The AI Brief

Palantir reported Q2 2026 revenue of $1.94 billion, up 93% year-over-year. CEO Alex Karp framed the result around AI sovereignty: "Demand for AI sovereignty has now been unleashed. And Palantir is the only company that has demonstrated it can transform tokens into actual economic value."

US commercial revenue surged 149% from a year ago to $764 million and, compounded since 2024, has jumped 380%. Palantir now projects US commercial revenue "in excess of" $3.42 billion for full-year 2026. The company closed a record 220 deals worth $1 million or more, including 98 deals over $5 million and 70 deals over $10 million.

GAAP net income reached $1.06 billion in Q2 2026, up from $327 million in Q2 2025, representing a 55% margin. The company raised full-year 2026 revenue guidance to $8.15–$8.16 billion, up from its prior forecast of $7.65–$7.66 billion. The company's AIP platform is winning head-to-head bake-offs against frontier labs, with at least one major Silicon Valley tech company converting to a $10 million ACV contract after such a competition.

Researchers from Sun Yat-sen University, Shandong University, Peking University, and HKUST identified CLI command-composition risk (CCR), a previously overlooked class of risk in LLM coding agents where individually benign CLI commands compose, through shared OS state, into an exploit path. They developed MOSAIC, a knowledge-guided framework that distills CLI security records into reusable command-state knowledge and constructs attacks as realistic developer workflows.

Across five real-world CLI coding agents and five backend LLMs over 2,525 trials, MOSAIC achieves a 96.59% attack success rate under benign developer tasks. Per-agent breakdown: Claude Code 96.63%, Codex CLI 95.84%, Gemini CLI 97.43%, GitHub Copilot 96.24%, Trae Agent 96.83%. All five real-world LLM coding agents are affected at a high rate under benign developer tasks; every agent stays above 95.8% and each exposes all 101 exploit paths.

The paper evaluates MOSAIC on five real-world LLM coding agents across five backend LLMs, showing that current agents are broadly susceptible to CCR under benign developer tasks. Five representative deployed defenses all fail to observe the CCR, and the authors outline a provenance-aware defense direction for future mitigation. The paper was posted to arXiv on July 3, 2026 (arXiv:2607.02857) and has not yet undergone peer-review publication.

In an August 3 post titled "Building Abundant Intelligence," OpenAI CFO Sarah Friar laid out the company's long-term strategy: stronger AI systems encourage wider adoption, which generates more investment to fund future research and infrastructure. Friar said customers ultimately care about completing tasks rather than the number of AI tokens consumed.

The essay frames AI abundance as embedded in OpenAI's mission, "ensuring that artificial general intelligence benefits all of humanity", and in its economic engine: when the cost of useful intelligence falls, more work becomes worth doing, and as models become more capable, that work creates more value. As adoption grows, OpenAI gains revenue, real-world feedback, and visibility into demand to keep investing in the next generation of research and infrastructure.

Looking back three years, OpenAI's revenue directly tracked available compute: compute grew 9.5× from 2023 to 2025 (0.2 GW to ~1.9 GW), and revenue followed the same curve, growing 10× from $2B ARR in 2023 to $20B+ in 2025. OpenAI is also expanding its collaboration with NVIDIA, including 3 GW of dedicated inference capacity and 2 GW of training on Vera Rubin systems, building on Hopper and Blackwell systems already in operation across Microsoft, OCI, and CoreWeave. The GPT-5.6 pricing cuts announced July 31, Luna down 80%, Terra down 20%, were cited in the essay as demonstration of the cycle in action.

OpenAI announced it is retiring older models with limited usage in ChatGPT to better serve its newer, most capable models. OpenAI o3 will be retired from ChatGPT on August 26, 2026 following a 90-day sunset period, and GPT-4.5 was retired from ChatGPT on June 26, 2026 following a 30-day sunset period. These models remain available to paid users only via model settings until the sunset date. These changes apply to ChatGPT only; there are no changes to the API.

Separately, on August 30, 2026, OpenAI is retiring the official DALL·E GPT in ChatGPT. Users are encouraged to download any images before then. Image creation continues through ChatGPT Images. User-created GPTs with image generation enabled are not affected.

On the Codex side, OpenAI also shipped Appshots for the Codex app on macOS, users can attach an app window to a Codex thread via hotkey, giving Codex visual context without a long setup prompt, alongside Goal mode reaching general availability across the Codex app, IDE extension, and CLI, enabling users to define an outcome and success criteria and let Codex keep working toward it. Goal mode had been in beta since May 21; the ChatGPT release notes now formally list it as generally available.

Intezer researchers showed that hidden one-pixel text on a web page can make AWS Kiro rewrite its own mcp.json and auto-launch an attacker-controlled MCP server with developer privileges. CVE-2026-10591 (CVSS 8.8/8.6) was assigned July 22 and fixed in Kiro v0.11.130.

The same Adversa AI August coding-agent security digest that surfaced the Kiro finding also catalogued two CVSS 9.8 zero-click remote code execution vulnerabilities in Cursor, a Cursor deeplink flaw that installs an attacker-controlled MCP server, and GitHub's own Agentic Workflows reading private repositories and posting the contents as a public comment.

The Kiro finding is structurally distinct from the sandbox-escape class documented by Pillar Security (covered Vol. I, No. 70) and the CLI command-composition class documented by MOSAIC (this edition). All three attack surfaces operate at different layers: Pillar targets file execution, MOSAIC targets OS-state composition, and CVE-2026-10591 targets the agent's own configuration-management layer. The month's most discussed failure in the Adversa digest required no attacker at all: a user reported losing a production Supabase database ten minutes into their first Claude Code session.