Cognition takes $1B —
and the security stack moves in next door.

Cognition Labs closed more than $1B at a $26B post-money — co-led by Lux Capital, General Catalyst and 8VC, with Founders Fund, Ribbit Capital, Atreides Management and Layer Global participating — more than doubling the ~$10.2B mark set in September 2025. The number that shifts the narrative is the underlying business: revenue reported at ~$492M (13× year-on-year), customers including Goldman Sachs, Mercedes-Benz and NASA, and an internal claim that ~89–90% of Cognition's own code is now written by Devin. After eighteen months of "is the demo real?" debate, the autonomous-coding-agent thesis just got priced like infrastructure. The same week, Anthropic is reported circling a $30B round at ~$900B and OpenAI's last secondary printed at $500B — the model providers' own valuations are no longer the only place the coding-agent capital is going.

CapitalG (Alphabet's growth fund) led, with NVentures, ServiceNow Ventures, MongoDB Ventures, Snowflake Ventures, Databricks Ventures, a16z and Menlo Ventures alongside — taking OpenRouter from a $547M Series A twelve months ago to a $1.3B post. The operating numbers are the story: 25 trillion tokens/week (5× growth in six months), 400+ models routed across Anthropic, Google, OpenAI, xAI and DeepSeek, and 8M global users. A year ago "model router" was a feature-store curiosity; this week it's the layer four of the hyperscalers' venture arms are simultaneously underwriting. The providers can keep raising at trillion-dollar marks all they like — the people building agents on top have decided they want one bill and one rate limit, not five.

Anthropic shipped the Claude Compliance API — programmatic access to two distinct streams: Claude Enterprise conversation content (chats, uploaded files, projects) and Claude Enterprise + Claude Platform activity events — and lined up 28 named partners across DLP, SASE, data security, SIEM, SecOps, IAM, eDiscovery, AI security posture management and observability for the launch. Partner list reads like a CISO's procurement roster: Cloudflare, Cribl, CrowdStrike, Cyera, Datadog, Forcepoint, Fortinet, IBM Guardium, Microsoft Purview, Mimecast, Netskope, Okta, Palo Alto Networks, Proofpoint, Relativity, ReliaQuest, Rubrik, SailPoint, Smarsh, Snyk, Sumo Logic, Tenable, Theta Lake, Trellix, Varonis, Wiz and Zscaler. The strategic move is bigger than the launch bullet list: Anthropic has stopped asking enterprises to invent new governance for Claude and started letting the controls they already bought treat it like any other SaaS app. That's the prerequisite for the next Fortune-500 deployment wave — and a quiet sealing of the moat against any "rip-and-replace to OpenAI" pitch.

Same day as the Compliance API drop, Zscaler announced an agreement to acquire Symmetry Systems — terms undisclosed — and folded its access graph into the Zero Trust Exchange. Symmetry ingests access logs from SaaS, public cloud, data stores and AI systems and renders a single graph of which identity (human or non-human, including agent-spawned temporary identities) is touching which data through which application. The pitch lands directly at the soft tissue of agentic deployments: today's enterprise can't actually answer "which Claude session looked at the M&A folder yesterday, on whose behalf, via which MCP tool, with what blast radius." Combine this with the Compliance API and the picture clarifies — Anthropic exports the data, Zscaler+Symmetry build the map, and the policy engine sits on top. Agent IAM has finally found its second source of buyers.

Microsoft's MSRC released two tools and one piece of doctrine. RAMPART (Risk Assessment and Measurement Platform for Agentic Red Teaming) is a Pytest-native harness on top of PyRIT for writing repeatable safety and security tests against an agent — cross-prompt injection, data exfiltration, behavioural regressions, harm-category probes — and running them as part of CI rather than as a one-off pre-launch audit. Clarity is the opposite bracket: a structured "sounding-board" agent that walks a team through problem clarification, solution exploration, failure analysis and decision tracking before they ship the design. Both Apache-licensed, both on GitHub. The doctrine — "agent safety is a living artefact, not a launch gate" — is the actual headline: Microsoft is naming the part of the SDLC where every serious agent team currently has a vacuum, and shipping the reference fill.

A package called mouse5212-super-formatter was caught exfiltrating files from /mnt/user-data — the directory Claude uses for uploads, generated artefacts and intermediate work — into attacker-controlled GitHub repos. The attacker's GitHub account was created on May 26, hours before the first malicious version went up; the package recorded ~676 downloads before discovery, and in a darkly funny twist leaked its own GitHub PAT, suggesting LLM-generated malware with no OPSEC discipline. The story is the targeting, not the volume. /mnt/user-data is a Claude-specific path; an npm-ecosystem attacker has now indexed Anthropic's runtime layout and is shaping payloads to it. The Compliance API and RAMPART above explain why this week — the security floor is being poured because the threat model is showing up to specifically target it.

The first user-facing release after the internal v2.1.150 build, and a dense one. /code-review --fix stops being advisory and applies its findings to the working tree (with /simplify aliased onto the same action), so the review pass becomes an edit pass. A new MessageDisplay hook event lets teams transform or hide assistant text on the way to the terminal — the cleanest seam yet for org-wide policy on PII redaction or output filtering — and SessionStart hooks can now flip reloadSkills: true to swap the skill registry inside the live session, paired with a new /reload-skills command. Skills and slash commands gain a disallowed-tools frontmatter field so a skill can temporarily strip tools from the model surface (read-only-by-policy modes get one-line cheap). A pluginSuggestionMarketplaces managed setting lets admins allowlist the plugin marketplaces that may be suggested via context-aware tips, and a --fallback-model flag stops a missing primary model from killing every request. Auto mode is now on by default; Vim users get reverse history search on /; OpenTelemetry gains an opt-in app.entrypoint attribute. Read in aggregate: the harness is hardening exactly the seams the Compliance API and RAMPART are now asking it to.

Anthropic announced its third APAC office (after Tokyo and Singapore) and named KiYoung Choi — most recently GM of Snowflake Korea, with prior runs at Google Cloud, Adobe, Autodesk and COO at Microsoft Korea — as Representative Director. The stated rationale is usage: Claude consumption in South Korea is reportedly running ~3.5× above what population-weighted models would predict, second in East Asia only to Japan. Named anchor customers include SK Telecom (custom-trained Claude for customer service) and Law&Company (an AI legal assistant). The geography signal is that "deploy fast in markets that already over-index on the product" is now the playbook — and a 30-year enterprise sales operator is the hire profile, not a research lead. Tokyo, Singapore, Seoul — the LLM-providers' first real Asia footprint is taking shape, and Anthropic just shipped it.

The meeting-capture tool BlueDot shipped a v2.1 that does two interesting things at once. An Apple Watch app records and transcribes in-person conversations from the wrist with a single tap — the offline-mic problem solved by the device people already wear — and the resulting transcripts ship through a first-class MCP server straight into Claude, the CRM and the ATS. Combined with auto-recording, custom retention and voice-to-CRM mappings, this is the cleanest example yet of "MCP from the edge": the agent doesn't reach out to a service, the device pushes context in. Expect every wearable, vehicle and workspace appliance with a microphone to grow an MCP face over the next two quarters — and a corresponding fight over which agent ecosystem (Claude, Codex, Gemini) becomes the default consumer.

mukul975's cve-mcp-server is the kind of project the MCP standard was supposed to make obvious: one MCP server, 27 tools, 21 upstream APIs — NVD for CVE lookup, FIRST for EPSS scoring, CISA KEV, MITRE ATT&CK mapping, Shodan, VirusTotal, OSV.dev dependency scanning, GitHub Security Advisories, URLScan and the rest of the security analyst's daily browser tab pile — exposed to Claude or any MCP-aware harness as a single connector. Built in Python on FastMCP, httpx, aiosqlite, Pydantic v2 and defusedxml; outbound HTTPS only, no inbound ports, which keeps the deployment story small. Pair it with this week's Microsoft RAMPART and you get the practical answer to "what does agentic vulnerability triage look like?" — the agent reasons, the MCP server fetches, the RAMPART harness measures whether the answer is safe. Same week, different shelves.