The week was not about one new assistant. It was about who gets to own the place where agents run, pay, call tools, inspect code, and touch the web.
Google made the loudest platform move.
Vertex AI gave way to Gemini Enterprise Agent Platform. Agent Studio handled prototyping, ADK handled production code, Agent Engine handled runtime, Gemini Flash and Flash-Lite sharpened the price-performance story, Antigravity 2.0 added subagents and async tasks, and WebMCP proposed a browser standard for exposing website tools to agents.
That is not a feature bundle. It is an attempt to make Google the default runtime for agentic work.
The rest of the market answered in its own way. Vercel AI SDK 6 added durable agents, MCP support, and devtools. Cursor Composer 2.5 tried to undercut frontier coding models on cost while keeping work inside cloud dev environments. Anthropic bought Stainless, tightened SDK leverage, doubled Claude Code limits, opened private MCP tunnel routing, and pushed self-hosted sandboxes. OpenAI moved toward IPO disclosures, ads, personal finance, and confidential filings while its agent products kept spreading.
The shape is clear: everyone wants the same layer.
That layer is not the model. It is the runtime around the model: tool calls, memory, permissions, billing, evals, browser access, SDKs, deployment, and observability. The model may swap. The runtime is where habits, data, and lock-in live.
Security made the runtime fight more urgent.
Microsoft's AI security agents found 16 Windows flaws. MDASH claimed zero false positives. Claude Mythos passed a UK cyber attack simulation. AISI said AI cyber capability was doubling every 4.7 months. MCP flaws hit more than 200,000 servers. VS Code extensions stole repositories and credentials. The old line between "agent framework" and "security boundary" is gone.
If the agent runtime can call tools, inspect repos, open browsers, and touch internal APIs, it is part of your security architecture whether you planned it that way or not.
The business side was just as compressed. Anthropic neared extraordinary revenue and valuation numbers. Google pushed faster models. OpenAI prepared IPO filings. Chinese models held a large share of OpenRouter traffic at much lower cost. SpaceXAI's economics and researcher departures showed the other side of the arms race: model companies can look huge and fragile at the same time.
For buyers, the immediate move is to benchmark runtimes, not only models. Can the platform route between models? Can it run inside your boundary? Can it log every tool call? Can it pause before money, customer data, production systems, or legal records change? Can it survive a vendor acquisition, pricing shift, or API migration?
For sellers, the wedge is reliability under messy conditions. The next serious buyer does not need a nicer chat interface. They need durable workflows, permission maps, evals tied to business outcomes, browser/tool standards, and an incident story that does not depend on luck.
The week also exposed a cultural split. Some companies are racing to make agents always-on and ambient. Others are racing to put them in sandboxes and tunnels. Both are right. The agent should move fast only inside a boundary someone can explain.
The week in one line: the durable AI platform is no longer the model you call, but the runtime you trust enough to let it act.