The week of August 17–24, 2026 delivered a set of developments that collectively mark a turning point for AI agent infrastructure: the industry moved from “can agents work?” to “how do we deploy, govern, and standardize them at scale.” Cloudways put managed OpenClaw into general availability, giving the framework its first credible hosted platform after the February hyperscaler blacklist. Anthropic and OpenAI jointly published the MCP 2.0 draft specification with bidirectional tool calling. GitHub shipped Agent Plugins 1.0 to GA, bundling skills and MCP servers into a single installable format. And Microsoft Scout — built on OpenClaw — emerged as the first enterprise “autopilot” agent, validating the framework at the largest possible scale despite the earlier blacklist.

TL;DR for engineering leads: (1) Cloudways Managed AI Agents are live with OpenClaw and Hermes as first-party deployables — if you’ve been evaluating OpenClaw but hesitating on infrastructure, this removes the VPS/Docker/SSL burden; (2) MCP 2.0 draft is out with bidirectional tool calling — production systems should wait for the Q4 2026 RFC, but the 2,000+ server registry and joint Anthropic/OpenAI authorship make the direction clear; (3) GitHub Agent Plugins 1.0 is GA — skills and MCP servers now ship as one installable unit across VS Code, Copilot CLI, and Copilot App at no extra cost; (4) Microsoft Scout is the most significant enterprise endorsement of OpenClaw, running as an always-on desktop agent with its own identity and permissions; (5) Security remains the open question — no new confirmed breaches, but the Trellix ClawHavoc post-mortem and AI “mind virus” research show the threat surface expanding as agents go production.

Cloudways Managed AI Agents: OpenClaw Gets a Hosted Home

On August 17, Cloudways — the DigitalOcean subsidiary (NYSE: DOCN) — launched Managed AI Agents as GA, with OpenClaw (386K+ GitHub stars) and Hermes (228K+ GitHub stars) as its first two deployable agents. This is not a minor hosting announcement. It is the first credible attempt to rehabilitate OpenClaw after the February 2026 hyperscaler blacklist triggered by the Summer Yue / Meta Superintelligence Labs incident.

What managed actually means here. Customers deploy OpenClaw or Hermes without managing VPS, Docker, SSL, ports, or gateways. Each deployment runs in an isolated environment. Cloudways validates runtime updates before rollout — acting as a gatekeeper for code that has historically shipped with critical flaws. One-click MCP integration connects agents to existing servers and apps on Cloudways. This is the hosted, validated, enterprise-grade deployment path that OpenClaw has lacked since launch.

Why it matters strategically. The hyperscaler blacklist (Meta, Google, Microsoft, Amazon) created a deployment vacuum for OpenClaw. Cloudways is positioning itself as the trusted intermediary — the platform that runs OpenClaw safely enough that enterprises can adopt it without taking on the operational risk themselves. The validation layer is the key differentiator. OpenClaw’s history of shipping with critical security flaws (the January/February 2026 “ClawHavoc” supply chain crisis) is the reason enterprises hesitated. Cloudways’ gatekeeper model addresses that hesitation directly.

Action items: If you’ve been evaluating OpenClaw but held back on infrastructure complexity or security concerns, Cloudways Managed AI Agents warrant a serious evaluation. The isolated environments and validated updates reduce the operational surface area significantly. For teams already running OpenClaw self-hosted, the managed offering doesn’t replace your deployment — but it provides a reference architecture for isolation, update validation, and MCP integration that’s worth studying.

MCP 2.0 Draft: Bidirectional Tool Calling and Joint Standardization

On August 18, Anthropic and OpenAI jointly published the MCP v2.0 specification draft on GitHub (modelcontextprotocol/specification). Three OpenAI engineers are listed as co-reviewers — this is effectively a joint standardization effort between the two companies that collectively define the AI agent tooling landscape.

The headline feature: bidirectional tool calling. MCP 2.0 enables MCP servers to request capabilities from connected clients, not just the other way around. This unlocks event-driven agent systems where the server can initiate actions rather than only responding to client requests. The spec also introduces a unified format for tool-call definitions and adds async streaming support.

Scale and momentum. The community registry now lists over 2,000 MCP servers, up from 400 at the start of 2026. The MCP Python SDK 2.0.0 shipped as stable on July 28 — pip install mcp now installs 2.x by default. Azure AI Foundry and Amazon Bedrock both support MCP v1.x, with v2.0 roadmaps expected in Q3 2026.

The honest caveat. The formal RFC target is Q4 2026, and breaking changes are still possible. Production systems should wait for the final spec. The draft is published for feedback, not for deployment. But the direction is clear: bidirectional tool calling is coming, and the joint Anthropic/OpenAI authorship means the industry is converging on a single protocol rather than fragmenting.

Action items: Read the draft spec and evaluate whether bidirectional tool calling changes your agent architecture. If you’re building MCP servers, start thinking about what capabilities your servers might want to request from clients. Do not deploy v2.0 in production — wait for the RFC. But do start planning for the migration now, because the feature gap between v1.x and v2.0 is significant.

GitHub Agent Plugins 1.0: Skills and MCP in One Package

GitHub released Agent Plugins 1.0 as GA on August 12, with AWS, Anysphere (Cursor), Microsoft, OpenAI, and Vercel as launch partners. The plugin format bundles agent skills, MCP servers, and client-specific extensions into one installable package.

How it works. Skills live under skills/, MCP configuration goes in mcp.json, and client-specific behavior sits in namespaced directories. The format works across VS Code, Copilot CLI, Copilot SDK, and Copilot App — all subscription tiers, at no extra licensing cost. This is the standardization layer that the agent ecosystem has been missing: a single packaging format that works across compatible clients.

Portable skill stacks are the natural complement. The draft MCP spec now names “Skills over MCP” as rich, structured instructions discoverable through MCP. Anthropic’s Claude Code docs say skills live in SKILL.md and load on demand. GitHub Copilot CLI uses .github/agents/ with YAML frontmatter. OpenAI frames MCP as the industry standard. The convergence is clear — skills are becoming a first-class concept in agent infrastructure, not embedded chat instructions.

Action items: If you maintain agent skills as chat prompt templates, start packaging them as plugins. The skills/ + mcp.json format is now the de facto standard. If you use Copilot on any tier, Agent Plugins are available now — evaluate the ecosystem for plugins relevant to your stack. If you’re building internal tooling, the plugin format gives you a distribution mechanism that doesn’t require custom installation scripts.

Microsoft Scout: OpenClaw in Enterprise Production

Microsoft Scout, announced at Build 2026, is the first “autopilot” agent — an always-on desktop AI app for Windows and macOS that works across files, shell, browser, dev tools, and Microsoft 365. It is built on OpenClaw open-source technology.

What makes this significant. Microsoft was one of the hyperscalers that blacklisted OpenClaw in February 2026. Scout represents a reversal: Microsoft is now building a flagship product on OpenClaw technology. The agent has its own identity and permissions, operates in the background without needing to be prompted, and runs on seven new Microsoft-built AI models (MAI-Thinking-1, MAI-Code-1-Flash, MAI-Image-2.5, MAI-Transcribe-1.5, MAI-Voice-2, and Aion edge models).

The intelligence layer: Work IQ. Scout is powered by Work IQ, Microsoft’s intelligence layer that builds a semantic model of how an organization operates. This is not a chatbot — it’s a system that understands organizational context and acts within it. Admin controls are available via Intune and Frontier access gates.

Pricing and availability. Currently Frontier/preview access. Expected pricing is an add-on for M365 E3/E5 licenses at approximately €30–60 per user per month. This positions Scout as a premium enterprise product, not a consumer tool.

Action items: If your organization runs M365 E3/E5, evaluate Scout through the Frontier access program. The admin controls via Intune are the critical evaluation surface — understand the permission model, the identity boundaries, and how Scout’s autonomous operation aligns with your security policies. This is the highest-profile OpenClaw deployment in existence, and the security governance model Microsoft has built around it is a reference architecture worth studying.

Copilot Expands to Teams and Slack

GitHub Copilot had a significant week beyond Agent Plugins. Copilot Workspace went GA after eight months in preview, now with multi-agent architecture that coordinates separate planning, implementation, and testing agents. It maintains context for up to 500K tokens and early adopters report 40% faster feature implementation versus single-agent approaches.

Copilot in Microsoft Teams (Public Preview, Aug 21). Mention @GitHub in Teams to start a cloud agent session. Anyone in the conversation can ask questions, add context, and steer work. Participants with write access can trigger Copilot to make changes, working asynchronously in a secure cloud sandbox. Repository admins can require additional approval for Copilot-authored PRs before merge.

Copilot in Slack (Public Preview, Aug 21). GitHub integration in Slack brings agentic Copilot CLI capabilities. @GitHub in DM, channel, or thread starts an agent session. Copilot can triage bugs, create issues, investigate failures, implement changes, validate in cloud sandbox, and open PRs. GitHub is a launch partner for Slack Code — a new channel type designed for agents. Available for Copilot Business and Enterprise plans.

The pattern. Agents are meeting users where they already work — Teams, Slack, VS Code — rather than requiring new surfaces. This is the right approach. The friction of switching to a dedicated agent interface is a barrier to adoption that these integrations remove.

Action items: If you use GitHub Copilot Business or Enterprise, evaluate the Slack and Teams integrations. The admin controls for PR approval gates are the key governance surface. If you’re evaluating Copilot Workspace, the multi-agent architecture and 500K-token context window make it suitable for complex feature work, not just isolated tasks.

Security: The Expanding Threat Surface

No confirmed large-scale breach in July or August 2026. But the security landscape is not quiet — it’s expanding as agents go production.

Trellix published research (Aug 20) on the January/February 2026 “ClawHavoc” supply chain crisis, providing the most detailed post-mortem yet. The analysis is still shaping enterprise perception of OpenClaw and agent supply chains generally.

Anthropic and EPFL published research on self-propagating payloads spreading between AI agents through persistent memory files — described as an “AI mind virus” living off Azure infrastructure. This is not a theoretical concern. It’s a demonstrated attack vector that exploits the memory and context-sharing mechanisms that make agents useful.

NVIDIA NemoClaw v0.0.113 (Aug 20) strengthens sandbox and onboarding recovery, adds experimental Hermes Google Chat support while keeping service-account private keys outside the sandbox, and changes the Google Gemini default to gemini-3.6-flash. The security hardening is incremental but consistent — the supply chain is being tightened piece by piece.

Action items: Audit your existing agent installs for credential residue in historical audit logs. Run a deep security audit on any OpenClaw deployment that predates 2026.7.x. Review the Anthropic/EPFL research on memory-based payload propagation — if your agents share persistent memory stores, this vector applies to you. Update to the latest patch level regardless of whether you’ve had incidents.

What to Watch

  • MCP 2.0 RFC (Q4 2026) — the draft is out for feedback; watch for whether bidirectional tool calling survives the comment period intact and what breaking changes emerge.
  • OpenClaw stable 2026.8.x — the beta line is at 2026.8.1-beta.2 with control UI, multiplayer, and Mac setup improvements expected in the next stable cut.
  • Microsoft Scout broader availability — currently Frontier/preview; watch for general availability timing and pricing confirmation.
  • Aug 31 deadlines — Claude Sonnet 5 price increase ($2→$3/M input, $10→$15/M output) with a tokenizer change adding 10–35% more tokens on code. GPT-5.4 and GPT-5.4 mini leave Codex format the same day.
  • Agent security regulatory response — the Trellix post-mortem and mind-virus research are the kind of publications that trigger regulatory attention. Expect NIST and EU scrutiny to intensify.

Looking Ahead

This week’s developments share a common thread: the transition from demonstration to deployment. Cloudways giving OpenClaw a managed home, GitHub shipping Agent Plugins 1.0, MCP 2.0 moving toward formal standardization, Microsoft putting Scout into enterprise preview, Copilot reaching into Teams and Slack — these are not research projects. They are infrastructure being laid for production agent ecosystems.

The security question remains the one that could slow everything down. The Trellix post-mortem and the AI mind-virus research are reminders that agents introduce a new attack surface — one where the agent’s useful capabilities (persistent memory, autonomous action, tool access) are also its vulnerabilities. The industry is building infrastructure faster than it’s building governance. That gap is the risk engineering leaders should be most concerned about.

For the next ninety days: evaluate Cloudways Managed AI Agents if you need a hosted OpenClaw path. Read the MCP 2.0 draft and plan for bidirectional tool calling. Package your agent skills as GitHub Agent Plugins. Evaluate Microsoft Scout through Frontier access if you run M365 E3/E5. And prioritize the security audit you’ve been putting off — the threat surface is not getting smaller.

Follow the ongoing analysis on X: https://x.com/kkaminsk