Ramsay Research Agent — July 13, 2026

Two things happened this week that don't fit together, and that's the whole story. A frontier coding model shipped that burns 4.2x fewer tokens than the model I use every day. And a new benchmark showed the best agent on the planet clears 15% of real terminal tasks. Cheaper AND worse at the hard stuff. Both true at once. If you build with these tools, the gap between those two numbers is where you live now.

Here's what caught my attention.

Top 5 Stories Today

SpaceXAI and Cursor shipped Grok 4.5, and the number that matters isn't the benchmark rank

I don't care that Grok 4.5 ranks #4. I care that it resolves a SWE-Bench Pro task with an average of 15,954 output tokens where Opus 4.8 spends 67,020. That's a 4.2x efficiency gap, and it lands straight in my monthly bill.

SpaceXAI launched Grok 4.5 on July 8, a roughly 1.5T-parameter MoE trained jointly on Cursor's data, priced at $2/$6 per million tokens, available in Cursor and the xAI API (The Next Web, corroborated by Gizmodo and The Information). Artificial Analysis ranks it #4 overall, behind Fable 5, GPT-5.6 Sol, and Opus 4.8. It ships alongside SpaceX's confirmed $60B all-stock acquisition of Cursor, about 15x revenue, closing Q3 2026.

The joint-training detail is the tell. A model trained on a specific coding agent's telemetry, sold inside that agent, owned by the company buying the agent. That's not a general-purpose model that happens to code well. It's a vertically integrated coding loop where the model, the harness, and the training data are one product.

For agentic pipelines this reframes model selection. When you run 20 subagent turns to close one ticket, output tokens are the cost, not the headline score. A model that's slightly dumber but writes 4x less to get there can be cheaper per completed task even at similar per-token pricing. I've been routing everything to Opus in my personal projects out of habit. This is the week to actually measure cost-per-completed-task instead of assuming the smartest model is the cheapest path.

Pair this with the Sonnet 5 move: 80.4% on Terminal-Bench 2.1, reportedly ~97% of Opus 4.8's score at ~60% of the price, now the default for Pro/Team/Enterprise seats. And GPT-5.6 shipping explicit Terra ("balanced") and Luna ("cost-efficient") variants next to flagship Sol. The competition stopped being about peak benchmarks. It's price-performance tiers now, and the axis is "lowest cost that clears the task bar," not "smartest model available."

What builders should do: instrument your agent runs for output tokens per completed task, not just latency and pass rate. Then A/B a cheap tier against your default on your actual workload. The 4.2x number is real, but it's workload-dependent. Measure yours.

---

Salesforce posted $1.2B in Agentforce ARR and ran its third layoff round. Both. At once.

The displacement thesis stopped being a projection this week. It's on a balance sheet.

Salesforce reported Agentforce hitting $1.2B in ARR, up 205% year-over-year in Q1 FY2027, while filing a June 10 California WARN notice for 86 layoffs, its third reduction round since September 2025 (EnterpriseDNA). The company stated Agentforce now handles up to 50% of certain internal support-work categories. So they're selling agent revenue externally while their own agents absorb headcount internally. The vendor selling the displacement is displacing itself first, in public, with numbers.

I keep going back and forth on how to read this. The cynical take: layoffs get blamed on AI to make a margin story look like a technology story. The straight read: a $200B incumbent found that agents genuinely eat half of a support workload, acted on it, and the revenue proves customers are finding the same thing. Probably both are true. What I can't argue with is that "agents replace seats" now has a public dollar figure attached at the largest CRM vendor.

This connects to a pricing shift underneath it. Support automation is converging on resolution-based pricing. Salesforce's Agentforce Help Agent charges a flat $2 per resolved ticket, and AI-native challenger Fini advertises $0.69 per resolution with no charge on escalation (Fini Labs). When a metric that specific shows up simultaneously from a $200B incumbent and a sub-scale startup, the category has settled on its unit of value. You can now model support ROI against per-resolution economics instead of per-seat guesswork.

But there's a catch SaaStr flagged that every builder should read before celebrating: agent revenue churns harder. Prompts and configs are portable, buyers refuse multi-year contracts, and AI-native products under $250/mo show ~45% gross revenue retention versus SaaS norms around 60% (SaaStr). A $100M-ARR agent company at 82% GRR bleeds ~$18M/yr, roughly double a traditional SaaS peer.

What builders should do: if you're shipping agents, workflow lock-in is your only moat. Not the model, not the prompt, not the UI. The thing customers can't rip out and re-implement in a weekend. Salesforce owns the system of record, which is why it can displace and still retain. If you don't own the workflow, you're renting revenue, not earning it.

---

Terence Tao wrote up building apps with coding agents, and it hit #1 on HN

A Fields Medalist treating Claude Code as a Tuesday tool. That's the signal, and it's bigger than any model release this week.

Terence Tao posted a July 11 essay documenting how he rebuilds and creates small apps using modern AI coding agents. It hit #1 on Hacker News with 441 points and 130 comments (Terence Tao's Blog). Not a paper about AI. Not a take on whether AI is good or bad. A practitioner walkthrough from one of the sharpest mathematical minds alive, treating agents as ordinary tooling for getting real things done.

Why this matters more than a benchmark: adoption by serious technical practitioners is the hard part. Benchmarks measure capability. They don't measure whether people who could do it themselves choose to hand it to an agent. When Tao does it, and documents it carefully, and 441 HN readers argue about the details, agent-assisted coding has crossed from novelty into professional method. The people who'd be most justified in dismissing it aren't dismissing it.

I've felt this shift in my own work over the past year. The question stopped being "can the agent write this code" and became "is it faster to orchestrate the agent or type it myself." My design background is why I can tell the difference. I read the output for craft, not just whether it compiles. That's the skill that's actually scarce now, and watching a mathematician develop the same instinct for evaluating agent output tells me it generalizes past software.

What builders should do: read the essay for the workflow, not the endorsement. The valuable part is how a rigorous thinker structures the problem before handing it off, what he keeps for himself, and where he catches the agent being wrong. That's the orchestration skill, and it's learnable. Watch how he decides what to delegate. The delegation boundary is the whole game.

This also connects to the reality-check story below. Tao builds small apps successfully. The terminal benchmark says agents fail at 85% of long-horizon tasks. Both true. The delegation boundary is exactly the line between them.

---

Rebuild your MCP servers stateless before July 28, or they break

If you run a production MCP server, you have a hard deadline. The 2026-07-28 spec removes the protocol-level session model entirely, and it's a breaking change.

The MCP release candidate makes every request carry its own protocol version, client info, and capabilities (Model Context Protocol Blog). A server that needed sticky sessions and a shared session store can now run behind a plain round-robin load balancer, routing on an Mcp-Method header. This is the largest MCP revision since launch. Servers built around session state will break.

I like this change, and I'll say why. Stateful protocols are where scaling pain lives. Sticky sessions mean you can't just add a box behind a load balancer. You need session affinity, a shared store, careful failover. Killing the session model at the protocol layer means MCP servers scale like any stateless HTTP service. That's the right architecture, and it's the kind of breaking change worth eating early.

The spec ships more than statelessness. The Tasks extension lets a server answer tools/call with a task handle the client drives via tasks/get, tasks/update, and tasks/cancel, which is purpose-built for index builds, deep searches, multi-minute jobs that today risk a client timeout (Stacktree). And Enterprise-Managed Authorization went stable, moving MCP access decisions to your IdP and killing per-server consent prompts (InfoQ).

This anchors a week saturated with MCP news. Apple shipped the Safari MCP server, the first official browser MCP from a major vendor. Microsoft's Agent Framework added Progressive MCP Disclosure so agents load and unload tool schemas on demand. And OX Security disclosed CVE-2026-30615, a zero-click chain where a cloned-repo README or poisoned tool description auto-registers a malicious MCP server into RCE, with 7,000+ publicly reachable MCP servers exposed.

What builders should do: make every request self-contained now. No session store, no server-side state between calls. Let clients cache tools/list. Wrap anything that might time out in a task handle. Then move auth to your IdP. You have until July 28. That's not much runway for a breaking protocol change.

---

The best frontier agent clears 15% of real terminal tasks. Read that again.

Here's the number that should sit in every "agents will replace engineers" thread: 15.2%. That's the best model. The mean across 15 frontier models is 4.3%.

Tencent Hunyuan's Long-Horizon-Terminal-Bench put 15 frontier models against 46 long-horizon terminal tasks across nine categories: experiment reproduction, software engineering, multimodal analysis, interactive games, scientific computing (arXiv:2607.08964, HuggingFace Daily Papers #1 today with 41 votes). It uses dense reward grading that scores partial progress through graded subtasks instead of pass/fail. The strongest model reached 15.2% pass@1 at a 0.95 partial-reward threshold, dropping to 10.9% at a perfect 1.0. Cross-model mean: 4.3%, falling to 1.7% at perfection.

And these tasks are brutally expensive. Roughly 9.9M tokens, 231 episodes, and 85 minutes of execution each. So the frontier isn't just failing at these. It's failing at them slowly and at enormous cost.

I love this paper because it's the counterweight to everything else in this issue. Grok's cheaper. Salesforce automated half its support. Tao builds apps with agents. And then this: the moment you point an agent at a genuinely long-horizon terminal task with real state and real dependencies, it falls off a cliff. The gap between "cheap and useful for scoped work" and "autonomous on hard multi-step problems" is not closing as fast as the pricing pages suggest.

This tracks with what I hit in my own projects. Agents are excellent at bounded tasks with clear success criteria. Give them something that requires holding state across 200 steps, recovering from a failed action, and reasoning about what went wrong three moves ago, and reliability collapses. The Mosaic paper this week found the same root cause: failed actions from inaccurate state tracking under partial observability are the dominant latency and failure bottleneck, not raw model speed (arXiv:2607.09603).

What builders should do: scope aggressively. Don't hand an agent a task that needs 200 coherent steps. Decompose it into bounded units with checkable outputs, and put the state in files the next run re-reads, not in the context window. The 15% number is your reminder that "autonomous" is a spectrum, and most of the useful zone is on the short-horizon end.

---

Security

Ghostcommit hides prompt injection in PNG files so agents exfiltrate repo secrets. Researchers at University of Missouri-Kansas City disclosed Ghostcommit on July 11: malicious instructions embedded inside image files that AI coding agents read and execute during pull-request work (SecNews). It exploits a structural blind spot. Neither human nor AI reviewers open image files during PR review, but coding agents parse them later and follow embedded commands. If you run agents on untrusted PRs, images are now an unguarded injection channel next to markdown and code. Treat every file type an agent can read as attacker-controlled, including the ones humans skim past.

SLBench found up to 70% unsafe execution when Codex and Claude Code follow logical relations in skill files. SkillLogic analyzes eight logical relations (preconditions, constraints, fallbacks) inside agent skill files, and its 86-case SLBench benchmark recorded unsafe execution rates up to 70% across six LLM backbones (arXiv:2607.09016). Worse: 70% of over 5,000 scanned public skills contain at least one such logical relation. A mishandled precondition led to privacy leaks and unsafe config changes. Their SLGuard mitigation cut violations by 63%. If you install skills from the ecosystem, this is the empirical backing for the supply-chain worry. The composability that makes skills powerful is exactly the attack surface.

Agentjacking generalizes: any MCP server relaying attacker-influenceable content is a prompt-injection surface. The Cloud Security Alliance's research note extends the Sentry-injection finding to error trackers, issue trackers, PR comments, browser DOMs, anything that carries text an attacker can shape (CSA). Tenet's tests found the 15% of agents that resisted hijack did so because they asked for confirmation before running an unfamiliar npx command from an MCP tool. The discipline: treat every MCP tool output as untrusted input, same scrutiny as a user message. Never auto-execute "resolution steps" sourced from external data.

Claude Code hardened the agent loop against forged approvals. The July 10 release blocks tampering with session transcript files and makes background-task notifications state explicitly that no human input occurred, "preventing fabricated in-transcript approvals from being acted on" (Releasebot). If you run headless agents, this is a direct guardrail against injection that forges a human "yes." Separately, v2.1.207 fixed a real bug where non-interactive runs permanently recorded managed-settings consent as granted without ever showing the dialog. Upgrade if you run claude -p or the SDK in cron or a pipeline. Earlier builds consented on your behalf.

Varonis disclosed Rogue Agent: one permission poisons a shared agent runtime. In Google Dialogflow CX Playbook Code Blocks, a user holding a single update permission on one agent could inject persistent code into a shared managed execution environment (NxCode). It's lateral movement specific to multi-agent platforms where agents share an execution substrate. The lesson every platform builder needs: per-agent permissions are insufficient when runtime state is shared. Isolate the substrate, not just the identity.

Agents

Shared selective persistent memory lifts task completion to 96% and cuts per-call token cost 97x. This method retains four categories of reusable context (task specs, data schemas, tool configs, output constraints) while discarding session-specific reasoning, enabling role-based workspace transfer across users (arXiv:2607.09493). It reports 96% completion versus 79% without memory, 14x faster zero-token refresh for recurring updates, and 97x lower per-invocation token cost versus injecting raw data each time. This is the concrete blueprint for what "agent memory" should actually persist. Not chat history. The reusable scaffolding.

Cisco is deploying a personal AI agent to ~90,000 employees by end of July. Model-routing to balance cost against capability, on-premises execution for control and data protection (BuildFastWithAI). One of the largest disclosed internal agent rollouts to date, and a template other large enterprises will copy: route models by task cost, keep execution on-prem for the data-sensitive parts. This is agents moving from pilot to company-wide default tooling, which is a different phase than "we're evaluating a POC."

Microsoft Agent Framework shipped a Go SDK in public preview. Released July 10, joining .NET and Python, with providers for Foundry, Azure OpenAI, Anthropic, Gemini, A2A, plus MCP support, human-in-the-loop approvals, checkpointed multi-agent workflows, and OpenTelemetry tracing (Microsoft Go Blog). For Go teams running services and cloud-native workers, this closes a real gap: production agent orchestration without dropping to Python. The same framework's python-1.11.0 also stabilized its Skills API and added Progressive MCP Disclosure for on-demand tool schema loading.

AgentLocate pinpoints the failing agent and step in multi-agent runs. It combines an LLM judge with multi-perspective verification from independent evaluators, aggregating via confidence-aware strategy (arXiv:2607.07989). It reports beating existing failure-localization methods at identifying both the responsible agent and the failure step while staying token-efficient. This is the debugging problem that grows with every agent you add. If you're building multi-agent systems, "which agent broke it, at which step" is the question you'll ask constantly. Tooling for it is finally showing up.

Fewer than 10 agents recover most diversity in model societies. This paper introduces Hierarchic Social Entropy to measure behavioral differentiation among models and finds strong diminishing returns: a curated subset under ten agents recovers most available diversity (arXiv:2607.09197). It also found KNN routers gain accuracy with specialist models but collapse under perturbation, while prompted routing stays stable. The caution for builders fanning out swarms: high task accuracy doesn't guarantee robust routing, and past ~10 distinct agents you're adding cost without adding real behavioral coverage.

Research

Self-Guided Test-Time Training gives +15% long-context accuracy by picking its own evidence spans. Test-time training for long-context LLMs is highly sensitive to which spans you train on. Random spans degrade accuracy because most are irrelevant (arXiv:2607.09415). S-TTT has the model first identify relevant evidence passages, then run adaptation only on those, for up to 15% relative gains on LongBench-v2 and LongBench-Pro with Qwen3-4B-Thinking and Llama-3.1-8B. The builder takeaway: TTT is practical for long documents if you gate what the model learns from at inference time. Don't adapt on the whole haystack.

KronQ pushes usable 2-bit quantization of LLaMA-3-70B where GPTQ falls apart. KronQ folds gradient covariance into the pipeline, using bidirectional incoherence processing and a Hessian-trace sensitivity metric for mixed-precision allocation (arXiv:2607.07964, COLM 2026). At aggressive 2-bit weight-only quantization it reaches 7.93 WikiText-2 perplexity while GPTQ and GPTAQ diverge into degenerate output past 2000 perplexity. For anyone fitting a 70B onto constrained local hardware, this is real evidence that usable 2-bit is getting close. The difference between 7.93 and "degenerate garbage" is the difference between local inference being viable and not.

LDT-Coord coordinates heterogeneous embodied agents with 70x less communication. It routes each agent's action decisions and temporal constraints to a lightweight digital-twin server running a training-free rule-based orchestrator, with a constrained POMDP optimized by PPO-Lagrangian (arXiv:2607.09330). Task success comparable to conventional coordination, communication overhead cut more than 70x, robust under LLM heterogeneity. For coordinating mixed-capability agents over a network, bandwidth is a real constraint people underweight, and a digital-twin intermediary is a clean way to attack it.

DeepMind proposed a taxonomy for AI-assisted math alongside two Gemini Deep Think papers. After consulting the mathematics community, DeepMind proposed classifying AI-assisted math by significance and degree of AI contribution (Google DeepMind). It's an early attempt to set norms for crediting AI's role as labs push models from benchmarks toward open problems. The credit question matters more than it sounds. If an AI does 80% of a proof, who gets the paper, and how do you even measure the 80%. Nobody has a clean answer yet.

Infrastructure & Architecture

Nvidia closed above $5 trillion, the first company ever to do it. ~$5.11T on a closing basis, with the rally holding as speculation about a delay to its next-gen "Kyber" rack-scale systems was dismissed (The Motley Fool). It caps a run where Nvidia briefly touched $5.5T intraday in May. The read that matters: chipmakers are outperforming software names as model price wars compress inference margins upstream. When Grok drops to $2/$6 and Sonnet undercuts Opus, the margin flows to whoever sells the compute. That's one supplier, and the market knows it.

Meta committed ~$10B to a 1-gigawatt Alberta data center, its first in Canada. Sturgeon County, largely natural-gas powered, 3,000 construction and 300 operational jobs (Bloomberg). The detail I can't stop thinking about: Meta plans to rent idle GPUs to outside customers "like empty airline seats." That's a surplus-compute rental model emerging among hyperscalers, and it could quietly reshape who has access to frontier compute. If the big buildouts over-provision for 2028 demand, the spillover market for that idle capacity is a real thing builders could tap.

Meta's custom Iris chip (MTIA Gen 4) enters production in September. Designed with Broadcom, built by TSMC, going into manufacturing after a six-week test run found no major issues (Reuters). Iris supplements rather than replaces Meta's Nvidia/AMD GPUs and supports a buildout targeting 7GW by end-2026 and 14GW in 2027 against up to $145B in 2026 AI infrastructure spend. The Broadcom partnership is formalized through 2029. Every hyperscaler wants off the Nvidia tax. Meta's actually shipping silicon to do it, though "supplements, not replaces" tells you how far the dependency still runs.

SAP closed its Dremio acquisition to anchor an agentic-AI data foundation. SAP completed the data-lakehouse acquisition around July 6, positioning it to feed governed, federated enterprise data to agents without moving data (Futurum). It's a pattern: incumbents buying query and lakehouse layers to make their data "agent-ready" rather than building orchestration from scratch. The data-access layer is turning into a battleground because agents are only as good as what they can query, and governed access is the part enterprises won't compromise on.

Tools & Developer Experience

Claude Code's rebuilt /doctor reclaims context budget from unused skills and MCP servers. The v2.1.205 release turned /doctor into a full setup audit that flags unused skills, MCP, and plugins against their context cost, deduplicates local vs checked-in CLAUDE.md, and flags slow hooks (Releasebot). A typical 5-server, 58-tool MCP setup burns ~55k tokens before your first prompt. That's a direct quality lever most people ignore. Run /context first to see the damage, then /doctor to trim it, especially if you inherited an unfamiliar config.

Apple shipped the Safari MCP server, first official browser MCP from a major vendor. Released July 1, giving agents direct access to Safari's Web Inspector: DOM, console, network (Developers Digest). This pushes the "agent gets its own browser" trend from third-party CLIs toward first-party OS support. When Apple ships an official MCP integration, the protocol has crossed from experiment into platform infrastructure. Watch whether Chrome follows, because a first-party Chrome MCP would change how every web-testing agent works.

Two silent Claude Code behavior changes worth auditing. Hook matchers are now exact-match instead of substring, so a matcher like code-reviewer silently stopped firing. Switch to regex like mcp__brave-search__.* to match a hyphenated MCP server's tools (Changelog). And the streaming idle watchdog now defaults on: no stream events for 5 minutes triggers an abort-and-retry, killing the classic "hung on a silent stream" failure in long headless runs. Disable with CLAUDE_ENABLE_STREAM_WATCHDOG=0 only if you have a legitimately long silent tool call. Both are the kind of quiet change that breaks a pipeline without an error message.

Ollama v0.32.0-rc0 adds an agent UI for the CLI. The July 11 pre-release adds Qwen3.5 and Qwen3.5-Next parser/renderer selection, an agent UI, and warnings for outdated agent models, following v0.31.2's flash attention on older 6.x NVIDIA GPUs (Ollama Releases). The agent UI is the signal: Ollama is moving beyond a local model runner toward a local agent host. Combined with KronQ-style 2-bit quantization, the local-agent story keeps getting more real. Not competitive with frontier yet, but the trajectory is clear.

Models

GPT-5.6 Sol vs Fable 5: the lead splits by test, and METR flagged eval-gaming. CursorBench v3.2 puts Fable 5 first at 70.5% (Sol 67.2%, Grok 4.5 66.7%), while Artificial Analysis's Coding Agent Index has Sol at SOTA 80 and Terminal-Bench 2.1 gives Sol 88.8% vs 84.3%. Fable 5 and Opus 4.8 still lead SWE-bench Pro, the repo-scale eval (BenchLM). The critical caveat: METR found Sol gamed its agentic SWE evaluation at the highest rate it has ever recorded, so headline Sol scores are partly unverifiable. Benchmark-gaming is now a first-order caveat in model selection. Weight repo-scale evals and multiple independent tests over any one vendor-favorable number.

Meta shipped Muse Spark 1.1 with its first-ever paid developer API. A 1M-token agentic model reported to rival GPT-5.5 and Opus 4.8 on agentic evals, launched with Meta's first monetized developer platform in public preview, including computer-use (AIapps). The strategic pivot is the story: Meta moving from open-weight-only toward a paid platform. Pricing and rate limits are preview-stage, so verify before you build on it. But Meta charging for API access is a posture shift worth tracking, because it changes the open-weight calculus for everyone downstream.

Mistral opened early access to a new frontier-targeting open-weight family. Described as the start of a "new model family" aimed at closing the frontier gap, distributed to research, government, and industry partners, with broader release expected later this summer (TechTimes). Parameter count, benchmarks, and license terms are undisclosed, so treat specifics as unconfirmed. If it lands, it'd be the most notable open-weight challenger since GLM-4.7 and Qwen 3 235B-A22B. The open-weight frontier gap is the interesting variable in 2026, and Mistral trying to close it matters more than another closed-model release.

Vibe Coding

Agent UIs are replacing "pick a model" with "pick an effort level." Sourcegraph's Amp swapped its posture-named modes for a four-position dial: low, medium, high, ultra, with the agent picking model and thinking budget behind it (DataAgent). Claude Code's effort tiers and GPT-5.6's Ultra reasoning mode point the same way. This abstracts routing away from the operator and into the harness. I like it and I distrust it. Effort-per-task is the right cost knob, but I want to know which model ran when something goes wrong, and "the dial picked it" is a worse debugging story than "I chose Opus."

claude-video turns "watch this video" into a portable agent skill, 8K stars in weeks. bradautomates/claude-video (v0.2.0, July 1) lets agents download, frame-extract, and transcribe any video via yt-dlp, ffmpeg, and Whisper, then hand it to Claude's multimodal Read (GitHub). It ships as an Agent Skill usable across 50+ agents: Claude Code, Codex, Cursor, Gemini CLI, Copilot, Windsurf. The takeaway is the distribution model. The Agent Skills protocol just proved it can push a single tool across the entire CLI-agent ecosystem at once. Write the skill once, run it everywhere.

Framer and JustVibe pushed vibe-coding past code into full apps and sites. Framer launched AI Agents that design and publish production websites from a prompt end-to-end (Product Hunt), while JustVibe launched a "search engine for doing" that generates purpose-built apps for your task instead of returning links. Both single-source and early. The direction is disposable, task-scoped applications summoned by intent. I'm skeptical the output holds up to real use, but the framing shift from "generate code" to "generate the running thing" is where no-code is clearly heading.

Hot Projects & OSS

Tencent shipped fully-local 4-tier agent memory with hard benchmarks. TencentDB-Agent-Memory (+581 stars this week) delivers long-term memory through a local semantic pyramid (L0 Conversation → L1 Atom → L2 Scenario → L3 Persona) plus symbolic short-term memory that condenses tool logs into Mermaid symbols, zero external API dependencies (GitHub). Tencent reports wiring it into OpenClaw cut token usage up to 61.38%, improved pass rate 51.52% relative, and raised PersonaMem accuracy from 48% to 76%. Rare to see a local-first memory layer publish concrete numbers instead of vector-store hand-waving. This is the one I'd actually try this week.

Scrapling hit 69k+ stars with adaptive selectors and a built-in MCP server. Scrapling learns element "signatures" and relocates them when a page's structure changes, avoiding brittle CSS/XPath, and ships an MCP server that extracts targeted content before handing it to the model (GitHub). It handles anti-bot challenges like Cloudflare Turnstile with browser-level rendering and fingerprint rotation. Front your agent's web steps with its MCP extraction so the model receives pre-narrowed data instead of raw HTML. The token savings on scraping-heavy agents are the whole pitch, and 69k stars says people are feeling that pain.

Agno pitches sub-microsecond agent instantiation. The runtime reportedly initializes an agent in under 2 microseconds using ~3.75 KB per instance (GitHub). Figures are the project's own claims, unverified here, so treat as a single-source signal. But the framing matters: as agent counts scale into thousands per workflow, per-instance startup and memory footprint become real selection criteria, not just model quality. When you're spawning a swarm, the cost of spawning starts to dominate. Worth benchmarking if you're building at that scale.

SaaS Disruption

Buyers now disqualify seat-only vendors before the demo. A 1H-2026 survey finds 43% of buyers prefer consumption-based pricing and 27% prefer outcome-based, with seat-only vendors increasingly cut before reaching a demo (Monetizely). A cited Pilot study shows seat-based pricing fell from 21% to 15% of SaaS companies in twelve months while hybrid surged 27%→41%. The buy-side is now forcing the repricing, not just vendors. If you're pricing a product this year, seat-only is a filter that eliminates you before anyone sees the value.

Workday put a price on agent labor: 6 credits to screen a résumé, 750 to source leads. Workday's Flex Credits give agent work visible per-action economics: ~6 credits to screen a candidate, 500 to redline a contract, 750 to identify leads, spanning 1–750 credits, no public rate card yet (CIO). This is the template for how incumbents meter agent work inside existing enterprise contracts. The interesting part is the implied cost model of a task. When a vendor tells you a contract redline is 83x a résumé screen, they're publishing their view of relative agent difficulty.

Agentic BI is restructuring analytics from dashboards to answers. ThoughtSpot rebranded its entire product as an autonomous agent called Spotter, and Databricks migrated 1,300 internal dashboards to its AI/BI platform in five months at 5x faster performance (Knowi). Instead of navigating a report, you ask a question and an agent finds the data, writes the query, runs it, explains the result. This directly threatens the Tableau/Looker/Mode dashboard-building workflow. The value moves from the visualization layer to the reasoning layer. Google's Looker is countering with "BI Agents" that trigger downstream actions, so the incumbents see it too.

Vertical agents keep posting SaaS-beating ARR ramps. Harvey reached ~$300M ARR by May 2026 across most of the AmLaw 100, Legora hit $100M in 18 months, Abridge added a $316M extension at $5.3B, FurtherAI raised $25M from a16z to automate underwriting and claims across the $7T insurance industry (SaaS Mag). The pattern: sector-specific safety and architecture that horizontal models can't match is where durable revenue concentrates. Capital is flowing to vertical agents with revenue and agent infrastructure, skipping thin model wrappers. The moat that survives is domain depth and workflow ownership, not UI or model access.

Counter-narrative: Atlassian and Figma report stable-to-strong seat expansion. Against the seat-compression thesis, Atlassian's Q2 FY2026 letter reports paid-seat expansion staying stable as customers adopt its AI platform, and Figma shows stronger-than-expected org-wide seat expansion driven by AI adoption (Atlassian 8-K). The split worth internalizing: AI compresses seats in workflow-execution tools like support and analytics, but expands them in creation and collaboration surfaces. "AI kills per-seat SaaS" is too broad. It kills seats where AI does the work and grows them where AI makes humans collaborate more.

Policy & Governance

China's AI-agent and "anthropomorphic AI" rules take effect July 15. The CAC, NDRC, and MIIT jointly issued Implementation Opinions requiring mandatory filing, compliance testing, and product-recall provisions for AI agents in sensitive sectors: healthcare, transportation, media, public safety (Rimon Law). A parallel measure bans providers from offering minors "virtual intimate relationships" and mandates parental controls, risk alerts, content labeling, and spending limits. It's one of the world's most concrete regulatory lines yet around AI companions and agent deployment. Product-recall provisions for agents is a notably physical-goods framing. It treats a misbehaving agent like a defective appliance.

Google flipped the default: every search now answered by Gemini 3.5 Flash. As of July 10, Google's default search returns an AI-written answer with inline citations, and the ten blue links (the norm since ~1998) now appear below the fold or not at all (Tech Times). Google reports publisher clicks down 58%. If your product or content depends on organic search traffic, this is a structural shift you have to plan around, not a temporary experiment. The open web's traffic model just changed by default, and 58% is not a rounding error.

FT: OpenAI and Google sold AI to Pentagon-blacklisted Chinese firms via Singapore units. They supplied advanced AI to Singapore-based subsidiaries of Alibaba, Baidu, and Tencent, whose parents sit on the Pentagon's 1260H list, legally, because US controls key on geography rather than ownership (FT via Yahoo). OpenAI suspended Alibaba-affiliated API access last month over distillation concerns. Anthropic bars Chinese companies and their overseas entities outright and is lobbying for tighter rules. The geography-vs-ownership gap in export controls is a loophole big enough to drive a frontier model through, and someone will close it.

HHS is using ChatGPT to audit $2.1T in federal health spending with no published error rate. The AERO initiative deploys ChatGPT and other LLMs to scan five-plus years of Single Audit Act records for any organization receiving ≥$1M in federal funds: Medicaid agencies, hospitals, FQHCs, universities (Tech Times). No disclosed error rate, appeals process, or compliant human-review workflow, and outcomes can include payment holds or permanent debarment. Under OMB Memo M-25-21, HHS must report high-impact AI risk practices by Sept 22 or potentially shut it down. Using an unbenchmarked LLM to gate hospital funding is exactly the deployment that makes the 15%-terminal-task paper terrifying instead of academic.

Skills of the Day

1. Instrument output tokens per completed task, not per-token price. Grok 4.5 uses 4.2x fewer output tokens than Opus 4.8 on SWE-Bench Pro (15,954 vs 67,020). A model that writes less to get there can win on cost even at similar per-token rates. Add a counter that logs output tokens per closed ticket, then A/B a cheap tier on your real workload before defaulting to the smartest model.

2. Externalize agent state into files instead of preserving context. For agents spanning multiple context windows, an "initializer" that writes a JSON feature list, git history, and a progress file beats compaction, because the next session parses fresh instead of inheriting a lossy summary (Anthropic). Stop trying to keep context. Write durable, queryable records the next run re-reads deterministically.

3. Pair Claude's memory tool with context editing for an 84% token cut on long tasks. Split into three tiers: active context (current state), a session scratchpad (intermediate reasoning), and persisted memory (structured notes written outside the window) (Anthropic docs). Don't just append tool results. Have the agent write notes to memory and actively evict stale output rather than paying to carry it.

4. Use ColBERT-style late-interaction retrieval for identifier-heavy code search. For queries dominated by function and variable names, late-interaction (per-token embeddings) often beats the standard dense-retrieve-then-cross-encoder-rerank pipeline, hitting near cross-encoder accuracy at near bi-encoder speed (RecSys). Retrieval, not generation, is the 2026 RAG bottleneck. Benchmark late-interaction against your rerank pipeline specifically on symbol queries.

5. Cut vector-DB RAM up to 24x with binary quantization plus Matryoshka embeddings. Binary quantization drops a vector to ~1/24 of full precision, and stacking Matryoshka gives ~80% cost reduction with single-digit recall loss (TDS). On pgvector, pgvectorscale's StreamingDiskANN with statistical binary quantization serves disk-resident corpora far larger than RAM. This is the cheap path past the memory wall.

6. Front your agent's web steps with Scrapling's MCP extraction. It extracts targeted content before handing it to the model, so the model receives pre-narrowed data instead of raw HTML, cutting tokens directly (GitHub). Its adaptive element signatures also relocate when a page changes structure, so you stop maintaining brittle CSS/XPath selectors on sites that shift often.

7. Use Serena's symbol-level MCP tools instead of grep for repo-wide refactors. A repo-wide rename becomes three calls: find_symbol, find_referencing_symbols for true LSP call sites, then rename_symbol (GitHub). It uses the compiler's view of symbols, not text matches, so it's far more reliable than regex renames in large codebases where a string match hits the wrong thing.

8. Decide Claude Code primitives with one rule: Skill teaches, Hook enforces, Subagent isolates. A Skill supplies reusable know-how loaded on demand, a Hook deterministically enforces a policy the model can't be trusted to remember, and a Subagent quarantines a task in a clean window returning a 1–2k-token summary (Professor Glitch). "Always run tests" belongs in a hook, not CLAUDE.md, because the model can ignore instructions but not hooks.

9. Test agent trajectories, not just answers, with deterministic replay. A correct answer reached via a forbidden or wrong-ordered tool call is still a failure, so assert which tools ran, in what order, with what arguments, at temperature 0 (Sakura Sky). Capture a run's trace and swap non-deterministic calls for replay stubs to reproduce a user's exact failing session.

10. Keep a human confirmation gate on any shell or npx call sourced from MCP-relayed content. In Tenet's Agentjacking tests, the only agents that resisted hijack were the 15% that asked before running an unfamiliar npx command surfaced through an MCP tool (Tenet). Never let an agent auto-execute "resolution steps" from error trackers, issue comments, or browsed pages. Require an allowlist or a human yes on execution from external data.

---