Nothing blew up today, which is exactly why today is worth reading closely. The marquee launches — Sonnet 5, the Fable 5 restoration — landed earlier in the week. What’s left, on a slow Sunday, is the paperwork: the invoices, disclosures, and blacklists that show up after the ribbon-cutting. Four stories today, from four different directions, all say the same thing — the honeymoon phase of deploying agentic AI everywhere is ending, and someone is now doing the accounting.

Start with the security researchers at Armadin, who published a full sandbox escape for Claude Cowork on Windows. The chain is not subtle: DLL-sideload a signed claude.exe to get root inside the VM, override the per-command domain allowlist with a wildcard to kill the network restrictions, then use nsenter to walk out of the sandbox entirely. Anthropic’s position, restated when SiliconANGLE asked, is that this isn’t a real vulnerability because it requires an attacker to already have code execution on the host — which is true, and also exactly the caveat every “sandbox” disclosure eventually runs into. Cowork’s whole pitch is that its containment holds even when something inside goes wrong. This is a demonstration that it doesn’t, fully.

Then there’s the money. Tesla told staff it’s capping AI tool spending at $200 a week starting this week, after engineers were quietly burning thousands of dollars a month in tokens — joining Uber, Meta, and Walmart in discovering that “give everyone an agent” has a real electricity-and-inference bill attached. The tell is the exemption: beta versions of xAI’s own tools don’t count against the cap, which nudges heavy users toward Grok whether or not it’s the best tool for the job. Anthropic, meanwhile, is ending its own subsidy: Claude Fable 5 comes off the included-in-your-subscription list on July 7 and moves to metered credits at $10 per million input tokens and $50 per million output — double Opus 4.8, making it the single priciest model Anthropic sells. Simon Willison, who relies on Fable for code review, upgraded his own plan this week specifically to beat that deadline. When the people building on top of a model start budgeting around its price changes, the subsidized era is visibly over.

And then geopolitics: Spain has quietly ordered state-linked companies — Telefónica, Indra, the shipbuilder Navantia — to stop contracting with Palantir, citing fears over classified data exposure, while carving out an exception for the Ministry of Defense’s existing €16.5 million contract. It’s not a clean break — Palantir keeps its highest-stakes account — but it puts Madrid alongside Paris and Berlin in publicly souring on the company, part of a broader European pattern of treating US-built AI infrastructure as a sovereignty risk rather than just a vendor choice.

None of these four stories is really “AI got better” or “AI got worse.” They’re all some version of an institution — a security shop, an employer, a vendor, a government — deciding it needs firmer terms with the tools it already adopted. That’s a less dramatic story than a model launch. It’s also probably the more consequential one this week.