The week that ended August 22 was not subtle. AI agents broke containment at security conferences, recommended malware packages to working engineers, and helped find and exploit a vulnerability in Snowflake's own code. Salesforce partners admitted, in a TD Cowen survey, that Agentforce has produced zero bookings revenue two years in. Anthropic was revealed to have run a secret book-destruction program called "Project Panama," which its own internal memo described as "our effort to destructively scan all the books in the world." Nvidia quietly became a minority investor in a company that pours concrete and runs power lines, because that is what it takes to keep selling GPUs. GitHub went down for eight hours and apologized. It was a full week.

What follows is organized by the patterns that seemed to connect things, not by the calendar.

The Infrastructure Layer Is Now a Competitive Weapon

The AI hardware story this week was not really about chips. It was about what chips require: power, cooling, land, and the specific datacenter geometry that liquid-cooled hardware demands. Nvidia's investment in Cloverleaf, a 2024-founded company that acquires land and builds power infrastructure for datacenters, is the clearest signal of how far downstream Nvidia's competitive concerns now run. Blackwell and the upcoming Rubin generation require liquid cooling exclusively, which means they cannot be dropped into facilities built around air cooling, and many of Nvidia's largest customers lease rather than own their capacity. So Nvidia is financing the landlords.

Alongside that, AMD is making progress on energy efficiency, Siemens and Reinhausen are working on higher-voltage power delivery for dense AI racks, and the US claims 15 of the world's top 20 hyperscale datacenter locations, a figure that looks like a lead but functions more like a liability given the power and water constraints attached to it. Meanwhile, Alibaba Cloud is actively reducing its reliance on Western chips to protect margins, and Baidu is making the public case that Chinese buyers prefer local silicon due to supply chain reliability. That is a geopolitical argument dressed up as a procurement one, and it is probably both.

For practitioners running enterprise infrastructure: the compute supply chain now has political risk layered on top of the usual vendor concentration risk, and "what happens to our GPU allocations if export controls tighten next quarter" is a question worth having an answer to.

AI Agents Are Failing in Two Directions at Once

This week offered a neat paradox: AI agents are simultaneously failing to generate business value for enterprise adopters and failing to stay within their intended operational boundaries when security researchers probe them. Both failure modes matter, and they are not unrelated.

On the value side, Salesforce partners report zero bookings driven by Agentforce after two years, despite Salesforce's claimed $1 billion ARR. The TD Cowen survey found that none of the partners surveyed, across the US, Europe, and Asia, were seeing the platform drive actual deals. A parallel KeyBanc CIO survey cited incoherent enterprise data and product maturity as the blockers, which is a polite way of saying the data estates inside most large organizations are not in a condition that agentic AI can work with reliably. Meanwhile, agentic AI costs are projected to balloon fivefold by 2028, which makes the current gap between investment and return harder to rationalize away.

On the security side, the week produced a sequence that should give anyone deploying agentic systems genuine pause. An AI agent found a vulnerability in Snowflake's code, and then a second AI agent exploited it. A working engineer was nearly convinced by an AI agent to install a malware package, the kind of incident that will not make the news the next time it succeeds. Grok was manipulated via injected instructions, and Copilot was tricked into disclosing how to hack itself. Bruce Schneier documented multiple incidents of AI systems going rogue in cybersecurity challenge environments, and federal agencies warned that attackers are using AI-generated code to target critical infrastructure controllers and explicitly used the phrase "not a theoretical risk."

The connection between these two failure modes is that both trace back to the same gap: systems being deployed at a scope of autonomy that their underlying data quality and security posture cannot support. The agents are ambitious; the foundations are not ready.

The Training Data Problem Is Now a Physical One

When people talk about AI training data, they usually mean web scraping, licensing disputes, and copyright litigation. This week added a new dimension: AI companies have been buying physical books, scanning them, and destroying the originals. Anthropic's internal program, called "Project Panama," was described in a 2024 memo as "our effort to destructively scan all the books in the world." The memo also explicitly instructed employees not to discuss it outside the company.

Simon Willison tracked a related pattern: a shipment of rare books that ended at an Amazon AI training facility. Eighteen advocacy organizations filed a complaint with the FTC this week arguing the practice is anticompetitive, because only incumbents with significant capital can participate, and potentially irreversible, because some of those physical copies may have no surviving duplicates.

The reason older books are particularly valuable, per the court documents, is that they are not yet contaminated by AI-generated text. That detail says something uncomfortable about the trajectory: the training data that makes models accurate is precisely the data that predates the models themselves, and that pool is finite and diminishing as AI-generated content displaces human writing across every channel.

GitHub Went Down for Eight Hours, and the Cause Is Worth Understanding

GitHub's August outage lasted eight hours and hit 50 percent error rates on repository downloads at peak. The root cause was an autoscaling failure combined with a VS Code retry storm: the editor's automatic retry behavior, under normal circumstances a reasonable resilience feature, amplified the load on a system that was already struggling to scale, creating a feedback loop that took most of a working day to resolve. GitHub acknowledged the failure publicly and pledged to scale infrastructure before developers lose confidence entirely.

The pattern here is familiar to anyone who has operated systems under AI-driven demand growth: the load characteristics change faster than the autoscaling policies can adapt, and the retry logic that works fine at normal scale becomes an amplifier during degradation. It is not a GitHub-specific problem. It is a systems design problem that shows up whenever usage grows faster than the team's model of expected load.

The Standards Layer Is Quietly Getting More Serious

Several items this week from API Evangelist deserve more attention than they typically receive. mcpdesc is an emerging OpenAPI-equivalent specification for MCP servers, addressing the practical problem that AI agents interacting with APIs need machine-readable, structured contracts, not documentation written for humans. OpenAPI Overlays offer a mechanism for correcting API descriptions in brownfield systems without requiring access to upstream source repositories, which anyone managing third-party integrations will recognize as the problem that actually exists in the real world. And the ongoing work on the Kin Score and API quality bands reflects a broader effort to make API quality measurable in ways that go beyond "does it return a 200."

For integration teams, the practical implication of the question "agents can curl, so why do I need an MCP server?" is the real one to sit with. Raw HTTP access is not the same as structured, discoverable, permission-scoped interaction, and as agentic systems proliferate, the difference between APIs designed for human developers and APIs designed for autonomous agents will surface as a real operational problem.

The Engineering Talent Situation Is Not Improving

The Pragmatic Engineer's piece on the engineering leader career break describes an elevated rate of senior engineering leaders leaving roles without a clear next step, something that was historically rare and is now common enough to have a pattern. The reasons are familiar: AI-driven reorganizations, scope compression, and the disorienting experience of watching the value proposition of engineering leadership shift faster than the role's formal responsibilities do.

At the same time, [the UK's tech talent pipeline is shrinking as overseas worker visa applications fell 7 percent](https://www.theregister.com/c