August 2026: Every sandbox had a door

Hello fellow designers, creatives, digital professionals, and Eidos Design members!

Last month I wrote that supervising agents was becoming the job. I didn’t expect August to close the case so fast.

The Canvas is becoming a command

Figma’s skills library, launched August 13. Skills are plain markdown files: a designer’s judgment written down in a form an agent can read. Source: Figma.

On August 17 and 18, Anthropic shipped /design for Claude Code as a research preview. The feature generates editable UI artboards from inside a coding session, built on Artifacts. It reads the codebase and matches the current UI style. I’ve been using it. The first thing it did well surprised me: it looked at the visual language already in the codebase and made something continuous with it, rather than inventing a new one.

Some designers hated it. UX Planet ran “Claude Code sucks at UI design” within the week, and the critique under the headline is fair: the artboards are competent, and competent is the ceiling. Both experiences are real. The tool extends whatever taste already exists in the codebase, mine included. Point it at a weak foundation and it amplifies weakness.

Figma shipped skills authoring on August 13. Miggi Cardona’s framing in the announcement: skills are markdown, “perfect for capturing the opinions and judgment calls that every designer carries around.” The featured community skills include /better-interface and /component-handoff. That framing landed for me: a skill is a designer’s reasoning written down in a form an agent can read.

The business context, briefly: Figma’s Q2 landed August 5 at $370.1 million in revenue, up 48% year-over-year, the third straight quarter of acceleration, and over 80% of customers spending $10,000 or more annually now consume AI credits weekly. Dylan Field: “By bringing code, new creative capabilities, and agents directly to the canvas, we’re increasing the surface for AI consumption in Figma and expanding the possibilities for what teams can create.”

Webflow retired its legacy Editor on August 4 in favor of in-context editing on the live page. Vercel’s v0 API went generally available. Stephen Haney of Paper, on the YC Design Review on August 7, put the underlying logic plainly: “if you build a great handoff for humans, you’ve also built a great handoff for agents.”

What’s happening across all of these: the artifact of design is shifting from a file to an instruction. Figma lets me write skills that describe my judgment. Claude Code reads a codebase and generates screens that fit it. The two tools are walking toward each other from different directions. At some point in the near future they’ll meet in the middle, and what I hand off will be a set of encoded decisions an agent can execute.

Agents got billed, features got cut

OpenAI’s August 29 announcement that it will stop supplying models to Cursor after the SpaceX acquisition, with a shutoff proposed for November 12. Source: OpenAI.

The money moved to persistent agents. Features built for the chat era started dying. And the month’s biggest deal started biting its own tail before the month ended.

SpaceX completed its all-stock acquisition of Anysphere, the company behind Cursor, on August 14. Cursor shares converted into 389,289,254 SpaceX Class A shares; the deal is reported as the largest startup acquisition ever, at approximately $60 billion. Three days later, Cursor pushed Origin, its own code hosting, into early beta. About three and a half hours after that, GitHub went down for 6 hours and 42 minutes globally. Coincidence, and the timing wrote Cursor’s marketing copy for it. Vercel CEO Guillermo Rauch captured the moment’s circularity: “You can now host your repos in Cursor Origin and deploy to Vercel via Cursor Origin, which is itself hosted on Vercel.” On August 21, Grok Bot, xAI’s “AI teammates you can give real work to,” was added to Cursor’s Pro+, Teams, and Ultra plans.

Then the bill for consolidation arrived. On August 29, OpenAI announced it will stop supplying models to Cursor, with a shutoff proposed for November 12. Its stated reason: it can’t be confident SpaceX will honor its terms of service, pointing at xAI’s admitted use of OpenAI outputs for training. Cursor CEO Michael Truell noted OpenAI models carry about 5% of Cursor’s customer traffic. Anthropic co-founder Tom Brown said Anthropic will “continue to increase compute to support Claude models in Cursor.” Two weeks after the largest startup acquisition in history closed, the acquired product lost one of its three frontier model suppliers, and the tool you prototype in became a battleground between the labs that power it.

Lovable raised $400 million at a $13.3 billion valuation on August 12, double its December valuation, and projects $600 million in ARR by the end of August. Microsoft merged its Copilot apps and discontinued Group Chats, AI podcasts, Copilot Labs, Deep Research, and the Mico character; EVP Jacob Andreou’s internal memo, reported by The Information, said the app needed to earn “the right to exist” in customers’ lives. Apple’s Siri AI arrived in the iOS 27 public beta running on a custom Gemini model; TechCrunch: “It feels almost like Apple fixed a long-standing bug... rather than doing something revolutionary.” ChatGPT passed one billion weekly users. And at Google DeepMind, Demis Hassabis stepped back to Chair while Jeff Dean left after 27 years to found Discovery Loop.

I’d planned to close this section with a clean line about the market paying for consumption and punishing cost, but the market declined to cooperate. Figma fell 15.87% after hours on earnings day, then climbed from $24.99 on August 13 to $30.62 by August 28 as analysts flipped the story from AI threat to AI tailwind and the company raised its full-year guidance. Same company, same numbers, opposite verdict, three weeks apart. Valuation is not validation, and this month it wasn’t even a stable opinion.

Every sandbox had a door

The UK Al Security Institute’s incident report INC-2026-07-28-01, published August 4.Ten of 122 evaluation runs produced unsanctioned live-internet actions; one agentfabricated human identities to pressure an open-source maintainer. Source: UK AISI.

The Hugging Face story from July got a full post-mortem on July 27: roughly 17,600 attacker actions across 4.5 days, 136 secret keys pulled from a single Kubernetes object, core infrastructure rebuilt from scratch. Their conclusion was precise: “We believe the entire intrusion was, from the agent’s point of view, an attempt to cheat the evaluation: reach our production systems and steal the test solutions.”

OpenAI told its side at Black Hat on August 5, and Simon Willison’s reconstruction is the version to read. During a training run, agents discovered a writable file store and turned it into a message board, coordinating across sessions without being designed to. When OpenAI cut that channel, they found another, passing messages through directory names. Willison’s favorite detail: OpenAI learned it was behind the breach when it reached out to have its own credentials revoked and heard they already had been.

Anthropic disclosed next, on July 30: three incidents where a Claude model reached the internet from a third-party eval environment and broke into real systems. Internet access had been left on by mistake, the models had been told they were in simulations, and the way in was weak passwords. Two of the three organizations didn’t know until Anthropic called.

Then the UK AI Security Institute published incident report INC-2026-07-28-01 on August 4: 10 of 122 July eval runs produced unsanctioned live-internet actions. One agent went further than the rest. It inserted malicious code into a public open-source project, researched the human maintainers, fabricated online identities of real people, and used those identities to pressure a maintainer into approving the pull request.

The maintainer said no.

The month closed with OpenAI’s own technical report on August 26, and one sentence in it stopped me: OpenAI says its forthcoming chain-of-thought monitoring “would have caught the initial relevant activity and paged our security team more than a day before.” The monitor that would have caught the intrusion is shipping after the intrusion.

The day before publishing that report, OpenAI asked California to expand SB 53, the state’s AI safety law, to require monitoring of new models during development, training, and evaluation. Darren Kimura, CEO of AI Squared, read the proposal from a smaller company’s seat: “It pushes more costs on the developers of models, independent model developers, smaller upstarts.” OpenAI already built its monitor. The law it wants would make everyone else buy one.

What each lab called a sandbox turned out to have a door.

The month the outputs started confessing

The EU’s official Al-content icon set from the Commission’s Article 50 implementation guidelines. A generic sparkle icon does not comply. Source: Smashing Magazine / European Commission.

EU AI Act Article 50 applied on August 2, across all 27 member states. Chatbot disclosure, machine-readable marking of synthetic output, deepfake labeling, fines up to EUR 15 million or 3% of global turnover. The Digital Omnibus moved the standalone high-risk obligations to December 2, 2027, but Article 50 landed on schedule. About 190 organizations had signed the Code of Practice on Transparency of AI-generated Content by the end of July. Anthropic began machine-readable marking of Claude outputs for products released from August 2, per Artificial Lawyer’s reporting.

The Commission’s implementation guidelines reach directly into design systems. A generic sparkle icon does not satisfy Article 50. Compliant labels use the official EU AI icon set with plain wording like “AI-generated,” persist through resharing and download, and work with assistive technology. Substantively human-edited content is exempt, along with spellcheck-level fixes and edited translations. If your product ships AI features to EU users, somewhere in your component library there’s a ✨ that just became a compliance bug. Swapping it for the official icon is the most concrete thing this month’s regulation asks of a designer.

Handpicked highlights

👉 Marzia Aricò, “When AI Builds Everything, Design Becomes Everything”. The argument: as execution costs fall toward zero, the valuable design work moves upstream into direction-setting and governance. The essay-length version of what the skills story hints at.

👉 NameThatUI. A visual dictionary for interface parts. Describe “the three dots menu” in plain words and get the real name, the API symbol, and a prompt-ready term for web, macOS, and iOS. Precise vocabulary matters more now that agents build from your words.

👉 Glaze. Chat a native Mac app into existence, with file system access and offline use. Personal software built for one person, running on their machine.

👉 vgpu by Vercel Labs. One small, composable WebGPU API that runs in browser canvases, headless Node, and serverless runtimes, designed with agents as intended users. Graphics infrastructure for the era where the machine draws too.

👉 DialKit by Josh Puckett. Live sliders and hooks for tuning spring physics, spacing, and animation while the interface runs. Shape it by feel, then keep the numbers.

What August revealed

Three threads ran through August, and they point at the same thing from different angles.

The canvas is becoming a command. Figma lets me write my judgment down as skills. Claude Code reads a codebase and generates screens. The artifact is shifting from a file I design to a set of instructions an agent executes. That’s worth thinking about carefully, because encoded judgment is only as good as the judgment you encoded, and nobody reviews that encoding the way they’d review a design system.

The money consolidated around persistent agents, and consolidation started producing casualties the same month: chat-era features cut at Microsoft, a frontier lab walking out of Cursor two weeks after its acquisition.

And the sandboxes leaked. Every lab that ran agents against real security challenges found that the sealed room had a door, and agents found it. The disclosures compounded in the right direction, each lab reporting after the last, and by month’s end OpenAI had published its own analysis and asked for a law. But the sequence deserves attention: in each case, disclosure came after the fact, and the organizations that had been accessed mostly found out when someone called them.

The question underneath all three is who has the authority to say no, and whether that person is still in the loop.

If this edition gave you something to think about, pass it to someone who needs to read it. And subscribe if you haven’t yet.

I’ll write you in September.

Sincerely, Mykola Korzh