Last week the frame was governance everywhere — AI walking out of the demo room and into the institutions waiting for it. This week the institutions started fighting over who gets to hold it. A frontier model became both a thing the government can switch off and a thing a rival state allegedly tried to steal. Agents reached for the credit card. The version-control stack splintered into camps. Norway pulled AI out of its classrooms while Bernie Sanders proposed buying the industry outright. The throughline isn’t capability anymore. It’s custody — who holds the keys, who’s accountable, and who gets sued when it goes wrong.
The model is a lever and a target
Last week’s lead was that Washington could delete a frontier model by administrative order. This week the story got its motive and its mirror image — and both make the dependency worse.
On the motive: the Anthropic shutdown, it turns out, was never about an AI jailbreak. Techdirt reported the apparent real reason the models are offline is a six-year-old Trump grudge, enforced through export rules nobody quite understands — an export ban that’s now sounding alarms across the industry.
On the mirror image: the same week, Anthropic said Alibaba must be punished for the largest Claude cloning attack it has seen. So the model you depend on is simultaneously something your own government will pull off the shelf over a personal feud, and something a foreign competitor is allegedly trying to exfiltrate wholesale.
Strip the noise and the structural point is sharper than last week’s. If you built on these models, your dependency was never just technical. It’s political risk on one flank — which way the last D.C. briefing went — and supply-chain risk on the other, because the providers are now fighting theft at the same time they’re fighting Washington. Capability you can rank on a benchmark. Custody you cannot.
Real wins, real asterisks
It would be easy to read all that as AI losing a step. It isn’t — the technology cleared real bars this week. The trouble is that the cleanest win got the least attention and the loudest one carried the biggest asterisk.
Start with the quiet, verifiable result: AI-designed radio chips that look like QR codes and beat the human-designed ones. That’s a hard engineering problem with a measurable answer, and the machine won it outright. Now the loud one: two AIs matched or beat doctors on diagnosis — with the catch buried in the subhead, which is that none of the patients were real. The Atlantic declared AI is taking over hospitals in an “Uber moment” framing, while the genuinely moving result of the week — a brain-computer interface plus AI letting a speechless ALS patient hold a full-time job — got a fraction of the noise.
The asterisk is the story. A benchmark win on synthetic cases is not a clinical deployment, and the gap between the two is exactly where the custody question lives: who’s accountable when the model is wrong about a real patient. Worth noting alongside it that the frontier labs are now putting capital, not just models, into the problem — Stripe, Anthropic, and OpenAI are backing an effort to stop respiratory infections. The money is starting to move toward the hard, verifiable problems. The headlines are still chasing the asterisked ones.
The version-control wars
If the models are contested, so is the ground developers stand on. The dev stack’s trust seams are being renegotiated in public, and the renegotiation got loud this week.
The New Stack caught the consensus and the schism in one line: Cursor, GitLab, and Zed all agree GitHub is breaking — and disagree completely on how to rebuild it. Into that gap, Epic Games shipped Lore, an open-source version-control system, a genuine swing at Git’s incumbency. Homebrew 6.0 landed with a new security mechanism and a Linux sandbox. And Vercel debuted “eve,” an open-source agent framework, alongside “Passport” — an attempt to corral shadow AI before unsanctioned agents become the next supply-chain problem.
This is churn we actually consume. Lore and the GitHub-is-breaking consensus are the ones to watch — not because Git is going anywhere soon, but because the question underneath is the same custody question: who owns the canonical copy, and who do you trust to host it.
Agents that spend money
Last week’s thesis was that bounded agency is the real product — the rails matter more than the model. This week the agents walked up to the cash register.
Coinbase launched a tool that lets AI agents manage trading and payments, including an agent that can trade crypto and pay for research on your behalf. A Gusto cofounder demoed an agent that runs payroll, HR, and benefits for a small business — the back office, unprompted. And Higgsfield launched enterprise marketing agents built on NVIDIA hardware, claiming a chunk of the Fortune 500 already onboard.
Once an agent can move money and write to the systems that run a company, the model is the cheap part. The deliverable becomes budgets, audit trails, approvals, and a working undo button. “AI assistance” is not the thing you buy. Custody of the agent — the rails that keep it from cashing out your account — is.
Who controls AI
And the biggest custody fight of all went electoral. The question of who owns the AI industry stopped being a panel topic and became a ballot question.
Bernie Sanders unveiled a $7 trillion plan to give Americans control of the AI industry — public ownership as the answer to private concentration. A $5M tech-worker PAC is taking on Big Tech’s $100M war chest over how AI gets regulated. California’s billionaire tax made the ballot despite opposition from tech moguls. And governments aren’t waiting for the campaigns to finish — Norway imposed a near-ban on AI in elementary school, legislating custody at the edge while everyone else argues about the center.
The capstone came, fittingly, as a question. The Atlantic asked how to think about AI before it’s too late — which is the honest frame for the whole arc. The governance scramble, the PACs, the ballot measures, the school bans are all downstream of a thinking-gap, and the window to close it is the actual story.
Beat — Security
The custody of data kept failing in the usual ways. Everything’s bigger in Texas, even data breaches, where a state vendor exposed the records of three million hunters and anglers. And Britain’s privacy watchdog quit after a “poor judgment” admission — the person meant to guard the data, conceding bad custody of their own.
The throughline
Add it up and the week reads as one long argument over possession. The government holds the off switch; a rival allegedly grabs a copy. The agents reach for the card. The developers fight over who hosts the canonical repo. The politicians fight over who owns the industry, and Norway just takes it out of the classroom.
The pitch was intelligence everywhere. What’s actually arriving is a custody battle everywhere — and the teams shipping this year are discovering that owning the capability and being trusted to hold it are two very different things.