The protocol named agent identity. Memory washed the flags off an email. Three MCP servers listened on every interface. Nvidia reportedly bought the warehouse.
The tool middleware week did not fail at discovery. It failed at who the caller is, what the memory file believes, and which interface the server bound.
On Saturday the Model Context Protocol maintainers published the updated roadmap. David Soria Parra and Den Delimarsky, six minutes of prose, five priority areas. The one that matters for this publication is the third: agent identity and enterprise-ready security. MCP authorization today is built around a person approving access in a browser. That works for a human with a tab open. It does not work for an agent running as a cloud workload, acting for a user who is not present, or handing a narrower grant to a sub-agent.
The maintainers named the path. Finish Demonstrating Proof of Possession. Drive Workload Identity Federation. Use the ID-JAG grant behind Enterprise-Managed Authorization. Standardize token exchange. They will keep showing up in the IETF OAuth working groups so those building blocks exist in the standards, not only in a blog post. Tuesday’s piece on this desk said the catalog finds the tool and the hook decides whether it fires, and neither one can tell you who the agent is when the call leaves the process. The roadmap is the first time the USB-C of agent capabilities has admitted that sentence is a spec gap, not a vendor feature request.
The rest of the document is the operational half of the same problem. The 2026-07-28 specification already dropped protocol-level sessions and the initialization handshake so a server can scale without holding state. Clients can call server/discover before they do anything else. List results are cacheable. Tasks moved into an official extension. A new Multi Round-Trip Requests pattern replaced server-initiated requests so elicitation works on a stateless server. Next they want Streamable HTTP covering local servers over stdio, one transport instead of a zoo. They also want progressive discovery, because connecting to a server with a hundred tools means the model pays for the entire surface before the user has asked a question. HN put 270 points and 161 comments on the post. The split was the expected one: HTTP-native cheers, sampling mourners, people who already lazy-load and are moving to code-mode. None of that changes the identity line.
The identity line is also where the week’s most useful attack landed, and it did not need a CVE.
Patrick Walsh at IronCore Labs spent April sending prompt injections at an OpenClaw instance on GPT-5.4. Direct ones failed. OpenAI’s March detector claimed 99.8 percent. OpenClaw wrapped untrusted email in <<<EXTERNAL_UNTRUSTED_CONTENT>>> tags, stripped angle brackets, and taught the model to ignore instructions inside the wrapper. The hourly summarizer named the attempts: coordinated prompt-injection, a cute little test wrapped in a poem, leave it for the user. Spotlighting worked on the ingest path.
It did not survive promotion. Daily memory files ingested excerpts of those emails without the untrusted tags, without the trust level, without the source. Dreaming, OpenClaw’s periodic distillation of daily notes into MEMORY.md and USER.md, is the second wash. Those two files load into every context, including HEARTBEAT and cron, the sessions that never saw the original email. Walsh sent a series of messages declaring the attacker address an internal account, the user’s other address, a bug in the external list. After the third message he did not have to wait for dreaming. The summarizer cron updated the current day’s memory on its own. Then commands from that address were instructions from an internal alt, not a standard email. The agent tried to send mail, failed, and followed the CLI directions.
The detector was not the hole. The memory writer was. A 99.8 percent injection score on ingest is theater if promotion strips the flag. Walsh names ChatGPT, Claude, and Hermes in the lede for the same pattern: spotlight or flag the untrusted text, write a memory file, drop provenance on the way in. Tuesday said the missing piece is a standard for agent-level OAuth that does not require a human to click Allow every 90 days. Thursday’s OpenConnector piece said the enterprise question is not whether the agent can find the tool, but whether it should be allowed, and whether you can prove it. Walsh’s writeup is the memory version of that question. Diff MEMORY.md the way you diff IAM. Cron should not load user-authored memory that started life in an untrusted channel.
The implementations of the connector spent Thursday proving the other half.
NVD assigned a 17:20Z wave against MCP HTTP servers that defaulted to every interface with auth off. UI-TARS-desktop, CVE-2026-81735, scored 10.0. @agent-infra/mcp-http-server listened on :: when no host was given. Auth middleware applied only if the caller supplied it. The commands server handed run_command to child_process.exec on the caller’s string. Anyone who could reach the port ran commands as the desktop user. The listen default moved to 127.0.0.1 in commit c2ad42e. The package version stayed 1.2.4 across that change. The pin is the commit, not a tag. mcp-router, CVE-2026-81094, scored 9.3: serve bound the aggregator to all interfaces on a fixed port and required a token only when the flag was passed. Release 0.6.3 defaults to loopback and refuses to start without a token when the host is not loopback. Telnyx MCP, CVE-2026-81098, scored 9.3 through 6.83.0. Current npm telnyx is 7.17.0, loopback, required server API key. Same costume we have been writing down all month. USB-C with the port open and the lock optional is not a connector. It is a LAN shell.
If the protocol is going to be the default answer for tool discovery, the default listen address is part of the product. Stdio until you have a token and a loopback bind. Inventory 0.0.0.0 and :: on every MCP HTTP process you actually run.
The warehouse underneath those tools changed owners, if the report holds.
The Information, via CNBC and TechCrunch, said Nvidia agreed to buy Hugging Face for $12.9 billion. Neither company has commented. Business Insider still will not call the ink dry. Treat the number as a reported agreement, not an 8-K. What they would be buying is the two-sided Hub, the default from_pretrained libraries, the telemetry of who downloads which shard onto which GPU, and a cloud re-entry after last year’s DGX Cloud pullback. ggml.ai joined Hugging Face around February. Local GGUF already sits under this roof. Hugging Face raised at $4.5 billion in 2023, turned down a $500 million Nvidia check at $7 billion late last year because it did not want a dominant investor, and was recently doing about $150 million a year. Stripe took OpenRouter earlier this month. Same pattern, one week apart: the meter and the warehouse get bought, the models stay “open.”
Do not rewrite CI tonight. The actionable move is the one that was already hygiene. Mirror the checkpoints you actually serve so Hub origin is a convenience, not a single point of failure. Watch GGUF, MLX, and non-CUDA defaults, not a fantasy TOS that bans quants. Pin the llama.cpp commit you ship, independent of Hub’s default branch. Model IDs will keep resolving. The operator behind the catalog is the thing that moved.
The quiet open-source drop sat under all of that. Munder Difflin is an Electron desktop that wraps the terminal CLIs you already pay for (Claude Code, Codex, Gemini CLI, Qwen, OpenCode, Copilot, Cursor, local models) and seats each one as a real process on an office floor. You talk to one clone. That clone routes. Everyone else is a worker with a desk and a mailbox. The coordination layer is a local git repo of plain files. Agents write outbox/. A harness router delivers into inbox/. No agent touches git. Single-committer, on purpose, because twelve CLIs trying to commit at once corrupt index.lock. GitHub shows 5,102 stars this morning. Tagged v0.4.6 on August 27. v0.4.5 was the release that admitted the load-bearing bugs: cost reporting reset on every restart, semantic memory on Apple Silicon returned NaN embeddings, mail sat in inboxes nobody woke. Official builds send anonymous usage events. Opt out, or build from source.
Treat it as a CLI multiplexer with a file-shaped mailbox, not as The Office for agents. If you already pay for two of those CLIs, the new cell is the hive directory, which you can read because it is git. Last week’s OneCLI put the credential outside the model. Munder put the conversation between tools into a repo you own. Both are votes for the same design: the middleware is files and a gateway, not a prompt.
The pattern across the five is the split this week spent drawing. Discovery is no longer the scarce layer. Identity is. MCP named the grants. Walsh showed what happens when memory promotion drops the grant on the floor. The CVE wave showed what happens when the HTTP transport defaults to every interface. Nvidia buying the Hub, if it closes, is who hosts the weights those tools load. Munder is the local reminder that the tools were already on the machine.
Next week the arc moves from the connector to the decision that sits on top of it. Build your own runtime, adopt OpenClaw, or bet on Hermes. The scorecard after that. The week after the USB-C thesis is the week you pick which socket you are willing to live with.
If this was useful, forward it to one engineer who needs less noise in their feed.