsoft shipped VS Code 1.133 on August 12 with an architectural change worth more than its changelog placement suggests: agent sessions now run in a standalone Agent Host process rather than inside the extension host. The Agent Host Protocol is published on GitHub under MIT, positioned next to LSP and DAP. It uses JSON-RPC with immutable state, pure reducers, and sequence numbers on every state change so clients stay ordered and in sync.

The practical result is that an agent session stops dying when you close a window. Multiple windows attach to one session with a synchronized view, and sessions run remotely over SSH or a dev tunnel. Microsoft built first-party adapters for Copilot, Claude, and Codex, and in Claude sessions you can now mix Anthropic and Copilot models per turn, with Anthropic models billing your API key and Copilot models drawing on your subscription. Run code agent host in a terminal to start your own, token-protected on localhost, --tunnel for remote. chat.agentHost.enabled: false reverts everything.

Mitch Ashley of The Futurum Group read the open spec as a land grab: “Publishing the protocol as an open spec, alongside LSP and DAP, is Microsoft staking the agent execution surface before rivals do. Open beats proprietary only if the adapters for Claude and Codex stay first-class. Buyers should test that promise before committing a stack.”

One un-revoked token reached 434,000 CI/CD pipelines

CloudSEK published the accounting on March’s LiteLLM compromise, and the numbers are worse than the initial reporting suggested: more than 2,500 companies exposed and roughly 434,000 CI/CD pipelines. LiteLLM was never attacked directly. TeamPCP compromised Aqua Security’s Trivy scanner and its GitHub Actions, LiteLLM’s CI installed the poisoned scanner, and releases 1.82.7 and 1.82.8 went to PyPI carrying malicious code. CloudSEK’s summary of the chain is the line to quote in your next supply-chain review: “Trivy, then the build system, then the LiteLLM release: one un-revoked token, three tools deep.”

The packages sat on PyPI for about 40 minutes. That was enough, because dependency resolvers, scheduled jobs, and mirrors copy faster than humans revoke. The payloads included CanisterWorm (cloud tokens, API keys for AWS, GCP, Azure), SandClock (AWS credentials, Kubernetes service account tokens, wallet data), and two self-replicating npm/PyPI worms, Mini Shai-Hulud and Miasma. Where exfiltration to the typosquatted collection domain failed, the malware created a public repo inside the victim’s own GitHub account and uploaded the loot as a release asset. Some organizations leaked their own secrets into public view without knowing it. The exposure list runs from Nvidia, Intel, AWS, Cisco, Salesforce, and ServiceNow to Airbus U.S., FedEx, Volkswagen, Bayer, and Deloitte. The FBI’s July advisory told victims to treat exfiltrated credentials as a persistent risk rather than a closed incident.

CloudSEK’s structural point deserves the attention: AI gateways, agent runtimes, MCP servers, and vector stores are becoming junctions where identity, data, compute, and autonomous action all meet, which makes them worth attacking for the same reason rail junctions were. Cloudflare shipped in the same direction this week with detection and controls for MCP traffic, starting from the observation that permission models were designed around a human who exercises judgment and acts at human speed.

Cheap is now a product decision, not a fallback

JetBrains made Gemini 3.7 Flash the default in Junie, in both the IDE plugin and the CLI, at 40% off base pricing for a limited window. Google pushed 3.7 Flash across the Gemini app, Search AI Mode, Workspace, and Spark on the 14th. External signal is real but modest: Vals put it at #7 on Index v2 at 59.4%, up from #14 for Gemini 3.6 Flash. Writer made the same bet from the model side, claiming Palmyra X6 cuts agent costs 52% as token spending climbs. On the serving side, Qdrant and Minima published a joint benchmark reaching 2.92x more successful agentic RAG tasks per GPU-hour, 1,081 to 3,158, cutting GPU cost per 1,000 successful tasks by 65%.

Grok 4.6 fits the same pattern from a different angle. Augment reported it as the fastest adoption curve of any model added to Cosmos, and NLW’s read on why the options landscape shifted is that xAI, the Chinese labs, and the open-weight tier together mean nobody is locked into one price-performance point anymore.

Governance moved from policy documents into the token stream

Anthropic published an FAQ on Claude text watermarking after a week of pushback. The specifics: it exists to comply with the EU AI Act, other labs signing the same Code of Practice will ship it too, nothing is added to the text and there are no hidden characters, it costs no extra tokens, and watermarks cannot be traced to a person, organization, or chat. Anthropic’s second Risk Report under its Responsible Scaling Policy landed the same day.

Databricks acquired Electric to bring WASM Postgres into AI agent sandboxes, which is the unglamorous version of the same trend: agents need disposable, real databases inside their sandbox, not mocks. And on the evaluation side, BulkPR-Bench proposes the benchmark nobody had built yet, measuring queue-level governance when pull requests interact. Sequential policies process a PR queue one candidate at a time, but when queued changes touch each other, maximizing safe delivery means deciding jointly which to merge and in what order. Anyone running a fleet of agents that all open PRs against the same repo has already met this problem without a name for it.

What to watch

Whether GLM-5.3’s post-training-only story replicates when the weights actually ship, and how long the partner-gated window lasts. Whether Microsoft’s Agent Host Protocol picks up a second implementation outside VS Code, which is the only real test of whether it becomes LSP or stays a VS Code detail. And whether Augment’s “fewer tools” result holds on codebases that are not SWE-bench Pro, because if a four-tool harness beats a twenty-tool one at half the cost, most agent products are carrying schema tax they never measured.