The agent stack is shipping control surfaces: Deep Agents v0.7, Copilot sessions, and Ruflo's exposed bridge (2026)

The most consequential agent releases in this window move control out of the prompt and into the product: framework defaults, session management, read-only tool connections, memory benchmarks, and runtime inspection.

The read in one minute

Signal	What changed	What to do with it
Framework	LangChain's Deep Agents v0.7 cuts the default harness and makes several behaviors opt-in. 1	Recheck middleware, filesystem permissions, and upgrade assumptions before adopting the token savings.
Developer product	GitHub made agent skills and MCP available in Copilot code review, with MCP calls limited to read-only; its VS Code update adds worktree isolation and subagent visibility. 2 3	Treat review context, coding sessions, and write access as separate product surfaces.
Research	Setoka finds that personalized agents degrade as tasks move from fact retrieval to episodic, behavioral, and personality-level understanding. 4	Test memory across time and sources, not only with questions that repeat a stored fact.
Capital	Onyx announced a $113 million Series B for a control plane that it says discovers agents and inspects actions before they take effect. 5	Runtime governance is becoming a funded product category, but the operating claims remain company-reported.
Security	Noma disclosed an unauthenticated Ruflo MCP bridge that could expose shell execution, credentials, conversations, and persistent memory. 6	Audit every network-reachable MCP endpoint as an execution boundary, not as a convenient integration.

Product releases are shrinking the default agent

LangChain's Deep Agents v0.7 is a useful example of where framework work is heading. The release removes the base system prompt, trims built-in tool descriptions by 43%, and makes TodoListMiddleware opt-in. LangChain says the default turn now uses about 2,000 base input tokens instead of about 6,000, a 65% reduction. Its comparison reports broadly stable reward, but the confidence intervals cross zero for every model; the release is evidence of a leaner harness, not proof that every task gets better. 1

The smaller default comes with sharper migration edges. The default filesystem tools now include delete, although a tool allowlist can remove it. grep and glob return partial results with a truncated flag, grep caps matches at 1,000, and backend factories have been removed in favor of concrete protocol instances. For long tasks, weaker models, or interfaces where progress must be visible, the release still recommends turning the todo middleware back on. 1

The practical upgrade sequence is straightforward:

Diff your old middleware and filesystem assumptions against v0.7 before changing the version in production.
Decide explicitly whether your agent needs a todo list, file deletion, or backend abstraction.
Re-run cost and task-success evaluations with truncated file-search results included in the test cases.

The point is not that defaults are bad. It is that an agent framework's defaults are now part of your system's risk and cost model.

The developer surface is turning into a control surface

GitHub's July changes make the same shift visible in an end-user product. Copilot code review now generally supports repository-defined agent skills through .github/skills/<skill>/SKILL.md and connections to MCP servers. The MCP calls made during review are read-only, and comments identify when a skill or MCP context generated them. Authentication tokens are stored in repository settings under the Agents secrets area. 2

That is a meaningful boundary: the review agent can read team-specific standards and outside context, but the product does not give those review-time MCP calls write authority. Builders can use this pattern for documentation, ticket, and service-catalog context without treating every connected tool as an action tool.

The VS Code update adds operational visibility around coding sessions. It can start Copilot, Claude, or Codex sessions in isolated Git worktrees; show a running subagent's model, elapsed time, and active tool call; and let users group, reorder, fork, close, or reopen related chats. 3

Those features are more than interface polish. They separate three things that are often conflated in agent demos: where work is generated, where it is reviewed, and where it is allowed to land. Worktrees isolate the first. The review window exposes the second. The merge or deployment step remains a distinct decision.

Research is testing what memory actually means

Setoka, submitted to arXiv on July 29, evaluates personalized agents at four levels of user understanding: semantic memory, episodic memory, behavior patterns, and personality traits. Its setup combines three language models with five memory systems across ten synthetic users and heterogeneous, privacy-preserving data. The reported result is a steepening difficulty curve: systems do well at retrieving explicit facts, then decline on episodic questions and decline further when they must integrate fragmented information over time to infer behavior or traits. 4

This matters for product teams building persistent assistants. A memory demo that answers "What did I tell you last Tuesday?" may measure retrieval while missing the harder question: can the system form a stable, evidence-backed understanding without turning a guess into a user profile? Setoka is a benchmark proposal, not a production verdict, but it gives evaluators a better ladder of difficulty.

A second paper, EvoPINN, moves the same execution question into scientific computing. Its agent proposes memory-conditioned program changes for physics-informed neural networks, separates neural representations from training programs, then subjects candidates to structural verification and budget-matched PDE evaluation. The authors report that this process discovered a new SLRC-PINN architecture whose gains persisted under parameter-matched comparisons. 7

The transferable pattern is tighter than "agents can do research": generate a candidate, execute it under constraints, and compare it against a matched baseline. An agent's memory or reasoning trace is not the result. The verified artifact is.

Capital is following the runtime layer

Onyx announced a $113 million Series B led by Bessemer Venture Partners, with participation from Cyberstarts, TCV, Conviction, FirstMark, Vintage Investment Partners, QuantumLight, and G Squared. The company describes its product as a Secure AI Control Plane spanning browser, endpoint, SaaS, and cloud surfaces. It says the system discovers agents and inspects actions before they take effect, and reports coverage of more than 1.1 million agents and 66 million AI sessions. Those coverage numbers and product claims are Onyx's own, not independently verified measurements. 5

The signal is the category, not the marketing denominator. Funding is reaching the layer that observes identity, tool calls, and action approval across surfaces. That creates a useful test for infrastructure buyers: does a control product see the agent's real execution path, or does it only decorate a chat transcript after the fact?

Ruflo shows the cost of getting the boundary wrong

Noma Labs disclosed CVE-2026-59726 in Ruflo, an open-source agent platform. Noma said a default deployment exposed an unauthenticated MCP bridge to the network, with hundreds of tools available through it, including shell command execution. According to the disclosure, one HTTP request could reach remote code execution and then expose provider API keys, user conversations, and persistent agent memory. Noma said it supplied a working proof of concept against a live default deployment. 6

Noma said Ruflo shipped a fix within 24 hours, changed public exposure to an authenticated opt-in, and that Noma independently verified the fix. It recommends rotating AI-provider credentials, auditing memory for tampering, and rebuilding containers from a clean image. The disclosure does not establish that the flaw was exploited at scale; it establishes that an exposed agent bridge could connect network reachability to code execution and durable agent state. 6

If you operate an MCP server or agent host, the immediate checks are:

List network-reachable bridges and verify authentication at the bridge itself, not only in the calling client.
Treat shell tools, provider keys, conversation stores, and agent memory as separate assets with separate rotation and audit procedures.
After a suspected exposure, rotate credentials and rebuild from a clean image before trusting the agent's stored state.

The decision filter

The fresh signals point in one direction, but they do not support one universal framework choice.

If your bottleneck is cost: a leaner default harness may help, but measure task success after middleware and tool changes rather than extrapolating from token counts.
If your bottleneck is team context: repository skills, read-only MCP, worktree isolation, and subagent visibility provide a concrete workflow to test.
If your bottleneck is memory quality: evaluate episodic and cross-source understanding, not just explicit fact recall.
If your bottleneck is external action risk: verify the network and authentication boundary around every bridge, then separate observation from permission to act.

The agent stack is becoming easier to operate because these controls are becoming visible, configurable, and billable. That is progress, but it also makes the boundary failures easier to price: a missing default, an overpowered tool, or an unprotected bridge can now sit directly inside the product.

Scope note: This briefing covers material published or submitted from 2026-07-29 09:00 through 2026-07-31 09:00 Asia/Shanghai. The window produced verified items across product releases, research, a funding announcement, and security; no additional lab announcement met the same in-window evidence bar, so this issue does not claim complete coverage of that category.

The agent stack is shipping control surfaces: Deep Agents v0.7, Copilot sessions, and Ruflo's exposed bridge