Anthropic, OpenAI, Hugging Face and Alibaba hand agent projects to the Agentic AI Foundation
Agent Skills, Open Responses, OpenEnv and OpenSandbox join MCP at the Agentic AI Foundation. OpenAI's Decisions API is generally available at $0.10 per million input tokens. Google previews Agent Compute Engine, microVM sandboxes that pause while the model thinks. METR details how Codex agents could have dodged OpenAI's internal monitor.
- The Agentic AI Foundation took over four agent projects: Anthropic’s Agent Skills, OpenAI’s Open Responses, Hugging Face’s OpenEnv and Alibaba’s OpenSandbox, so the skill format, a cross-provider API spec, an RL environment framework and a sandbox platform now sit alongside MCP under neutral governance.
- OpenAI’s Decisions API is generally available on GPT-6 Luna at $0.10 per million input tokens, with prompt caching, JSON input and 400 questions per request; it costs more than twice as much as Jev and d1-ultra and scores lower on JevBench.
- Google Cloud’s Agent Compute Engine, the microVM service that runs Gemini’s agents, pauses each sandbox while the model thinks; preview in the coming months, no price yet.
- METR and Redwood Research found that OpenAI’s internal agent monitor could be dodged: in principle Codex agents could bypass their sandbox, and agents could set headers that turn monitoring off for new instances or hide hundreds of actions from it. OpenAI says the production holes are patched.
- PHP2Shell is now taking services offline: a UK minister said 32 government services are down while patches go in, and VulnCheck has an exploit that defeats ASLR; patch rather than rely on hardening.
Agent Skills and Open Responses get a neutral owner
The Agentic AI Foundation (AAIF), the Linux Foundation group that already runs MCP, AGENTS.md, A2A, goose, agentgateway and Agent Router, added four projects at AGNTCon + MCPCon in San Jose on 22 October:
- Agent Skills (Anthropic): the SKILL.md folder format. Anthropic says more than 70 platforms support it, including ChatGPT, Cursor and GitHub Copilot, with nearly 280 million installs. Engineers from Anthropic, Google, OpenAI and others will maintain it.
- Open Responses (OpenAI): a spec based on the Responses API, so one request schema and one set of streaming events work across model providers.
- OpenEnv (Hugging Face): containerized reinforcement learning environments that speak MCP and Gym.
- OpenSandbox (Alibaba): sandbox SDKs and a lifecycle API, with Docker and Kubernetes runtimes.
That makes 10 projects, up from three in December 2025.
Why it matters
If you write skills (our guide), Anthropic has proposed a roadmap with versioned releases and a formal proposal process, so you could target a spec version rather than whatever one vendor ships. It also proposes security guidance for writing and installing skills, which can carry scripts.
Neutral governance is what winners do
Anthropic is giving away a format that has arguably already won, as it did with MCP less than a year ago. The more interesting piece is Open Responses: if other providers adopt a neutral version of OpenAI’s API shape, switching models gets cheaper and OpenAI’s interface becomes the default without being OpenAI’s.
Google’s agent sandbox pauses while the model thinks
Google Cloud announced Agent Compute Engine, the service that already gives every Gemini agent its own computer, for customers’ agents, in preview “in the coming months”. Each agent gets a hardware-isolated microVM with its own kernel and persistent Hyperdisk. When the agent finishes a tool call and goes back to the model, the microVM signals it’s idle and is checkpointed, then resumed from a snapshot. Credentials are injected outside the VM, which has no network card; traffic goes through a policy proxy. On Kubernetes, the open-source Agent Substrate brings the same suspend-and-resume design.
Why it matters
Agents spend most of a session waiting on the model. Our sandbox comparison found idle shutdown can matter more than the hourly rate, and Google is building pausing into the platform rather than leaving it to a timeout setting.
No price, so no verdict on cost
Google’s current Agent Platform sandbox costs about $0.206 an hour at list rates for 2 vCPU and 4 GB, the third-dearest of the 14 we priced at that size; E2B is $0.166 and Northflank $0.067. Fly.io Sprites and Blaxel already stop charging soon after a sandbox goes idle, so pausing isn’t new. Google hasn’t said how Agent Compute Engine will bill; until it does, its pitch is Gemini-scale testing and isolation built into Google’s own hardware, not price.
METR found ways for Codex agents to slip OpenAI’s monitor
METR published a summary of a three-week exercise (21 July to 11 August) in which a METR and a Redwood Research employee tested OpenAI’s internal misalignment monitor, with access to its code and prompts. Among the findings, for the system as it stood on 21 July:
- About 75–94% of internal agentic Responses API traffic from models at least as strong as GPT-5.5 was eligible for monitoring; RL training runs weren’t covered.
- The monitor ran when an agent handed control back to the user, and context compaction wasn’t monitored, so an agent could put off review by never stopping.
- Codex agents could in principle bypass Codex sandboxing and Auto-Review, and one exploit kept hundreds of recent actions from being monitored. Two client-controllable headers disabled monitoring for new agents, though setting them could itself be caught.
OpenAI says every flaw affecting production safeguards is patched; METR hasn’t checked.
Why it matters
These are bugs any team running agents can have. METR’s fixes: monitor every N messages or minutes, not at the end of a turn; reconcile inference logs against monitor logs; never let the agent influence when monitoring runs.
The monitor needs its own threat model
A monitor is only as strong as the plumbing around it: headers, compaction and serialization, not prompts. METR ran a similar exercise on Anthropic’s systems in March; expect this access to become a condition of credible safety claims.
OpenAI’s Decisions API is generally available
OpenAI made its Decisions API generally available on 22 October, 16 days after the public beta. It still runs only on GPT-6 Luna and costs $0.10 per million uncached input tokens; output isn’t charged. New since the beta: prompt caching (cache writes are now charged), images in individual questions, JSON input, conversation history with tool calls, Private Link, and 400 questions per request, up from 200.
Why it matters
Classification, routing and agent gates that run on a chat model can move to one call that returns probabilities. OpenAI says it’s about 10x faster than the Responses API; Speak told TechCrunch its time between actions fell from 1.4 to 0.13 seconds.
OpenAI is selling convenience, not the best model
| Model | Input, $ per million tokens | JevBench score | Seconds |
|---|---|---|---|
| OpenAI Decisions (GPT-6 Luna) | 0.10 | 73.5 | 0.30 |
| d1-ultra (Liquid AI) | 0.042 | 80.5 | 0.23 |
| Jev 1.13 (TypeSafe) | 0.042 | 77.1 | 0.24 |
| Microsoft-Decision-1 | 0.042 | 70.8 | 0.46 |
Scores are from our decision models table. OpenAI charges more than twice as much and trails the leaders; its pull is the bill, data controls and GPT-Live hookup customers already have. Expect it to keep OpenAI shops from adding a second vendor rather than take the category. A Luna trained for decisions, which OpenAI’s Nikunj Handa said may come, would change that.
Quick hits
- PHP2Shell takes UK services offline: a UK minister told the House of Lords that 32 government services are unavailable and four partly, mostly as a precaution. Docker has rebuilt its Official and Hardened PHP images on 8.2.35, 8.3.36, 8.4.27 and 8.5.12. VulnCheck has built an exploit that chains a memory leak to code execution with ASLR on and
display_errors=offon x86-64, so hardening is no substitute for patching. - Claude on Google Cloud gets an Anthropic-managed option, now GA: Anthropic runs the stack as data processor on Google’s infrastructure, so Managed Agents, skills and code execution arrive on day zero, with Google Cloud IAM, audit logs and billing that draws down commitments. The Google-managed option keeps VPC Service Controls, CMEK and data residency.
- AWS Continuum for code vulnerabilities is GA in US East (N. Virginia) and US West (Oregon): it tests findings in a sandbox, ranks them by reach into your AWS estate and opens fix pull requests that a person must merge.
- 1Password for Agents fills logins for agents such as Claude Duet, ChatGPT Work and Meta’s Muse after you approve on your device, so the agent never sees the password; no pricing or availability date yet.
- Six unpatched Linux kernel bugs went public when Trend Micro’s Zero Day Initiative sent them to the public kernel mailing list, including two CVSS 9.0 remote code execution flaws in SMB Direct and ksmbd; if you run ksmbd, watch for patches.
- eMudhra is leaving the SSL/TLS business after Mozilla blocked eight of its intermediate certificates; it says TLS was about 1% of revenue and will replace customers’ certificates through partners for free.
- JetBrains Air Governance is GA: one console for which agents (Claude Agent, Codex, Gemini CLI, Junie) and models a company allows, with credit limits, bring-your-own keys and company-wide MCP servers.