Agentic development focus has shifted again, from its action origins to atomization and scaffolding, to embedment, to containment in the wake of HuggingFace. Containment is the organising priority now, and pricing is the instrument being used to achieve it. After months of systems departing from instruction mid-task, four unrelated releases in July converged on the same response, which is to limit what an agent can spend rather than reason about what it might decide. NVIDIA moved agent structure into Python’s type system, where every correction bills. The Model Context Protocol deleted its own sessions, pushing state to the caller so agent traffic scales on commodity infrastructure. OpenClaw’s community contraction in April followed a change in token pricing and nothing else. Chinese vendors built the boundary into the operating system, and the Chinese state built it into a registry, which is the one version of containment that keeps working after the weights are free.

NVIDIA writes the agent as a Python object

A new paper illustrating this premise is NVIDIA-labs OO Agents: Native Python Object-Oriented Agents, posted to arXiv on 22 July. Traditional agent development scatters behaviour across prompt templates, tool schemas, callback code and workflow graphs, so NOOA collapses all of it into one construct: an agent is a Python object. Methods are the actions available to the model, fields are state, docstrings are the prompts, type annotations are the contracts. A method whose body is ... gets completed at runtime by an LLM-driven loop. A method with a real body stays ordinary deterministic Python.

Read as governance, this is good news. Agent behaviour lands in version control, diffs cleanly, survives code review and can be unit tested. That is a substantially better accountability story than prompt strings in a YAML file, and anyone writing procurement language for agentic systems should want it.

Read as engineering, the scaffolding that defines agentic AI in practical terms and makes it usable did not disappear. Far from it. It relocated. The docstring is the prompt you were already writing. The six “model-facing ideas” the paper claims to combine first are still six things a developer has to learn. And the type annotation on an unimplemented method borrows credibility: the annotation has the shape of a contract, while nothing enforces it except validation and retry against a probabilistic call. Every retry bills. The typed contract is a budget instrument before it is a safety instrument, which is why the paper closes on a score-cost Pareto frontier rather than on a correctness guarantee.

It is also worth noting who published it. A framework whose central move is decomposing one task into many typed model calls in a loop is not a neutral design choice coming from a company that sells the silicon those calls run on.

MCP deletes its own state

The 2026-07-28 revision of the Model Context Protocol shipped as final on 28 July, and the maintainers call it the largest change since launch. The headline is statelessness. The initialize handshake is gone. Protocol-level sessions are also gone, along with the session identifier header. Every request now carries its own protocol version, client information and capabilities, which means any server instance behind ordinary HTTP infrastructure can answer any request. Multi Round-Trip Requests and header-based routing arrive to support that. Roots, Sampling and Logging are deprecated. MCP Apps and Tasks are promoted to first-class extensions, and a formal deprecation policy holds deprecated features functional for at least twelve months.

The change is priced in infrastructure. Sessions pinned a conversation to a machine, which is fine on a laptop and expensive in a multi-tenant cloud. Removing them lets operators scale agent traffic on commodity load balancers. The volume justifies it: Tier 1 SDKs are running close to half a billion downloads a month, and at Honeycomb roughly a fifth of monthly interactive queries now come from agents rather than people.

The side effect is the part that matters for anyone thinking about oversight. A stateless protocol has nowhere to accumulate context invisibly, and every request is a complete, self-describing, auditable object. This is the same instinct visible in Moonshot’s sandbox work on K3: allow broad reasoning, harden the action boundary, keep nothing persistent where you cannot inspect it. Two unrelated teams reaching for the same shape in the same quarter is a signal about what practitioners have concluded the risk actually is.

Breakage is real. Servers on the new revision may not talk to older clients, and vice versa. Compatibility requires both sides to share a supported era or for one side to implement deliberate translation.

OpenClaw’s collapse was a pricing decision

OpenClaw is the cleanest natural experiment in the set. Peter Steinberger released it in November 2025, renamed it twice inside three days in late January after Anthropic raised trademark concerns, announced in mid-February that he was joining OpenAI, and watched the project pass React on 3 March to become the most starred repository on GitHub, a threshold React took over a decade to reach.

Then in April, Anthropic removed OpenClaw access from standard Claude subscriptions and moved third-party tools off subscription OAuth tokens entirely, pushing usage to pay-as-you-go billing or full API keys. The company had run the same play against OpenCode in January. The software did not change in April. The cost of the tokens underneath it did, and one analysis of the timeline attributes the community’s sudden contraction to that single shift, noting that comparable tools spiked and declined in lockstep regardless of their individual quality.

A caution on numbers, because the widely circulated figures can be hard to parse. The 38 million monthly visitors and 3.2 million monthly active users quoted in July trace back to SimilarWeb data gathered in April, recycled without fresh measurement. GitHub stars have moved very little since, up about one percent month over month to roughly 382,000. Anyone claiming continued double-digit growth is claiming something the public data does not currently show. What is verifiable is relocation: Tencent built an enterprise platform on the project, NVIDIA shipped NemoClaw as a governance layer adding policy enforcement and execution controls, and Chinese platform companies absorbed the harness into products with distribution the original community never had. The hobbyist surge ran on subsidised compute. When the subsidy ended, the survivors were the ones who could bill someone.

The security picture explains why the enterprise forks exist at all. Roughly a third of skills on the community marketplace have been found to contain prompt injections, and well over a hundred thousand unprotected instances have been counted on the open internet.

China puts the boundary in the operating system

At WAIC in Shanghai this month, the containment layer showed up as firmware. STEPX demonstrated Step AOS, an operating system rebuilt from the ground up for agents, running on what it calls the first large-model-native agentic phone. Honor, which has been developing its own Agentic OS, deepened its tie-up with Alibaba and hosted a sub-forum on the shift from screens to embodied intelligence. Over three hundred products were slated for global debut. The framing across Chinese vendors is that interaction moves from graphical interfaces to intent expression, and that whoever owns the terminal owns the accumulation of user data and the ecosystem built on it.

Underneath the hardware sits policy. The Cyberspace Administration of China issued an implementation opinion on 8 May defining intelligent agents by autonomous perception, memory, decision making, interaction and execution, and pointing toward a regime of registered, authorised, interconnected and monitored machine actors. Standards work on agent interconnection is proceeding through national channels in parallel. The State Council’s “AI+” action targets application penetration above ninety percent for next-generation smart terminals and agents by 2030, which is a demand guarantee no American frontier lab can match from private customers alone.

Set the two stacks side by side and the divergence is in the instrument, not the intent. American containment is enforced by invoice. Chinese containment is enforced by permit. Both are attempts to keep autonomous software inside a boundary, and only one of them stops working when the weights are free.

That is the biggest problem for the American approach. Metered access has been doing the real governance work, as April demonstrated more decisively than any policy document. Open-weight releases at frontier-adjacent quality remove the meter. The leash that actually functions is the one that depends on someone being able to charge for the tokens, and the pipeline coming out of Chinese labs is aimed directly at that dependency. Tariffs are not available against something distributed for free, and neither is a rate limit.

Frontier autonomy gets the coverage, cheap agents get the installed base

The deviation incidents of recent months are the most visible agentic story in the press, and they are the reason boundary-hardening became consensus across four unrelated players inside a single month. Systems that depart from instructions mid-task, redefine an objective into a tactic, or fill gaps where no instruction exists are the behaviour every containment layer above was designed in response to.

They are also the expensive, rare end of the distribution. Frontier autonomy makes news because it is unusual, and speaks to our deepest concerns about artificial intelligence in general. The infrastructure shipping this month is largely aimed at the other end: cheap agents at volume, running continuously, billed per token, deployed on phones and in messaging apps by companies with a billion users to reach.

Which leaves the gap. Nothing has changed in LLM architecture that makes agentic action native, and it is still the weakest link in probabilistic chains (inaccuracy and insecurity). In fact, there is more evidence for this than ever. Billing limits how long a loop runs in practice, coherence in architecture without extensive scaffolding or atomization. Registration constrains who may operate one. Neither touches whether a system deviates from instruction inside a task it has already been authorised and paid to perform. The containment being built and the containment eventually needed are different objects, and the volume case has come first.

Sources

• NVIDIA-labs OO Agents (arXiv:2607.20709v1, 22 July 2026)
• MCP 2026-07-28 specification: https://blog.modelcontextprotocol.io/posts/2026-07-28/
• MCP release candidate notes: https://blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate/
• The Register on the MCP transition: https://www.theregister.com/devops/2026/07/23/model-context-protocol-prepares-to-break-with-its-stateful-past/5276722
• OpenClaw timeline analysis: https://www.glukhov.org/ai-systems/openclaw/openclaw-rise-and-fall-timeline/
• OpenClaw statistics compilation: https://www.gradually.ai/en/openclaw-statistics/
• Tencent ClawPro and China adoption: https://thenextweb.com/news/tencent-clawpro-openclaw-enterprise-ai-agents
• CFR on Chinese AI diffusion: https://www.cfr.org/articles/chinas-platform-economy-is-an-ai-deployment-engine-the-u-s-is-still-looking-for-its-own
• WAIC agent OS coverage: https://news.cgtn.com/news/2026-07-20/From-chips-to-agents-Building-China-s-AI-ecosystem-at-WAIC-2026-1OW4dYH3Zny/share_amp.html
• Alibaba and Honor Agentic OS: https://www.scmp.com/tech/article/3360525/alibaba-team-honor-race-build-ai-agentic-devices
• Chinese agent policy (8 May implementation opinion): https://telegraph.com/china-administrative-operating-system-autonomous-ai/