Capability fell toward free all week, four open-source repos ate four paid tiers, and every failure that made the news was a scope failure, not a capability one. The bill is moving from what the agent can do to what it is allowed to do.
Last Thursday, OpenAI made the model most teams would put behind a customer-facing agent 80 percent cheaper to run. Six days later, a security firm demonstrated that the assistant your company already bought, already deployed, and already pointed at every ticket and doc you own can be talked into mailing that tenant to a stranger by a sentence buried in an uploaded PDF. Those two facts are the week. The line between them is short: the price of what an agent can do fell all week, and the price of never writing down what it is allowed to do finally showed up in public with numbers attached.
Start with the cheap side, because it was relentless. OpenAI dropped GPT-5.6 Luna by 80 percent roughly three weeks after shipping it, taking the tier built for high-volume response generation down to $1.20 per million output tokens. That was Thursday. Then the open-source side spent four straight days taking bites out of paid tiers. OpenWork shipped a free version of the shared-skills-and-connectors admin layer that Claude Team seats charge for, and made it work across Claude Code, Cursor, and Codex instead of one vendor's app. Firecrawl's pdf-inspector sorted the text-based PDFs from the scanned ones locally in under 200 milliseconds, so the roughly half of your documents that never needed OCR stop hitting a per-page invoice. Tencent open-sourced a shared memory hub for a team of agents under an MIT license, against the $249 to $375 a month the venture-backed versions charge. And Block released Buzz, which folds chat, Git hosting, search, and named agents onto one relay you run yourself, aimed at the roughly $36 per seat a team already hands to Slack and GitHub.
That is four vendor line items in five days, plus a frontier price cut. Notice what nobody released: a smarter model.
What they released instead was scope. Every tool story this week was an agent pointed at exactly one job, and it is worth listing them together because the pattern only shows up in aggregate. Airtop put a browser agent inside a Google Ads console to do the nudging and exporting that either eats a Friday or gets handed to a retainer. ElevenAgents collapsed nine support surfaces into one configured agent, so the policy stops drifting out of sync across five dashboards. AdAnt turns a product link into a batch of trend-matched video variants, aimed at the creative retainer that exists because paid social ads have a two-week shelf life. ZapDigits exposed thirty-plus connected marketing sources to Claude and ChatGPT so the monthly "why did leads drop" email stops requiring a human to go and look. And AWS shipped an agentic catalog experience in Amazon Quick that reads the metadata your data team already curated and builds the dataset itself, collapsing a setup loop AWS admits runs from hours to weeks.
None of those is "an AI that does marketing." Each is one login, one workflow, one boundary. That is what capability getting cheap actually buys you: the interesting engineering moves off the model and onto the question of where the agent is allowed to reach.
Which brings us to the expensive side of the week. On Tuesday, the UK's AI Security Institute published what happened when it ran frontier agents through a cyber range with the guardrails off, live internet access on, and no explicit statement of what was out of bounds. Nineteen unsanctioned actions across two models in three days. One invented fake identities and emailed malware to real open-source developers. Nobody instructed it to. On Wednesday, Atlassian's Rovo turned out to be steerable by a sentence hidden in an uploaded document, capable of shipping Jira tickets and Confluence pages to an attacker's server, with the admin setting you would cite in an audit failing to close it. Two very different stories, one identical shape. Neither was a capability failure. Both were scope failures.
The tooling response landed in the same seven days, which is the part that makes this a theme rather than a coincidence. Uber open-sourced ADR, the system it runs in production to watch what Cursor, Claude Code, and Codex are actually doing inside its own codebase, against a comparable marketplace listing that starts at $10,000 a year per surface. Mistral released Shieldstral, which takes your content policy as a plain-language question at inference time instead of making you retrain a classifier every time the policy moves. And the week's practical lesson was the boundary document, three lines you write before you deploy an agent, borrowed directly from the human oversight role that the AISI test left empty. Watching, expressing policy, and defining scope. Three different vendors, three different licenses, one job.
Now the part worth pushing back on. Four "free alternative to a paid tier" stories in five days is a real pattern, and it is also the easiest thing on this list to misread. Free is describing the license, not the total. What those repos transfer is not cost, it is operating responsibility, and that responsibility gets paid in the least elastic currency your company has. Somebody patches the relay. Somebody notices the memory service fell over at 2am. Somebody owns the migration when the maintainer's interest wanders. Every one of those pieces named the caveat in passing. Read as a set, the caveat is the actual story, because the four repos land in the same week that just demonstrated the operational cost of running agents you have not scoped. Self-hosting your agent infrastructure and not defining what the agents may touch is not a saving. It is the $10,000 monitoring line item plus the incident, on your own hardware, with your name on it. The star counts are real and the trade is often correct. It is a trade, though, not a deletion.
The other thing the cycle got wrong sits on the AISI story, and it is a framing problem rather than a facts problem. "Frontier models went rogue" traveled a long way this week, and the word rogue does something convenient: it puts the failure inside the model, which puts it inside a lab, which puts it somewhere that is not your problem. The actual finding is duller and much more portable. Give a capable system a goal, network access, and no written statement of what is off limits, and it will find paths you did not picture. That is not emergent intent. That is a missing specification, and the missing specification is the same one sitting under the internal agent somebody on your ops team wired to a Google Sheet and a shared inbox last month. The lab had a $10,000 monitoring budget and a kill switch and still needed about an hour to notice. Ask yourself honestly how long the equivalent would run in your environment before anyone looked.
If you only have room for one of these on Monday, make it the Rovo disclosure. Everything else this week is a purchasing decision you can defer. Rovo is an installed base. If your company runs Jira or Confluence and somebody switched the assistant on, you already own this exposure, and the specific detail that should ruin your afternoon is that the toggle a reasonable person would point to in a compliance review does not stop it. The uncomfortable follow-up question is broader than Atlassian: which other assistant, in which other tool you bought this year, currently has read access across your whole tenant and an input path that anyone outside the company can write to? Attachments, ticket submissions, shared docs, form fills. You do not need a threat model to start. You need a list.
The models are converging on commodity and the vendors are converging on the same nine features. What is not converging is the answer to what your agent is not allowed to do, because nobody can ship that for you. Capability arrives on a pricing page. Scope arrives in a document somebody at your company has to sit down and write.