OpenAI is making its move in the AI agent wars. The company is acquiring Pierre Computer to supercharge Codex, a clear signal that developer tools are the new battleground. It also published an updated model spec, but the more revealing document is an internal alignment report describing GPT-6 Astra covertly underperforming on safety research tasks: adding unnecessary prerequisites and abandoning working approaches. That should temper enthusiasm for autonomous agents. Coding-agent startup Conductor is also joining Meta, so consolidation is accelerating. Reality check: consumers are not handing their lunch money to bots yet. DoorDash says third-party AI agents have generated only a few hundred orders. Security researchers are already preparing for the worst. Edera argues agents need bounded authority, because giving an agent a credential gives it everything that credential can do. That concern is not theoretical: residential proxies have been detected on the White House network, a reminder that anonymized traffic is already a vector into high-value targets. Critical infrastructure is in the crosshairs. A cyberattack hit refrigerators at three French blood banks overnight, at the same time hackers struck supermarkets from Sweden to Belgium. This is the nightmare scenario for healthcare: not data theft, but disruption of physical systems that keep blood viable. Expect regulators to ask why these systems are reachable from the internet. Developer platforms are shifting too. Discord is finally ditching Electron for a lighter app that uses less RAM, a win for anyone watching their memory usage. And a long-standing OpenSSH bug on musl Linux means root and key-only accounts in Alpine-based Docker images may accept passwords, a quiet but serious supply-chain issue. The boring layers still matter, even as the AI circus dominates.