Everyone Is Quietly Building Rooms for Agents to Live In

No frontier models dropped this week. Instead, four releases attacked the same unglamorous problem: where do agents actually run, and who's allowed to touch what?

MCP Drops Its Baggage

The Model Context Protocol is moving to a stateless architecture, killing the session-ID system that made large-scale MCP servers painful to operate. Why you should care: stateless means MCP servers can finally sit behind ordinary load balancers like any other web service, instead of needing sticky sessions and bespoke routing.

Protocols win when they become boring. This is MCP becoming boring in the best way.

For context, the ecosystem crossed sixteen thousand public MCP servers recently. Boring infrastructure is what gets you to sixty thousand.

Perplexity's SPACE

Perplexity introduced SPACE, the sandbox platform now running every Perplexity Computer session. Agents need to run code, edit files and execute multi-step tasks for hours, and users need confidence their machines survive the experience.

• Each sandbox runs as its own virtual machine behind hardware isolation
• Credentials never enter the sandbox, injected at the network layer when needed
• btrfs copy-on-write clones sandboxes from warm templates
• Median creation latency dropped from 185ms to 60ms

That credential detail is the elegant part. Even a fully compromised agent literally cannot reach for secrets, because they aren't in the room.

WordPress Ships Governance

WordPress VIP released Secure MCP, a single governed endpoint letting AI agents act with the exact permissions of the authenticated user. Security teams get audit logs, per-app controls, and an org-wide kill switch. No new identity to manage.

Developers already run Claude Code, Cursor and Codex alongside their platform tools whether security teams like it or not. This accepts reality and adds guardrails instead of pretending the behavior doesn't exist.

What I Changed After Reading All This

• Split my automation credentials into scoped roles instead of one admin key
• Moved secrets out of container environments into a mounted file my agents can't list
• Added logging on every automated write, because audit trails sound paranoid until the day they aren't

Frontier intelligence gets the headlines. Sandboxes and audit logs keep it employed.

Cheers, Yassen