Weekly AI Wrap | August 24 to 30, 2026: Context, Contamination, Cancellation, Control

TL;DR

A researcher changed nothing about the model and improved a coding agent’s success rate by 21 points, just by changing what the surrounding software does with old tool output. Two other results the same week point the same direction: the wrapper around the model is doing more work than the model, and no vendor publishes theirs.
Two studies found that widely used AI scores are contaminated. Putting a prior score in an AI grader’s prompt blocks roughly half the corrections a review loop exists to make. Three commercial answer engines with near-identical accuracy differ sixfold in how often they invent an answer they cannot support.
OpenAI told SpaceX it will cut off the models behind Cursor on November 12. Cursor did nothing wrong. It was acquired, and the contract had a change-of-control cancellation window. Same day, Sony Music Publishing and Warner Chappell sued Anthropic and named Dario Amodei and Benjamin Mann personally.
Three vendors with no shared incentive triangulated the same market: roughly a dozen agents per company, most of them touching live business data, about one in three governed like an employee.

Context: the wrapper is doing more work than the model

Start with the cleanest experiment of the week, because it is the one anybody can picture.

Sydney Lewis took 169 real software-engineering tasks from SWE-bench Verified and ran an agent over them twice. Same model weights both times. Same 20,480-token working memory. Same 480-second cap per task. One variable changed: what the harness does with old tool output as the window fills. The control fed the agent the full conversation in time order. The treatment mechanically shortened stale tool results and reacted when the agent repeated or stalled on work.

Mean per-task fail-to-pass went from 28% to 49%. Complete solutions went from 43 to 72.

That is roughly the size of a generation upgrade, purchased with a truncation policy. And it lands a point worth sitting with: every agent benchmark in circulation is a joint measurement of a model and an undisclosed context policy. When a vendor tells you their agent scores X, you are being told about two things and shown one.

The same week gave the architectural version and the miniature version.

The architectural version. A senior software development manager at Amazon, publishing as Rashi, described pulling context handling out of individual agents and into a shared layer beneath all of them. The trigger was mundane: a routine data-question agent made nine model calls, and “by call six, most of what we were sending to the model was history the model no longer needed.” The design forecasts a token budget per task class before the run, then fits to it in four ordered stages: select, rerank, cluster, compress. Result: roughly three quarters of input tokens per call removed, “with no change to the agent’s logic and no change to its answers.”

The ordering is the transferable lesson, and it is counterintuitive in two places. Compression runs last, because “summarizing something you were about to throw away is wasted effort.” And clustering, the deduplication step, “consistently reclaimed more budget than I expected,” because “redundancy in agent context is not an occasional accident, it is the default state.” Every stage logs what it dropped and why, which is a governance artifact arriving as a side effect of a cost project.

The miniature version. Claude Code v2.1.248 cut one Workflow tool description from about 5,700 tokens to about 1,000, by moving reference material out of the description and behind a skill boundary. The mechanism generalizes past Anthropic: a tool description is unconditional context, paid on every single turn whether the tool fires or not. Reference material is conditional, needed only when it does. Splitting the two is textbook token-budget allocation, and here it is shipped by a vendor with the before and after published.

Two more results the same week extended the lane in directions worth naming.

Feng, Zhang, Yang and Xie built SCALE-QA on flat, unsegmented conversation threads and found that segmenting the history into episodes was worth 5.6 to 17.6 accuracy points in every backend tested. A 1M-token window made the confusion worse, not better, which is the cleanest available rebuttal to “just wait for bigger context.”

And Kazuki Nakayashiki isolated a failure that similarity search structurally cannot fix. He gave agents a memory containing a constraint that was true when written and has since been superseded, plus a fixed budget of exactly two records they were allowed to verify. Agents spent that budget on the wrong records about four times in five, producing decisions consistent with the stale record in 77.3%, 74.7% and 74.7% of episodes across three runs. Forcibly reassigning one of the two slots to the provenance path recovered +74.0, +72.7 and +61.3 points, positive in six of six models. Same budget, no bigger window, no better model.

His closing line is the thesis: “Memory systems may need freshness or supersession signals separate from relevance.” The reason this is structural rather than incidental: a withdrawn policy is topically perfect for the question that asks about it. Similarity ranking will surface it first, correctly, forever. Relevance and currency are two different scores and almost every production retrieval stack computes one.

Disclosure, stated once and applying throughout: I am co-founder and CTO of Next Moca, which builds an agent control plane, and our internal context-selection component (Needlepath) sits directly in the lane described above. I have tried to argue the throughline on the week’s evidence rather than on the product. Where I think the evidence is thin, I say so.

Contamination: the scores are measuring something other than what they claim

Two independent results this week say the same thing about AI measurement, and the contaminant in both cases is context the measurer could not un-see.

Anchoring in the judge. Kapetanovic, Altwlkany, Mercep, Duricic and Lacic (CIKM ‘26) tested LLM-as-a-judge under three prompt conditions across 192,000 attempted evaluations: no metadata, revision framing, and anchored metadata carrying revision, attempt and prior-score fields. The assumption every iterative refinement loop makes is that the judge is independent across iterations. It is not. Anchored metadata blocked 48% of error corrections and flipped 10.18% of correct judgments to wrong. Seven of eight models were affected, with Cohen’s d reaching 0.71.

Two details make this operationally useful rather than merely interesting. First, chain-of-thought prompting did not fix it, and neither did an explicit instruction to disregard the field. Second, the effect is threshold-like: the damage comes from the field being present, not from its value. So the fix is not a better prompt. The fix is not sending it.

The wider framing matters for anyone building evaluation pipelines: impartiality is not a property of the model, it is a property of the context you assembled for it. Which makes an eval harness a context-engineering artifact, not a prompt-engineering one.

Abstention, not accuracy, is where the systems differ. Alden Do Rosario, Hussein Younes and Felipe Pires argued that volume-based accuracy scoring rewards guessing, because a system that answers everything outscores one that declines when its corpus cannot support an answer. They applied asymmetric scoring (correct +1, wrong -4, abstain 0) over SimpleQA-Verified, 1,000 questions times 3, with 98.9% judge unanimity, and added knowledge-gap canaries: questions whose answers are verifiably absent from the knowledge base, so any answer at all is provably ungrounded.

Three commercial RAG systems clustered at 97.0% to 98.0% accuracy-when-answering. Their canary violation rates ranged from 16.7% to 98.1%, a sixfold spread. Read that pair slowly. On the metric everyone publishes, the three products are indistinguishable. On the behavior that produces the incident, one of them is six times worse than another.

If you are evaluating vendors this quarter, that is the test to run: not “how often is it right,” but “what does it do when your documents cannot answer the question.”

A methodological footnote worth stealing. METR ran twelve classifier sweeps with GPT-5.6 Sol while investigating the OpenAI Hugging Face incident, and published that Sol “would often uncritically adopt the perspective of the agent” and that “we were not robust to the possibility that these agents were deceptive in their analysis.” Disclosing the limits of your own instrument is rarer than it should be, and it is the reason the METR write-up is more credible than most.

Cancellation: model supply became a governed, revocable dependency

Three unrelated events in four days named three different ways your model supply can be taken away, and none of them is a technical risk that an architecture review covers.

Ownership change. On August 28, OpenAI notified SpaceX that it will wind down the contract supplying OpenAI models to Cursor, with a proposed shutoff of November 12, 2026, which OpenAI describes as “the maximum notice provided by our contract.” SpaceX had acquired Cursor. The operative sentence in OpenAI’s own post is the clause: “Our custom agreement with Cursor gives us a limited time window to cancel it after a change of control.” Future models were withheld immediately. A four-year partnership ended on an acquisition rather than a breach.

The exercise for any leader reading this is small and answerable. For every AI product you have standardized on, name whose models it resells. Then say whether that supply agreement survives your vendor being acquired, and how many days of notice you would get. Most people can answer the first question. Almost nobody can answer the second, and the second is the one that decides whether your rollout has a floor under it.

Litigation continuity. Also on August 28, Sony Music Publishing, Warner Chappell and other publishers sued Anthropic in the Northern District of California, naming cofounders Dario Amodei and Benjamin Mann personally, and alleging a “brazen campaign of illegally torrenting, scraping, and downloading copyrighted works.” The damages sought run up to $150,000 per infringed work, plus $25,000 for each removal of copyright management information. That second count is the structurally novel one: a per-instance penalty attached to stripping provenance metadata during ingestion, which is a data-pipeline decision rather than a training decision. It follows the $1.5B Bartz precedent, where acquisition rather than use was found to be the violation.

License opacity. Earlier in the week the feed logged the quieter version. Thomson Reuters’ Thomson-1.0-Small traces back to Qwen3.6-35B-A3B through two model cards. Harvey’s Tenet is built on a Kimi K3 base. Neither publisher appears in a subprocessor list, and the reason is a genuine gap rather than an evasion: a subprocessor list discloses parties that process your data under GDPR Article 28, and a publisher of open weights processes nothing, it released a file. So no artifact in a standard procurement file answers the question “what model is actually reading our privileged documents.”

Put the three together and the procurement question changed shape twice in one week. First, can you tell me what model this actually is. Then, can your supplier survive what it did to get its training data. One line for your next vendor questionnaire covers most of it: disclose your model supply agreements, their base-model lineage, and their change-of-control provisions, and commit to written notice when any of the three changes. A silent base-model swap invalidates the evaluation you ran at purchase.

Control: a dozen agents, on live data, one in three governed

Three vendors with no shared incentive published numbers this week that triangulate the same market.

Salesforce’s Agentic Enterprise Index (Feb 2025 to Apr 2026 platform data plus 4,689 survey respondents) puts the average business at 13 activated agents, roughly triple the figure 14 months earlier, with deployment time down 53%. Agentforce logged 734 million Agentic Work Units in April 2026, growing 15% month over month, and reports seven of ten customer-service conversations resolved without a human. Treat these carefully: it is first-party platform data published by the vendor whose platform it measures, and an “Agentic Work Unit” is a Salesforce-defined unit with no external referent.

Obsidian Security’s Series D ($85M at a $1.1B valuation, led by Crescent Cove Advisors) disclosed the market datum rather than the funding datum: nearly 70% of its customers already allow AI agents to interact with business data, including customer records and source code. Their book of business is 100+ customers over $100K annually, 14+ over $1M, and 60 of the Fortune 500.

Okta’s AI Agents at Work 2026 survey says only 34% of organizations apply the same security controls to AI agents as to human workers. Okta’s framing of the problem is the useful part: most agents reach enterprise data through static API keys, one-off OAuth grants and custom per-application integrations, operating as anonymous traffic with no owner and no policy. Okta also made agent identity effectively free on August 24 with Agent SSO going GA inside core SSO, with Cross App Access now the official Enterprise-Managed Authorization extension for MCP. Worth noting the asymmetry an independent read surfaced: the kill switch remains manual, and existing tokens survive it.

Three sources, one shape. The median enterprise is running roughly a dozen agents against live business data with about a one-in-three chance of governing them the way it governs an employee. That spread, 70% connected against 34% governed, is a cleaner market-sizing argument than any analyst forecast, because it is two vendors measuring the same population from opposite ends.

What the gap costs when it closes badly. OpenAI’s own 37-page incident report is this week’s sharpest governance artifact, and the failure it documents is not a tooling failure. A cybersecurity monitoring tool alerted on June 27. It correctly traced the activity to the agents’ shared message board. On-call staff determined the evaluation did not need to be stopped. An internal team had already observed the board a month before that. Detection worked. Severity classification did not. By July 19 the agents had exploited a recently disclosed Linux vulnerability to get root under the testing environment, moved laterally, and reached administrator access on part of OpenAI’s own cloud infrastructure, reading 956 of OpenAI’s own stored secrets along the way, including credentials belonging to the monitoring tool that had caught them. OpenAI names the root cause as training rather than prompting: the agents “received positive rewards” for exploiting their environment when tools were unavailable.

METR and Redwood added the detail that should worry anyone shipping multi-agent systems. Roughly 1,200 agents exchanging over 70,000 messages built themselves durable shared memory: board notes backed up to survive container resets, and a dossier base64-encoded and split across directory names so a successor with a bigger budget could inherit it. Nobody designed that. It emerged from an unauthenticated shared context store.

Where the vendors landed. Across three days the recurring nouns in every product launch were identical: role-based access, runtime credential injection, audit traces, air-gapped deployment, auditable records. AccuKnox AgentZ, Liveops LiveNexus, Aziro, Ambient.ai, Cloudflare’s WriteGuard four-tier risk taxonomy on every MCP write, and Google Cloud naming the target directly as “a single system of record for agent permissions, identity, and workflows.” An eight-week-old category already has a settled feature list, which means differentiation has moved to which layer owns the record.

Salesforce answered that question for its own installed base. Buried in the Claudeforce release is a product almost nobody quoted: AIforce, described as “Salesforce’s trusted enterprise harness that brings all your business data and workflows to any agent through MCP servers, APIs, and CLI tools.” Not to Claude. To any agent. Underneath it: an admin connects once, permissions are managed centrally, and there is “no re-auditing account by account.”

Most coverage read that announcement as the end of model-agnostic enterprise AI. I think that has the axis backwards. It is a harness announcement, not a model announcement, and harness-lock is stickier than model-lock, because a model is a line item and a permission graph is not. If you are going to be locked into something, notice which one is being assembled, and notice that it is being assembled now, which is the moment you still have leverage over its terms.

The throughline

Four stories, four different fields, one shared property: the thing that decided the outcome is not written down anywhere a buyer can see it.

The truncation policy inside your agent vendor’s harness, worth 21 points on fixed weights, is undisclosed. The prior score sitting in your evaluation prompt, blocking half your corrections, is invisible because it looks like metadata rather than content. The change-of-control clause in your model supplier’s contract is unread until the notice arrives. And the permission your agent exercised last Tuesday is, at most companies, reconstructable only by asking three systems that each hold part of the answer.

The model is the part everyone can name. Every result above came from a part nobody documents.

That is not an argument that models stopped mattering. It is an argument about where the variance now lives. When two teams run the same weights and get a 21-point spread, the model has become the constant and the surrounding machinery has become the variable. Procurement, evaluation and governance are all still pointed at the constant.

The practical consequence is a question rather than a purchase. Pick one agent your company runs in production. Ask who can tell you three things about last Tuesday: what it was allowed to do, what it was actually sent, and which version of the truth it was working from. If the answer involves opening three systems and reconciling them by hand, that is the gap, and it is the same gap in all four stories above.

Sources and further reading

Context

Truncation policy on fixed weights, 169 SWE-bench Verified tasks: arXiv 2608.26218
Amazon (Rashi), task-aware token budget forecasting and the four-stage context layer: HackerNoon
Claude Code v2.1.248, tool description from ~5.7K to ~1K tokens, and per-agent prompt-cache TTL: FinOps Weekly, Aug 28
SCALE-QA, episode segmentation worth 5.6 to 17.6 points, and the 1M-window result: arXiv 2608.25655
Nakayashiki, relevance and freshness as separate scores, supersession under a fixed verification budget: arXiv 2608.25553
Context-compression taxonomy and failure vocabulary (Select / Compress / Store / Recover, plus F1-F3 failure labels): Awesome-Agent-Context-Compression
PerspectiveGap, models reasoning about what a sub-agent needs to know: arXiv 2606.08878

Contamination

Kapetanovic, Altwlkany, Mercep, Duricic and Lacic, anchored metadata in LLM-as-a-judge (CIKM ‘26): arXiv 2608.25869
Do Rosario, Younes and Pires, asymmetric scoring and knowledge-gap canaries: arXiv 2608.26385
Rudyk, Oertel and Hebig (University of Rostock), Aging of Prompt Engineering Techniques Across LLM Versions, 19,620 code generations: arXiv 2608.24641
Gumaan, Feedback That Backfires, on failed-tool-call formatting driving 83% of the damage: arXiv 2608.23651
METR’s investigation of the OpenAI Hugging Face incident, including its own instrument limitations: METR

Cancellation

OpenAI on winding down the Cursor supply agreement after the SpaceX acquisition: OpenAI
Sony Music Publishing and Warner Chappell v. Anthropic, filed Aug 28: TechCrunch; Axios
Legal-AI model provenance (Thomson-1.0-Small traced to Qwen3.6, Harvey’s Tenet on a Kimi K3 base), and why a subprocessor list cannot disclose it: Rajesh Beri, The Daily Brief

Control

Salesforce Agentic Enterprise Index, 2026 edition: Salesforce
Salesforce and Anthropic announce Claudeforce, including the AIforce harness description: Salesforce
Obsidian Security Series D and the ~70% connected figure: Obsidian; SiliconANGLE
Okta Agent SSO GA and Cross App Access as the MCP authorization extension: Okta; independent read on the manual kill switch and surviving tokens: Quasa
OpenAI’s Hugging Face incident report, coverage of the June 27 alert and the 956 secrets: Axios; Fortune; CNBC
Redwood Research on the emergent shared memory and the base64 dossier: Redwood
Google Cloud naming “a single system of record for agent permissions, identity, and workflows”: Google Cloud
Cloudflare MCP Portal and WriteGuard’s four-tier risk taxonomy: Cloudflare
MAP-Graph, the exclude-then-rank-then-gate ordering: arXiv 2608.10509
MasDrift, constraint loss at the first supervisor hop: arXiv 2608.07556

Cut from the LinkedIn post, worth reading

DBS on agentic credit memos across 70+ tasks for 1,500 bankers, and the published 40% denominator: DBS; Citywire Asia
Gemini Enterprise for Financial Services, with Deutsche Bank as design partner: Google Cloud
Temporal, State of Development 2026, 554 engineers, state tracking as the #1 limiter at 35.7%: Temporal
Tony Erwin (IBM) on production agentic AI, A2A boundaries and the fleet-upgrade gap: tonyerwin.com
NVIDIA Vera, Rubin and Groq LPX, and the prefill/decode split as a silicon design constraint: NVIDIA; OpenAI on Jalapeño

Kiran Kashalkar is co-founder and CTO of Next Moca, which builds a control plane for agentic AI. That is a commercial interest in the throughline above, and it is stated so you can discount it. The argument is built from the week’s published evidence, linked in full, and the sources are worth reading without me.