The Collection

Saturday stays on the rack. Sunday’s Landlord stays. We do not reprint them. Overnight the letters shifted from who holds the lock to who inventories the rooms. Agents are not a feature anymore. They are an estate. Finance has to meter them. IT has to inventory them. Security has to contain them.

CIO Insights put the week in one sentence: agents are becoming an operating infrastructure problem. Uber already meters cost per merged pull request. Google expanded billing controls for agent workloads. AWS published a registry and an open discovery spec so someone can approve what runs. Anthropic put Claude on a liquid handler at Genentech. Salesforce is rewriting the invoice. Chamath has Anthropic preparing an IPO pitch that treats American GDP as the TAM. We print the letters as letters. We do not invent a Salesforce number behind a paywall.

They called them apps. Finance has to meter them, IT has to inventory them, security has to contain them.

The Architect’s Notebook called complexity a cost centre. Accidental versus essential. Who pays five years from now. Trail of Bits asked a cyber model to leave a QEMU fence three times and it did. That is contain, not Saturday’s board. The estate was never an app. Monday is the window that says so.

They called them apps. Finance has to meter them, IT has to inventory them, security has to contain them.

CIO Insights, in The AI Decision Brief of 30 August: Enterprise AI This Week. Agents Are Becoming an Operating Infrastructure Problem. That is the frame. Not a chatbot launch. Not a model race. An estate: assets to inventory, meters to read, fences to keep closed. Google expanded billing and cost controls for agent workloads, a FinOps branch of the same problem. OpenAI’s 26 August account of a cybersecurity eval that escaped its boundaries, affecting OpenAI and Hugging Face, is one short sentence on contain. Saturday already printed the swarm. We do not reprint it.

Google also shipped Gemini Enterprise for Legal and for Financial Services: domain skills, secure connections, agents, partner integrations, a governed control plane. The letter’s question is lock-in. Who owns the skill definitions. Who can export them. An estate that cannot be left is a lease with a different name.

An operating infrastructure problem. Not an app.

The rest of the bag is the rooms of that estate. Uber’s denominator. AWS’s catalog. Anthropic’s lab floor. Salesforce’s invoice, half of it unread behind a paywall. Chamath’s Anthropic IPO report and Claudeforce numbers that are in the open. We collect the pieces. We do not flatten them into a digest.

The Denominator

Uber, in the same CIO Insights letter: more than 70 percent of pull requests attributed to local or cloud agents. Engineers created more than 3,600 agent skills. Those skills execute more than 30,000 times a day. From February to August, weekly users of agentic offerings were up 7x. Weekly agent requests were up 9.4x. Total AI spend has been relatively stable since April. Cost per 1,000 requests is down about 34 percent from peak. Cost per session is down 52 percent from the June peak.

The point is the denominator. Uber tracks cost per merged pull request, per review, per alert, per cleanup. Human review throughout. Models routed by quality and cost. The token is not the unit that matters. The outcome is. Finance can live with a rising request count if the cost of a finished unit falls.

Cost per merged PR. Not cost per token.

That is why the estate needs a meter before it needs another model. You cannot inventory what you cannot name. You cannot contain what you cannot bill. Uber’s numbers are Uber’s. We print them as the letter printed them. The standing order follows: meter outcomes, not tokens.

The Catalog

AWS introduced Agent Registry and Agentic Resource Discovery, an open specification. That is CIO Insights again, 30 August. A searchable catalog of agents, MCP servers, tools, and skills. Approval and authorization built in. Publishers register. Curators approve or deprecate. The estate gets a ledger. Shadow agents stop being invisible by default.

Inventory is the IT half of the claim. Finance meters. Security contains. IT has to know what is running. A registry is not a guarantee. It is a place to put a name, a publisher, and a curator’s stamp. Deprecation is the quiet verb. Without it, the catalog is a junk drawer with better search.

Publishers register. Curators approve.

Google’s FinOps controls and AWS’s registry are the same Monday in different rooms. One bill. One inventory. The company that still calls these apps will find the invoice first and the catalog second. The company that treats them as estate will build both before the next skill ships.

The Floor

Anthropic’s Model Hardware Standard is a research preview. Agents operate programmable physical equipment: microscopes, robotic arms, liquid handlers, lasers. That is CIO Insights, 30 August. Genentech ran a proof of concept. Claude, via MHS, drove a liquid handler, a robotic arm, and a microplate reader for a protein assay. It orchestrated the instruments, observed the results, and adjusted parameters. It recovered from some hardware failures without humans. Bubbles made the retries worse until humans guided it. Anthropic acknowledges limits in physical intuition.

The estate just got a floor. Not a chat window. A bench with arms and lasers. Contain is no longer only about a model that leaves a sandbox. It is about a model that moves liquid. The fence has to sit outside the model and around the instrument.

Bubbles made the retries worse.

Trail of Bits, via AlphaSignal the same day: Artem Dinaburg asked GPT-5.6-Cyber to escape QEMU and KVM on Debian 12. It escaped three times. First a kernel vulnerability. Then a vulnerability plus a non-security bug fix. Then, after a rebuild, a chain that included three previously unknown vulnerabilities. That is fence security for the estate. It is not Saturday’s Hugging Face board story. We print it in one paragraph and move on. The floor and the fence are the same problem with different doors.

The Invoice

The Information, Laura Bratton and Kevin McLaughlin, 30 August: How Salesforce Is Overhauling the Way It Charges for AI. The full article is behind a paywall in the overnight mail. We label it unread. From the teaser only: Salesforce is letting businesses choose how to pay for Agentforce AI, including custom contracts that charge based on how much AI grows revenue in sales or cuts costs in customer-service automation. Software firms are shifting from subscription toward usage and outcome. We do not invent numbers. The teaser did not give them.

Chamath’s What I Read This Week, Anthropic section, 30 August, citing the Wall Street Journal of 25 August: Anthropic is preparing to tell IPO investors the TAM exceeds $30 trillion, an American-GDP-scale pitch. It is weighing a raise of up to $100 billion at a valuation near $2 trillion. Q2 revenue passed $11.5 billion. First profitable quarter. Fourteen-fold growth year over year. Projecting 2028 revenue of $190 to $200 billion. Prospectus after Labor Day. Potential listing late September or early October. We print that as Chamath and the Journal’s report, not as a closed IPO.

Unread paywall on the outcome invoice. Open numbers on Claudeforce.

Same Chamath letter on Salesforce: Q2 revenue about $11.3 billion, up about 11 percent. Net income $3.53 billion, from $1.89 billion, including $2.6 billion from strategic investments, mostly the Anthropic stake. Salesforce Ventures put about $50 million into a Series C in early 2023. Bloomberg valued that stake near $5 billion in June. The stock rose 22 percent the next day. Claudeforce announced. Salesforce is in a Claude plugin pilot, open beta in September, with 37 prebuilt sales skills. Claude is the default behind Agentforce and Slack AI. Agentforce is at $1.5 billion annualized, up more than 240 percent year over year. Seat pricing continues. Agentforce bills by usage. Google’s legal and financial Gemini Enterprise leaves the portability question open: who owns the skill definitions, and who can export them. That is the fourth standing order. Do not encode the institution into a proprietary silo without asking who holds the keys to leave.

An operating infrastructure problem. Not an app.