Anthropic at $900B —
and the agent layer learns to be audited.

Bloomberg confirmed Anthropic is set to close a $30B+ primary at roughly a $900B post-money as soon as this coming week, co-led by Sequoia, Dragoneer, Altimeter and Greenoaks at about $2B apiece, with Founders Fund and General Catalyst following on. The number to anchor on is the revenue line: Q2 is tracking to $10.9B — more than double Q1 — with annualised run-rate expected to clear $50B by month-end and the first profitable quarter in sight. Pair that with a $45B compute deal with SpaceX and $1.8B with Akamai and the round reads less like a bet and more like financing the supply chain. Strategically, it locks in the dual-lab equilibrium: OpenAI and Anthropic both sit above the $500B line, and the rest of the field is racing to be platform, tooling or vertical — not frontier model.

NVIDIA shipped a verification framework for the new "skills" pattern that Anthropic and others have pushed as the unit of agent capability. Every published skill goes through SkillSpector — a scanner checking for software vulnerabilities, hidden instructions, prompt-injection bait, tool-poisoning patterns and mismatches between a skill's declared and actual behaviour, grounded in OWASP-for-LLM and MITRE ATLAS — then gets cryptographically signed and ships with a machine-readable skill card listing owner, dependencies, limitations and verification status. It's the cleanest articulation yet of "skill = sandboxed binary you wouldn't run unsigned," and it's notably the GPU vendor — not the lab — that drew the line. Enterprise procurement teams will start asking for signed-skills-only fleets within the quarter.

Microsoft quietly published a Python toolkit that claims coverage of all ten items on the OWASP Agentic Top 10: policy enforcement, zero-trust identity for the agent itself, execution sandboxing and a reliability-engineering layer for autonomous loops (~1.8k stars, MIT). Read it next to NVIDIA's release and the picture is consistent — the three biggest names that don't ship a frontier model (NVIDIA, Microsoft, AWS-via-Strands) are converging on the same answer: wrap the agent in a policy engine before you ship it. The hyperscalers are absolutely fine with the foundation labs winning the model fight, as long as they own the rails the agents run on.

A Go-based, deny-by-default sandbox aimed squarely at coding agents — uses Linux Landlock and seccomp plus macOS sandbox primitives to enforce filesystem, network and syscall isolation without requiring a container runtime. The smaller cousin to the OpenAI / Anthropic / Google in-house sandboxes we covered last week: same problem, indie-friendly answer. ~190 stars, Apache-2.0, supports Claude Code and OpenCode out of the box. The sandbox tier is now its own product category — and that's a healthy sign that the security posture for agents is maturing outside the big-lab fortresses.

Mercury closed a $200M Series D at $5.2B (TCV-led, a16z / Coatue / Sequoia following), pushing total raised across primary and secondary to ~$700M against $650M annualised revenue and roughly 300,000 customers — one in three US startups, per the company. The Spotlight-relevant detail is buried in the announcement: Mercury also shipped an MCP server and a command-line interface so customer agents can read balances and move money directly. Combine with April's conditional OCC bank-charter approval and the positioning is bald — Mercury wants to be the regulated banking layer that agentic startups plug into by default. The "AI-native bank" thesis just got priced.

Paris/NY-based Pivot raised $40M (Forestay Capital and Notion Capital co-led; ex-Ariba and EcoVadis founders on the cap table) to put an autonomous agent on top of enterprise procurement across 25+ countries — $3B of invoices a year, customers including DoorDash, Lemonade and Flix. Total raised: $70M. Follows Primer's €86.2M last week for autonomous payments and reads as the same bet from the other end: the enterprise spend pipeline — request → PO → invoice → payment — is being rewritten with an agent at every step, and the legacy procurement-suite incumbents have no plausible answer.

xAI's answer to Claude Code and Codex finally shipped as an early beta: a terminal-native coding CLI that plans, edits files, executes shell commands, and runs up to 16 parallel agents under its Heavy architecture on Grok 4.3 with a 2M-token context window. Gated behind SuperGrok Heavy ($299/mo, with a six-month $99 intro) before being opened up more broadly mid-week. The product itself is competitive on paper, not unique — but the strategic read matters: every serious lab now ships a first-party coding agent, and the contest has shifted from "do you have one" to "what does its planner do when the context fills up." Worth watching how Goal-mode-style long-horizon execution lands here.

Atlassian's Rovo MCP server hit general availability and the new remote-agent connector now lets you assign Jira work items directly to Cursor's cloud agent (alongside GitHub Copilot and Box). The endpoint is hosted at mcp.atlassian.com/v1/mcp; Claude, Cursor, the Gemini CLI, Lovable and WRITER all speak it. The notable part is the contract: tickets get assigned, the agent works under existing Jira permissions, status updates flow back into the same board the humans use. The PM-as-orchestrator-of-mixed-teams pattern just got first-class support in the most boring possible place — and the boring is the point.

Following last week's Windows-sandbox hardening, OpenAI shipped three Codex updates that materially widen the loop: Goal mode graduated from experimental to GA across the macOS app, IDE extension and CLI — Codex can now drive toward an objective across session breaks, token budgets and "hours to days"; Appshots (press both Command keys) snapshots the frontmost macOS window into the chat as context, no copy-paste required; and remote computer-use can now continue running after the Mac locks, scoped to short-lived authorisations and gated on relock-on-local-input. Together they're the most concrete step yet from "coding assistant" to "agent that owns the laptop for a shift."

The de-facto Python framework for building MCP servers and clients formally lives under PrefectHQ now and continues to dominate — trending hard, with daily releases against issues. The interesting signal isn't the star count; it's the org. Prefect built its name on workflow orchestration, and bringing fastmcp under that banner telegraphs where this is going: MCP servers as orchestrated, observable workflows rather than one-off Python files. If you're picking a Python MCP stack today, this is the boring-and-correct choice.

The release candidate for the next MCP specification was frozen this week. The headline is a structural break: the initialize/initialized handshake is gone, the Mcp-Session-Id header is gone, protocol version and client info now travel in _meta on every request, and a new server/discover method handles upfront capability fetches. Net effect: any MCP request can land on any server instance, killing the sticky-routing and shared-session-store gymnastics horizontal deployments needed. Add W3C Trace Context propagation and reverse-DNS-identified extensions and this is the version where MCP stops being a Claude-desktop curiosity and starts being something you can run behind a load balancer. Ten-week window for SDKs; final spec lands July 28.

A TypeScript "enterprise AI platform" putting an MCP gateway, a curated registry, an orchestration layer and guardrails behind one self-hostable runtime (~3.7k stars, AGPL-3.0). Slots into the same lane as IBM's mcp-context-forge from last week — the open-source enterprise-MCP-platform category is now a real one, with at least three credible options. The thesis: MCP servers in production need the same operational scaffolding any other microservice does — discovery, auth, rate limits, audit logs — and the spec deliberately doesn't provide it.

A self-hostable platform for shipping AI assistants and multi-agent workflows that takes the drag-and-drop builder and the typed SDK seriously enough to keep them in lockstep — what you wire in the canvas appears as TypeScript and vice versa, no one-way export trap (~1.2k stars). The interesting bet is the 2-way sync: most "no-code agent" tools force you to choose between the business analyst and the engineer at the moment of commitment. Inkeep is wagering you don't need to. If it holds up under non-trivial graphs, this is the cleanest answer yet to "give my PM the builder, give my eng the SDK, never let them diverge."