AI Masterclass Podcast Week 29: when AI agents start finishing the job

Week 29 was less about another chat box and more about what happens when AI is allowed to finish the work. Claude can use an approved browser login without placing the password in model context. Gemini Notebook can run code against its source material. Grok can start scheduled workflows. Manus can create editable presentations and publish a working web build.

At first glance, these are separate product updates. Together, they point to the same shift: AI providers are building complete execution environments for delegated work, not just models. That is why this week's podcast spends as much time on permissions, recovery, and human stop points as it does on new features.

The AI agent runtime is becoming part of the product

An AI agent is a system that does more than answer a question: it uses tools, runs several steps, and may change something outside the chat. When an agent works for minutes or days, judging the model's response is not enough. You also need to know where code runs, how state is stored, and which data the agent is allowed to use.

Perplexity made that question explicit with SPACE, the runtime behind Perplexity Computer. It combines persistent sessions with disposable Firecracker microVMs, snapshots, controlled network access, and externalized credentials. That can make long-running tasks easier to pause and resume. It also concentrates more trust in the provider's network, storage, and identity controls. A pilot should therefore start with a reversible deliverable, not production data or broad write access.

Google is moving in the same direction. Gemini Notebook gained a secure cloud computer that can write and run code against source-grounded data. That could be useful for analyzing a bounded spreadsheet or document collection, but the first test should use non-sensitive data and a reproducible output. The week also included a lengthy AI Studio Build incident, which is a reminder that an impressive runtime still needs a fallback.

Logging in without handing the password to the model

1Password for Claude shows how agent permissions can become more practical. On Mac, a user can approve a specific login or one-time code for a Claude Cowork browser task. 1Password fills the credential locally while the agent waits; the secret is not supposed to enter model context, memory, or Anthropic's systems.

That reduces an important risk without removing responsibility. Once logged in, the agent can still act inside the approved session. Use a separate browser profile, limit access to the task, and keep human approval for payments, publishing, and other hard-to-reverse steps.

Claude also added support for instructions in the middle of an active API conversation on selected models. A trusted operator can change priority or policy without discarding the entire cached history. This capability should be reserved for controlled instructions. Text retrieved from the web or a customer document should not automatically receive the same authority.

Automation needs a brake, not only a calendar

xAI launched Grok 4.5 for coding, agentic tasks, and knowledge work. The model has a 500,000-token context window and reached Grok Build as well as several third-party tools. Grok also gained scheduled Automations, while some subscriptions can trigger them by email.

That last feature is convenient and security-sensitive. Email is outside input. Before an email-triggered agent can write to a business system, teams need to test prompt injection, duplicate delivery, spending limits, and failed-step behavior. Start with read-only connectors or a reversible destination.

OpenAI's signals during the week pointed in the same direction. GPT-Red uses automated adversarial testing to train models against prompt injection, while Codex 0.144.5 expanded dangerous-command detection. Those are useful defensive layers, not a case for unrestricted execution. Sandboxes, task-scoped credentials, backups, and review gates are still required.

From draft to deliverable file

Manus focused on the last part of the workflow. Native PowerPoint creates editable PPTX files with real charts, tables, and slide layouts. A new skill can typeset professional PDF documents, and Auto-Publish can deploy every successful WebDev build to a live address.

This is practical for organizations that spend too much time moving an AI draft into a file a colleague or customer can edit. A successful build is not the same thing as approved content, however. Auto-Publish is off by default, which is sensible. Keep a quality gate for facts, tone, accessibility, and personal data before anything becomes public.

Mistral Vibe 2.20.0 offered a more technical version of the same theme: more reliable Windows and shell behavior, plus fixes around MCP authentication, streaming, rewind, and user questions. Mistral's TypeScript telemetry-redaction support had been merged into source but was not yet available in the npm package. That distinction between intended direction and installable functionality matters.

This week's practical test: define the consequence first

Choose one recurring task that ends in a concrete deliverable, such as a presentation, weekly report, or updated web page. Before choosing the tool, write down four boundaries:

• Runtime: where does code run, and how long is the session retained?
• Permission: which data may the agent read, and where may it write?
• Approval: which step must a person confirm?
• Recovery: how do you roll back after a poor result or an outage?

Run the task three times with test data. Measure review work and errors as well as time saved, and check how easily the process can be stopped or restored. If it holds up, the same specification can become the start of a bounded Tool Forge engagement.

Week 29 shows the agent market maturing in a slightly unexpected way. Models are improving, but competition is shifting toward who can handle identity, code, state, and finished deliverables without making control invisible. For the buyer, the best question is therefore not only “what can the agent do?” but “which consequence may it create without asking?”

This episode is an AI-generated masterclass built from Hammer Automation's deep weekly research into AI-provider updates and features, processed with NotebookLM. No Whisper transcription was used in the automated workflow.