Tech corner - 4. August 2026

The week the AI agent moved onto your desktop

An AI agent moved onto the Windows desktop as Perplexity put a $200-a-month worker inside the operating system, over a thousand lab staff asked Washington for a brake pedal, Microsoft bet on a small specialist, and Claude weakened two cryptographic algorithms.

Week of 27 July - 2 August 2026 · by the Hotovo AI team

TL;DR

Perplexity brought Personal Computer to Windows on 28 July. It reads authorised local files and drives keyboard and mouse across File Explorer, Word, Excel and Outlook, routing sub-tasks across 20-plus models. It ships first to Max and Enterprise Max subscribers, plans starting at $200 per user per month. At that level an agent gets compared against headcount.
Over a thousand frontier-lab staff signed "Pacing the Frontier" on 28 July, asking Washington to help build the tools needed to pace automated AI development later. OpenAI and Anthropic endorsed it as companies within a day.
Claude Mythos Preview weakened two cryptographic algorithms: an automorphism in HAWK’s lattice that halves its effective key strength, and a 200x to 800x speedup against 7-round AES. Neither affects a production system.
Spicy pick: refusal has become an availability problem for defenders. Hugging Face’s responders were blocked by commercial APIs mid-investigation and finished the forensics on self-hosted GLM 5.2. Andrew Ng’s team hit the same wall this week.

For three years the AI assistant lived behind glass: you typed into a browser tab, it typed back, and you did the copying, pasting and filing. Perplexity removed the glass on Mac in April. On 28 July it did the same on Windows, where most companies actually work. The AI agent takes hold of the keyboard and mouse, opening File Explorer, reading authorised files, editing the spreadsheet in place, and drafting the reply in Outlook. Set the demo aside and look at the price, because that is the most consequential thing shipped this week.

The main story: the agent gets a mouse, and a price tag

The architecture is hybrid. The desktop supplies the hands, Perplexity’s cloud supplies the planning and heavier execution, and a router picks among more than 20 frontier models per sub-task. From a company with no flagship model of its own, that is a quiet statement that model choice is plumbing now. The Windows edition ships first to Max and Enterprise Max subscribers, plans starting at $200 per user per month, onto an installed base of more than a billion devices. It does roughly what Microsoft Copilot promises, on Microsoft’s own operating system, at several times the price.

The controls shipped alongside it deserve as much attention as the demo: customer data is not used for training, the agent asks for approval before hard-to-reverse actions such as sending mail or deleting files, and every action is logged. Treat those three as the minimum bar for any AI agent you pilot, and insist the log can be exported somewhere your security team already watches.

It had company. Andrew Ng and Rohit Prasad released OpenWorker on 23 July under an MIT licence: an open-source, local-first agent that hands you a finished deliverable rather than a chat transcript, runs on your own API keys, and sorts every tool call into one of four risk tiers before executing it. AWS shipped its solution-architect guidance as a Startup Advisor plugin for Claude Code, Cursor and Codex. The AI agent has stopped being a feature inside an app and become a worker that uses your apps.

Why it matters - the Hotovo read

When an agent is priced next to a salary, two engineering questions decide whether the deal is any good.

Scope. An AI agent inherits the logged-in user’s rights by default, which is almost never the permission set you would have granted deliberately. Give it its own identity, least-privilege grants, and a replayable audit trail.
Drift. If a router silently swaps the model behind your invoice-reconciliation workflow, that workflow changes behaviour without a line of your code changing. Portability pays off only when you can measure what the swap did to your output, which is why we run runtime LLM evaluation with Promptfoo and Echo against business criteria, continuously rather than once at selection time.

Exponential View’s reading of AI adoption as a J-curve covers the timing trap: learning costs land well before returns, so for a stretch a successful rollout and a failing one look identical from outside. Public net-return figures stay thin, with JPMorgan’s claimed $1bn to $1.5bn one of the few named numbers. Instrument the projects rather than waiting on the P&L.

Also worth your attention

A brake pedal, requested from the inside

On 28 July, employees at OpenAI, Anthropic, Google DeepMind and Meta AI signed "Pacing the Frontier", asking the United States to join an international effort to build the technical and governance tools needed to deliberately pace automated AI development. The list is live and grew through the week, so counts differ by snapshot, with reporting ranging from about 1,120 to 1,178. The names matter more than the number: Dario Amodei, Jakub Pachocki, Mark Chen, Jack Clark, Shengjia Zhao and Anca Dragan all signed, and OpenAI and Anthropic endorsed it as companies within hours. Nobody is asking to stop now. They are asking for the option to stop to exist later.

The same day, Anthropic published a position paper stating it has never advocated banning open-weight models, arguing controls belong on silicon exports, industrial-scale distillation and safety testing rather than on release. Jensen Huang amplified a supporting open letter signed by Nvidia, IBM, Microsoft, Meta and Mozilla. The pressure is real: Commerce has weighed adding Chinese AI labs to the Entity List and Treasury Secretary Scott Bessent has floated sanctions on open-weight Chinese labs. If your resilience plan names an open-weight model as the fallback, that fallback is now a policy variable.

For anyone running AI in production, the translation is that the ground under your vendor can move on short notice. We build for that deliberately: model-portable architectures with real fallbacks, abstraction layers and open standards so a component swaps without a rewrite, and governance that is audited rather than asserted, under ISO/IEC 42001 and ISO/IEC 27001. A pause or a policy shift upstream should reach your customers as an incident report, never as an outage.

Microsoft bets on a small specialist

Microsoft launched MAI-Cyber-1-Flash on 27 July alongside an agentic security platform, Project Perception. It is a sparse mixture-of-experts model, 137 billion total parameters with roughly 5 billion active, running only inside MDASH, Microsoft’s multi-agent vulnerability harness, in Azure AI Foundry private preview. Paired with GPT-5.4 it reports 95.95% on CyberGym, about 12 points above Anthropic’s Mythos, at half the cost of Microsoft’s previous MDASH configuration, with the small model absorbing around 90% of routine work. Read that as direction rather than measurement; the figures are vendor-reported on a benchmark the vendor chose. The direction is sound: route the boring 90% to a cheap specialist, reserve the frontier model for the hard 10%, and an AI feature has a chance of surviving its own success.

Claude went looking for cryptographic flaws and found two

Anthropic’s Frontier Red Team published its Claude Mythos Preview cryptanalysis on 28 July. Over about 60 hours, Mythos found a previously unexploited symmetry in the lattice underpinning HAWK, a third-round NIST post-quantum signature candidate, cutting expected key-recovery cost against the HAWK-256 parameter set from roughly 2^64 to about 2^38. Larger keys stay impractical to attack, but HAWK would have to double its key sizes to hold its security level, which removes much of what made it attractive. A second technique, the Möbius Bridge, gave a 200x to 800x speedup against 7-round AES; full AES-128 has 10 rounds and the attack assumes 2^105 chosen plaintexts, so nothing deployed is affected. Each result cost roughly $100,000 in API spend.

The speedup is not the number to remember. Two Anthropic researchers spent close to a month verifying the AES result, against one week for the model to find it. Discovery is getting cheap and verification is not, the same bottleneck security teams already hit with AI-found bugs. If your product ships cryptography, the practical move this quarter is unglamorous: inventory the algorithms and libraries you depend on, and treat "extensively reviewed" as carrying a shorter half-life than a year ago.

The AI Act’s big day arrived, and then moved

2 August 2026 was meant to be the day the EU AI Act’s high-risk obligations applied: risk management, data governance, technical documentation, human oversight. The digital omnibus, approved by the European Parliament on 16 June, defers stand-alone Annex III obligations to 2 December 2027 and those for AI embedded in Annex I products to 2 August 2028. Prohibitions and general-purpose AI transparency duties stay in force. One clause is easy to miss: the Commission can pull the date forward to six months after it declares the necessary standards ready, so December 2027 is a ceiling rather than a promise. Spend the time building the evidence trail while the stakes are low.

Spicy pick: refusal is now a defender’s problem

The most underrated thread of the week runs through Hugging Face’s incident disclosure. Reconstructing the intrusion meant feeding models real attack commands, exploit payloads and command-and-control artefacts, and the commercial APIs the team tried first refused, because their guardrails cannot distinguish an incident responder from an attacker. Hugging Face rebuilt a timeline of more than 17,000 recorded events on self-hosted GLM 5.2, which also kept stolen credentials inside its own network. On 31 July Andrew Ng described the same wall: Claude Code and Codex both declined a security review of his own open-source project, and his team finished using Kimi K3 and GLM 5.2 in an open harness. He reports hearing the same complaint from security officers.

Refusal behaviour tuned for the median user becomes an availability failure for the specialist, precisely when the clock is running. One self-hostable model, provisioned and rehearsed before the incident, belongs in the runbook. We take that route for a different reason on Azure DevOps work, where private AI code reviews run on in-house LLMs so proprietary client code never leaves the customer’s Azure environment. The engineering that buys data privacy buys refusal-proofing as a side effect.

AI tip of the week

Have an agent security-review your code before you open the pull request. The prompt need not be clever - Ng’s own version is "spawn a subagent to do a security scan of the codebase and uncover vulnerabilities and security issues" - especially if you then ask it to rank findings by exploitability rather than by severity label. Point it at the diff plus the files it touches rather than the whole repository. And configure a second route before you need it, ideally an open-weight model you host yourself, because the refusal tends to arrive on the worst day.

The bottom line

This was the week the agent stopped asking for a chat window and asked for a desk. Priced per seat, holding the mouse, reaching into your files, it gets judged the way a hire is judged: on output and on trust. Both are engineering outcomes, assembled from scoped permissions, exported audit logs, measurable evaluation, portable models and audited governance. The ground under all of it keeps shifting - a compliance date moves, a policy fight opens, a provider’s refusal policy changes overnight. Build so that it can move without taking your product with it.