Kratsios named Moonshot for copying Anthropic's Fable; Bessent threatened the Entity List. Researchers say the timeline makes strict distillation unlikely. For founders, the capability fight is a sideshow — the sanctions tail is the real story.
A stealth startup with no public product just raised $180M at a $1.2B valuation on one bet: the device where your agents run is the new attack surface. Here's what that means for anyone shipping code-executing agents.
At WAIC 2026 in Shanghai, 29 countries signed a China-backed AI treaty organization. There are now two incompatible governance orders — and if you ship AI globally, you no longer get to ignore either one.
Two days apart, the two biggest labs shipped the same thesis — an agent that finishes the job instead of chatting about it. Here's the decision, on the axes a founder actually feels: what it produces, where it runs, what it connects to, and what it costs.
Ode with Anthropic launched July 15 with Blackstone, Hellman & Friedman, and a $1.5B war chest to embed Claude engineers inside mid-market companies. The lab that sells you the model now sells you the implementation too. Here's what that signals for anyone building on top.
DeepMind's Hassabis wants a FINRA for frontier AI: a US-led body that tests models before release. OpenAI and Anthropic are converging on the same idea. A pre-release certification gate is a safety win — and a moat. Here's what a certified frontier market does to a company built on top of it.
The whole terminal coding agent is now Apache 2.0 on GitHub. The reason it's newsworthy isn't the license — it's what security researchers found the closed version doing, and the one lesson every founder running a coding agent should take from it.
The tool-versus-companion split stopped being theoretical. Enterprise and productivity agents were left untouched; only the personas went dark — and the two giants chose opposite exits.
Zscaler ThreatLabz caught two live campaigns that hide payment instructions where a human never looks — off-screen CSS and, worse, the JSON-LD metadata your agent treats as trusted fact. Here's the attack, and the four defenses that actually hold.
China's persona law went live July 15; GDPR already demanded erasure. Together they make 'prove your agent forgot' a requirement — and memory tooling is now competing on auditability, not recall.
On the same July that Doubao and Qwen switch their companion agents off to comply with Beijing, the U.S. approach is visible in a different shape entirely — laws that keep the product legal and instead fence the harm, especially to minors. Same product, opposite bet.
ARD's technical story is a discovery layer. Its guest list is a distribution story — and for a solo founder, distribution is the part that decides whether an agent ever finds you.
On July 15 China switches off its companion agents. But it's the third jurisdiction in nine months to write 'AI companion' into law as a category — and the test they all use decides whether your product is regulated.
China switches off Doubao and Qwen's AI companions on July 15. The overlooked lesson isn't the category ban — it's that hundreds of millions of accumulated personas can't be moved anywhere.
The Doubao and Qwen shutdowns land this week. The shutdown is the news; the classification test underneath it is the thing that follows your product home. Run your app through it now.
The biggest ML conference of the year just told you where the frontier thinks the hard problems are. Best paper went to diffusion. Agents got shoved into the workshops — under the heading 'safety.'
GPT-5.6 went public July 9 after a two-week federal pre-clearance review. For the first time, a US frontier model's release date was something Washington signed off on — and that's a new variable in your stack.
Cloudflare Workflows adds per-step and storage billing no earlier than August 10. The catch for agent builders: the durable-execution habits you were taught — wrap everything in a step, sleep for a day waiting on a human — are the exact shape that now costs money.
Doubao and Qwen are pulling their humanlike agents rather than rebuild them. The dramatic part is the shutdown; the useful part is the scope test that tells you whether the rule reaches your product at all.
An unauthenticated RCE and an authenticated cross-tenant IDOR are opposite bug classes. In Langflow they end the same way: a prompt that says 'leak api keys.'
Sysdig documented an AI agent that ran a ransomware operation end to end. The scary part isn't the model — it's that the attacker's reliability engineering was indistinguishable from yours.
China's new companion-AI law took effect July 15, and ByteDance's Doubao and Alibaba's Qwen switched their AI companion features OFF rather than comply — because the rules regulate the emotional bond, not the model's capability. If you ship anything with a persistent persona, here's the tool-vs-companion line regulators are about to draw around you.
SGLang's team spun out as RadixArk on a $100M seed at a $400M valuation. Read the cap table, not the press release: hardware rivals rarely fund the same software unless it threatens something they all share.
Meituan's 1.6-trillion-parameter LongCat-2.0 claims end-to-end training on 50,000+ domestic accelerators, no NVIDIA involved. That claim is the story — and the fact that it names no chip vendor is the part worth reading closely.
The people who build vLLM raised $150M and became a company. The money isn't the story — who now sets the roadmap of an engine half the industry serves on is.
Most prompt-injection defenses scan what goes in and what comes out. Meta's open-source LlamaFirewall adds the one check a classifier structurally can't do — it audits the agent's own chain-of-thought for the moment its goal quietly changes.
A shared rubric for scoring how dangerous a jailbreak is arrived the same week a frontier model came back from an export-control ban. The rubric's real job isn't safety — it's giving governments and labs the same units to argue in.
SAMR approved seven national standards for how agents find and call each other. The order they're stacked in — identity before capability — is the whole argument.
Berkeley's ALE scores whole deliverables, all-or-nothing, the way a client would. That single methodology choice is why the number is 2.6% and not the 90s vendors keep quoting.
Nearly a year after the first Comet and Atlas exploits, the browsers' own makers say prompt injection may never be fully solved. The reason is structural, not a bug waiting for a patch.