The Weekend Read: The Control Point Moved to the Loop

Three groups with nothing in common spent this week reaching the same conclusion. Brussels switched on the enforceable half of the AI Act. Las Vegas filled a security conference with agent exploits. Anthropic shipped a checkpoint that sits between a tool’s response and the model. None of them were arguing about model capabilities.

The week’s central shift

For three years the industry’s mental model of AI governance was model-shaped. You classify the system, you certify the risky ones, you audit the frontier labs, and the artifact you govern is a set of weights with a model card attached. The AI Act was drafted around exactly that picture. This week the picture quietly stopped being the operative one.

What became enforceable on August 2 was not the high-risk regime. The amending package — the Digital Omnibus on AI — pushed those obligations out: standalone Annex III systems to December 2, 2027, product-embedded Annex I systems to August 2, 2028. What landed instead was Article 50 transparency: tell people they are talking to a machine, mark generated content in a machine-readable way, disclose deepfakes, disclose emotion recognition and biometric categorization — plus enforcement powers over general-purpose models and the penalty regime standing behind them. Systems already on the market get until December 2, 2026.

Put the two lists side by side, because the split is not arbitrary. The deferred obligations are the ones you discharge by certifying an artifact before it ships — conformity assessment, technical documentation, a file you hand an auditor. The obligations that actually landed are the ones you discharge at runtime, per interaction, inside the running system. The certifiable half slipped two years. The observable half is live now.

Security walked to the same boundary from the opposite direction. At Black Hat USA this week, 35 of 121 briefings — 29 percent — covered AI security, and the offensive research has largely moved off base models onto agent stacks: framework runtimes, cloud platforms, compute clusters, tooling. The recurring message from researchers and vendors was that agent access should be scoped, logged, and governed with the rigor applied to privileged human identities. Which is the correct framing, because that is what an agent holding a token actually is — a privileged identity that improvises.

The numbers presented there make the asymmetry concrete. Palo Alto’s Unit 42 ran an autonomous vulnerability system across 3,915 open source projects over two months and surfaced 14,090 findings, 99.4 percent of them previously unreported, with 92 percent involving semantic or logic problems that conventional fuzzing doesn’t catch. Dataminr put median patching time at 43 days against attacker breakout time under 30 minutes. Autonomy is compounding on both sides of that gap, and the defensive side is bottlenecked on a human review step that does not scale the way the offensive side does.

Then the product move that names the shift outright. On August 5 Anthropic put inference hooks into beta for Claude Enterprise: every prompt and every tool-call response routes over a signed WebSocket to the customer’s own DLP server, which allows or denies before the content reaches the model. It covers chat, Claude Code, and Cowork, and it covers responses coming back through MCP connectors, skills, and plugins — one switch at the organization level.

The interesting part is not data loss prevention. It is where the checkpoint sits: on the tool-call return path. That placement concedes something the field spent two years resisting — the risky content is rarely what the model was trained on. It is what the loop pulls in halfway through a task, from a document or an API or a web page nobody reviewed. Put that way, prompt injection stops being an alignment problem and becomes an ingress filtering problem, which is a category enterprises already know how to staff, budget, and audit.

A regulator writing runtime disclosure duties, a research community attacking runtimes, and a lab shipping a runtime policy hook are three descriptions of one control point. The unit of governance is no longer the model. It is the loop the model runs inside.

Signals

Capital went to atoms. The largest rounds of August 1–7 were Hadrian at $1.37 billion for automated factories at a $7.87 billion valuation, then Base Power and Valar Atomics at $1 billion each. Pure software AI appeared further down the list — Volta at $300 million for infrastructure, HappyRobot at $150 million for agentic AI. The marginal venture dollar is buying physical constraints, factories and power, rather than another model.

Agent credentials are being farmed. BeyondTrust’s Phantom Labs found that 75 percent of 400-plus investigations involved identity or privilege abuse. CrowdStrike’s 2026 threat hunting report logged a 2.5-fold rise in detection leads triggered by AI agents, device-code phishing up fifteenfold, and one LLM-jacking operation pushing more than 200,000 API requests in two minutes. The attack has shifted from the model to the key that lets the agent act.

The transparency clock is already running. If you ship a chatbot into the EU or generate content for European users, machine-readable marking and interaction disclosure became engineering tickets with a date on them, not a policy discussion — December 2, 2026 for anything already in market. On BONO we treat that as a data-model question rather than a UI one: if provenance isn’t a column, you will be retrofitting it under deadline.

Security vendors turned the tools on themselves. The vendor floor at Black Hat went agentic this year, which is the usual pattern — the defensive tooling adopts the architecture roughly one cycle after the offensive research proves it works.

Worth your time

• Anthropic on inference hooks — skip the announcement framing and read the protocol; the placement of the checkpoint is the argument.
• Data Protection Report on what is actually enforceable — the clearest short account of which AI Act duties moved and which did not.
• Black Hat 2026 research roundup — worth it for the patching-time versus breakout-time comparison alone.

There is a practical consequence for anyone building this way. If the loop is the thing being governed, then your compliance story and your security story collapse into the same artifact: the trace. What the agent was asked, what it called, what came back, what it decided, and under whose authority. I have argued before that supervision moves from checking each step to writing the policy the steps run under. This week is the infrastructure catching up to that — the checkpoint, the disclosure duty, and the audit log are all landing at the same seam. Build the trace before someone requires it of you. It is a much better artifact when it is designed rather than reconstructed.