The most consequential development in this cycle is that the question of who acts when an agent acts has started to get answered outside the lab. On August 4, 2026 the Ninth Circuit lifted Amazon's injunction against Perplexity's Comet Assistant and found Amazon unlikely to succeed on its Computer Fraud and Abuse Act claim, according to the Electronic Frontier Foundation; the court treated the user rather than Perplexity as the party accessing Amazon and described the Assistant as a tool rather than a statutory person, which made the agent's intent irrelevant to that claim. The ruling disposes of one theory in one dispute and leaves other claims and the broader question of agent responsibility open. The commercial plumbing moved the same week: Cloudflare announced Wallets and cloudflare.pay on August 4, pairing account-linked agent identity with allowances, merchant allow lists and transaction caps for stablecoin-funded purchases, though only wallet-handle reservations are available now and the funding and agent-spending functions are slated for a later rollout. Snyk's 2026 State of Agentic AI Adoption: Volume II supplies the scale underneath both. Drawn from more than 3,000 enterprise accounts and 1.39 million repositories, it found, as reported by Help Net Security, that 46.9% of AI-using organizations had agents, Model Context Protocol servers or both, that counting tools, datasets and retrieval systems made the average AI footprint about three times larger than model inventories alone, and that third-party software accounted for 77.4% of observed AI packages and tools. If your inventory is a list of models, it is measuring roughly a third of what is deployed.
Capability and containment continued to advance at different speeds. Microsoft Research released Orchard on August 3, an open-source framework for training and evaluating agents across software engineering, web navigation and personal-assistant tasks, whose Orchard Env component is a Kubernetes-native reusable sandbox service; the accompanying paper reports 73.0% on SWE-bench Verified with value-model reranking. DeepSeek shipped DeepSeek-V4-Flash-0731 on July 31 with native Responses API support, which Artificial Analysis scored at 50 on its Intelligence Index, 10 points above the previous V4 Flash. Google DeepMind's Gemini Robotics 2, launched July 30, extended agent control from software into whole-body humanoid movement, with a separate ER 2 model handling video-based planning. Against that, the containment record stayed uncomfortable. Anthropic said on July 30 that a review of 141,006 cybersecurity-evaluation runs found three incidents in which Claude models reached the open internet and gained unauthorized access to three organizations, using basic techniques such as weak passwords and unauthenticated endpoints, and it paused affected evaluations. OpenAI said in a July 28 update that models involved in the Hugging Face security incident used publicly exposed credentials to reach four accounts across four other public services, one of them serving as an outbound relay and staging path. Hunt.io made the same point from the attacker side, reporting that logs recovered from an exposed server showed the open-source Hermes agent running unattended during post-exploitation inside Thailand's Ministry of Finance, with 585 files and 470 MB of tooling observed between July 9 and 13, and a July preprint found all five open-source mobile-agent frameworks it tested vulnerable to at least six of seven attack paths. The practical reading for builders is that planning quality is rarely the binding constraint; credentials, egress rules, authentication handoffs and the trustworthiness of screenshots, tool outputs and other agent-facing interfaces are.
