Windows takes the runtime —
Anthropic takes the prospectus.

The model story Microsoft did not tell at the day-one Polaris unveiling, and the one with the wider operational implication. Microsoft introduced two new Windows-resident small models: Aion 1.0 Instruct — a faster, leaner successor to the current Windows OS SLM, for summarisation / rewrite / intent / accessibility — and Aion 1.0 Plan, a 14B parameter reasoning model with a 32K context window and native tool-calling for multi-step planning and sub-agent orchestration. The deployment model is the important bit: Aion 1.0 Plan ships in-box as part of Windows on capable devices, so an application calling the Windows Copilot Runtime API gets a local agent brain without bundling weights or paying a per-token bill. Aion 1.0 Instruct is in preview now; open weights are scheduled to land on Hugging Face in July 2026, with Aion 1.0 Plan shipping "in the coming months." Three reads. (1) On-device tool-calling at 14B is the missing rung between the phone-class 3B Gemma-2-tier models and the cloud frontiers — the first time a Windows-OS-resident model is positioned to run a real agent loop without round-tripping a hyperscaler. (2) The in-box distribution sidesteps the App Store / model marketplace problem entirely: ISVs do not have to ship, license or A/B a brain, they call an API. (3) Read with the NVIDIA OpenShell story (item 04), this is the hardware-software pact for "agents run on Windows, locally, by default" — the same pitch NVIDIA's Computex keynote framed as "personal AI" but with the OS vendor's distribution.

The two pieces Microsoft used at Build to answer the "every agent rebuilds context from zero" complaint that has dogged the category since Q1. Rayfin — an open-source SDK + CLI announced in preview at Build — lets a developer (or coding agent) describe a complete application backend in code (database, auth, storage, access policies) and ship it with a single CLI command to a managed Microsoft Fabric tenant, where the app inherits the tenant's identity, network and governance controls and app data lands directly in OneLake (no copy, no ETL). The named build-side partner is Replit: build in Replit, deploy with Rayfin, stay in the customer's Fabric tenant. Alongside it, Fabric IQ — Microsoft's semantic + ontology layer for enterprise agents — moved to GA, and was folded into a broader Microsoft IQ that unifies three additional context sources — Work IQ (productivity signals), Foundry IQ (institutional knowledge) and Fabric IQ (live business data) — so any agent reads from a single ontology rather than reinventing one per stack. Three reads. (1) Microsoft IQ is the explicit concession that context, not model power, is now the enterprise battleground — and Microsoft's structural advantage is owning the productivity + identity + data plumbing the others have to integrate into. (2) The Replit partnership matters because it gives Microsoft a credible "build agent" surface without owning a Cursor / Cognition substitute — Polaris owns the IDE, Replit owns the vibe-coder. (3) Read with the Salesforce Agent Fabric GA (item 10), this is Microsoft's argument that the agent control plane is the data layer, not a separate one.

The Build day-two session that finally puts SWE-agent-style autonomy inside the Microsoft IDE, not adjacent to it. Visual Studio 2026 ships a triad of Copilot Agents that own discrete inner-loop tasks against live runtime behaviour, not static analysis: a Debugger Agent that reproduces a reported issue, instruments the app, isolates the root cause and validates the fix end-to-end; a Profiler Agent that points at real bottlenecks, writes a benchmark, suggests a fix and validates the improvement in a guided loop (and a new Profile with Copilot command in Test Explorer profiles a specific test with it); and a Test agent that builds unit tests and chases edge cases. Alongside the runtime trio, Visual Studio ships an Agent Designer — a low-code companion that emits YAML manifests describing an agent's intents, actions and safety constraints — and a new wagent CLI that packages the manifest into a single executable portable to Windows Server 2026 / IoT / Windows 365 without modification. Two reads. (1) The debug-profile-test split is the first credible Microsoft answer to Cognition / Cursor / Claude Code at the SWE-agent seat — autonomy inside an IDE the regulated buyer already owns, not a new product to procure. (2) The wagent + Agent Designer pairing is the operational version of the WAF-is-the-runtime pitch: an agent is an artefact (YAML + binary) you check into Git and deploy with one command, same as a container.

The hardware-and-runtime half of the Build / Computex pact, and the most direct counter to "ChatGPT is the OS." At NVIDIA GTC Taipei at Computex 2026, NVIDIA announced OpenShell: a Windows-side agent runtime that ships on top of Microsoft's new security primitives, exposes per-agent policy capabilities (what an agent can and cannot touch), intelligently routes queries between local and cloud models based on the user's privacy policy, and disguises personal information when a query has to leave the device. Alongside it, NVIDIA unveiled the RTX Spark superchip and a matching RTX Spark PC class — Arm CPU + Blackwell GPU + 128GB unified memory, purpose-built for personal agents — with systems shipping in fall 2026. The OSS uptake is the tell: Hermes Agent and OpenClaw — the two most-installed independent harnesses — are named as the first to integrate OpenShell + the Microsoft primitives into their native Windows apps, and verified NVIDIA agent skills now appear in the Claude Code plug-in marketplace and the Hermes Skills Hub. Two reads. (1) The right way to read OpenShell is as the Windows equivalent of kubelet for agents — a managed runtime the platform owner controls so policy and identity are not negotiated per-vendor. (2) NVIDIA picking Windows-first rather than Linux-first for OpenShell is the consumer-PC volume play; the Computex framing of "the NVIDIA agents are here — and it's personal" is the marketing of the same thesis Microsoft's Build pitch opened: local, governed, by-default.

OpenAI's answer to "Microsoft owns the IDE" is to stop arguing about the IDE. On June 2, OpenAI rolled out six role-specific Codex plugins — sales, investment banking, public-equity investing, data analytics, creative production and product design — each pre-loaded with integrations, instructions and context for the named role. The sales plugin ships with native hookups for Salesforce, HubSpot, Slack and Outreach and runs follow-up, close plans and account risk; the investment-banking plugin builds pitch materials, comparable-company / comparable-transaction analyses, and diligence recommendations. The numbers OpenAI led with: Codex now has 5M weekly active users, 6× growth since the desktop app launched in February, with 20% of users non-developers (analysts, marketers, operators, designers, researchers, investors, bankers) growing more than 3× faster than the developer cohort, and data-analytics tasks up 110% week-over-week, research +37%, knowledge artefacts (reports, memos, contracts, slides) +36%. Three reads. (1) This is the role-shaped version of the same thesis Anthropic shipped as Claude for Legal (90+ named agents covered yesterday) and Claude for Small Business: the horizontal-chat era is over, the package is the job. (2) The plugin framework is positioned as an "open ecosystem" for partners — the substrate Codex needs to absorb the Salesforce / HubSpot / Bloomberg integration surface without re-implementing it. (3) 5M Codex WAU at 3× non-dev growth is the strongest quantitative answer yet to "is the agent layer just for engineers?" — it isn't, and OpenAI now has the numbers to cite in the next round of enterprise procurement.

The June 2 announcement that drew less press than the plugins but is the more interesting product primitive. Sites — now in preview for ChatGPT Business and Enterprise — lets Codex generate shareable interactive websites and apps directly inside ChatGPT, with a workspace URL anyone in the team can open; unlike a static deck, a Site stays live and gets refreshed as project context changes. OpenAI also brought the full Codex experience inside the ChatGPT app (web + desktop + mobile), and expanded Codex annotations beyond code and Markdown to cover documents, spreadsheets and slides. Two reads. (1) Sites is the OpenAI answer to Microsoft Rayfin (item 02): both put "ship an app backend by describing it" inside the agent surface — Microsoft for Fabric tenants, OpenAI for ChatGPT workspaces. The split tracks the broader contest — Microsoft argues the governed backend should win, OpenAI argues the in-chat share link should. (2) Folding Codex into ChatGPT (instead of keeping it a separate desktop app) is a distribution change as much as a UX one — the 5M Codex WAU number is going to compound against ChatGPT's consumer base much faster from here.

The headline of the week on the cap-table side. Anthropic confirmed on June 1 that it had confidentially submitted a draft registration statement on Form S-1 to the SEC for a proposed initial public offering of common stock; the company's own one-paragraph press note disclosed nothing on share count, price or timing, which is the entire point of the confidential filing path. The filing comes three days after Anthropic's $65B Series H closed at a $965B post-money — first frontier lab to clear $900B private — and against a reported annualised revenue run-rate over $47B. Reporting names Goldman Sachs, JPMorgan and Morgan Stanley as the lead underwriters under consideration for both Anthropic and the pending OpenAI filing. Two reads. (1) Anthropic going formal-first on the S-1 reverses the usual cadence — OpenAI signalled its filing earlier (covered in the Opus 4.8 / $965B brief), but Anthropic is the one with the lodged paperwork on June 1 — and that ordering matters for narrative: the safety-first lab argues it can also be the disclosure-first lab. (2) The filing closes the long-running uncertainty about Anthropic's path — Long-Term Benefit Trust plus public-company governance is now the explicit destination, not a rumour, and the EU AI Act review process now has to model a publicly-listed Anthropic by 2027.

The materially new development on the Glasswing arc. Yesterday's brief covered the ENISA addition as the first EU institution; on June 2 Anthropic followed that with a much larger expansion — Project Glasswing adds 150 additional partner organisations across 15+ countries, bringing the program from its ~50-org launch cohort to roughly 200+. The new wave deliberately fills sectoral gaps that were under-represented at launch — power, water, healthcare, communications and hardware — and lands alongside an updated tally: program participants have disclosed 10,000+ high- or critical-severity vulnerabilities through Mythos since the program began, against a stated target customer base of "hundreds of millions of users." Founding partners cited in the expansion press: Apple, NVIDIA, Microsoft, CrowdStrike, Palo Alto Networks. Two reads. (1) Going from a US-heavy ~50-org cohort to a 200+, 15-country roster is the structural move Anthropic needed to claim Mythos is governable globally rather than just inside US procurement — the same point the ENISA news made qualitatively, now in scale. (2) 10,000+ disclosed vulnerabilities is the regulator-quotable number: with the EU AI Act Code of Practice still being drafted, Anthropic now has the world's largest model-driven CVE pipeline as evidence the frontier lab pays its own safety costs.

The second major credit-pool move in three weeks, after Anthropic's Agent SDK billing split (still landing on June 15). On June 1, GitHub Copilot transitioned every plan to usage-based billing metered in a new unit — GitHub AI Credits — that replaces premium request units and is consumed against published API rates per model. Inclusion is tied to the subscription tier: Pro+ gets $39 in monthly credits, Business $19, Enterprise $39, with paid plans able to top up. Code completions and Next Edit Suggestions stay unlimited; all agent features (chat, code review, agent mode) consume credits. The visible reaction this week: developers reporting they burn through monthly allotments in hours on agent-heavy workflows, with the GitHub community discussion threads filling fast. Two reads. (1) Take GitHub + Anthropic together and the pattern is plain: flat-rate agent use is over. Both platforms spent 12 months subsidising agent calls inside chat subscriptions; both have now decided the agent bill is its own line item, and the developer audience is discovering its agent loops cost more than they guessed. (2) The structural beneficiary is the cost-cutting substrate — Tensormesh, prompt caching, context compression, KV reuse — all of which this brief has been tracking. The credit pool is the forcing function that makes those layers a line item.

The third-party control-plane move that lands on top of Microsoft IQ's pitch. Salesforce (via MuleSoft) moved Agent Fabric — its multi-vendor AI agent control plane — to GA this month, with three named additions: Agent Broker goes GA with a visual authoring canvas, Agent Script and Salesforce-model support for deterministic multi-agent orchestration; an AI Gateway adds LLM Governance to standardise token spend, enforce routing rules and unify access across a multi-LLM stack; and Trusted Agent Identity lets agents execute under specific user permissions, with mobile approval flows for high-impact actions. The rollout cadence Salesforce published puts MCP server support in May, OAuth in June, and Informatica-hosted MCPs joining the Agent Registry by default. Two reads. (1) Where Microsoft's pitch is "the data layer is the agent control plane" (Microsoft IQ, item 02), Salesforce's is "the customer-graph identity layer is" — Trusted Agent Identity tying actions to user permissions is the SaaS-native version of WAF's manifest. (2) Read with the Anthropic + GitHub credit moves, governance and identity are converging on the same point: an agent has to declare who it's acting as and what it's allowed to spend before it acts at all.

The distribution side of the OpenShell story (item 04), and the one to watch before next week. NVIDIA shipped the NVIDIA Agent Toolkit at Computex — a set of CUDA-X-backed primitives for helping agents access tools and follow policies — and, more interestingly, the first tranche of verified NVIDIA agent skills now appear in the Claude Code plug-in marketplace and the Hermes Skills Hub. Reading list for next week: how quickly the verified-skill model expands beyond NVIDIA's own primitives, whether OpenShell-managed local agents start showing up in the same skill catalogs, and whether the in-box Aion 1.0 Plan (item 01) gets a Claude / Hermes route by GA. The unifying question across all three is the same: is "verified by the platform vendor" the new spec the agent layer settles on, the way signed binaries settled the OS?