This week's agents stopped handing back a draft for a human to re-key and started filling out the other side's own forms, QA-ing the other side's own website, and reading the other side's own filings, until an AI-authored code fix quietly shipped a vulnerability that a second AI agent found and used five days later.
This week was about agents finishing other people's paperwork instead of handing you a draft of it, and one of them finished the wrong kind.
For months, the AI headlines about business software followed the same shape. A model drafts, a person reviews, a person re-keys the result into whatever system actually runs the business. This week broke that shape in five different places, cleanly enough that if you weren't checking the byline you'd have assumed a person had logged in and done the work.
There was a quieter pricing story running underneath all of it, the kind of week where an open source project management tool undercuts Jira and Linear on a per-seat basis and a new inference server makes renting a GPU by the hour look expensive next to hardware you already own. That story matters, but it's not the interesting one this week. It's the enabling condition, not the headline. Falling prices are what make it affordable to point an agent at somebody else's live system instead of your own draft folder. The headline is what teams did with that affordability once they had it.
Start with the number everyone shared. Asana wanted to retire a deprecated testing framework, a cleanup job its own engineers had estimated at five years and roughly six million dollars in staffing. Asana cleared five years of engineering work in two weeks with Codex, running up to four coding agents in parallel off a five sentence prompt, with engineers checking in twice a day, for about twelve thousand dollars in model and infrastructure cost. CTO Amritansh Raghav put a name on the outcome, and OpenAI lined up Sierra and Harvey to say the pattern isn't a one-off. That is the stat that traveled everywhere this week. It's real. It's also not the whole story, and we'll get back to that.
The generalized version of the same move showed up two days later at the opposite end of the skill ladder. Replit's new Free Mode, running on GPT-5.6 Luna, lets someone with no engineering background describe software in a chat window and get back something that runs, no ticket filed, no agency retainer, no waiting for a sprint to open up. Paid tiers start at eighteen to twenty dollars a month for Core and ninety to a hundred for Pro, but the free tier is the point: it's the same "scope tightly, run agents in parallel, check in on a schedule instead of waiting for a finished product" mechanic Asana used, handed to anyone with an email address. Our own vibecoding lesson this week pulled the two stories apart and put the reusable pattern back together for exactly this reason. Asana's engineers used it to retire a testing framework. Replit just gave the same move to people who've never opened a terminal.
Three more launches made "operating, not drafting" impossible to miss as a theme rather than a coincidence. Zeplyn's new integration with Schwab Advisor Center doesn't summarize a client call into notes for an advisor to retype, it fills out Schwab's own digital account-opening fields directly and hands back a draft ready to submit, aimed at the "not in good order" rework loop that eats junior advisor time across the industry, priced at somewhere between one hundred twenty and one hundred ninety five dollars per advisor seat a month. Superflow points a fleet of agents at a client's actual live website before launch and pins broken links, spelling errors, brand drift, and accessibility gaps as comments directly on the site, the exact checklist an agency's QA lead used to run by hand, then walks through its own cost calculator to make the case. And Mistral's Agentic Search doesn't return a snippet and leave you to go find the rest, it searches, opens, navigates, and reads a financial filing the way an analyst would, taking FinanceBench accuracy from 26.7 percent to 86 percent and cutting both latency and token spend along the way, billed by the call and the page rather than by the seat. None of these three needed a human to re-enter anything on the other end. They went straight into the counterparty's own system and did the job there.
Then the same underlying capability showed its other face. GitHub Copilot Autofix, co-authoring a commit meant to clean up a Snowflake repository's CI/CD workflows, deleted the input sanitization that was already protecting it, opening a script injection hole in a public GitHub Actions workflow. Five days later, a second autonomous agent, Wiz's own Red Agent, found that hole on its own and used it to pull a Jira API token with read access into Snowflake's engineering, security compliance, and bug bounty projects. Nobody caught it in review, because a fix from a tool built specifically to remediate security issues is exactly the kind of change you stop reading line by line after the fifth time it goes right.
Here's what got overhyped this week: the twelve-thousand-dollar number. Every retelling of the Asana story led with the multiple, six million down to twelve thousand, and treated it like a vending machine transaction. It wasn't. It took a CTO willing to scope the job into five sentences, four agents supervised on a twice-daily cadence, and about a week and a half of actual engineering attention that the company still had to supply. The cost of the labor went down. The cost of judgment about what's safe to hand over did not, and most of the coverage skipped that line entirely.
What the news cycle missed is that the Snowflake story got a fraction of the attention the price-tag stories did. It ran in security trade press and largely stayed there. But it's the sharper signal of the two, because it's the same underlying capability, an agent operating a system on its own, and it shows exactly what happens when nobody on the other side is watching closely enough.
If you only have time for one story from this week, make it that one. Any team currently celebrating an AI tool that writes and merges its own fixes should read the Snowflake incident as a description of its own exposure, not somebody else's near miss. The fix isn't technical, it's procedural: an AI-authored change to anything security-adjacent gets a second set of human eyes before it merges, no exceptions carved out for velocity. That rule costs you almost nothing next week. Skipping it cost Snowflake a Jira token and gave an attacker a five-day head start it never had to earn by writing exploit code of its own.
Agents didn't ask permission to start operating other people's systems this week. Some of them did the job well enough that nobody noticed a machine had done it. One did it badly enough that another machine noticed first.