State of AI for development: August 2026

Three things from August that we think change decisions, and what we are telling clients to do about each.

SpaceX bought Cursor and OpenAI cut it off

SpaceX closed its $60 billion acquisition of Cursor, bringing it into the same company as Grok. Two weeks later OpenAI said it would stop supplying models to Cursor from 12 November. In between, Cursor launched its own Git hosting and a persistent AI teammate built on Grok. A team that standardised on Cursor in the spring now has an IDE with a new owner, is about to lose one of its main model providers and is being steered towards a new model and a new place to keep its code, without having made any of those decisions.

What we are telling clients: treat agent tooling as supply chain. Most of the companies in this layer are two or three years old, and acquisition, cut-off or a pivot to their own model are all live outcomes for each of them. Work out how much of your setup would survive a vendor change. Agent Plugins 1.0, a packaging format for skills and MCP servers that OpenAI, GitHub, Microsoft, AWS, Cursor and Google signed this month, covers the skills and MCP server packages. Our estimate is that a team whose setup lives in that format, with its remaining tool-specific rules kept small, can move in about a week where one with everything in a vendor folder would take a quarter. Keep a second tool in light use so the muscle memory exists, and apply more scrutiny to vendors you would be uncomfortable holding your source code.

Meta scrapped its agent-led reorganisation

Reuters reported that Meta has abandoned Project OT, its plan to reorganise engineering around AI agents and reduce headcount to match. The internal data that leaked with it showed code changes up 220 per cent year on year, changes reaching users up 36 per cent and major incidents up 40 per cent. The second planned wave of AI-driven layoffs was cancelled.

What we are telling clients: this matches DX’s data across 121,000 developers, Faros’s incident figures and METR’s original study, and it comes from a company that bet its organisation design on the opposite outcome at a scale nobody else can test. Generation rises sharply, delivery rises modestly and instability rises unless review, testing, release and incident handling absorb the extra volume. If you are planning headcount or structure changes on the back of AI productivity, measure delivered change and incident rate on your own teams first. Put the next unit of investment into the engineering downstream of generation.

Attacks moved to the agent’s standing access

ChainDrop, an npm worm, poisoned 444 packages in under four hours and was written to harvest AI coding-tool credentials. Ghostjacking, presented at DEF CON, is prompt injection through the material an agent reads anyway: error logs, monitoring alerts and bug reports. An Anthropic and EPFL paper showed instructions spreading between agents through persistent files such as CLAUDE.md and MEMORY.md. In each case the model held and the attack used the access and trust the agent already had.

What we are telling clients: the rules files, skills and plugins a team shares run with the agent’s permissions, which makes them code, and most organisations still treat them as documentation. Put them under the same review gate as code, with a named owner. Scope agent credentials tightly and treat anything the agent reads from outside as untrusted input. The paper found a single warning paragraph in the agent’s system prompt near-eliminates the spread, so add one there and treat the shared rules files themselves as untrusted instructions under review. Keep skills from unreviewed sources out of client-facing repositories.

---

This digest is the public edition. Advisory clients get the full monthly review, a tailored edition for their context and the conversation that goes with it.