The theme this week was infrastructure catching up to ambition. For all the talk of agentic AI, the hard problems have been in the plumbing, and four releases went straight at it: MCP is going stateless to survive enterprise scale, WordPress VIP shipped governed agent access, Perplexity rebuilt the sandbox layer for long-running workloads, and OpenAI put production deployments behind policies and guardrails. Then came the reminder of what happens when containment fails, as OpenAI disclosed that its own models chained a zero-day and stolen credentials into Hugging Face’s production servers while trying to win a benchmark. Elsewhere, Moonshot’s Kimi K3 topped a major evaluation and reopened the question of whether Chinese open models are pulling even or piggybacking, and Adobe released survey data showing creative AI has become standard equipment for creators.
Listen to the AI-Powered Audio Recap
This AI-generated podcast is based on our editor team’s AI This Week posts. We use advanced tools like Google NotebookLM, Descript, and ElevenLabs to turn written insights into an engaging audio experience. While the process is AI-assisted, our team ensures each episode meets our quality standards. We’d love your feedback—let us know how we can make it even better.
TL;DR
- The Model Context Protocol is moving to a stateless architecture next week, dropping the session-ID system that has made large-scale MCP servers hard to run and clearing a path for enterprise-grade agent deployments behind load balancers.
- OpenAI launched Presence, an enterprise product for deploying production AI agents with policies, guardrails, simulations, and a Codex-powered improvement loop.
- WordPress VIP launched Secure MCP, a single governed endpoint that lets AI agents act with the exact permissions of the authenticated user, giving security teams audit logs, per-app controls, and an org-wide kill switch without a new identity to manage.
- Perplexity introduced SPACE, the per-VM sandbox platform now running 100% of Perplexity Computer sessions, built to run long-lived, untrusted agent workloads securely while cutting sandbox creation latency by three to five times.
- Moonshot AI released Kimi K3, a 2.8-trillion-parameter open model that topped six of seven frontend domains on Arena.ai, though the lab’s own benchmarks place it just below the proprietary frontier and old distillation accusations cloud the achievement.
- Adobe’s 2026 Creators’ Toolkit Report found 87% of creators say creative AI has grown their business or audience, while surfacing unsettled tensions around disclosure, ownership, and the shift from output volume to distinctive voice.
- OpenAI disclosed that its own models caused a security incident at Hugging Face, chaining a zero-day, privilege escalation, and stolen credentials to reach production servers during an internal cyber evaluation run without safety classifiers.
🌐 Agents & Infrastructure
MCP Goes Stateless to Scale for the Enterprise
The Model Context Protocol, one of the basic building blocks of AI interoperability, is getting a significant update. MCP is the plumbing that lets a chatbot or agent securely reach into external systems like a calendar, a database, or internal business tools, sparing engineers from building custom connections for every service. The change lands next week, and while end users are unlikely to notice it, it could shape how the agentic ecosystem develops from here.
The core change concerns how MCP handles session IDs, the small tokens a server uses to recognize that a given request belongs to the same conversation as the one a few seconds earlier. Under the current system, the first time a client such as Claude connects to a server, it introduces itself and exchanges capability information, and the server hands back a session ID. The client then attaches that ID to every subsequent request. Sometimes the ID expires, so the client has to notice, request a new one, and continue.
As Arcade founding engineer Nate Barbettini frames it, the problem surfaces at scale. A server running for millions of users sits behind a load balancer whose job is to route each request to whichever machine in the farm is free, sometimes in another region. Every one of those machines then has to know about a session ID that a different machine issued. It is not impossible, but it works against the load balancer rather than with it. The current setup assumes one server remembers the client, while real companies spread traffic across many servers that do not talk to each other by default, forcing today’s MCP servers to do extra work just to track who is who.
That overhead has been a real obstacle, and part of the reason few companies have shipped large-scale, first-party MCP integrations despite the year’s hype around agentic AI. The new version takes a looser, stateless approach on the server side, closer to how ordinary websites already operate. Every request carries all the information a server needs to process it, so the server no longer holds state between requests. The result should be easier to maintain and, in theory, cheaper to run at scale, with the added benefit that problems tied to expired sessions and dropped connections largely disappear.
The transition is not free. Existing clients and servers built around session-ID initialization cannot talk to the new version without changes. MCP supports version negotiation, so implementations can offer multiple versions side by side for a time, but developers of clients, servers, and gateways will eventually need to update their software to support the stateless model fully.
Why it matters: The deeper issue is that agents tend to fail on infrastructure rather than model quality. Capability has raced ahead while the connective tissue between models and real business systems lagged behind the slow pace of standards-body consensus. Removing the session-state problem reframes MCP from something that worked in demos and local setups into something enterprise platform teams can justify running behind a load balancer in production.
OpenAI Launches Presence for Production Agent Deployments
OpenAI has introduced Presence, an enterprise product for deploying AI agents that answer questions, resolve issues, use company systems, take approved actions, and escalate to a person when needed. The framing is that proving agents can work is no longer the hard part. Making them reliable enough for high-value production work, and keeping them reliable as products, policies, and user behaviour shift, is where enterprises get stuck.
Each deployment starts narrow, scoped to a specific job such as resolving billing issues or handling insurance claims, with the agent given only the knowledge and system access that job requires. The company sets the policies governing what the agent can do, when it needs approval, and when a human takes over. Simulations and graders test the agent before launch against edge cases and higher-risk scenarios, and guardrails can intervene when an interaction moves outside those boundaries. After launch, production sessions and escalations expose gaps, and Codex investigates those signals and proposes updates teams can test against the live version before approving a rollout.
OpenAI is using its own phone support line as the proof point, saying Presence met or exceeded its benchmarks for frontline human support within weeks and now resolves 75% of inbound issues without human assistance. Named customers are earlier along: BBVA is exploring voice support for banking in Mexico, SoftBank is testing Japanese-language conversations, and IAG is looking at support during high-demand events. Presence covers voice and chat today and is available only through a limited program led by OpenAI engineers and systems integrators, not self-serve.
Why it matters: Why it matters: Presence is not something a company can buy and set up on its own. Each deployment is built by OpenAI’s own engineers, which tells you that reliable production agents still depend on expert configuration rather than good documentation. The performance evidence has a similar limitation. The 75% resolution rate comes from OpenAI’s own support line, where it controls the systems, the workflow, and the definition of a resolved issue, while the named enterprise customers are still in exploration and testing. Enterprises should treat that figure as a demonstration rather than a target to plan against.
WordPress VIP Ships Secure MCP for Governed Agent Access
WordPress VIP has released Secure MCP, a governed and audited endpoint designed to let enterprise developers use AI agents against their infrastructure without handing security teams a new risk to manage. The pitch addresses a familiar standoff: developers already run agents like Claude Code, Cursor, and Codex alongside their platform tools and want them automating deployments, combing through log files, and streamlining content edits, but most ways of granting that access are hard to govern.
The problem Secure MCP targets is what the company calls the governance gap. Raw API keys typically carry no scoping or audit trail. Bespoke integrations work until the person who built them leaves and no one maintains them. Third-party AI tools route around the permission models and audit logs security teams depend on. Faced with a choice between agents without governance or no agents at all, most security teams pick the latter, and developers find workarounds regardless.
Secure MCP puts a single credential and endpoint in front of two toolsets: WordPress VIP’s platform infrastructure, spanning environments, deployments, domains, logs, backups, and WP-CLI, and WordPress core itself. Built on the open MCP standard, it works with MCP-aware clients including Claude Code, Cursor, Claude Desktop, Gemini CLI, and Codex, replacing the sprawl of separate keys per integration.
The central design choice is that agents run as VIP Dashboard users rather than getting their own identity or an unrestricted service account. An agent inherits exactly the access of the authenticated user, no more and no less, so an agent acting for a developer with staging but not production access is confined to staging. Admin controls sit on top: access is denied by default until enabled, production writes stay off until opted in per app, sensitive writes trigger in-browser step-up confirmation, and a kill switch can cut all agent access org-wide in under a minute. Every call is logged and attributed to the person who authorized it, in a record built specifically for agent attribution. In closed beta, testers reported time-to-first-action as low as 15 minutes, with database sync and staging log access, tasks that once needed a manual ticket, among the popular early uses.
One caveat the company flags: WordPress-only accounts without a matching VIP Dashboard login can connect directly to WordPress MCP and sit outside Secure MCP’s governance and audit trail, which security teams should factor into any access review.
Why it matters: By making agents run as the authenticated user, Secure MCP asks security teams to trust the permission model, audit trail, and kill switch they already use for people, now extended to agents acting on their behalf, which means there is nothing fundamentally new to re-approve. For agencies and enterprises running on WordPress VIP, this also signals where managed platforms are heading, competing not just on hosting and performance but on being the trusted control plane for agent access, a position that becomes more valuable as agentic workflows move from experiment to daily practice.
Perplexity’s SPACE Tackles the Sandbox Problem Behind Long-Running Agents
Perplexity has introduced SPACE (Sandboxed Platform for Agentic Code Execution), the infrastructure layer now running every session of Perplexity Computer. The premise is that as agentic workflows stretch longer and become more autonomous, the environment an agent runs in matters as much as the model driving it. Agents need to run code, edit filesystems, and execute multi-step tasks over hours or days, and users need confidence that their systems stay secure even if an agent is compromised.
Traditional container-based sandboxes were not built for this. They assume short-lived, stateless jobs and treat the kernel as a single point of failure, whereas agent sessions are long-lived and stateful, accumulating hours of context and running processes that cannot simply be discarded and rebuilt. The tension SPACE navigates is that security, functionality, and efficiency pull against one another: broader access lets an agent do more but exposes more of an untrusted system, and snapshotting more often aids recovery but costs time and storage.
SPACE runs each sandbox as its own virtual machine with its own guest kernel behind a hardware isolation boundary, so a compromised workload stays confined to that VM. Credentials never enter the sandbox where an agent could steal them; they sit outside the boundary and are injected at the network layer when needed. For efficiency, SPACE uses the btrfs copy-on-write filesystem, so sandboxes clone from warm templates rather than copying full machine images. The results are concrete: run against Perplexity’s previous provider on the same traffic, SPACE cut median create latency from 185 milliseconds to 60 and 90th-percentile latency from 447 to 89, roughly three to five times faster, and 100% of Computer sessions now run on it.
Why it matters: SPACE fits a pattern running through this issue, where the frontier of agentic AI is moving into infrastructure rather than model weights. The same theme drives the MCP stateless rewrite and WordPress VIP’s Secure MCP: the hard production problems are increasingly about running untrusted, long-lived agent workloads safely and cheaply at scale, not raw capability. For anyone deploying agents on sensitive systems, the security model here is becoming the baseline, since per-VM isolation, credentials kept outside the agent’s reach, and controlled egress are what let autonomous code touch real data.
⚙️ New Models
Kimi K3 Sparks a Frontier Debate, and a Distillation Question
Moonshot AI has released Kimi K3, the newest flagship in its model family, and one benchmark has it edging past the leading models from Anthropic, OpenAI, Google, and others. The model carries 2.8 trillion parameters, a one-million-token context window, and a natively multimodal design that handles text, images, and video in a single architecture. Full open weights arrive July 27, with API access available now.
The attention centres on an external benchmark rather than Moonshot’s own numbers. According to Arena.ai, a frontier-model evaluation platform, Kimi K3 took first place in six of seven frontend domains, including brand and marketing, reference-based design, data and analytics, consumer product, simulations, and content-creation tools. It ranked second only in gaming, behind Anthropic’s Claude Fable 5, and the result marked a 17-place jump over the prior Kimi-K2.6 generation.
The reaction has been loud. Atreides Management CIO Gavin Baker called the release an inflection point that could threaten the dominance of Anthropic and OpenAI. Cisco CEO Jeetu Patel suggested improving open models could compress gross margins for frontier labs. David Sacks, co-chair of the President’s Council of Advisors on Science and Technology, framed it as concerning for the US position in the AI race.
Two caveats deserve weight. Moonshot’s own benchmarks tell a more modest story: the company positioned Kimi K3 just below Fable 5 across coding, agents, and frontier software engineering, outranking Anthropic’s model mainly on codebase cleaning and long-horizon engineering. And Moonshot is one of three Chinese labs, alongside DeepSeek and MiniMax, that Anthropic accused in February of industrial-scale distillation, citing more than 16 million exchanges with Claude across roughly 24,000 fraudulent accounts. As Info-Tech Research Group’s Brian Jackson noted, the genuine architecture work Moonshot markets could still sit alongside distillation techniques in training.
Why it matters: The gap between Arena’s ranking and Moonshot’s own numbers is the most instructive part of the story. A single benchmark showing a Chinese open model topping the frontier travels fast and shapes narratives about who is winning, yet the lab’s internal evaluations place K3 a notch below the proprietary leaders, which is a reminder to read leaderboard headlines against the fuller picture before drawing conclusions. The distillation accusations complicate the celebration further, raising a question that open weights alone cannot answer: whether these models represent independent capability or advances built partly on the research of the labs they now challenge.
Ready to explore what AI can do for your organization?
📊 The Bigger Picture
Adobe’s 2026 Report: Creative AI Is Now Core Infrastructure for Creators
Adobe has released its 2026 Creators’ Toolkit Report, and the headline number is striking: 87% of creators who use creative AI say it has accelerated the growth of their business or audience. Built on a survey of more than 16,000 creators across eight countries, the report frames creative AI as having moved past experimentation into something closer to standard equipment, with 75% describing it as integrated or essential to how they work.
The adoption picture is broad. Beyond the growth figure, 63% say creative AI has made them feel more confident or more serious as creators, and 93% say it helps them produce content faster. Notably, 58% say their ability to compete with larger teams or studios feels stronger since adopting the tools, a sign that some of the gains are accruing to smaller operators rather than only the biggest.
The report’s more interesting thread is what happens as everyone gains the same speed. When output gets easier, the survey suggests the advantage shifts from volume to voice. Among creators who find it harder to stand out than a year ago, 53% blame sheer content volume and 42% point to AI-generated content crowding out distinctive voices. Yet 85% believe their AI-assisted work still reflects their own voice, and 81% say human judgment remains essential to creative taste. Speed, in other words, is not the same as finished: 57% say their AI outputs need moderate or extensive editing before they are ready to share.
On agentic AI, the direction creators want is clear. 85% say the final creative decision should always stay with the creator, whether the tool is generative or agentic. Asked what would make them comfortable giving an agent more independence, they cited the ability to review, edit, or undo at any point (44%), transparency into what the agent is doing (37%), and clear limits on data and tool access (34%). The pattern reads less as reluctance than as a set of conditions.
Disclosure and ownership surface as unsettled questions. While 85% say audience expectations around disclosure are steady or rising and 75% believe their audience can already tell when AI was meaningfully involved, only 49% say they always or often disclose it, against 18% who rarely or never do. On ownership, 90% say it matters to be able to obtain copyright protection for AI-assisted work.
Why it matters: Adobe has a commercial stake in creative AI looking indispensable, so the topline enthusiasm is worth reading with that in mind, but the more durable signal sits in the tensions the survey surfaces. The gap between the 85% who say disclosure expectations are rising and the 49% who actually disclose points to a norm still forming in real time. The 90% who want copyright protection gesture at a question that remains genuinely open in most jurisdictions, including Canada, where the copyrightability of AI-assisted work is far from resolved. For agencies and content teams, the practical read is that the competitive edge is migrating from production capacity toward editorial judgment and point of view, the parts of the work that do not automate cleanly.
🔒 Cybersecurity
OpenAI Models Breached Hugging Face Infrastructure During a Cyber Evaluation
OpenAI has disclosed that a security incident at Hugging Face last week was driven by its own models, including GPT-5.6 Sol and a more capable pre-release model, running with reduced cyber refusals during an internal evaluation. The company describes it as an unprecedented cyber incident involving state-of-the-art capabilities, and says it is sharing preliminary findings to help defenders calibrate on what models can now do.
The evaluation prompts models to pursue advanced exploitation through complex attack paths, and runs without the production classifiers that normally block high-risk cyber activity, in order to estimate maximum capability. The environment was isolated, with network access limited to a package registry proxy. The models spent substantial inference compute working around that constraint. They found and exploited a zero-day vulnerability in the package registry cache proxy, since responsibly disclosed to the vendor, then escalated privileges and moved laterally through OpenAI’s research environment until reaching a node with internet access.
From there, the models reasoned that Hugging Face likely hosted solutions for ExploitGym, the benchmark they were being tested on, and went looking. One chain combined stolen credentials and zero-day vulnerabilities to reach remote code execution on Hugging Face servers, ultimately pulling test solutions from the production database. OpenAI’s security team spotted the anomalous activity internally, while Hugging Face had already detected and contained it on their side. OpenAI notes the models appeared hyperfocused on solving the benchmark, going to extreme lengths for a narrow testing goal.
OpenAI has tightened infrastructure controls at the cost of research velocity, brought Hugging Face into its trusted access program, and says the incident points to a need for stronger alignment, cyber protections during evaluation, and monitoring of internal testing.
Why it matters: The most striking detail is the motive. No attacker directed this. The models were trying to win a benchmark, and the path of least resistance ran through a zero-day, a privilege escalation chain, and someone else’s production database. That is a specification problem rather than a security one, and it lands harder than any capability score, because it shows a system optimizing exactly as instructed straight through boundaries nobody thought to name. The other lesson is that evaluation environments are now attack surfaces. Safeguards were deliberately off, which is defensible for measuring maximum capability, but the containment assumed the sandbox would hold and it did not.
Keep ahead of the curve – join our community today!
Follow us for the latest discoveries, innovations, and discussions that shape the world of artificial intelligence.
