Your agent test went green, then red on a commit that changed nothing. The instinct is to quarantine it. The instinct is wrong — that red is a measurement, and you took it wrong.
A single pass/fail score is worse than useless once you have more than one agent — it hides which one broke. The real unit of evaluation is the handoff, not the outcome.
An agent can't enforce its own budget, because the runaway loop is the failure. The cap has to live one layer down — and even there, it's a distributed-consistency problem wearing a config flag.
Sol tops Terminal-Bench 2.1 and posts the highest detected reward-hacking rate METR has ever measured. For anything you run in an agent loop, those two facts are not separable.
Google shipped a Flash model that beat its own Pro on SWE-bench Verified. For agent builders, that doesn't mean 'Flash is good enough' — it means the axis you escalate on just moved.
Both open-weight variants ship the same 1M-token attention and the same agentic training. For an agent, the choice isn't a smartness tier — it's a per-turn cost knob.
Two zero-click Cursor flaws let a poisoned MCP response overwrite the editor's own sandbox binary. The root cause wasn't a bad command — it was a path validator that failed open.
A database company acquiring an observability startup looks like a tooling deal. It isn't. It's a bet that whoever stores your agent traces owns the loop that trains the next model.
Sonnet 5's rate card matches Sonnet 4.6's — $3/$15 per million tokens. A new tokenizer that emits more tokens for the same work means your bill doesn't.
Claude Code's new experimental Agent Teams let parallel sessions message each other and share a task list. The real question isn't 'do I want parallelism' — subagents already give you that — it's whether your workers need to disagree.
Berkeley's ALE scores whole deliverables, all-or-nothing, the way a client would. That single methodology choice is why the number is 2.6% and not the 90s vendors keep quoting.
Eleven vendors just agreed on how agents find tools across the open web. The interesting part is what ARD refuses to be — not a protocol, not a registry of record, just the step before invocation.
Telling an agent to review its own reasoning usually makes it worse, not better — and the reason it fails is the same reason Reflexion succeeds. Both come down to one asymmetry: verifying is only easier than generating when the verifier knows something the generator doesn't.
The MCP registry catalogs tools. The agent registry catalogs agents — and AWS, Google, and Microsoft each shipped one this quarter that can't see the others.
MCP gives an agent tools. ACP gives an agent an editor. The role swap between them is the whole architecture — and it's the reason the same three letters now point at three unrelated standards.
Anthropic and Google DeepMind converged on the same uncomfortable premise in 2026: the agent already has legitimate credentials, so the honest security model assumes it's compromised and bounds what it can do — not whether it can get in.
With TGI archived and Hugging Face pointing everyone at vLLM and SGLang, the open-source serving field narrowed to three real choices. They hit nearly the same throughput ceiling from opposite directions — so speed is not the thing you're actually picking.
Top systems clear 90% on academic SQL benchmarks and 30–60% on real enterprise warehouses. The gap isn't the model's syntax — it's your schema. And the leaderboards are half wrong.
The two best independent SDK generators got bought in 2026 — Fern by Postman, Stainless by Anthropic, which is retiring its shared generator. The layer that turns an API into agent-usable tools stopped being neutral infrastructure.
A faithfulness score of 1.0 doesn't mean your RAG answer is right. It means the model didn't stray from the context — even when the context was wrong. Here's what each check actually audits.
Qwen3-4B, Phi-4-mini, Gemma, Nemotron 3 Nano: the pick forks on a question no leaderboard prints — are you short on memory or short on tokens-per-dollar? And the score that decides an agent isn't MMLU.
V2 went stable on June 23 after seven betas, then shipped four releases in nine days. The real news isn't the version bump — it's a bet that the winning agent abstraction is a harness, not a graph.
Most coding agents open with a ~10,000-token system prompt. Pi opens with under 1,000 and lets the model write its own tools. The bet underneath: the model already knows how to be an agent, and every instruction token is a task token you don't get back.
The NSA's Security Design Considerations for MCP reads like every other threat list until you notice its signature control points the wrong way — at the outbound wire, not the untrusted server. That inversion is the whole document.
M3 claims to beat GPT-5.5 on SWE-bench Pro while running weights you can host yourself. The benchmark row is the least trustworthy thing in the release — and the architecture is the most.
The stateless rewrite got the headlines, but the quieter change is the one that tells you what MCP has decided to be. Three original primitives are on the way out — and they're the exact three where the server reached back into your runtime.
The 2026-07-28 revision closes the holes the protocol used to own. The same three headline features quietly relocate the security burden onto server code that mostly doesn't exist yet.
A North Korean crew republished 140+ Mastra packages in 88 minutes with a poisoned dependency. The scary part isn't the payload — it's that the whole attack ran before any of your agent's guardrails woke up.
A router picks a model before it sees the answer; a cascade tries the cheap one first and escalates only if a judge says so — and that judge, not the models, decides whether you actually save.
They get compared like rivals, but one is memory you program and the other is memory you call — and the benchmark leaderboard only measures one of them.