Week 35, 2026
Coverage window 14 – 27 August 2026.
This edition covers two weeks. There is no Week 34 edition; the gap is a planned skip rather than a missing record.
For the interpretation of this fortnight, why the agent acquiring a trigger, a credential and a schedule matters more than any capability it gained, see the companion essay: Weekly AI Tools That Matter to Me: Part 5, Week 35. This page is the record; the essay is the read.
This fortnight’s record
The agent stopped waiting to be asked. In two weeks it acquired a trigger, a credential and a schedule.
- OpenAI gave scheduled tasks webhook triggers on 25 August, so a task fires on a new Gmail message, a Slack channel message or a GitHub pull-request event rather than on a clock or a person, with actions requiring approval paused until reviewed.
- OpenAI also let ChatGPT Work complete tasks on signed-in websites on the same day: the user enters credentials securely, ChatGPT cannot access or store the password, and the session may persist for future tasks.
- Treasure AI shipped Action Schedules on 25 August, running a saved agentic workflow on a cron cadence, starting a fresh chat each time under the creator’s account with nobody clicking Run.
- Google Antigravity shipped Remote Control on 20 August, to drive and monitor agent sessions running on a local device from any browser.
- And on 25 August OpenAI pointed the same architecture at the workspace itself with the Admin plugin for ChatGPT Work and Codex, which adds and removes members, controls feature and model access by role or group, adjusts usage limits, approves or denies spending requests, and automatically grants feature access when a request meets policy.
Two counter-currents ran in the same window.
- Anthropic removed the “Allow all browser actions” option from Claude in Chrome permission cards on 17 August, and on 18 August added a delay to computer-use permission prompts so a send keystroke could no longer approve one by accident. Three days later Braze shipped an Auto-approve actions setting in its marketing platform. The same fortnight produced a hardened approval prompt and an approval-free mode.
- Anthropic shipped
organizationInstructionson 25 August and described it in the release note as “guidance the model follows, not an enforced control”, which is the clearest published statement anyone has made this year about the difference between shaping a model and constraining it. - OpenAI published the enforcement side of the same question on the same day. The Admin plugin works within each user’s existing role and permissions and does not grant broader access; each instruction maps to a supported read or write action returning a structured result; workspace policies and approval requirements are honoured; each change records what was requested, whether it completed and what changed; and actions with broader impact can be reviewed before they are applied. Five published guarantees, against which no customer engagement or CDP vendor shipping an equivalent surface this fortnight published more than two.
Memory diverged into two designs. Anthropic made memory inspectable at item level with a sensitive-topics category excluded by default, on by default for individuals and off by default for Team and Enterprise. OpenAI made memory isolatable, with project-only memory for existing projects that prevents outward reference, at the cost of ChatGPT Work being unavailable inside such a project.
What changed this fortnight
| Platform | What changed | Source |
|---|---|---|
| Anthropic ClaudeShipped (Aug 25)Memory / Governance | Memory in Claude Cowork, editable topics, and a sensitive topics setting, 25 August. Memory now works across chat and Cowork in the cloud. Everything Claude remembers is listed under Topics in Settings, Memory, where any item can be edited or deleted. Topics such as health or beliefs stay out of memory unless “Include sensitive topics in memory” is turned on. Memory is on by default for Free, Pro and Max plans and off by default for Team and Enterprise organizations. Three firsts in one entry: memory that is inspectable per item, a category exclusion with an explicit opt-in, and a default that inverts by plan tier. | Claude release notes |
| Anthropic Claude Desktop (v1.37937.0/.1, 25 Aug)Shipped (Aug 25)Administration / MCP | organizationInstructions, organisation-wide instructions appended to the system prompt in Chat, Cowork and Code, up to 3,000 characters, set by device management, local config or bootstrap, and explicitly “guidance the model follows, not an enforced control”. userPluginMarketplacesEnabled and userPluginUploadsEnabled to stop members adding their own marketplaces or uploading their own plugins. disableDesktopLocalSessions to force remote environments only. builtinToolPolicy now accepts argument-scoped rules such as Bash(curl *) rather than bare tool names. mcpToolTimeoutSec, default 180 seconds. Usage-page cost estimates via inferenceModelPricing and a scaling multiplier, off by default. Plugin marketplace credential helpers for Bitbucket Data Center and GitLab deploy tokens. Remote MCP servers now reconnect after a dropped connection or report as failed. | Claude Desktop changelog |
| Anthropic Claude Desktop (v1.32352.0, 17 Aug; v1.32885.1, 18 Aug)Shipped (Aug 17–18)Permissions / Supply chain | The “Allow all browser actions” option was removed from Claude in Chrome permission cards, leaving per-website approval as the coarsest grant; the approval mode no longer shows “Skip all approvals” when an organisation policy blocks it, and switching back to manual approval re-asks before fetching pages visited while approvals were off. Computer-use permission prompts hardened so a send keystroke aimed at the message box can no longer land on the prompt and approve it. Breaking: managed-config URLs reject embedded credentials, replaced by bootstrapHeaders and bootstrapHeadersHelper with values masked in diagnostics. A url source for allowedPluginMarketplaces delivering plugins as zip archives over HTTPS with manifestSha256 pinning required for automatically installed plugins. Admin-configured marketplaces now apply to Code sessions too, and removing the organisation plugins endpoint uninstalls its plugins from members’ devices. coworkEgressAllowedHosts port suffixes extended to shell commands and package installs. | Claude Desktop changelog |
| Anthropic Claude Desktop (v1.34493.0, 20 Aug)Shipped (Aug 20)Reliability | Scheduled task correctness fixes: “every N days/months” schedules ran on the wrong days, re-enabling a task or editing its schedule triggered a catch-up run for a slot that had passed while it was off, and manually run tasks sometimes failed to record their last run. Sessions unopened for 30 days or more lost conversation history despite the app being in regular use. Archiving an SSH session no longer discards uncommitted or unmerged work in its remote worktree. | Claude Desktop changelog |
| Google AntigravityShipped (Aug 20–26)Product release / Agent tooling | Three capability releases after four with none. 2.9.1 (20 Aug): Remote Control, driving and monitoring agent sessions on your local device from any browser. 2.10.0 (24 Aug): an embedded terminal in the sidebar for build commands, test suites and scripts, and Git version control in the Review pane to inspect diffs, stage, unstage and commit; plus audio attachments, image commenting and rich MCP tool execution previews. 2.11.0 (26 Aug): generative UI rendering HTML artifacts inline; @path/to/file inlining inside AGENTS.md and custom rule files; a rules: key binding rule files to an agent; and discovery of custom skills, agents and rules from skills.json, agents.json and rules.json in project subdirectories. Thirty fixes in 2.11.0 include command permission allow and deny rules being ignored after migration to the updated permissions system. CLI 1.1.13–1.1.22 and IDE/SDK 0.1.13–0.1.15 shipped in the same window; both streams are now itemisable, closing a standing flag. | Antigravity changelog |
| Google Gemini Enterprise (developer tools)Generally available (Aug 18)Agent tooling / Governance | AI developer tools generally available, 18 August, for Standard, Plus and Pay-as-you-go editions on invoiced billing, covering Antigravity 2.0, Antigravity CLI and Android Studio. Capabilities as published: administrative controls to enable or disable the tools, configure security policies such as file access and terminal command execution, and manage model availability; a usage metrics dashboard for developer adoption, active users, token consumption and API call volumes through Cloud Monitoring and logging; access manageable through a custom IAM role. Antigravity for IDEs followed on 20 August, and the Standard Emerging Market edition on 21 August. This establishes what the Antigravity CLI, SDK and IDE surfaces are: the coding tier of a licensed enterprise product, governed by administrator policy over file access and terminal command execution. | Gemini Enterprise release notes |
| Google Gemini Enterprise (connectors)Public Preview / GA (Aug 21–24)Connectors / Write scope | New data stores in Public Preview, 21 August: Atlan, Bitly, FactSet AI-Ready Data, FullStory, Globalping, Pendo and Stripe. New write actions in the same entry: Supabase apply migration, deploy edge function, execute SQL, pause project and restore project; Descript import media, prompt project agent and publish project; Gamma generate; Bitly create and update short links and QR codes. Two editions ago this series counted seventeen new read stores against one new write action and called the ratio a governance posture; the new actions are now overwhelmingly writes, and the most consequential are infrastructure operations rather than content operations. 24 August: D&B Commercial Graph data store in Public Preview, and Cloud Monitoring observability for data connectors, with dataconnector/request_count gaining tool_id, engine_id and response_code dimensions and a new dataconnector/request_latencies metric in beta. | Gemini Enterprise release notes |
| Google Gemini Enterprise (agents and identity)Generally available (Aug 14–26)Agent interop / Identity | Registering A2UI and A2A agents reaches general availability, 17 August, up from Public Preview, with A2UI v0.9 alongside v0.8; the A2UI Material catalog was updated again on 26 August, replacing the static required boolean on input components with a reactive validation-checks rule array. Google Identity support for third-party data stores, GA, 20 August, supported and recommended for managing access when connecting third-party sources with external identity providers such as Microsoft Entra ID or Okta over OIDC or SAML 2.0, covering all third-party federated and ingestion connectors except Microsoft 365 ingestion. Okta SCIM autocomplete when sharing notebooks and agents, 20 August. Gemini 3.6 Flash GA in the us and eu multi-regions, 18 August, and Gemini 3.7 Flash GA in the mobile app, 14 August. Seat quantity limits, 19 August: up to 25 seats for self-serve and resold accounts, up to 1,000 for invoiced accounts. | Gemini Enterprise release notes |
| OpenAI ChatGPTShipped (Aug 25)Agentic execution / Triggers | Scheduled tasks respond to app updates and can be shared, 25 August. Webhook triggers for Gmail, Slack and GitHub: a task can act when new messages arrive or a pull request changes. Actions requiring approval are paused until reviewed. Free users may hold three active scheduled tasks at a daily maximum; webhook-triggered tasks require Work access. Shared tasks let recipients customise instructions, connect their own apps and take independent copies. | ChatGPT release notes |
| OpenAI ChatGPT WorkShipped (Aug 25)Agentic execution / Credentials | Completing tasks on signed-in websites, 25 August. ChatGPT Work can handle authenticated logins on supported sites. The user enters credentials securely, ChatGPT cannot access or store passwords, and sessions may persist for future tasks. Available on Plus and Pro, with named use cases including appointment booking, form completion and navigating an insurance portal. The credential handling is stated; the session lifetime, revocation path and behaviour on password rotation or an MFA challenge are not. | ChatGPT release notes |
| OpenAI (Admin plugin)Shipped (Aug 25)Administration / Write scope | Admin plugin for ChatGPT Work and Codex, 25 August. Administrators can, in one conversation: review activity and credit usage across Work and Codex and see when members or groups approach limits; add or remove members, update groups and run onboarding, offboarding and team changes; review effective permissions, diagnose access issues, and control feature or model access by role or group; and adjust usage limits and spending for members, groups and workspaces, reviewing requests against current usage and approving or denying them with context. It also automates recurring admin workflows without custom engineering, for example routing pending usage requests into Slack or Microsoft Teams for authorised reviewers, and automatically granting feature access when requests meet policy. The published governance model, which is the point: it works within each user’s existing role and permissions and does not grant broader access; each instruction maps to the appropriate supported read or write action and returns a structured result; Admin Console capabilities are exposed as permission-aware tools honouring workspace policies and approval requirements; for each change admins see what was requested, whether it completed and what changed; and actions with broader impact can be reviewed before they are applied. | OpenAI |
| OpenAI (data handling)Shipped / Preview (Aug 19)Data handling / Enterprise | Zero data retention for frontier models, 19 August. Eligible API customers get a stated guarantee: once a request is processed OpenAI retains neither the prompts nor the model’s responses, OpenAI staff cannot access customer content to review it, and enterprise customer data is not used to train the models. Published with it is a preview of “private processing for safety”, described as strengthening safeguards across multiple interactions while remaining compatible with zero data retention. That combination is the part to watch, since cross-interaction safety normally implies retaining something. | OpenAI |
| OpenAI (media)Launched (Aug 18, live Aug 24)Media / Measurement | ChatGPT Ads expands across Europe, announced 18 August, live from 24 August, in 31 countries including Italy, Germany, France, Spain, Sweden, Norway, Denmark, the Netherlands and Austria. Bidding spans CPM, CPC and oCPC; geographic targeting and custom audiences are supported; and measurement extends past clicks through an OpenAI Pixel, a Conversions API and third-party measurement integrations. OpenAI states ads are clearly identified, separated from responses, and that advertising does not influence the answers ChatGPT gives. Reported in full in the MarTech series, because a pixel and a conversions API put OpenAI inside every server-side tagging, consent-scope and incrementality conversation from now on. Recorded here as the clearest evidence yet that the assistant is also a media channel with an auction attached. | OpenAI |
| OpenAI ChatGPT (20 Aug)Shipped (Aug 20)Product / Connectors | Apple Messages plugin for Codex and Work on Apple silicon Macs, reading and searching iMessage, SMS and RCS and preparing or sending messages, subject to user approval. Computer History available in the EEA, Switzerland and the UK for Pro users on macOS, off by default and requiring Memories. Codex chat snapshots shareable by personal link, read-only and static, redacting known secrets with an explicit instruction that users should still review before sharing. Site owners on Plus and Pro can change ChatGPT-hosted URLs with routes and parameters preserved on redirect. Pinned chats sync between desktop and iOS. | ChatGPT release notes |
| OpenAI ChatGPT (14 Aug)Shipped (Aug 14)Memory / Platform | Project-only memory settings for existing eligible unshared projects, isolating conversations and memories inside a project so nothing outside is referenced; changes take several hours, shared projects remain project-only, and ChatGPT Work is unavailable in project-only mode. Linux desktop public preview on Ubuntu 24.04 and 26.04 LTS, Debian 13 and Fedora 43 and 44, with browser actions supported and desktop app control not yet. Interactive quizzes across consumer and Edu plans; homepage suggestions from chat history and connected tools for paid users. | ChatGPT release notes |
| OpenAI ChatGPT Enterprise & EduShipped (Aug 13–20)Administration / Identity | 20 August: workspace-scoped Admin APIs automating invitation and member administration, covering listing, retrieving, creating, resending and deleting invitations and retrieving members and updating built-in roles. Global Admin Console now shows which tenant or workspace you are in, with workspace-specific URLs and members limited to their own analytics. Personal Analytics plugin extended to Work and Codex, read-only. ChatGPT Sites collaboration, with owners adding workspace members as editors while retaining sharing, analytics and ownership. Plugin catalogue CSV export for review. Late captures dated 13 August, not recorded in the previous edition: additive role-based access controls with permissions set to Default, On or Off and an explicit Off in any applicable role preventing access; Codex service accounts, non-human accounts for automation with assigned roles and groups and scoped access tokens; and per-chat lifetime credit usage for credit-based workspaces. | ChatGPT Enterprise & Edu release notes |
| Microsoft 365 CopilotNo items in windown/a | Nothing reportable under this series’ relevant-only rule. The 25 August section covers 11 to 25 August and contains Python in Edit with Copilot in Excel with existing security and execution controls unchanged, Viva Engage private community content as a permission-scoped grounding source, a Copilot Notebooks UX revision, Copilot Chat in the side pane during Copilot Search, and Organizational Messages support for hybrid-joined devices. Agent 365 connected agents via Agent2Agent was expected to reach general availability in August; no announcement located, a third consecutive edition with that expectation unmet, while Google took its own A2A agent registration to GA on 17 August. | Copilot release notes |
| Anthropic (newsroom)No items in windown/a | No items in window. Newest remains Claude Opus 5, 24 July 2026. | Anthropic newsroom |
A note on method, because it changed the edition
This edition was scanned twice. The first pass ran without the browser, using full-page retrieval with complete text extraction; the second pass re-read every material source in the browser. The two agreed exactly on the Anthropic release notes, the Claude Desktop changelog, the Gemini Enterprise release notes, the Antigravity changelog and the Microsoft Copilot notes.
The second pass changed one thing, and it is the largest single addition to this edition: the OpenAI newsroom, unreachable on the first pass and honestly reported as unverified, turned out to hold three in-window items, including the Admin plugin that reframes the whole edition and the ChatGPT Ads expansion that belongs to the sibling series. The general lesson, recorded in both series: an unreachable source is unknown, not quiet, and the gap between those two words was worth three items this fortnight.
Google Workspace updates were scanned with nothing in scope and are not itemised.
Cross-notes to the MarTech series
Also covered in MarTech Watch, Week 35:
- Tealium shipped a Configuration MCP on 26 August that lets an agent read and update the server-side profile configuration of a CDP in natural language, then shipped a read-only chat interface over the same configuration a day later. The clearest same-vendor demonstration that read and write agent surfaces are separable by choice rather than by technical necessity.
- Braze made Operator generally available on 20 August, able to create and edit Canvases and act on admin and settings pages, with an Auto-approve actions setting. Discussed above against Anthropic’s approval hardening in the same fortnight.
- Salesforce took Data 360 MCP to GA on 19 August, roughly 200 APIs including audience segment creation, and expanded Headless 360 across every cloud with 100-plus Agent Skills. Permission inheritance and audit attribution are published; session lifetime and revocation path are not.
- Treasure AI shipped Action Schedules on 25 August, unattended cron execution of saved agentic workflows under a named human account.
- Insider One and Anthropic announced a partnership on 20 August, putting Claude into a customer engagement platform’s insights, content, segmentation, journey orchestration and its Agent One agents. Insider One has now announced partnerships with OpenAI, Google and Anthropic inside six months.
- The Dutch data protection authority fined Uber €824,990,000 on 21 August for fully automated decisions about drivers taken with no human assessment, and for not adequately informing them that the decisions were automated; the conduct ran from 2018 to 2022. The CNIL, which cooperated, published on 24 August, and the issuing authority’s date is the 21st. The largest sum yet attached to the absence of a human in a consequential automated decision, in the same fortnight this series recorded unattended, credentialled, event-triggered execution arriving at four vendors.
- Optimove published an actual MCP write scope, in a note under a feature bullet: missions are created as drafts requiring manual activation, and the MCP cannot edit or delete existing entities. With OpenAI’s Admin plugin it is one of only two published agent write boundaries across both series this fortnight.
Watching next (Week 36)
- Persistent authenticated web sessions in ChatGPT Work: how long they last, how they are revoked, what happens on password rotation or an MFA challenge.
- Which actions count as “requiring approval” in webhook-triggered tasks, and whether the classification is visible or configurable.
- Codex service accounts: token scope, lifetime, rotation and audit attribution for non-human identities.
- Agent 365 connected agents via Agent2Agent, a fourth edition of waiting.
- Skill format convergence, or the absence of it, across Anthropic scanning, Gemini Enterprise approval queues, Antigravity
skills.jsondiscovery and Treasure AI work folder skills. - Anthropic skill and plugin scanning semantics, unpublished three weeks after the beta shipped.
- Zero data retention alongside “private processing for safety”: how cross-interaction safeguards work without retention, and whether a technical write-up follows.
- The Admin plugin’s five published guarantees as the benchmark to hold every other agent-writes-configuration surface against, in both series.
How this is compiled. Each edition is assembled from official release notes, changelogs, and corporate newsrooms, with AI assistance for the first-pass scan, then reviewed and edited by me before publishing. Items are checked against the primary source and anything I could not confirm is flagged inline. Dates and status reflect what was published as of the current as of date and can change. A note on method for this edition: the usual browser-based scan was unavailable, so pages were retrieved and converted in full rather than summarised, and client-rendered pages were read through their own machine-readable routes. One consequence worth recording: the Antigravity changelog, flagged in earlier editions as readable only in a browser, proved fully retrievable this way, including its separate 2.0, CLI, SDK and IDE streams.
Corrections and method notes. If something here is wrong or has moved on, tell me and it will be corrected in the next edition. Three ChatGPT Enterprise items dated 13 August are recorded above as late captures because they were missed by the Week 33 edition: additive role-based access controls, Codex service accounts, and per-chat credit usage. They are dated to 13 August, not to this window.
One correction to the previous edition of the sibling series and to earlier drafts of this one: the Uber decision is dated 21 August by the issuing authority, the Dutch Autoriteit Persoonsgegevens, not 24 August, which is the date the cooperating CNIL published its own note.
AI Watch is compiled and edited by Andrea Veggiani, Head of Cross-Channel Marketing & MarTech Solutions at BitBang.