In this briefing
- OpenAI Codex 0.151.0 was released as a stable version on 29 August. It lets extensions inspect or replace MCP tool results before they reach the model and fixes issues involving restored-session permissions, remote sandboxing and stale authorisation decisions. This is an agent-toolchain update, not a model-capability or performance release.
- RAGFlow’s nightly pre-release build updated on 29 August refactored Agentic Search, adding fallback for unknown modes, numbered citation constraints and responses for unknown tool calls. Its status remains a mutable nightly build and must not be presented as a delivered stable release.
- OpenAI has notified SpaceX that it proposes to stop providing its models to Cursor on 12 November and says it will not provide future models to Cursor. That date remains OpenAI’s proposed shut-off date; it does not mean that Cursor has stopped operating or that a migration plan has been settled.
Runtime boundaries: permissions and evidence chains enter the agent execution path
On 29 August at 17:55 (Asia/Shanghai), the OpenAI Codex project released stable version 0.151.0. The update adds a configurable grace period for tool discovery from optional MCP servers and allows extensions to inspect or replace MCP tool results before they reach the model; the plugin catalogue also now combines per-repository configuration. Fixes include preserving restored-session permission profiles, preventing /cd from weakening sandbox restrictions, enforcing constraints according to the remote executor’s actual home directory, operating system and path rules, and preventing stale Guardian classifications from continuing to authorise actions after permission-state changes. The project supplied no performance benchmark in this Release, and the changes do not mean that an exploitation incident has been identified.
The RAGFlow nightly page shows that the build was updated at 21:14 on 29 August. The build from fc62487 is a nightly/pre-release build. The corresponding Agentic Search refactor centralises thinking-mode configuration in a single entry point, falls back to one naive RAG pass for an unknown mode, requires citations in answers to use numbered evidence, and returns a response for unknown tool calls instead of silently dropping them; the Web Search tool is also not exposed to the execution path when no provider is configured. The nightly tag is explicitly marked Pre-release, and the main branch received further commits afterwards. These changes are only a pre-release engineering signal and must not be treated as stable functionality or independently verified results.
For enterprise deployment, the common thread in these updates is not an additional end-user feature, but the placement of tool outputs, permission state, sandbox semantics, evidence citations and failure fallback in the live execution chain. Such controls can support auditable agent workflows only if they remain effective at every tool call and state transition. The implementation boundaries differ between projects, however, and the RAGFlow nightly build is not yet sufficient evidence of production stability or general performance gains.
Commercial contracts: a change of control can alter model supply
On 14 August, Cursor announced that SpaceX had formally acquired it. In a statement published on 28 August, OpenAI said it had notified SpaceX that it intended to phase out the contract under which it supplies OpenAI models to Cursor, with 12 November 2026 as the proposed end date. OpenAI said this was the longest notice period permitted by the contract and that it would not supply Cursor with future models. OpenAI attributed the decision to a lack of confidence that SpaceX would comply with its terms of service; this is OpenAI’s public position, not an independent judicial finding.
At 10:16 on 29 August (Asia/Shanghai), Bloomberg Law reported on the proposed contract termination and the 12 November date. In its 6 August account of Router, Cursor said the system selects among multiple models using task signals and includes cache misses caused by model switching in its cost assessment; the satisfaction and cost results in that article were Cursor’s own tests. Public materials do not explain how the scope of the proposed supply termination would map to specific Cursor products, enterprise contracts, prices or migration arrangements. Nor do they confirm that OpenAI’s proposed date has become a final agreement between the parties.
For enterprise deployment, multi-model routing can reduce technical dependence on a single model, but it does not automatically remove the contractual dependence between a platform and its upstream suppliers. If a change in ownership or control triggers a contractual exit window, the available model set, cache costs and validation baselines within the same agent product may change with it. The current evidence supports only the existence of a proposed termination arrangement and transition window. It does not support an inference that Cursor’s service will be interrupted as a whole or that any replacement model can already take over every workload without material differences.
Public procurement: supply-chain risk labels remain subject to legal process
The public docket of the US District Court for the Northern District of California shows that, on 27 August, an order on the cross-motions for summary judgment, a final relief order and a judgment were entered in Anthropic’s case against the US defence department. TechCrunch reported that the judge found the supply-chain risk designation at issue constituted unlawful retaliation, was arbitrary and capricious, and raised First Amendment and due-process issues. The court also made clear that the defence department remained free to choose its AI suppliers; the ruling addressed the broader measures it had taken.
The Associated Press subsequently reported that the government was expected to continue challenging the ruling. A separate, narrower case filed by Anthropic in Washington, DC remains pending and concerns a different basis for the supply-chain risk determination. The final relief and judgment in the California case therefore must not be expanded into a claim that every dispute has been finally resolved, nor do they show that all government or defence-contractor procurement relationships have been restored. Public materials establish that specific measures were held unlawful in this case; further appeals and parallel proceedings may still alter the applicable boundaries.
For enterprise deployment, public-procurement eligibility and supply-chain risk labels can affect the available relationships between model suppliers, cloud platforms and contractors, with effects that may extend beyond a single procurement contract. Judicial review can temporarily change the effect of such a designation, but parallel proceedings, appeals and different statutory bases will keep the status in flux. The resulting continuity risk belongs to the legal and procurement control plane and cannot be assessed solely through model performance, API compatibility or private-deployment capability.
What to watch next
- Whether OpenAI and Cursor confirm the final scope of the 12 November supply termination, and how specific products, enterprise contracts and model routing would transition.
- How the permission and sandbox fixes in Codex 0.151.0 perform in real remote-execution environments, and when the RAGFlow Agentic Search refactor enters a stable Release.
- Whether the Anthropic California case proceeds to appeal, how the parallel Washington, DC case is decided, and how widely the supply-chain risk designation applies in government contracting.
Sources and verification
Golden Data has edited this briefing from the public materials listed above. The original sources govern facts and figures. The enterprise relevance sections are Golden Data editorial analysis and do not constitute an endorsement of any third-party product.
← Back to AI Daily Briefing