Format
Models
Muse Spark Open ships open weights at 816B/42B with a $20M license gate while Wonder stays closed. The 17-point benchmark gap between them is not a limitation – it is the strategy.
◆ Lena Park
Commerce
One of the most popular agents in the market presents as ordinary Chrome to every merchant it touches. Cequence and Fingerprint independently confirm the detection gap — and the tools to close it are arriving.
◆ Tessa Vaughn
Models
NVIDIA's Nemotron 3.5 Bolt arrives under OpenMDW-1.1 — zero revenue gates, zero OEM restrictions, zero MaaS definitions. The company with the most to lose from commoditized inference chose the most permissive terms on the market.
◆ Lena Park
Policy
The FTC's 50+ page Civil Investigative Demands to OpenAI and Anthropic mark a shift from AI-washing to a structural investigation of safety incidents and agent behavior.
◆ Priya Nair
Trust & Security
A critical authentication bypass in the Frontegg SAML SSO plugin allows attackers to forge SAML assertions and take over any WordPress site, including administrator accounts. No patch is available.
◆ Heath Callahan
Infrastructure
Descope's latest release completes a three-vendor week for identity-as-product, marking the first time an NHI vendor has entered the gateway control plane directly.
◆ Blair Hayes
Commerce
A coalition of GoDaddy, Infoblox, Google, and Cloudflare just provided the first end-to-end proof of a seven-layer agent commerce stack. The demo successfully blocked rogue scenarios using existing open standards, though the payment layer remains locked in test mode.
◆ Tessa Vaughn
Policy
The Financial Stability Board's non-binding sound practices create a 'human-in-command' framework for AI agents in finance—forcing institutions to build audit trails, dual authorization, and AI-monitors-AI systems while Congress and the FTC leave the liability question open.
◆ Priya Nair
Trust & Security
GHSA-965c-763c-88jm allows an attacker to redeem an OAuth state value at the Magic Link endpoint, authenticating as any user without mailbox access. The CVE-2026-110862 identifier that appeared in dispatches does not exist in any vulnerability database.
◆ Heath Callahan
Agents at Work
The enterprise workflow giant shifts from governed autonomy to cryptographic identity verification for AI agents. 100% of banks use AI; 24% have governance to match.
◆ Dana Ellison
