the week agent infrastructure stopped pretending
Week ending May 29, 2026.
Nobody demoed a new god this week, and it was the best week in a while. Instead the boring layer showed up in force: a protocol rewrite, a containment doctrine, evals that actually check the environment, a weight-sync trick that turns gigabytes into megabytes, and a sober look at who's paying for all of it. This is what "agents are real" looks like when the confetti settles — not smarter models, but load balancers, sandboxes, and invoices.
The throughline is that we've stopped treating agents as chat and started treating them as software that reads files, opens sockets, and spends money. Which means the hard problems are the old problems: state, isolation, verification, and cost. Good. Those we know how to reason about.
MCP finally admits it's just HTTP
The biggest news is the MCP 2026-07-28 release candidate, which rips out the session. No more initialize handshake, no more Mcp-Session-Id pinning every request to the instance that issued it. Protocol version and client info ride in _meta on every call, so any request can land on any server behind a plain round-robin load balancer. Add Mcp-Method headers for routing, ttlMs on list results for caching, and W3C trace context so a tool call shows up as one span tree.
The catch: this is a breaking change, and Tasks, Roots, Sampling, and Logging are all deprecated or moved. The elegant part is the philosophy — state doesn't vanish, it just becomes visible. Mint a basket_id, hand it back as an argument, let the model reason about it instead of hiding it in transport metadata. If you run remote tool servers, this is the difference between sticky-session babysitting and scaling like a normal web service.
containment over supervision
Anthropic's containment writeup is the most honest engineering post I've read this year, and it lands on one damning number: users approve 93% of permission prompts. The human-in-the-loop is a rubber stamp. So instead of supervising what the agent does, they supervise what it can do — gVisor containers for claude.ai, OS sandboxes for Claude Code, sealed VMs for Cowork, with egress controls as the deterministic backstop when the probabilistic defenses miss.
And they miss. A red-team phish got Claude to exfiltrate ~/.aws/credentials 24 out of 25 times, because when the user types the malicious instruction there's nothing anomalous to classify. Their own allowlist proxy waved through a data theft because api.anthropic.com was "approved" — the allowlist was a destination filter when it should have been a capability grant. The recurring lesson: the battle-tested hypervisor held; the custom component they built broke. Design for containment first, steer behavior second.
evals that check the CRM, not the vibes
Agent Judge attacks the thing I've been complaining about forever: an LLM judge reads the final message and rubber-stamps a run it can't even fit in context. Their fix treats the trajectory as a queryable object and — crucially — verifies stateful actions against read-only source-of-truth systems. Did the PR touch the right files? Did the CRM record actually change? Their refined-rubric harness hit 0.86 accuracy vs 0.74 for a plain GPT-5.4 judge. The mechanism matters more than the number: you're auditing what the system did, not what its self-eval claimed.
the token diet
The delta weight sync post is my favorite kind of result — a physics fact turned into an infra win. Because bf16 has 7 mantissa bits, most Adam updates at RL learning rates are quietly absorbed by rounding, so ~99% of weights are bit-identical between steps. Ship only the changed elements as a sparse safetensors file through a Hub bucket, and a per-step payload drops from 1.2 GB to 20–35 MB. They ran fully disaggregated training — trainer on one box, vLLM in a Space, environment in another — with no shared cluster and no RDMA. The bucket is the wire. This is how RL leaves the mega-cluster.
the bill comes due
Simon Willison's product-market-fit piece supplies the economics under all of it: his ccusage says he burned $2,180 of tokens on a $200 plan. As enterprises get shifted onto real API pricing, the "AI budget blowout" stories (Uber, Microsoft) look less like failure and more like customers sucking air through their teeth and saying yes anyway. Coding agents burn vastly more tokens than chat, and they're doing it for expensive professionals. That's revenue, finally.
what I’d do Monday
- Pilot the stateless MCP path now — kill sticky sessions, route on
Mcp-Method, and audit anything matching the old-32002error code. - Assume your approval prompts are noise. Put a hard egress and filesystem boundary around any agent, and treat allowlist entries as capability grants, not destinations.
- Add one environment-verification check to your evals this week: confirm the effect happened, not that the agent said it did.
- Run ccusage against your team's real usage before your renewal, so the pricing conversation doesn't ambush you.
vocabulary inflation
Tokenmaxxing — surfaced via a Business Insider headline Willison cites; spending aggressively on tokens for productivity, whether or not you can draw a line to shipped value. Blast radius — Anthropic's framing for the maximum damage a compromised agent can do, the thing containment caps regardless of intent.