On August 25, the AI stack continued to integrate vertically. OpenAI published the first performance figures for its own inference chip. Figure is building its own market for physical-world data. Google is packaging a model, domain-specific skills, and permissions into a legal product, while Copilot is bringing MCP, plugins, and skills together in a single distribution layer.

On the surface, these are eight separate stories. Underneath, they are one fight over the system's boundaries. Whoever controls the silicon, data, sandbox, document access, and method for connecting tools depends less on the quality of any single model call and increasingly determines how the entire product behaves.

Infrastructure

OpenAI publishes the first measurements of its own inference chip

OpenAI published the first results for Jalapeño. On GPT-OSS 120B, DeepSeek R1 670B, and Kimi K2.5 1T, the company claims 1.5–1.9 times more work per watt at peak throughput and 1.7–3.6 times lower end-to-end latency than selected commercial systems.

This is a vendor benchmark. Public availability through InferenceX does not make the measurement independent: the outcome depends heavily on competitor configurations, the software stack, batching, and the target workload. The range cannot be turned into a promise that every OpenAI application has suddenly become three and a half times faster.

The first substantive result is not a record, but the emergence of a closed loop: model → compiler → serving → silicon. The lab can now adapt model architecture to the properties of its chip and the chip to the model without waiting for a general GPU vendor roadmap. The price of that freedom is having to prove that the system wins beyond carefully selected internal workloads.

Source: the first Jalapeño results.

The sandbox becomes a distributed primitive in Ray

Google Cloud and Anyscale introduced an experimental library that creates isolated OCI environments inside Ray clusters on GKE using gVisor. Its target use cases include reinforcement-learning rollouts, generated-code execution, and parallel tool interactions.

Previously, an agent sandbox often looked like a separate external service: a request left the runtime, a container started elsewhere, and the result came back. Here, isolation becomes an object managed by the distributed scheduler itself. Ray can place thousands of environments alongside tasks, data, and accelerator resources.

The claims of sub-second startup and low overhead come from the vendors, and the publication does not provide a full benchmark setup. The API is experimental and is not yet a stable Ray contract. But the architectural move is already clear: if agents execute untrusted code at scale, sandboxes must be scheduled as naturally as CPU, memory, and GPU resources.

Source: gVisor sandboxes for Ray.

Models and data

Granite 4.2 learned not only to answer, but to act in an environment

IBM released the Granite 4.2 family for reasoning, tool use, coding, and speech, with variants designed for local and enterprise deployment. The models are available through Hugging Face, GitHub, Ollama, watsonx, and other channels.

There is no single independent table for the family that would justify naming it the winner across models of different sizes and purposes. Sizes, licenses, and benchmarks therefore need to be checked against the individual model cards rather than combined into one headline.

The more important detail is that some models were trained on agentic sandbox tasks. Tool use stops being merely an output format added during instruction tuning and becomes behavior practiced inside an environment. That does not guarantee production reliability, but it brings training closer to the real unit of agent work: not “produce the correct JSON,” but “achieve the result through several actions.”

Source: IBM on Granite 4.2.

Figure buys the physical world's long tail directly from people

Figure launched Index, an app and paid program for collecting videos of physical actions. The company reports 16 million uploaded videos, 264,000 downloads, 44,000 weekly active users across 108 countries, and $15 million paid to contributors. It is promising more than $1 billion for data and compute over the next 12 months.

Every figure is self-reported. They reveal neither the diversity of actions nor annotation quality, and they do not show how much the videos actually improve robots. “Launched” should not be confused with an open dataset: the collected data remains exclusive to Figure.

The strategy is still notable. The internet gave language models a cheap corpus of human text, but it does not contain enough video of people picking up an unfamiliar object, repairing a particular mechanism, or acting in a rare situation. Figure is trying to create that missing layer through a market rather than laboratory capture: users find the long tail, and the company assigns it a price.

Source: Figure Index.

Vertical agents

A legal agent begins with ethical walls, not a legal prompt

Google introduced Gemini Enterprise for Legal. The product combines domain skills, MCP connectors, acting agents, and a managed control plane. The crucial detail is the inheritance of matter permissions, document-level ACLs, and ethical walls, together with traceable citations.

The announcement names customers and partners but provides no independent measurement of accuracy, time saved, or the cost of errors. “Production-ready” remains Google's characterization.

Even so, the product correctly identifies what makes an agent vertical. Legal language can be embedded in a model, but a document's association with a matter, a conflict of interest, and a particular employee's right to view the material live in the organization's systems. A vertical agent is not an LLM that knows the terminology. It is a workflow that understands and respects the real boundaries of access.

Source: Gemini Enterprise for Legal.

Developer tools

Visual Studio treats reasoning budgets and worktrees as ordinary IDE settings

The August update to Visual Studio 2026 added Low, Medium, and High reasoning controls for supported models, usage reporting, distribution of organizational custom agents, and Git worktree creation from the interface.

Microsoft provides no productivity measurements, so the presence of a switch does not prove that development became faster. But the feature set captures a new norm. Reasoning is no longer treated as a bottomless internal property of the model; it is a visible budget that a developer chooses for the task. Worktrees are also moving from an advanced Git workflow into the main interface because multiple agents need to work in parallel and in isolation.

The IDE is gradually managing not just files and the compiler, but the agent's computational effort and the topology of its working copies.

Source: Visual Studio August update.

Copilot gives extensions their own storefront

The Customize section in the Copilot App became generally available, bringing discovery and management of MCP servers, plugins, skills, and canvases into one place. For now, this is a catalog and interface, not a new packaging standard. An item appearing in the storefront also does not mean it has automatically received permissions or works the same way in every client.

But the agent ecosystem is acquiring a familiar structure: a base model, a runtime, and a separate distribution layer for capabilities. Users now choose not only a model, but also the instructions, tools, and context sources that assemble a particular worker.

The main risk is conflating discoverability with trust. The easier it becomes to connect an MCP server or plugin, the more important it is to show provenance, requested permissions, and data boundaries separately. A capability store without a permission model quickly becomes a supply-chain problem.

Source: GitHub Copilot Customize GA.

WebMCP tests whether the page itself can become an agent tool

OpenAI, together with Chrome, Cloudflare, Shopify, Vercel, Render, and Netlify, launched a ten-day WebMCP Challenge. Participants were invited to build open-source projects around an experimental interface that exposes structured tools to an agent directly on a live page and inside the user's authenticated session. The prize pool is $35,000.

A hackathon does not make WebMCP a standard or provide a production guarantee. It establishes only that the interface is open to public experimentation and has attracted several platform companies.

The underlying bet matters more than the event. Today, an agent often “sees” a site through a screenshot and clicks coordinates even though the application already knows the semantics of each action. Browser-native tools could remove that brittle layer of visual imitation. But the agent receives the user's authenticated session along with the DOM, so the tool contract must include confirmation, data provenance, and narrow authority. Otherwise, a structured API will merely make a dangerous action more reliable.

Source: WebMCP Challenge announcement.

The issue's main technological shift

On August 25, the competitive product became not the model, but the boundary around it.

Owning the chip reduces dependence on someone else's hardware roadmap. An internal data market addresses the shortage of physical observations. A distributed sandbox makes action at scale viable. A domain control plane inherits real permissions, while an extension storefront determines which capabilities reach the runtime at all.

AI companies are moving toward vertical integration for practical reasons, not aesthetics. Every external layer is a source of latency, risk, and someone else's rules. But every layer brought inside becomes a new responsibility: it must be measured, secured, and proven in someone else's production environment, not merely in the company's own press release.

What to discuss with the technical team

  1. Which layer of our AI product is the actual bottleneck: the model, data, sandbox, permissions, or tool distribution?
  2. Which vendor benchmarks depend on a configuration that users will be unable to reproduce?
  3. Is isolation scheduled as a distributed-runtime resource, or does it remain an external service with its own queue and failure modes?
  4. Does the domain agent inherit existing ACLs and ethical walls, or create a parallel access system?
  5. Does the extension catalog separate discovery, trust, and the actual grant of authority?