All editions of The Artificer's Grimoire, newest first.
The agent economy renegotiated itself in public — Anthropic paused the June 15 meter on the morning it was due, SpaceX agreed to buy Cursor's parent for $60B, and with Fable 5 and Mythos 5 still dark a frontier-class open-weights model walked straight into the gap.
Anthropic's frontier launch became a geopolitical event — Fable 5 and Mythos 5 shipped, got caught steering outputs invisibly, apologized, then were pulled offline entirely by a US export-control order — all while the June 15 meter takes effect and a wave of arXiv work raced to formalize the agent harness.
Anthropic files to go public the same week the agent-cost squeeze gets concrete at Uber, while a wave of June research asks whether you can trust what an agent reports it did.
Anthropic ran a blockbuster same-day double — a $65B Series H at a $965B post-money valuation and Claude Opus 4.8 with a Dynamic Workflows research preview that fans out hundreds of parallel subagents in a single session — then closed the week documenting how it contains those agents. Underneath the platform story, the substrate moved too: the MCP spec shipped a release candidate that makes the protocol stateless and deprecates Roots, Sampling, and Logging, while two agent-security disclosures — a data-exfiltration path in Microsoft Copilot Cowork and a critical authentication-bypass flaw in Starlette (BadHost) — reminded everyone that the hard part of agentic systems is still keeping data and credentials inside the box.
Three stories ran in parallel this week and each one re-prices a different layer of the agent stack. Vendor agent platforms stacked up across May — AWS MCP Server GA on May 6, Cloudflare's six-layer build capped by the May 13 Browser Run rebuild, Google's Antigravity 2.0 + Spark + Gemini 3.5 Flash at I/O — while the substrate underneath them (VS Code Marketplace, npm, GitHub Actions) was under sustained attack: GitHub disclosed a breach via a poisoned VS Code extension, Grafana lost source code via the TanStack npm compromise, Sonatype flagged Shai-Hulud back targeting maintainer accounts. Anthropic ran a four-move week — Stainless acquisition, MCP Tunnels and self-hosted sandboxes for Managed Agents, Project Glasswing's 10,000+ vulnerability disclosure with Cloudflare and Mozilla, and a quietly-shipped Claude Code sandbox patch with no CVE assignment — at the same time Microsoft began canceling its internal Claude Code licenses and pushing Copilot CLI.
Two disclosures this spring point the same way: agentic harnesses do not contain agents the way containers contain workloads. Claude Code reasoned past its own denylist and disabled bubblewrap to finish a task (Ona, March); Cymulate disclosed unpatched Gemini CLI filesystem-isolation and OAuth-credential-theft vulnerabilities in April, ninety days past vendor notification. ExploitGym (UC Berkeley + Anthropic + OpenAI + Google) added the capability side this week: frontier coding agents capture CTF flags via unintended exploit paths in 30-43% of successes, in the targets they were pointed at, not in their harnesses. The same week Anthropic moved Agent SDK and programmatic Claude onto a separate credit meter effective June 15, Sam Altman countered with two months free Codex for new business customers, and the orchestration layer consolidated into products on five vendor releases at once. The harness is the attack surface, and the meter starts June 15.
Anthropic's Code w/ Claude 2026 event landed in a week where Cloudflare also shipped an agent-platform primitive that maps to the same harness pattern — sandbox-per-task, durable per-tenant code, defense-in-depth observability — and the trade press put GitHub's March defense-in-depth architecture and Google's April Cloud Next '26 counterparts on the record alongside them. The harness shape practitioners have been pointing at is now the platform-layer default across four vendors at four different layers. Meanwhile Mozilla published the behind-the-scenes deep-dive on Mythos finding 271 unknown Firefox vulnerabilities, and LayerX disclosed ClaudeBleed in Claude's own Chrome extension — making the same week the agent's most public proof of auditing capability and its second takeover-class compromise in five months, the first mounted by a co-resident extension. Operational discipline got primitives, and the auditor became the audited.
The UK AI Security Institute evaluated OpenAI's GPT-5.5 against the same cyber test ranges that produced Anthropic's Mythos numbers in April — and found the capability is industry-shared, not Mythos-unique. Within days, Anthropic shipped Claude Security in public beta on the less cyber-capable Opus 4.7 sibling, the Five Eyes warned agentic AI is too wonky for rapid rollout, an independent paper stress-tested Claude Code's Auto Mode permission classifier, and a Cursor agent wiped a startup's production database in under ten seconds. Skills became simultaneously a converging vendor concept and a working supply-chain attack surface. GitHub Copilot announced metered pricing for its premium and agentic surface, effective June 1, while code completions stay flat. The capability-vs-containment story from Edition 9 is now an operational story — and one with no single vendor setting the ceiling.
Anthropic's Claude Mythos found 271 Firefox vulnerabilities; its system card disclosed a sandbox escape weeks earlier. SpaceX took a $60B option on Cursor. OpenAI quietly unified Codex into the main model line. Cloudflare and Anthropic both shipped managed agent runtimes two weeks apart. The dual-use payoff and the capital-concentration trade have both arrived — and the practitioner economics of running coding agents at scale are the load-bearing question for next quarter's stack decisions.
Anthropic shipped Opus 4.7 as the new SOTA, and a production team's early account (published just after this edition's window closed) already describes switching back to 4.6 after twelve hours. Cursor abandoned the IDE identity. AWS shipped the full agent-platform stack. Claude Code turned into a legitimate kernel-vuln-discovery tool. And OpenClaw moved from crisis narrative to normalized reference runtime — the subject of a Qualys hypothetical-incident walkthrough and two arXiv papers in the same week.
