What actually changed

A conversational model has one job: take text, return text. If it is wrong, a human notices and corrects it before anything happens in the world. An agentic system has a different job: take a goal, then plan, call tools, read results, and repeat until the goal is met or a limit is hit. The difference is not intelligence. It is that the second system has hands.

In 2026 that distinction moved from research demos to default product behaviour. Google is testing a household agent with its own account that coordinates calendars, documents and shared tasks for up to six family members. Meta has pushed an agent into email, calendar and checkout flows. Apple has allowed coding agents to drive Safari. OpenAI’s work-focused agent pulls context from a team’s own apps and files and produces finished documents over hours rather than seconds. None of these are chatbots. All of them take actions on a person’s behalf, using that person’s credentials.

If you can draw the stack, you can reason about where it fails. There are five layers, and almost every failure this year belongs to one of them.

1. The model layer

The reasoning engine itself — the thing that decides what to do next. Frontier models from OpenAI, Anthropic, Google, xAI, DeepSeek, Alibaba, Moonshot and Meta now ship point upgrades every few weeks, and the practical consequence for a builder is that the model layer must be swappable. Hard-coding a single model identifier into your application in 2026 is the equivalent of hard-coding a database driver in 2006. Abstract it, benchmark against your own task, and keep a fallback.

2. The context layer

What the model is allowed to know. Retrieval, memory, files, live data, and the connectors that reach into a company’s systems. The Model Context Protocol, contributed by Anthropic and now governed with other agent standards under a neutral foundation, became the de facto wiring for this layer during 2025 and 2026. This is also where most data leakage happens — not because the model is malicious, but because somebody granted a connector broader scope than the task needed.

3. The tool layer

What the model is allowed to do. Search, code execution, browser control, API calls, purchases, deployments. A tool is a permission. Every tool you expose is a verb the system can now perform without asking. The single most useful design question in agent engineering is: if this tool were called a thousand times in an hour by something that misunderstood the goal, what would the damage be?

4. The orchestration layer

Loops, retries, sub-agents, budgets and stopping conditions. This is the least glamorous layer and the one that decides whether a system is safe to leave alone. Agents fail in loops, not in single steps. Step limits, token budgets, wall-clock timeouts and explicit human approval gates belong here, and they should be enforced by your infrastructure rather than requested politely in a prompt.

5. The evaluation and observability layer

Traces, logs, replayable runs, regression suites, and measurement of the outcome rather than the output. A conversational product can be judged on whether the answer read well. An agentic product has to be judged on whether the world ended up in the right state. If you cannot replay exactly what an agent did last Tuesday at 14:20, you cannot debug it, and you certainly cannot defend it to an auditor.

What to practise this month

Build one small agent that does something genuinely useful and genuinely bounded. A good beginner project: an agent that reads your team’s issue tracker, drafts a weekly summary, and posts it — with a hard rule that it may read anything and write exactly one document. Then deliberately break it. Give it a malformed issue that contains instructions addressed to the agent. Watch whether it follows them. That single exercise teaches prompt injection, tool scoping and trust boundaries better than any course module, including ours.

The skills that follow from this — scoping permissions, writing evaluations, reading traces, setting budgets, designing approval gates — are what hiring managers are now describing as “AI engineering”, and they are much closer to classical software and site-reliability engineering than to data science. That is the good news for the several thousand of you who wrote to us this year asking whether it is too late to move into AI work without a research background. It is not. The field moved toward you.

Apple: a new chief executive, a new form factor, a higher price

Apple’s September keynote, titled “Surprise and Shine”, ran at Apple Park on 9 September and was the first presented under John Ternus, who became chief executive on 1 September when Tim Cook moved to the newly created role of executive chairman. Ternus came from hardware engineering, and the product slate suited him.

The headline was the iPhone Duo, Apple’s first foldable. It opens to a roughly 7.6-inch inner display with a 5.4-inch cover screen, uses the A20 Pro processor, supports Apple Pencil, starts at $1,999, and carries Apple’s new C2 modem. Apple described the open device as the thinnest iPhone it has built. Pre-orders start on 16 October with availability from 23 October — a deliberate gap from the rest of the line, which reads as a supply decision as much as a marketing one.

The iPhone 18 Pro and Pro Max moved to the 2 nm A20 Pro, took a $100 price increase, opened for pre-order on 12 September and reached customers on 18 September. Alongside them came the Apple Watch Series 12 and Ultra 4, with no dramatic exterior redesign, and AirPods 5. iOS 27 shipped to everyone on 14 September.

Samsung: a three-way foldable line and a long 2026

Samsung’s year had already been unusually front-loaded. The Galaxy S26, S26+ and S26 Ultra were announced at Unpacked in San Francisco on 25 February and reached buyers on 11 March. The Galaxy S26 FE was announced on 27 August and went on sale on 4 September, keeping the S-series in the news right up against Apple’s event.

The bigger structural change came in July, when Samsung split its book-style foldable into two products. The Galaxy Z Fold8 Ultra takes the tall, premium position, borrowing the Ultra name from the S-series for the first time in the foldable line. The Galaxy Z Fold8 takes a new wide-screen shape: a 5.5-inch cover display, a 7.6-inch main display, a 4:3 ratio when open, 201 grams, 4.5 mm unfolded, a 4,800 mAh battery rated for more than 26 hours of video, Snapdragon 8 Elite Gen 5 for Galaxy, Android 17 with One UI 9, seven years of updates, and a $1,900 starting price. The Galaxy Z Flip8 rounded out the line with more capable AI on the cover screen. Korean sales of the Fold8 reportedly picked up after the iPhone Duo announcement, which is the clearest evidence yet that Apple entering a category grows it rather than simply taking it.

The Chinese response, delivered one day early

On 8 September, the day before Apple’s keynote, Xiaomi introduced the 18 Fold, a passport-shaped wide foldable, and Huawei unveiled the Mate XT2, a trifold. Xiaomi also brought the 18 Fold to IFA in Berlin for its first major European showing. The timing was not subtle and it worked: for a full news cycle, the foldable conversation was three-sided rather than Apple’s alone.

Google’s August, briefly

Google moved its Pixel launch earlier again this year, with the Pixel 11 family — including a Pro Fold — arriving in August on 2 nm Tensor G6 silicon built by TSMC, at European prices reported from €999 for the base model. The Pro Fold’s camera advantage over Samsung’s wide Fold8 is the most interesting comparison in the Android foldable market right now.

IFA Berlin, 4–8 September

Europe’s largest consumer electronics show filled 25 halls with more than 2,000 exhibitors. The devices worth remembering: Xiaomi’s 18 Fold; a zero-bezel concept phone from TECNO; TCL’s first NXTPAPER handset with an AMOLED panel; Anker’s MindBase smart-home hub; the Homey Portal controller; new cleaning and mowing robots from Roborock and Mammotion; a new 360 camera from DJI; a rugged smartwatch from Motorola; and a wave of audio products built on Bluetooth 6.0 and 6.1 with LE Audio and Auracast, including surprisingly cheap flagship-class headphones. Humanoid robots were, once again, the most photographed objects on the concourse and the least explained.

What lands in the next fortnight

Qualcomm’s Snapdragon Summit runs 22–24 September in Maui, and the company has already teased two flagship chips rather than one. Reporting points to a Snapdragon 8 Elite Gen 6 and an 8 Elite Gen 6 Pro, both on a 2 nm process, with the Pro adding LPDDR6 memory and UFS 5.0 storage support and a revised Oryon CPU arrangement. Xiaomi’s 18 series is expected to be among the first devices on the new silicon, with iQOO and Honor close behind, and Samsung’s Galaxy S27 line following in the new year. If the reported component pricing holds, next year’s Android flagships will be more expensive again.

We keep this section deliberately short and deliberately uncomfortable. These are the items from September that a security-aware engineer should be able to explain to a non-technical colleague.

A marketing script became a supply-chain attack

A compromised third-party marketing script spread malicious code across more than 100,000 websites. The lesson is ancient and still unlearned: every tag you paste into a page is code you have chosen to execute on behalf of every visitor, and you have delegated its integrity to a company you have probably never audited. Subresource integrity, strict content security policies, and a periodic inventory of third-party tags are not advanced practices. They are hygiene.

A pinned plugin became a zero-click backdoor

A plugin marked as pinned — the normal, responsible-sounding way to lock a dependency — turned into a zero-click backdoor across four different coding agents. Pinning protects you from unexpected changes. It does not protect you from a version that was malicious at the moment you pinned it, and it does nothing at all if the resolution mechanism can be tricked into serving something else.

An autonomous agent caused a national-first breach

Spain recorded its first data breach attributed to an autonomous agent. Expect regulators everywhere to now require answers to a question most organisations cannot answer today: which non-human identities have access to your systems, what are they permitted to do, and who approved that.

A verification vendor lost 150 million identity documents

More than 150 million driver’s licences were confirmed stolen from a verification vendor’s cloud environment. Identity verification vendors concentrate the most sensitive data in the economy into a small number of targets, and the industry’s growth is being driven by age-verification and know-your-customer mandates that show no sign of slowing.

And the rulebook: Europe’s revised AI calendar

The Digital Omnibus on AI shifts the AI Act’s high-risk obligations for standalone Annex III systems — hiring, credit, education, critical infrastructure, law enforcement, biometrics — from 2 August 2026 to 2 December 2027, and for AI embedded in regulated products such as medical devices and vehicles to 2 August 2028. Transparency and synthetic-content marking obligations under Article 50 largely hold to the original timetable, with an extension to 2 December 2026 for systems already on the market. A new prohibition on AI systems that generate non-consensual intimate imagery and child sexual abuse material applies from 2 December 2026. Elsewhere, Europe moved to switch AI companions off by default for children, California created a registry of AI auditors, and the US Congress began work on an inventory of rogue AI agents.