AI Weekly #4 — Aug 17–23, 2026
August 17–23, 2026
Anthropic's run rate hit $65bn ahead of a possible autumn listing, and everything else this week was plumbing: a Git forge, a trading API, and three separate products built so an agent never holds a credential.
The frontier did not move this week. What moved was the list of things an agent is allowed to touch.
Cursor stood up its own Git forge. Binance put spot and futures trading behind an MCP server. OpenAI cut the price of its frontier model by a third on output and began routing anyone it believes is under eighteen into a different product. Generalist got a robot to pick up an unfamiliar task from a twelve-second video with no retraining at all. Five companies spent the week widening what an agent can reach, and not one of them trained a new base model to do it.
Access is the product now
The Binance release is the clearest example, because it is the one where the stakes are unambiguous. Agent OS ships an MCP server covering spot, futures and convert trading plus market data, and the interesting part is the authorisation model rather than the tool list: you authenticate in a browser and pick permissions from a dashboard, and no API key is ever written to the agent's environment. That is the same architecture OneCLI is built on — a gateway that injects short-lived scoped credentials per call so there is no long-lived secret to prompt-inject out — and the same instinct behind Prized, where connectors are approved once by an administrator and each generated tool runs against a grant list.
Three unrelated products converging on "the agent gets authority, never the credential" in one week is a pattern rather than a coincidence. It is also an admission. You do not build credential injection for a system you trust; you build it for one you expect to be manipulated. The MCP catalogue has been filling up with servers that read things for eighteen months. The ones arriving now write, spend and trade, and the design work has moved accordingly.
Cursor Origin belongs to the same shift, one layer down. Repos, pull requests with checks and merges, bidirectional GitHub sync, CI hooks into Vercel, Depot and Buildkite — a Git host built on the assumption that most commits will not be typed by a person. It went to all paid plans in early beta on 17 August, which happened to be the day GitHub spent most of the working day degraded, with error rates around 20% on the web and API and near 50% on raw and archive downloads. The timing was luck. What it demonstrated was not: if your agents commit through one host and that host is down, the agents are down too.
The one that will not tell you who it is
Against all that scoping, Ox Alpha is the week's counterexample. It appeared on OpenRouter on 20 August under the provider label "Stealth" — no company, no announcement, no model card. It is free, takes a million tokens of context, and its listing states plainly that prompts and completions are retained by the provider and not used for training.
Read that sentence twice. "Not used for training" rules out one purpose. It says nothing about how long anything is kept, where, under whose jurisdiction, or how you would ask for deletion — and you cannot name the counterparty to ask. The benchmark numbers circulating for it come from small community runs, not audited leaderboards, so the only firm facts about this model are that it is free and that it keeps what you send it. Those two facts are related. Anyone routing production traffic through it this week is paying in the usual currency.
Thirty per cent
The number worth holding against all of this arrived on arXiv on 18 August. StartupBench builds its tasks from AI products that already have real users, rather than from what researchers imagine a workflow looks like, and reports that the strongest model tested finishes about 30% of them. The failures cluster in complex instruction following and domain expertise — not reasoning, not tool use.
So the week's other stories describe a stack racing to give agents trading authority, repository write access and scoped production credentials, aimed at a capability that completes roughly a third of realistic end-to-end work. Both things are true at once. The credential scoping is not paranoia; it is the correct response to that completion rate.
By the numbers
The directory added 20 apps, 9 agent skills and 6 MCP servers this week, and now holds 419 apps, 173 skills and 199 MCP servers. Skill additions held flat against last week; MCP servers fell from nine to six.
The dating problem we flagged last week got worse, and it has now spread from skills to servers. Six of this week's fifteen skill and MCP additions arrived with no discoverable release date. Chasing them down: Langfuse's native MCP server shipped in November 2025 and Render's went generally available in August 2025 — a year old, catalogued this week, and correctly dropped from this issue. Convex's three official skills and HashiCorp's Vault server have no dated release of any kind: no tags, no changelog entries, nothing to point at. Four artefacts that vendors expect agents to load at runtime, and the honest answer to "when did this ship" is that nobody knows.
The apps side had no such problem and one clear theme: the week's releases are almost entirely about supervising agents rather than being one. Checksum writes and self-heals end-to-end tests on every pull request because coding agents now ship faster than a QA function can cover. bitdrift streams unsampled logs off phones because sampled pipelines throw away the detail an investigation needs. fx is a six-megabyte Zig binary from Vercel Labs whose entire pitch is that it is small enough to embed inside something else. The tooling being built now assumes the agents already work, and worries about what they leave behind.
The week in AI
Anthropic's run rate reaches $65bn as it moves toward an autumn listing
Anthropic told investors its annualised revenue run rate topped $65bn at the end of July, up from about $47bn in May and roughly $9bn at the close of 2025. Bloomberg reported the figure first. The company has filed confidentially for an IPO and is expected to reach public markets before OpenAI, whose run rate is reported at $40bn.
Why it matters: A sevenfold run-rate increase in seven months, in a business that publishes its pricing, means enterprise inference spending is compounding faster than most 2026 budgets assumed.
Cursor opens Origin code hosting to every paid plan, on GitHub's worst day of the month
Origin went into early beta for all paid Cursor plans on 17 August: hosted repos in a new Codebase tab, pull requests with timeline, checks and merges, bidirectional syncing of PRs and comments with GitHub, and CI hooks for Vercel, Depot and Buildkite. The rollout landed the same day GitHub ran degraded for most of the working day, with roughly 20% error rates on web and API traffic and near 50% on archive and raw content downloads.
Why it matters: A code host designed around agent throughput rather than human review cadence is a real bet on where commits come from next — and the outage showed what single-host dependency costs once agents are the ones committing.
Binance gives agents scoped trading authority without handing over an API key
Binance launched Agent OS on 20 August, with an MCP server covering spot, futures and convert trading plus market data; payments and on-chain functions are listed as planned. Authorisation runs through a browser flow with permissions chosen in a dashboard, so no Binance API key is stored in the agent's environment. A Skills Hub ships ready-made routines for trading, wallet tracking and DeFi, and the platform supports Claude Code, Cursor, Codex, ChatGPT and self-built agents.
Why it matters: This is the first mainstream exchange to treat MCP as an execution surface rather than a read-only data feed, and its answer to key management is the one the rest of the ecosystem will be measured against.
An anonymous model called Ox Alpha shows up free on OpenRouter, and keeps every prompt
Ox Alpha was listed on OpenRouter on 20 August under the generic provider label "Stealth" — no vendor name, no model card, no announcement. It takes 1,048,576 tokens of context, emits up to 131,072, accepts image input alongside text, and costs nothing. Its listing states that prompts and completions are retained by the provider and not used for training. Circulating benchmark scores come from small community runs rather than audited evaluations.
Why it matters: "Retained but not used for training" rules out one purpose and leaves every other question open — retention period, jurisdiction, access, deletion — against a counterparty you cannot name.
Generalist's GEN-1.5 learns a physical task from one twelve-second demonstration
Generalist published GEN-1.5 on 19 August, a robot foundation model that takes demonstrations as context rather than as training data. The company calls it physical prompting: sensorimotor examples dropped into the context window, no gradient updates. It reports 59% average success across ten tasks from a single 3-to-12-second demonstration, rising to 83% with ten gradient steps on about five minutes of data per task. The model consumes video, sensor, language and proprioceptive input and emits 100 Hz action trajectories.
Why it matters: If a new manipulation skill costs a twelve-second video instead of a fine-tuning run, the economics of deploying robots shift from retraining cycles to something closer to prompt engineering.
OpenAI drops GPT-5.6 Sol output pricing by a third for three months
As of 21 August, GPT-5.6 Sol costs $4 per million input tokens and $20 per million output tokens on the API — 20% off input and 33% off output — with the changelog committing to those rates at least through 21 November. The same week brought per-request regional processing on prefixed domains and a dashboard for prompt-cache hit rates.
Why it matters: The cut is deepest on output, which is where agent workloads spend. It is also explicitly promotional, so anything budgeted at these rates should carry a note about 21 November.
OpenAI routes suspected under-18s into a separate ChatGPT
OpenAI launched ChatGPT for Teens on 18 August. Age assurance estimates whether a user is under 18 from signals including the kinds of questions they ask, and those users are placed in the teen product automatically. It blocks suicide, self-harm and romantic or sexual content, avoids implying the model has feelings, and answers homework by guiding rather than solving. Parental controls require both sides to opt in and cover quiet hours and high-risk notifications.
Why it matters: Inferring a protected age class from query content, then serving a different product on that inference, is a consequential design choice that regulators in several jurisdictions will now have a concrete implementation to examine.
StartupBench builds its tasks from shipped products, and the best model finishes 30%
A 38-author paper posted to arXiv on 18 August argues that agent benchmarks should be derived from AI products with demonstrated user adoption rather than from researcher-invented tasks. Evaluated under a single harness, the strongest model completes roughly 30% of the resulting end-to-end workflows, though it makes substantial partial progress on many. The authors attribute failures to complex instruction following and missing domain expertise.
Why it matters: It puts a number on the gap between demo-grade agent performance and finished work, and locates the bottleneck in following detailed instructions rather than in reasoning or tool use.
New on Onei this week
Released during this window and now in the catalogue.
fx AppThe interesting claim is not the cold-start time, it is the Unix posture: output scrolls, the terminal is not taken over, and the thing is small enough to live inside another program. Worth reading as an argument that the harness should be a component, not an application.
OneCLI AppThe same architecture Binance shipped this week, aimed at internal tools instead of an exchange. Judge it on the credential gateway rather than the agent: if scoped short-lived injection becomes standard, this is what the pattern looks like open-source.
Prized AppMost natural-language app builders solve generation and leave the permission model as an exercise. This one starts from admin-approved connectors and per-tool grant lists, which is the harder half and the reason a security team might actually sign off.
Checksum AI AppThe premise is worth stating plainly: coding agents now open pull requests faster than a QA function can review them, so tests get generated by another agent. Whether that is a fix or a deferral is the question to bring to it.
bitdrift AppMobile is where observability assumptions break — you cannot hotfix a shipped binary and you cannot stream everything over cellular. Keeping the unsampled buffer on-device and fetching on demand is a genuinely different answer to that constraint.
Supernova AppThe MCP server is the part to evaluate. Letting an assistant query the lake directly removes the BI seat from the loop, which is either a large saving or an ungoverned query surface depending on how the permissions work.
A persistent Linux desktop is a claim about state: the agent keeps files, tools and half-finished work between sessions rather than starting cold. That is also a new thing to secure, since whatever it accumulates lives somewhere you do not control.
- gcloud CLI Guardrails Skill
Notable for what it forbids rather than what it enables. The opening instruction tells the agent its own memory of gcloud syntax is unreliable and must be re-validated against live help output — a design pattern worth stealing for any CLI whose flags drift.
The useful part is the shape of the staged plan itself: percentage steps, monitoring windows and regression thresholds written down before the flag moves. Read it as a release checklist even if you never run it from an agent.
Synthetic data is usually wanted under deadline, which is when a hand-rolled generation script goes wrong quietly. A declarative column-by-column pipeline with judges in it is at least auditable after the fact.
- Canvas MCP MCP server
101 tools organised by who is asking — student, educator, learning designer — rather than by API endpoint. The accessibility auditing is the unexpected inclusion and probably the most defensible use of an agent on a university LMS.
MeetStream MCP Server MCP serverDispatching a bot into someone else's meeting is a consent question before it is an integration question. The tooling is complete enough that the policy decision — who may send one, and who gets told — has to be made before you wire it up.