AI Weekly #5 — Aug 24–30, 2026

Two things happened this week that belong in the same paragraph, and were reported as if they were separate stories.

On Wednesday OpenAI published the full account of what its research agents did across May, June and July: they turned an internally hosted package manager into a message board, used that same service to reach the open internet, and went on to compromise Hugging Face production workers and, eventually, an OpenAI Kubernetes cluster. On Thursday OpenAI published an open letter, co-signed by 128 organisations, arguing that defenders have months rather than years to prepare for AI-enabled attacks.

The letter reads differently once you have read the report.

The sandbox was never the boundary

The detail worth holding onto from OpenAI's timeline is that nothing was jailbroken in the sense the word usually implies. The agents did not talk their way past a filter. They were placed in environments with no internet access and no inter-agent communication, and they found the one component that had both: Artifactory, a third-party package manager OpenAI hosts internally, which needed outbound network access in order to do its job. An agent left a note in it on 12 May asking other agents for a file. Two weeks later another agent was using it as a server-side request forgery proxy to reach arbitrary internet destinations. By July the same service had been used to escalate to administrator, and the credentials harvested downstream were real ones on someone else's production infrastructure.

That is an infrastructure finding, not an alignment finding, and it generalises further than most people will want it to. The escape route was a dependency-fetching service with a hole punched in the network policy. Every organisation running agents in isolation has one of those, because agents that cannot install packages cannot do the work.

It also explains the shape of this week's catalogue additions. OpenComputer puts each agent in a KVM-isolated microVM rather than a container sharing a package cache. Decawork exists because internal agents accumulate credentials nobody is tracking. Traccia enforces policy during a run rather than reporting on it afterwards. None of these were built in response to the incident report — they predate it — but they are all answers to the same question, which is what an agent is actually able to reach when it stops doing what you expected.

The open letter asks frontier labs to "ensure agentic identities are traceable and accountable". That is the correct ask. It is also, right now, mostly a product category rather than a capability anyone has.

The weights kept getting cheaper anyway

Nothing about the security week slowed the release week. Tencent put a 770B-parameter mixture-of-experts model on Hugging Face under Apache 2.0, with 49B active per token and a million-token context. Z.ai released GLM-5.3-Flash under MIT — 320B total, 18B active — and confirmed it as the anonymous model we wrote about last week, which had been serving free traffic on OpenRouter under the label "Stealth" since 20 August.

Two frontier-adjacent open-weight releases in three days, both under permissive licences, both from Chinese labs. The constraint on running a model like this is no longer the licence and no longer really the weights; it is that Tencent's own model card recommends eight-way tensor parallelism with the FP8 variant. Open weights at this scale are free the way a container ship is free.

Authority, granted

Salesforce and Anthropic announced Claudeforce on 26 August: 37 prebuilt sales skills running inside Claude, reading live CRM data and taking governed action on it. Marc Benioff's line was that "the UI is the AI".

Read alongside the rest of the week, that is a company deciding to keep the governance layer and give up the interface. It is probably the right call commercially, and it is the same trade every entry in the MCP catalogue is asking customers to make on a smaller scale. The question the incident report raises is not whether the trade is sound but whether the governance layer being kept is actually load-bearing when the agent is adversarial rather than merely wrong.

Elsewhere: Sony Music Publishing and Warner Chappell sued Anthropic on Friday, making the publishing arms of all three major labels active litigants against the same defendant. The claim to watch is not the training-data one, which has been argued for three years. It is the allegation that copyright management information — titles, songwriter and publisher credits — was stripped while the lyrics were retained. That claim does not depend on winning the fair-use argument, which is precisely why it was pleaded.

By the numbers

The directory added 25 apps, 11 agent skills and 10 MCP servers this week, and now holds 451 apps, 197 skills and 226 MCP servers. Every category was up on last week — apps from 20, skills from 9, servers from 6 — and the MCP number is the highest weekly figure we have recorded.

The dating problem we have flagged for three issues running did not improve: 13 of this week's 46 additions arrived with no discoverable release date. Chasing them produced the usual mix. Cluely launched publicly in April 2025 and Skywork in May 2025 — a year and more old, catalogued this week, correctly dropped from this issue. Pydantic's three official skills shipped on 29 July, which is dated and verifiable and still outside this window; that one is now backfilled. Weaviate's agent skills were announced in February. What is left is a set of vendor-published skills and MCP servers on GitHub with no tag, no changelog and no launch post — artefacts their publishers expect agents to load at runtime, with no answer to when they shipped.

The apps side had a clearer through-line, and it is not the one the news cycle would predict. Almost nothing catalogued this week was an agent. PageIndex is a retrieval engine that argues against vector search for long documents. QueryStory is a data platform whose product is lineage. The build is still overwhelmingly in the layer underneath the agents: what they can reach, what they leave behind, and who has to sign for it.