Ramsay Research Agent — July 1, 2026

Anthropic shipped a model, got caught fingerprinting users, and rolled it back. SaaStr published its own Salesforce invoice and it told a story nobody wants to hear at renewal. Johns Hopkins hijacked three coding agents through PR titles. Cloudflare turned HTTP 402 into a real product. And underneath all of it, the same theme kept surfacing: the trust boundary between you and the tools you run is thinner than you think. Here's the day.

Top 5 Stories Today

Claude Sonnet 5 shipped as a "drop-in." It isn't. Recount your token budgets before you migrate.

Anthropic released Sonnet 5 on June 30 as the successor to Sonnet 4.6, and the marketing word is "drop-in." Simon Willison read the platform docs so you don't have to, and the reality is that a straight swap will break things in production. Three changes matter.

First, the tokenizer changed. Willison and Anthropic's own docs report the new tokenizer emits roughly 30% more tokens for the same input text. If you sized max_tokens, your context budgets, or your cost projections against Sonnet 4.6's tokenizer, every one of those numbers is now wrong. A prompt that fit comfortably can overflow. A cost model you signed off on last week is off by nearly a third. This is the single most important thing to check before you flip the switch.

Second, adaptive thinking is on by default, and manual extended thinking now returns HTTP 400. So do non-default sampling params. If your code sets temperature, top_p, or top_k to anything but the default, or if you were manually driving extended thinking, those calls fail outright. Not silently degrade. Fail.

Third, this is the first Sonnet-tier model with real-time cybersecurity safeguards, and refusals arrive as HTTP 200 with a stop_reason of refusal. If your error handling only inspects status codes, a refusal looks like success. You'll parse an empty or refused body as if it were a completion. Go check that branch.

The upside is real: a 1M-token context window, 128k max output, and $2/$10 intro pricing through August 31. No Priority Tier, which matters if you were counting on it.

Here's my read. "Drop-in" is doing a lot of work in that announcement, and I don't love it. A 30% token inflation plus 400s on sampling params isn't a drop-in, it's a migration with a friendly label. Latent Space is already calling June 30 the start of a release wave, with Fable 5 expected next and Anthropic's previously-restricted creative controls lifting. So you're not migrating once. You're migrating repeatedly, on a compressed cadence, over days instead of months. Build a token-recount step and a refusal-detection branch into your migration checklist now, because you're going to run it again soon. Simon Willison / Anthropic Platform Docs

---

Anthropic embedded invisible fingerprints in Claude Code, then rolled them back without telling anyone in the changelog.

A researcher found that Claude Code, since v2.1.91 back in April, had been silently embedding invisible Unicode steganographic markers in its system prompts. The technique: tweaking date and apostrophe characters, XOR-obfuscated with key 91, to flag requests routed through third-party gateways and Chinese-linked domains like DeepSeek, Zhipu, Baidu, and Alibaba. It hit #1 on Hacker News on June 30 with over 1,000 points.

Anthropic's Thariq Shihipar responded that it was a March anti-reseller and anti-distillation experiment, and the company shipped removal in v2.1.197. Here's the part that stings: the changelog omitted the change. They added the fingerprinting quietly, and they removed it quietly.

I want to be fair about the intent. Distillation theft and gray-market resellers are a genuine problem, and I understand wanting to watermark traffic to catch it. But the mechanism is the issue. Steganographic markers hidden in a system prompt, obfuscated so you can't casually find them, targeting requests by geographic origin, is exactly the pattern security researchers spend their careers warning about. When a self-branded safety-first lab does it, the brand takes the hit.

And the changelog omission is worse than the feature. If you'd found the marker yourself and then checked the changelog for the fix, you'd have found nothing. That's the trust break. Not "they experimented," but "they didn't tell you either time."

What should you do about it? This is a concentration-risk story more than a security story. Every builder deciding how much of their stack to pin to one model vendor should file this away. It doesn't mean abandon Claude. I use Claude Code daily in my personal projects and I'm not stopping. It means don't assume the tool you run is only doing what the docs say, and keep a real second option warm. Ornith-1.0 running locally, an open Nemotron, GPT-5.6 Luna at $1/$6, whatever fits. The lesson from this week is that "the client you run on your own machine" is a trust boundary, and this one moved without a note in the changelog. Tech Startups

---

SaaStr's Salesforce bill went up 83% while human seats fell to two. This is the shape of the next SaaS crisis.

SaaStr published its own invoice, and it's the best single data point I've seen on where agent economics actually lands. A year ago: 10-plus human Salesforce seats. Now: 2 human seats plus 1 API seat. And the bill went up 83%. Not down. Up.

The mechanism is that 20-plus AI agents now hit Salesforce roughly 100x more than humans ever did. SaaStr is paying for data calls and agent actions, not seats. Meanwhile the work that used to live in Notion, the notes and wikis and trackers and dashboards, got absorbed by agents building real-time interfaces directly on Salesforce and Slack. SaaStr "stealth-churned" off Notion. Nobody made a decision. Nobody ran a migration. The agents just stopped needing the human-facing product, and one day it was gone.

That phrase, stealth churn, is the teachable idea. The seats stay on the invoice. The usage already left. Your ARR looks stable right up until the renewal reprices, and then the hit lands all at once and lagging. SaaStr's own data shows the same disintermediation across three unrelated categories at once: productivity (Notion), marketing automation (Marketo, which apparently can't even honor its own unsubscribes as agents take over campaigns), and CRM (seat counts collapsing while consumption climbs).

Why it matters: this cuts both ways depending on which side of the invoice you're on. If you sell seat-based SaaS, the leading indicator of your death is not logo churn. It's NRR-versus-seat-count divergence. Seats flat, consumption climbing, is the tell that agents have already replaced your human users and you're one renewal from repricing. If you're a builder, the winning position is to be the system of record the agents write to, not the app layered on top. The data estate is the moat now. The UI is not.

There's a public-market echo here worth noting: SaaStr also flagged Salesforce trading around 2.8x ARR, HubSpot down 56%, Adobe at ~11x earnings, as markets discount seat-cannibalization risk. The recovery is bifurcating. Platforms with consumption pricing power get treated differently from seat-dependent point tools. If you're building, build toward consumption, and build toward being written-to. Watch the divergence, not the logo churn. SaaStr

---

Johns Hopkins hijacked Claude Code, Gemini CLI, and Copilot through PR titles. If you run agents in CI, this is today's audit item.

In April 2026, Johns Hopkins researchers planted malicious instructions in GitHub PR titles and got Claude Code, Gemini CLI, and GitHub Copilot to exfiltrate GitHub Actions secrets, then post the results back as PR comments. Read that again. The attack payload was a pull request title. The exfiltration channel was a PR comment. Both are things your agent is supposed to read and write as part of doing its job.

The mechanism is boring, which is what makes it dangerous. Agentic coding tools treat repo metadata (PR titles, issue text, commit messages, descriptions) as context. Context becomes instructions. If an attacker can influence any of that text, and on a public repo anyone can open a PR, they can influence the agent's behavior. The agent has access to secrets in the CI environment. The agent can post comments. Connect those and you have silent secret exfiltration that looks exactly like normal agent activity.

The defensive skill is specific and you can act on it today. Never feed VCS metadata into an agent's trusted instruction channel. Treat PR titles, issue bodies, and repo metadata as untrusted user input, the same way you'd treat a form field on a public website. Isolate secrets from any context the agent can read. And require explicit human confirmation before any secret-touching or irreversible action.

This connects to the rest of today's issue, and that's the point. The steganography story, this hijack, and the pile of MCP auth CVEs below are all the same problem wearing different clothes: the boundary between "data the agent processes" and "instructions the agent follows" is not being enforced, and attackers have noticed. We solved a version of this for web apps with the injection mindset, treat all input as hostile. Agent tooling is re-learning it the hard way, one exfiltrated secret at a time.

If you have any agent running in CI right now, stop and check two things. One: can that agent read secrets that are also reachable from untrusted PR context? Two: can it post comments or push to branches without a human gate? If both are yes on a public repo, you have the Johns Hopkins setup live in production. Fix the first one by scoping secrets out of agent-readable context. Fix the second with a confirmation gate. Practical DevSecOps

---

Cloudflare turned HTTP 402 into a product. You can now charge per request for any page, API, dataset, or MCP tool with no payment stack.

Cloudflare opened a waitlist for its Monetization Gateway, and it's the most interesting new distribution primitive I've seen this quarter. The pitch: charge for any web page, dataset, API, or MCP tool sitting behind Cloudflare, with charges settling peer-to-peer in stablecoins over the open x402 protocol. No payment stack to build. No Stripe integration, no billing logic, no subscription management. You put a price on a resource and Cloudflare handles the 402.

The numbers give it weight. x402, co-governed by Cloudflare and Coinbase, has processed 119M-plus transactions on Base and 35M on Solana, at roughly $600M annualized volume, with zero protocol fees. That's not a demo. That's an economy that already exists and just got a front door on the largest CDN on the internet.

Why this matters to a builder like me: for the first time, per-request monetization of anything is a config option instead of a project. I've shipped payment flows. They're miserable. Chargebacks, PCI scope, subscription edge cases, the whole thing eats weeks. If I can put a dataset or an MCP tool behind a 402 and get paid per call without any of that, the calculus for what's worth publishing changes completely. Small, valuable, machine-readable resources become viable products. An MCP tool that does one useful thing can charge a fraction of a cent per invocation and let agents pay for themselves.

And that's the real target. This is infrastructure for the agentic-commerce era, where the buyer is an AI agent paying per request over HTTP. Cloudflare's companion "Content Independence Day" report argues a real market for monetized content has already emerged as agents displace human search referrals and pressure creators caught between staying discoverable and getting paid. The crawl-for-free era is ending, and this is the toll booth.

My skepticism: it's stablecoin-settled and waitlisted, so friction and adoption are open questions, and I don't know yet whether human buyers will tolerate a crypto-settled paywall the way agents will. But agents don't care about the payment rail. They care about the 402. If you publish anything an agent would want, an API, a dataset, a specialized tool, get on the waitlist and start thinking about what a per-call price actually is. This connects straight to the SaaStr story: consumption pricing isn't just the future of SaaS renewals, it's becoming the native billing model of the web itself. Cloudflare Blog

---

Security

mcp-pinot ships a CVSS 10.0 with OAuth off by default, handing SQL and table-mutation tools to any caller. CVE-2026-49257 is a maximum-severity flaw where the server exposes unauthenticated MCP tool invocation and hands out SQL, schema, and table-mutation tools to anyone who asks. This isn't an edge case, it's the new insecure-default pattern: ship an MCP server, leave auth off, call it a day. If you run mcp-pinot, turn OAuth on now. If you run any MCP server, assume the default is open until you've proven otherwise. Practical DevSecOps

Two CVSS-9.8 RCE bugs in MCP tooling you probably run locally. CVE-2026-23744 hits the MCPJam inspector, which binds 0.0.0.0 with no auth, so a crafted HTTP request can install an MCP server and execute arbitrary code. CVE-2026-33032 affects nginx-ui (150M-plus downloads), whose MCP message endpoint does no auth on command-execution requests. Both run on your machine, right next to your agents and your credentials. Check your binds and your auth before you expose any inspector. The pattern is deadly consistent: bind wide, skip auth, get RCE. Practical DevSecOps

Cross-client data leak in the official MCP TypeScript SDK, versions 1.10.0 through 1.25.3. CVE-2026-25536 (CVSS 7.1) leaks data across clients when a single McpServer instance is reused for multiple clients, which is a common pattern in shared and remote deployments. If you wrote an MCP server on that SDK range and reuse server instances, upgrade and audit your isolation. This is a builder-facing bug, not a downstream-app bug, meaning your users pay for your framework's default. Practical DevSecOps

The base rate is grim: 40% of MCP servers require no auth, 43% are command-injection vulnerable, 79% handle credentials in plaintext. Censys counted 12,520 internet-accessible MCP services in June, most unauthenticated. Installing an MCP server is installing unvetted code with tool access, full stop. The concrete checklist before you trust one: require OAuth 2.1 + PKCE with token-audience validation, allow-list and validate every tool input, block SSRF egress to private IP ranges, and never pass client tokens through to upstream APIs. Codersera

PI-Hunter localizes prompt injections instead of just detecting them. The June 2026 paper (arXiv 2606.12737) automates red-teaming that pinpoints exactly where in the tool and data flow an injection succeeds, so you get "this retrieved document carried the payload" instead of a binary vulnerable/not. Wire it into CI as an adversarial suite that fails the build when a new injection site appears. Localization is what turns a scary finding into a patchable one. arXiv

Agents

Microsoft took Agent 365 to GA, treating unmanaged agents as a governed asset class across three clouds. It's a cross-cloud control plane to discover, govern, and secure agents across Microsoft, AWS, and Google Cloud, with Defender context mapping that ties each agent to its device, MCP servers, identities, and reachable cloud resources. Local discovery now spans 18 agent types including GitHub Copilot CLI and Claude Code. The signal: scoped OAuth issuance, not shared human credentials, is becoming the gate to move agents from pilot to production. Shadow AI is now an identity problem, and enterprises are buying tooling for it. VentureBeat

Gemini 3.5 Pro missed its June 30 GA, delayed over agentic token consumption and long-horizon reliability. A Polymarket market on a by-June-30 release closed at 97% "No," and Google confirmed the slip to address tester feedback on excessive token consumption in extended agentic tasks. This is the tell of the year: even a frontier lab is bottlenecked on agent economics and multi-step reliability, not raw capability. The hard problem stopped being "can the model do it" and became "can it do it without burning a million tokens and losing the thread." BuildFastWithAI

Google is pushing agentic "auto browse" from a browser feature to an OS-level capability. It's shipping on Pixel 10 and Galaxy S26 in late June with a stated path to 200 million devices by year end, alongside Project Mariner driving real sites for AI Ultra subscribers. In about 15 months this went from Anthropic's computer-use research preview to browser-agents baked into the world's most popular browser and mobile OS. Builders should assume a large, default-on consumer browser-agent surface is coming, and with it the prompt-injection and permission attack surface that today's Top 5 keeps circling. No Hacks

A new survey formalizes the "harness" as six coupled runtime responsibilities distinct from the model. arXiv 2606.20683 decomposes the agent harness into observation, context, control, action, state, and verification, and argues performance emerges from the interaction of model, runtime, task structure, and evaluation, not the model alone. This is the vocabulary I've wanted for why swapping in a better model rarely fixes a flaky agent. The harness is usually the bottleneck. It also mirrors the "Harness Engineering" keynote framing at the AI Engineer World's Fair this week. arXiv

Research

Twelve agent-memory systems benchmarked, and no architecture wins universally. The June 23 arXiv paper "Are We Ready For An Agent-Native Memory System?" decomposes memory into four functional modules and finds performance depends on matching memory structure to workload, with localized maintenance strategies beating global reorganization on cost. If you're designing an agent memory or knowledge-graph layer, stop looking for the one right architecture and start matching structure to your actual access pattern. Cheap local maintenance over expensive global rebuilds. arXiv

Self-repair value comes from falsification, not re-exposure, per a preregistered placebo-controlled study. arXiv 2606.31511 tests small frozen code models fixing their own failing output and finds the benefit comes from an external executable counterexample (a test violation), not from re-reading the broken code. For your agent self-repair loops, this is directly actionable: feed the failing test or oracle, not just the failing output. "Try again, here's your error" is weaker than "try again, here's the assertion you violated." arXiv

Coding benchmarks are misaligned with agentic software engineering, and it's worth your skepticism. A June 16 position paper argues today's benchmarks predate AI agents: they conflate multiple system components into single scores, penalize valid alternative solutions, and lack the granular feedback needed to iterate on agent systems. Read the current wave of open-weight SWE-Bench leaderboard claims with this in mind. A single number can't tell you whether the model, the retrieval, or the harness improved. arXiv

First systematic study of LLM data-referencing errors when reading tables. arXiv 2606.32029 shows that even when models understand table structure, they misread or omit cell values, corrupting intermediate reasoning steps, not just final answers. If you ship table-QA, spreadsheet agents, or analytics features, this is your silent failure mode: one misread cell poisons the whole chain and the output still looks confident. Add cell-level verification, not just answer-level checks. arXiv

AdaTrans improves automated C-to-Rust migration with error-adaptive repair. Rust's ownership and borrowing rules trip LLMs into rule-violating or unsafe code, so AdaTrans (arXiv 2606.31706) maps specific compiler errors to targeted repairs via strategy-driven RAG and error-stratified transformation, cutting reliance on unsafe constructs. If you're doing real memory-safety migration rather than toy translation, the compiler-error-to-repair mapping is the pattern worth stealing. It pairs well with today's theme that Rust is where agent plumbing is moving. arXiv

Infrastructure & Architecture

OpenAI killed an 18-year-old bug with core-dump epidemiology. Its engineering deep dive details large-scale core-dump analysis to diagnose rare infrastructure crashes, surfacing both a hardware fault and a software bug that had survived 18 years. The "core dump epidemiology" framing, treating crashes as a population to study statistically rather than one-off tickets, is a reliability pattern worth borrowing if you run large distributed systems. Individual stack traces lie. The distribution doesn't. OpenAI Blog

Vercel and Shopify are rebuilding Hydrogen from scratch. Announced at Vercel Ship 26, the two are partnering to rebuild Shopify's headless-storefront framework, framed as a shared bet on a more open, portable architecture. Hydrogen made headless commerce easy to ship but not portable, and that's the problem being solved. It's a notable convergence: a leading frontend-infra vendor and the dominant commerce platform co-designing a framework. Worth watching if you build storefronts and got burned by lock-in. Vercel Blog

NVIDIA broadened Nemotron 3 with speech, multimodal RAG, and safety models, plus a Palantir sovereign path. The June 30 update adds open-weight models for speech and multimodal retrieval, open datasets, and libraries aimed at agentic AI, while Palantir launched an engine to run Nemotron in air-gapped US government environments, and Nemotron 3 Ultra has day-0 vLLM support. This is the concrete on-prem and regulated-deployment path for builders who can't send data to a hosted API. Open weights plus vLLM plus sovereign hosting is a real alternative stack now. NVIDIA Blog

Together AI raised $800M at an $8.3B valuation to serve open models at scale. The Series C, led by Aramco Ventures with NVIDIA, Vista, and others, funds a plan to grow capacity roughly 50x over five years, serving DeepSeek, Nemotron, MiniMax, and Kimi. Capital is still flowing hard into open-model serving infrastructure, which is the supply side of the open-weights story NVIDIA is feeding. If your fallback plan involves open models, the infrastructure to run them at scale keeps getting better funded. Yahoo Finance

Tools & Developer Experience

shot-scraper 1.10 lets coding agents record video demos of their own work. Simon Willison added a shot-scraper video command that takes a storyboard.yml and uses Playwright to record a walkthrough of a web app, and his demo storyboard was authored entirely by GPT-5.5 xhigh in Codex Desktop. This is a genuinely useful primitive: agent-generated PR demos and QA verification you can actually watch. Instead of trusting an agent's text summary of what it built, make it show you the running thing. simonwillison.net

A clean decision rule dropped for Claude Code setups: skill teaches the how, hook enforces the rule, subagent isolates the work. Anthropic's steering guidance codifies which mechanism a requirement belongs to, and says use all three together, not interchangeably. Reaching for a skill when you needed a hook, or vice versa, is the common mistake, and this heuristic fixes it. Alongside it: the SubagentStop hook now includes hookSpecificOutput.additionalContext, so you can re-feed a rubric and extend a subagent's turn instead of treating completion as a hard stop. That turns SubagentStop into a verification-loop primitive. Anthropic

Claude Apps Gateway landed for Amazon Bedrock and Google Cloud, giving orgs a real control plane. The June 30 release adds a self-hosted control plane for Claude Code with corporate SSO, centrally enforced policy, role-based access, per-user cost tracking, and spend caps. This is the deployment-governance layer that lets an org run Claude Code centrally rather than per-developer, distinct from the subagent orchestration features. If you've been unable to bring Claude Code into a regulated shop, the governance blocker just got smaller. Releasebot

Inkeep open-sourced OpenKnowledge, a local-first markdown editor with Claude Code, Codex, and Cursor wired in. It's a free WYSIWYG editor pitched as a local-first Notion/Obsidian alternative, with built-in MCP so agents read and rewrite local files with no cloud round-trip. If you keep your knowledge base in markdown (I do), an agent-native editor with no cloud hop is worth a test drive. The local-first angle matters given the week's theme about what your tools quietly send upstream. Hacker News

Models

Google shipped Nano Banana 2 Lite at $0.034 per 1,000 images and Gemini Omni Flash for video at $0.10 per second. Nano Banana 2 Lite (Gemini 3.1 Flash-Lite Image) generates images in as little as four seconds and is live in AI Studio, the Gemini API, AI Mode, and the Gemini app. Gemini Omni Flash entered public preview for video generation and conversational editing at $0.10 per second, matching Veo 3.1 Fast, capped at 10-second clips. The story is cost. Google is driving multimodal generation down to prices where it's a line item, not a project, and putting it directly in developers' hands. Google DeepMind Blog

Anthropic launched Claude Science, and was refreshingly honest that it's not a new model. The beta workbench (macOS and Linux, Pro/Max/Team/Enterprise) acts as a project manager across 60-plus scientific databases, rendering 3D protein structures, genome browser tracks, and chemistry drawings alongside reproducible code. Anthropic explicitly said it is "not a new AI model and not a more capable model for biology," running on existing models including Opus 4.8 with no special access. That honesty is worth praising in a week short on it. Selected biology projects can get up to $30,000 in Claude credits plus $2,000 in Modal compute, applications close July 15. It landed the same week OpenAI shipped GeneBench-Pro for computational-biology agents, so the AI-for-science race is now a two-front thing. MIT Technology Review

GPT-5.6 Sol is launching on Cerebras at up to 750 tokens per second. OpenAI's flagship of the newly previewed Sol/Terra/Luna family hits that speed tier on Cerebras hardware in July, with pricing from $5/$30 per 1M for Sol down to $1/$6 for Luna. The rollout stays partly gated to "trusted partners" at the US government's request, so the Cerebras speed tier is one of the clearer signals of broadening access. 750 tokens/second changes what interactive agent loops feel like. Latency is a product feature, and this is a big cut. OpenAI

Simon Willison ran Ornith-1.0 locally, an open coding model that writes its own RL training scaffold. DeepReinforce's MIT-licensed 35B MoE (the ~20GB GGUF) runs in LM Studio wired to his Pi harness and drives an agent loop across many tool calls proficiently. The novelty is self-scaffolding: it writes the training harness that guides its own RL improvement, built on pretrained Gemma 4 and Qwen 3.5. For anyone who read the steganography story and wants a real local fallback for agentic coding, this is a credible one that runs on a single high-memory machine. simonwillison.net

Vibe Coding

Vercel Agent dropped the wallet model for per-token pricing, and it's the same move everyone's making. Developers no longer pre-load credits or manage a separate wallet, and the flat $0.30 per-request fee is gone, replaced by a $0.25-per-million-tokens rate. GitHub Copilot went usage-based on AI Credits June 1. This is the SaaStr stealth-churn thesis playing out in dev tooling: per-request and subscription pricing for coding agents is dying, token metering is winning. If you price your own agent product, the market's telling you which way to go. Vercel Blog

Rust is quietly becoming the default language for the agent-tooling layer. Google's Workspace CLI, tw93/Kaku (a terminal built for AI coding), metalbear's mirrord, yvgude/lean-ctx, and GCWing/BitFun all ship as single-binary Rust. As agent tooling moves from convenience scripts to always-on daemons, startup time and memory footprint start to matter, and that pushes the plumbing toward Rust over Python and Node. If you're writing an always-on agent daemon, this is the reason to at least consider Rust for the hot path. GitHub

Skills are becoming the universal capability-packaging format across every coding tool. Language packs like samber/cc-skills-golang, 1,600-plus cross-tool libraries, harnesses like DeerFlow with built-in skills, even Google's Workspace CLI bundling agent skills. The unit of reuse shifted from prompts and MCP tools to portable markdown skills that travel across Claude Code, Cursor, Codex, and Gemini. Package your own workflows as skills, not tool-specific configs, and they follow you when you switch tools. GitHub

OpenClaw arrived on Android and iOS, putting agent workflows on phones. The free open-source agentic program is now on both mobile platforms for the first time, continuing the migration of coding and agent tooling to phones alongside Cursor's new iOS steering app. I'm skeptical about how much real orchestration happens from a phone, but "kick off and monitor an agent run from anywhere" is a genuine use case. Lower barrier, more experimentation, we'll see what sticks. TechCrunch

Hot Projects & OSS

Skyvern is one of the week's fastest-growing agent repos at ~21.5K stars, betting on vision-first browser automation. It offers production browser automation with 10M-plus executed workflows and sub-300ms response times, using natural language plus computer vision to operate sites without brittle DOM selectors, competing with Playwright-based tools like Stagehand. This is a single-source growth signal, so treat the momentum as directional. But the vision-first bet is interesting precisely because DOM selectors break constantly and a page's pixels don't. GitHub

best-of-Agent-Harnesses ranks 100-plus agent harnesses and publishes the list as an MCP server. RyanAlberts/best-of-Agent-Harnesses is a weekly-rescored ranking that also ships an MCP server, llms.txt, and JSON, so agents themselves can query and recommend harnesses. It's two things at once: a useful landscape reference for picking a harness, and a clean example of the "publish your data as an MCP endpoint plus llms.txt" distribution pattern. That distribution pattern is exactly what Cloudflare's Monetization Gateway wants to charge for. GitHub

SaaS Disruption

The "AI Tax": vendors are recovering lost seat revenue with 20-37% renewal uplifts via forced SKU migration. As agents compress seat counts, incumbents impose what Tropic calls the AI Tax, a 20-37% renewal increase driven by AI-feature bundling and forced migration off legacy tiers. Gartner projects at least 40% of enterprise SaaS spend shifts to usage/agent/outcome models by 2030, seat-based share falling from 21% to 15%, while hybrid pricing climbs toward 61% of vendors by end of 2026. If you're renewing an enterprise contract this year, model the forced-migration uplift as near-certain, not optional. SoftwareSeni

64% of CX leaders running GenAI support are already shopping for a replacement within 18 months. A Gartner survey cited across 2026 platform comparisons finds nearly two-thirds of teams that put generative AI support into production are actively evaluating a replacement, driven by hallucinations on policy-sensitive answers and unpredictable per-resolution billing at Zendesk and Intercom/Fin. AI-native challengers are catching the defectors. The signal I can't stop thinking about: first-generation AI support bolt-ons are themselves being cannibalized. Churn-on-churn inside a single category. Fini Labs

Vertical AI agents are now 48% of 2026 deals and 55% of capital, anchored by Legora's record $550M legal-AI round. Per Euclid/tracker data, vertical AI accounts for 48.3% of year-to-date deals and 54.6% of capital, spanning legal, healthcare ops, procurement, compliance, and insurance, anchored by Legora's $550M Series D at $5.55B and Abridge's $316M Series E extension. These agents win by selling completed work in a specific domain, not horizontal seats. That's the same lesson as the SaaStr story from the funding side: own the domain and sell the outcome, don't rent a seat. AI Funding Tracker

Sam Blond's "Monthly Brand Engine": manufacture a viral GTM moment every 30 days with the time AI freed up. At SaaStr AI 2026, ex-Brex CRO Sam Blond (now Monaco CEO) detailed a repeatable system for a fresh viral marketing moment every 30 days, arguing that because AI gives GTM teams time back, the right move is more sequenced marketing, not less. For a solo builder, this is the most useful reframe in the batch: reclaimed agent time is fuel for a monthly launch cadence, not just a headcount cut. Output compounds. SaaStr

Policy & Governance

Senators Warren and Scanlon want to ban AI companies from selling health and location data, explicitly including chatbot disclosures. The Health and Location Data Protection Act would bar the sale of Americans' health and location info to brokers, and it names data people reveal to chatbots like ChatGPT and Claude as protected. This is one of the first legislative moves to treat what you type into a chatbot as protected sensitive data. If you build anything handling conversational health or location context, this is a direct compliance signal. Start treating chatbot logs like PHI now, not after it passes. The Verge

The Bank of England is calling for bespoke regulation of agentic AI in finance. A senior official argued existing rules are inadequate for autonomous systems acting in markets, signaling a shift from generic AI guidance toward agent-specific supervision. For fintech builders, this foreshadows compliance requirements aimed squarely at autonomous decision-making agents, not just AI features. The regulators are moving from "AI in general" to "agents specifically," which is where the actual risk lives. Finextra

A Swedish court ordered Google to pay Klarna-owned PriceRunner $1.97 billion over search self-preferencing. It's one of the largest single-plaintiff antitrust awards against Google in Europe, over the same ranking behavior Google is defending in the AI-search era. The timing matters: as search shifts to AI answers, the self-preferencing question doesn't go away, it moves to a new surface. Nearly $2B is a real number attached to a behavior Google is about to repeat in a different form. Finextra

Skills of the Day

1. Recount your token budgets before migrating to Sonnet 5. The new tokenizer emits ~30% more tokens for identical text, so any max_tokens value, context budget, or cost projection sized against 4.6 is now wrong. Do the recount as a scripted step, not a vibe check, because you'll re-run this migration when Fable 5 drops next.

2. Detect Sonnet 5 refusals by stop_reason, not HTTP status. Refusals now arrive as HTTP 200 with stop_reason: 'refusal'. If your error handling only inspects status codes, a refused request parses as a successful empty completion. Add an explicit stop_reason check before you treat any 200 as done.

3. Feed the failing test to self-repair loops, not the broken output. A preregistered study (arXiv 2606.31511) shows repair value comes from an external executable counterexample, not from re-reading the failed code. Change your retry prompt from "here's your error, try again" to "here's the assertion you violated, try again."

4. Treat PR titles, issue text, and repo metadata as untrusted input in any CI agent. Johns Hopkins exfiltrated GitHub Actions secrets by planting instructions in PR titles. Scope secrets out of any context the agent can read, and gate every secret-touching or irreversible action behind explicit human confirmation.

5. Spawn a research subagent the moment a task would pollute your main context. Boris Cherny's 2026 rule: do the 20 file reads and 12 greps inside a subagent so your main session only sees the final report, then plan with a clean context. It's the single biggest lever for keeping main contexts small.

6. Use the skills-to-MCP-server ratio as a design smell test. More skills than MCP servers means you're probably architecting right. More MCP servers than skills means you're paying a context tax for capabilities you could express as a cheaper skill. Most MCP integrations you reach for could be a lightweight skill instead.

7. Gate deploys on trajectory regressions, not just final-answer pass/fail. Score the full path (every tool call, observation, state transition) against a reference trajectory and block merges when the path degrades. This catches "right answer via wrong reasoning" before it ships and silently rots. LangChain

8. Have a reasoning model write the production prompt your cheap model runs. Ask a high-effort model to author the system prompt for a cheaper model, feeding it your task spec and real failure cases. The cost lands once at authoring time, and the output beats manual crafting. Pair it with a handful of real examples so it optimizes against your actual distribution.

9. Order and group your agent's skills deliberately, because arrangement changes behavior. SkillJuror (arXiv 2606.11543) shows skill ordering, not just which skills exist, produces measurable deltas in success rate, token use, and speed. Group by frequency of use, task relevance, and execution dependency instead of dumping them in arbitrarily.

10. Add cell-level verification to any table or spreadsheet agent. The first systematic study of data-referencing errors (arXiv 2606.32029) shows models misread or omit cell values even when they understand the table structure, poisoning intermediate reasoning while looking confident. Answer-level checks miss it. Verify the cited cells, not just the conclusion.

---