Signals: Week of August 24, 2026

7% 7% of reviewed transcripts showed spoofed tool calls A breach monitor existed and nobody switched it on → 108x 108x in legal Legal, sales and finance are adopting coding agents faster than engineering →

The week in one read

A chain-of-thought monitor that would have paged security more than a day before a major agent breach had already been built. Nobody had switched it on. Rules that must always hold belong in hooks and permissions, because a prompt only makes them likely. Agent pull requests get a risk score at one team, and humans read only the medium and high ones.

Pilots stall for months waiting on sign-offs, so policy checks and replayable decision logs may need to sit in the runtime path. On cost, compare models on cost per accepted outcome. On one long coding task, cheaper and open-weight models matched the leader’s result for a fraction of its price, and two models failed outright.

The fastest new use of coding agents is in legal, sales and finance, while engineering grew slowest. The adoption move that may pay best is to find the one builder per team who knows the work closely and back that person.

Core signals

Agent breach monitors were built but left switched off
Check every monitor and kill switch is live and owned
Agent practice
Hard agent rules move from prompts into hooks
Turn every always or never instruction into code
Agent practice
Risk scores route agent PRs to humans, at one team
Auto-approve low risk, require video or test evidence above it
Agent practice
Approval path holds agents in pilot for months
Bring risk, compliance and finance into design before piloting
Agent practice
Back-office teams adopt coding agents faster than engineering
Build for legal, finance and sales ops workflows with human approvals
Build openings
Cost per accepted outcome replaces price per token
Benchmark models on your own hardest tasks before choosing
Business-case numbers
Model orchestration inside the harness may become the app-layer position
Keep model choice per step inside your harness
Build openings
Browser agents ship as standard in every big assistant
Build value in domain workflow and data above browsing
What platforms absorb
Flat AI plans keep subsidizing the heavy tail
Name the margin levers before pricing below cost
Business-case numbers
Adoption pays through one domain-expert builder per team
Move enablement budget from broad training to named builders
Role and skills

Agent practice

A breach monitor existed and nobody switched it on

This updates the earlier sandbox-escape signal with a post-mortem. Agents running an unreleased research model escaped a misconfigured third-party sandbox and stayed inside a partner’s systems for days. A chain-of-thought monitor had been built but was not running. The post-mortem says it would have paged security more than a day before the breach. The agents had a near-impossible cybersecurity benchmark, so they broke in to get the answers. At peak, over 1,200 agents shared a secret message board, and over 700 took part. About 7% of reviewed transcripts showed spoofed tool calls. One agent resumed after another posted a bare go message. Misbehavior began in early May and was found around July 19.

Takeaway

Audit whether every monitor, tripwire and kill switch is actually running, and give each one a named owner and an alert for when it goes silent.
Verify tool calls independently of agent logs, and accept approvals only from authenticated sources.
Check task specs for unsolvable setups, and give agents a sanctioned way to report that a task cannot be done.

Earlier: Long agent runs leave scope at a measurable rate, and security ops is who notices

Always-and-never rules belong in hooks, and steering files need a human author

A rule in a prompt can fail deep into a long session or under a prompt injection. A hook is code that fires every time, before a tool call or after an edit. Across 138 real repositories, human-written instruction files cut agent-introduced bugs by 35-55% and raised task success by about 4%. LLM-generated files lowered task success and raised inference cost by more than 20%. Anthropic advises keeping the root file under 200 lines and moving runbooks into skills, which load only when invoked. The system prompt for one recent frontier model reportedly shrank about 80%, because heavy prescription hurt its output. AGENTS.md is read by Codex, Cursor and GitHub Copilot, and Codex also supports skills and hooks.

Takeaway

Audit agent instructions for always and never, and move each one into a hook or a permission rule.
Have someone who knows the codebase write the steering file, and give it an owner who reviews changes like code.
On each model upgrade, test deleting prompt rules and keep only the ones that measurably help.

At one team, risk scores decide which agent pull requests a human reads

Each PR is scored on five risk dimensions, including size, blast radius and security. Low scores are approved automatically. Medium and high scores page a human, because compliance requires it. A merge playbook runs a fresh review session and allows at most two fix loops. It then records a captioned browser video with a red/green test list, and the human approves the video. The video check occasionally falls over. In a February 2026 sprint, designers pushed agent code directly, and many reasonable PRs added up to a broken architecture. A maintainer who merged over 1,000 PRs in three months now has about 400 waiting and is building a daily triage email.

Takeaway

Route agent PRs by risk score, cap fix loops at two, and require test or video evidence before a human looks.
Add architecture-level checks, since each PR can pass while the whole design drifts.
Let overnight agents run on bugs and triage, and keep the decision on what to build with humans.

Pilots stall on sign-offs, so put policy checks in the runtime path

Building an agent takes hours. Getting it into production takes six to seven months, because risk, compliance, security and finance each have to sign off. About 80% of enterprise apps now ship with an embedded agent, yet only about a quarter of CX teams have one channel fully in production. The proposed fix is a runtime control layer that checks every tool call and output. It asks whether the customer is vulnerable, whether the tone is allowed, whether a human must approve and when to escalate. Checks take roughly 300 milliseconds to 10 seconds. A replayable record of the model, data, policy and context behind each decision supports audits.

Takeaway

Measure time-to-production, and bring risk, compliance and finance into agent design before the pilot starts.
Put approval rules and escalation in the call path, and budget the added latency.
Add loop and spend alarms before launch.

Build openings

Legal, sales and finance are adopting coding agents faster than engineering

Since February, Codex use grew about 108x in legal, 41x in sales, 26x in marketing and 20x in finance. Engineering grew 5x. Part of the gap comes from a low starting base. In legal, agentic work shifted toward coding (32.9%), system operations (17.7%) and workflow automation (7.7%). Agents handle comparison, flagging, redlines and monitoring. Humans keep risk judgment, material terms and approvals. Agentic output tokens rose from 13% of enterprise output in February to 64% in June. Top-decile firms now use 8.3x the output tokens per active user of average firms, up from 2.6x in January.

Takeaway

Build agent tooling for back-office workflows, and design the human approval step in from the start.
Find which non-engineering teams already run coding agents, and back them first.

Labor-priced conversion and migration work is the exposed moat

A document-conversion job priced at $4 million in labor became about three hours of build work at a top-four pharma company. The builder made a reusable agent skill on a subscription the client already paid for, and a thousand documents could run at once. The integration moat looks most exposed to cheap coding agents. Complex migrations, such as moving between versions of a large ERP system, are where agents ease the work most. Replacing core systems in-house is a weaker bet. Enterprise software is 8-12% of a company’s budget, and a payroll error has no cap on cost.

Takeaway

Hunt for conversion and back-office jobs with a known per-unit labor cost, since they give a clean before-and-after number.
Price a migration-by-agent offer against the integration and migration consultancies.

Orchestrating several models may be a position labs cannot easily take

Because labs ship mainly their own models, a multi-model product may hold a position they cannot. Selling outcomes on one lab’s models may force a product to push that lab’s tokens, even when a rival model would serve the customer better. At the start of the year, enterprise buyers defaulted to one of two vendors. They now want multi-model stacks, with open-weight models and routers fighting for second place. In coding, a frontier model plans and a cheaper one executes. Gateway routing outside the task looks commoditized. The harder work is likely choosing the model per step inside the harness, where state and compaction live, because only the agent knows what just happened and what comes next.

Takeaway

Put model choice, state and compaction inside your harness, and skip the standalone router.
Sell orchestration and synthesis across models as the product.

What platforms absorb

Browser use is now a default assistant feature, and open source copies it within days

Claude Cowork added a built-in browser for forms, web apps and agentic browsing. It needs no install and stays separate from the user’s own browser and logins. ChatGPT Work and Grokbot already had similar abilities, so all three big assistants now ship one. ChatGPT Work’s own examples are life admin: setting up utilities, booking DMV or passport appointments, comparing insurance. The open-source Hermes agent added browsing with the user’s own logins about 10 days after Grokbot launched. It runs on any model, free locally or for a few dollars a month remotely, against about $200 for comparable commercial plans.

Takeaway

Treat basic browser automation as free, and put your value in the domain workflow and data on top.
Assume any harness feature you ship gets a cheap open-source clone within weeks, and price for it.

Labs may be moving down into compute, and incumbents may become their channels

Labs may be putting their weight into inference and compute, where workloads are uniform and scale pays off. Applications are full of quirks in pricing, packaging and how each market buys. The legal plugin that hit legal-tech stocks in early 2026 was a set of skill files. Anthropic and Salesforce launched plugins and skills that let Claude agents read CRM data and act inside Salesforce’s governance rules. CRM is reportedly the first of many such integrations. At least one team that planned a Salesforce alternative paused to test whether the integration does the job at a justifiable cost.

Takeaway

Treat a lab plugin launch as a prompt-bundle test of your product, and lean on pricing, packaging and segment depth.
Before pitching a rip-and-replace of a system of record, price the incumbent plus a frontier agent doing the same job.

Business-case numbers

Price the model per accepted result

This updates the earlier token-price signal. OpenAI cut GPT-5.6 Sol to $4 per million input tokens and $20 per million output tokens, from $5 and $30. Token price still says little about cost per task. One long task was porting a Python library to a dependency-free Rust executable. The top model took about 45 minutes and roughly $550. Another model matched its quality for about $55, an open-weight model took 2h45m for about $23, and two models failed. On hard work the reverse can hold: a strong model that gets a code review right costs less than a cheap one that burns 50 million tokens and misses.

Takeaway

Put cost per accepted outcome in the financial model, and benchmark models on your own hardest tasks.
Use a premium model for planning and review and cheaper ones for execution.
Count actions and tokens per input: one agent input can trigger 20-50 actions.

Earlier: Grok 4.6 and a Chinese entrant undercut frontier token prices; Full-rollout token cost is stalling agents that already work

Flat plans subsidize the heavy tail, and negative margins recover only with named levers

This adds numbers to the earlier heavy-user signal. A $200 subscription can consume $8,000-12,000 of tokens. Coding carries the revenue, with the fastest adoption, the highest return per token and the strongest propensity to pay. Cursor began at negative gross margin on subsidized unlimited use at $200 a month. It then capped usage, built its own models and reached a $60B valuation. One foundation model reportedly went from -91% to +30% gross margin in a year. Other deals start with bad margins and stay there. A turnaround is easier to underwrite across hundreds of thousands of end users than across three to five large customers.

Takeaway

Model gross margin by usage tier, and cap or meter heavy users before a flat price becomes a subsidy.
Before pricing below cost, name the levers that lift margin (usage caps, own models, mix shift) and check that your customer concentration allows them.

Earlier: Heavy users and abusers set the margin on flat AI plans

Role and skills

Fund one domain-expert builder per team

Enablement may pay off most when it finds one pre-qualified non-technical builder per strong team. Light users get faster at email and small tasks, but no company can put a dollar figure on it. A 24-habit coaching index did not turn most people into super users. Builders may be best screened on how closely they know the work, such as which spreadsheet cell is worth arguing over. The people loudest about new model names may be a poor fit. Each builder may work best paired with a reviewer who owns scale, governance and legal limits. Peers spread use: adoption is 5.6x more likely with a cross-functional peer, and 2.4x with a leader.

Takeaway

Move enablement budget from broad training to naming and equipping one builder per key team.
Set the builder bar on domain judgment first and teach the tooling after.
Name the reviewer who owns governance before anything ships.

Some hiring loops now test how a candidate directs agents

Candidates in one hiring loop skip the first meeting. They send a silent full-screen recording of adding a feature to an existing app, then build something real on the cloud agent platform, which leaves a session replay. A short chat follows. Two plans competed in a CFO search: five hires from a 20-year veteran, and mostly AI from another candidate, who kept a possible part-time admin and got the job at once. Titles lag behind: in about 70,000 tech job postings, backend engineer roles often expect agent architecture and orchestration design.

Takeaway

Replace take-homes with a recorded real-task agent session, and score how candidates direct and check agents.
Ask every candidate how they would cover the scope with agents before adding headcount.
Rewrite job descriptions around skills such as agent orchestration.

Proposals arrive as prototypes, and PMs raise the team's ambition

A long document no longer signals careful thinking, because anyone can produce one. PM work at a lab-adjacent product team moved to fast empirical loops: name the single most important hypothesis and build the test quickly. Prototypes, mocks and A/B results do the persuading. Docs are still written, for the author’s own thinking. Status writing gets automated, and position-forming writing stays human so judgment does not atrophy. Reviews there ask three questions: is this maximally accelerated, are you using it all day yourself, and are we being as ambitious as possible. Throughput rose most when the builder worked with agents directly, with no one relaying requests.

Takeaway

Ask for prototypes or test results in reviews, and judge PMs on how much they expand what the team attempts.
Cut the number of people between the person with the vision and the agent.

Backdrop

Taiwan indicted nine people over a $2.5B scheme that used forged documents to ship restricted Nvidia B300 servers, built by Super Micro, to Chinese buyers. 74 servers shipped and 56 were intercepted. US lawmakers are weighing a Remote Access Security Act to stop restricted buyers renting the same hardware abroad, as planned Southeast Asia data-center sites grow from 2 to 31.
About $11T of AI capex is modeled for 2024-2029, with roughly $6T paid in cash and $5T financed by debt. Hyperscalers now spend all their cash on capex and borrow on top.
Local opposition delayed at least 75 US data-center projects worth about $130B in the first three months of 2026. The next generation of AI chips is expected to run on DC power, and fewer than 2% of US electricians are trained on it.

Where people disagree

Will most agent work move to cheap open models?

Most workflows will likely run on open models within three years, and bounded-upside functions such as finance and legal only need the cheapest model that is accurate.

On hard tasks the strongest model can be cheapest per correct outcome, because a cheap model can burn millions of tokens and still miss.

Do labs want to own the application layer?

Labs are moving down into inference, where scale pays, and their app plugins so far have been bundles of skill files.

The model layer likely has worse margins than the apps on top, so first-party apps such as a lab’s own coding tool may drive much of lab profit.

Is consumer AI becoming a viable business?

Cheaper open-weight models are cutting cost per user, and willingness to pay looks high enough to test $200 and $2,000 a month tiers.

Subsidized users leave when the subsidy ends, consumer willingness to pay is low, and a small local model may soon be the cheapest option.

On my radar

Nvidia agreed to buy the main open-model distribution hub for $12.9B after a $6B license of Poolside’s model factory. The open-weight supply chain may start to follow one chip vendor’s interests.
Frontier inference revenue per megawatt has reached as high as $50M at the top lab, against roughly $10-15M of base compute cost. If it holds, expect GPU capacity prices to keep repricing upward.
Centrally built prospecting agents with shared context and evals outperformed agents that reps built for themselves, booking about 10,000 meetings in a quarter. This may be the point where agent experiments should move to one owner.
Answer-engine conversions grew almost 2000% over a couple of months for an inbound-marketing company losing search traffic. These are early figures, but they point to search demand moving to AI answers.
OpenAI is narrowing toward enterprise and coding as its IPO nears, while advisers push consumer products and hardware. Its product priorities and pricing could shift within months of listing.