The Settlement Layer — Beta Briefing

May 21: SARB drafts the exemption that finally decouples e-money and remittance from the Banks Act

hello@betabriefing.ai (The Settlement Layer) — Thu, 21 May 2026 09:00:00 +0000

Today on The Settlement Layer: agentic commerce moved from announcements to production this week — Visa's CEMEA programme, Fireblocks' Agentic Payments Suite, and a flurry of MCP infrastructure deals. Underneath the noise, SARB published the draft that finally decouples e-money and remittance from the Banks Act.

In this episode

SARB drafts the exemption that finally decouples e-money and remittance from the Banks Act — SARB published a draft exemption notice and authorisation framework on 19 May carving e-money issuance, money remittance and third-party payment initiation out of the 'business of a bank' definition under the Banks Act. Non-banks can hold authorisation directly, subject to proportionate AML/CFT/CPF, capital safeguards and governance — no mandatory sponsor bank.
Fireblocks ships Agentic Payments Suite and joins the x402 Foundation — Fireblocks launched an Agentic Payments Gateway (PSP-side merchant acceptance), Agent Wallets (fintech-side delegation with per-transaction spend caps, merchant allowlists and time windows), and a security extension to the x402 protocol that prevents man-in-the-middle rerouting. Tazapay is live across 70+ markets, and Fireblocks has taken a governing-body seat on the x402 Foundation.
Visa Agentic Ready goes live in CEMEA with 40+ issuers in production testing — Visa formally activated the Agentic Ready programme across Central Europe, Middle East and Africa, enrolling 42 issuing partners — including Bank al Etihad and Housing Bank in Jordan, plus banks in the UAE, Kuwait, Qatar, Egypt and Bahrain — in a production-grade environment to validate agent-initiated transactions. The framing is explicit: tokens, identity, risk and controls embedded at the network layer rather than as a separate track.
Treasury's draft crypto capital-flow rules now face a constitutional challenge from the IRR — Following the comment-window extension to 30 June (reported Monday), the IRR has now formally argued the Draft Capital Flow Management Regulations are ultra vires the 1933 Currency and Exchanges Act, and that the seizure, forfeiture and forced-liquidation provisions for crypto assets breach constitutional rights to property, privacy and due process. Luno is separately lobbying for locally-held crypto to be reclassified as domestic rather than offshore, exempting it from foreign investment limits. Two scenarios: the rules pass largely intact and face judicial review (long uncertainty, no immediate enforcement), or industry coordination forces material amendments before final publication.
Mastercard ships Merchant Trust Services — pre-transaction merchant risk scoring with a 90-day lead on issuer escalation — Mastercard launched Merchant Trust Services on 20 May — network intelligence, identity and real-time analytics combined into a Merchant Scam & Risk Indicator that flags risky merchants at authorisation. Pilot data shows 80% detection of risky merchants, with some flagged 90 days ahead of the issuer's own escalation. Franchise standards updated to require 72-hour investigation windows for merchants hitting risk thresholds.
Bank of England draws the future UK payments stack as deposits + stablecoins + (maybe) digital pound — Deputy Governor Sarah Breeden confirmed systemic stablecoin rules will be finalised this year, with sixteen firms — including HSBC, LSEG and Euroclear — preparing tokenised asset launches via the Bank/FCA Digital Securities Sandbox from late 2026. Authorities are also extending settlement infrastructure operating hours toward near-24/7. Draft systemic stablecoin rules due next month.
Stablecoin distribution arrives at checkout: PayPal/PYUSD in 70 markets, USDT into 200k Shift4 merchants — PayPal extended PYUSD to 70 markets including African corridors, embedding buy/hold/send/receive directly into PayPal accounts with local-currency off-ramp. The same week: Tether, Shift4 and Lydian wired USD₮ into Shift4's 'Pay with Crypto' platform covering 200,000+ merchants with automatic fiat settlement; Coins.ph integrated BTC and ETH into the BSP-backed QRPh national QR standard at ~700,000 merchants; and Fireblocks added ARP Digital (CBB-licensed) as the GCC settlement node on its payment network.
The agent liability gap, in three documents: Foley on supply chains, Fournier on accountability, Bankr's prompt-injection custody breach — Three pieces this week land on the same point from different angles. Foley & Lardner mapped the contractual liability gap in supply-chain agent deployments — standard SaaS contracts cap vendor liability at subscription fees while waiving consequentials, leaving deploying companies fully exposed. Camille Fournier (ex-Goldman CTO) wrote on the runtime-vs-policy governance gap, citing a 100-agent coding cluster that burned $1.3m/month in API costs and PocketOS's database-deletion incident. Coinbase-backed AI trading agent Bankr disclosed 14 wallets compromised via prompt injection through NFT metadata.
Treasury's 20% online betting tax now has academic cover — and the Dutch experience says it won't work — UCT researchers publicly endorsed Treasury's proposed 20% tax on gross online betting revenue, citing tripled retail+online betting volumes from 2021/22 to 2024/25 and rising harm metrics — and argued the tax must extend to retail to prevent operator migration. Same week, Dutch Lottery posted a €7.7m FY25 net loss (from €30.9m profit) after consecutive duty hikes to 37.8% pushed channelisation below 50%, with CEO Arjan Blok warning that further increases will simply accelerate the offshore drift. UK's remote gaming duty rises to 40% in April 2026.
Sportradar sued by shareholders over alleged 20–40% revenue exposure to unlicensed operators — Smale v. Sportradar was filed in the Southern District of New York alleging securities fraud after Muddy Waters and Callisto Research reports (22 April) claimed 20–40% of Sportradar's revenue derives from unlicensed operators, with ~33% of linked platforms operating illegally. The stock fell 22.6% on publication of those reports; the securities lawsuit is the new development this week. Sportradar is the data and integrity layer underneath a large slice of regulated sportsbooks globally, including in South Africa — a market this audience already tracks through the GGB governance collapse.
KPMG, SAP, Bristol Myers, iManage — Anthropic's enterprise wedge widens in one week — Four enterprise deployments landed in parallel this week. KPMG embedded Claude into Digital Gateway across 276,000 staff in 138 countries, with a preferred-consultant designation for deploying Claude into PE portfolio companies. SAP integrated Claude into Business AI Platform and Joule via MCP, exposing it as the reasoning engine across S/4HANA, SuccessFactors and Ariba. Bristol Myers Squibb made Claude available to 30,000+ employees for drug discovery and Claude Code for R&D. iManage and NetDocuments shipped MCP servers connecting Claude to governed legal-knowledge corpora.
FOLIO publishes Africa's first standardised payments-app benchmark — and the gaps are diagnostic — FOLIO benchmarked ten African and diaspora payments apps (OPay, PalmPay, Afriex, Chipper Cash, Kuda, Cleva, Raenest, Grey, Eversend, Flutterwave Send) across five dimensions — Friction, Cost, Clarity, Trust, Likelihood to return — using 20 verified users per app completing full signup-to-transfer flows with screen recordings. Top eight cluster within 5 points; diaspora-first apps (Afriex, Chipper) rank in the top four, contradicting the local-vs-diaspora UX divide that's framed several investor theses.
Pirates one game from the title — full squad, sold-out Mbombela, Appollis in every league match — Saturday's 15:00 kickoff at a sold-out Mbombela is the sequel to last week's frustrating 0-0 against Durban City — 30 shots, no goals, and Pirates still two points behind Sundowns going into the final matchday. The new details: full squad (no suspensions since 4 March), Oswin Appollis has played every one of the 34 league matches (9 goals, 6 assists, zero yellows), and the opponent — Orbit College — is fighting relegation and missing two players on loan from Pirates. A win reaches 69 points and ends a 14-year drought; anything less hands Sundowns a ninth straight title.
Joburg blinks: Morero will not fight Eskom's R5.2bn demand, commits to City Power turnaround — Following Eskom's 19 May disconnection notice (covered here Monday), Mayor Morero announced the city will not contest the demand and will instead pursue a turnaround plan with the Electricity Minister ahead of the 8 July deadline. New details: Johannesburg is also chasing a €200m KFW loan expected to disburse by end-June. The structural numbers underneath the crisis are now on the record: R220bn infrastructure backlog, 44.7% non-revenue water losses, R3.9bn employee-cost overexpenditure flagged as technical insolvency. Separately, Landis+Gyr launched the locally-manufactured E480 DIN-Rail smart meter at Enlit Africa this week — the only constructive lever in the picture, on a multi-year rollout timeline against a July deadline.

Read the full briefing with sources →

Generated with AI from public sources — verify before acting on anything important.

May 20: Anthropic ships self-hosted sandboxes and MCP tunnels — agent execution can finally sta…

hello@betabriefing.ai (The Settlement Layer) — Wed, 20 May 2026 09:00:00 +0000

Today on The Settlement Layer: agent infrastructure stops being a thought experiment. Anthropic buys the SDK factory and ships perimeter-aware sandboxes, Google's AP2 lands inside Gemini Spark with hard spend caps, and stablecoin licensing in Europe and Japan quietly hardens into the template everyone else will work against. Also: Pirates one win from the league, and Gauteng's water inquiry is finally on the record.

In this episode

Anthropic ships self-hosted sandboxes and MCP tunnels — agent execution can finally stay inside your perimeter — Announced at Code with Claude in London this week: Claude Managed Agents now run tool execution inside customer-controlled sandboxes (Cloudflare, Daytona, Modal, Vercel, or self-hosted) with the orchestration loop staying on Anthropic. MCP tunnels (research preview) invert the network model — outbound connection from your infrastructure, no inbound firewall holes, no public exposure of internal MCP servers. Cloudflare's integration ships V8 isolates that boot in milliseconds with zero-trust credential injection so secrets never reach agent code. Apidog and Stacklok both published deployment playbooks covering the Managed Agents vs Agent SDK decision and the vMCP orchestration layer most teams will need on top.
Anthropic acquires Stainless — the SDK-and-MCP factory is now first-party — Anthropic acquired Stainless on 18 May for a reported $300m+. Stainless — founded by ex-Stripe engineer Alex Rattray — generated production SDKs in Python, TypeScript, Kotlin, Go and Java from API specs, and produced every official Anthropic SDK since the early Claude API. The hosted generator product is winding down; existing customers (which included OpenAI, Google and Replicate) retain their generated SDKs but lose future maintenance. The team consolidates into Anthropic's Claude Platform org with explicit focus on the MCP connector ecosystem. This is Anthropic's fourth acquisition in six months (Bun, Vercept, Coefficient Bio, Stainless) and lands amid reports of a $30bn round and October IPO talk.
Gemini Spark ships with AP2 baked in — the reference design for delegated agent purchases — At I/O 2026 Google unveiled Gemini Spark, a Gemini 3.5-powered personal agent integrating with 30+ third-party tools via MCP, with transactions gated by the Agent Payments Protocol — hard spending caps, merchant whitelists, tamper-proof audit trails, human approval per transaction by default. Alongside, Google launched Universal Cart spanning Search, Gemini, YouTube and Gmail and expanded the Universal Commerce Protocol. TechTimes flags the gap behind the announcement: OpenAI quietly retreated from native checkout in 2025, Amazon refuses to allow agent-initiated purchases on its platform, and Gartner and Forrester are warning the industry is shipping ahead of its liability frameworks.
Agentic commerce won't disintermediate the card networks — it'll compress their pricing power — GL Insight's Zennon Kapron argues the card networks will survive the agent era — but as governance and trust layers (Visa Intelligent Commerce, Mastercard Agent Pay, AP2-adjacent infrastructure) rather than as rents on settlement. The mechanism: agents will automate merchant steering from premium card rails to whatever is cheapest and fast — UPI, Pix, account-to-account, stablecoins, mobile money — collapsing the merchant and issuer inertia that currently protects interchange. Banks without scale to build their own governance layer get reduced to commodity funding providers. Innopay's Shikko Nijland, writing the same week, extends the argument: agents will reprice flexibility itself, exercising refund windows, cancellation policies and chargebacks at machine speed in ways consumer-protection regimes were never designed for.
Zerohash secures first MiCAR+EMI dual authorisation; Japan's FSA opens the foreign-stablecoin pathway from 1 June — Two licensing milestones landed in parallel. Zerohash Europe became the first MiCAR-licensed firm to also obtain an EMI licence from De Nederlandsche Bank — the dual authorisation EBA's June 2025 no-action letter clarified as the operating model for E-Money Token payments across the EEA. Existing zerohash customers include Interactive Brokers Europe and unnamed banks and PSPs. Same week, Japan's FSA finalised its Cabinet Office ordinance taking effect 1 June 2026: qualifying foreign trust-based stablecoins (USDC, USDG and equivalents meeting reserve and redemption equivalence tests) gain electronic payment instrument status under the Funds Settlement Act, distributable by licensed operators without securities-law treatment. LDP simultaneously published a roadmap positioning stablecoins and tokenised deposits as core digital finance infrastructure.
Five Eyes publish first joint guidance on securing agentic AI — least-privilege, sandboxing, human approval for high-risk actions — On 1 May, CISA, NSA and the Five Eyes partners (Australia, UK, Canada, NZ) published the first joint cybersecurity guidance focused specifically on agentic AI. It identifies four risk categories — expanded attack surface, privilege compromise, behaviour misalignment, audit opacity — and recommends least-privilege access, phased deployment, mandatory human approval for high-risk actions, and comprehensive logging of decision chains and tool calls. China released parallel guidance on 8 May. US DoD procurement is already being shaped by the document. The guidance lands alongside open-source patterns (NanoClaw 2.0, rosud-pay) covered last week making the same argument architecturally: authorisation must live below the agent, not inside its reasoning layer.
Gauteng Gambling Board governance collapse: forensic detail surfaces, regulatory continuity in question — Follow-on international trade-press coverage of last week's GGB dismissal — iGaming Business and Casino.com confirm CEO Karabo Mbele fired and CFO Oscar Maripane suspended. The new detail surfacing this week is the procurement and approvals dimension: irregular financial decision-making and oversight failures as formal grounds, sitting alongside the R73m in irregular SDF/CSI allocations and R23m in misdirected SED funding already on record. The Board remains without quorum since December 2025; an administrator will run the entity. Backdrop: Gauteng's national gambling revenue share has collapsed from 35% to ~18% since 2019, while R&G Sigma reports 81% mobile betting share and 380m visits in Q1.
Chimoney shuts down — Canadian PSP licence, FINTRAC MSB, Interledger early adopter, no market — Canadian-African fintech Chimoney wound down on 30 April after four years and under $1m raised, despite operating across 41 currencies, holding a Canadian FINTRAC MSB licence and a PSP licence under the Bank of Canada's Retail Payment Activities Act, and being one of the earliest production users of Interledger. Founder Uchi Uchibeke publicly attributed collapse to distribution and visibility weakness, but BusinessDay's reporting pulls up app store reviews from H2 2025 showing exactly the operational failure mode the founder didn't mention: KYC delays, frozen funds, unresponsive support — surfacing during the company's pivot to AI-agent wallets.
The mobile money tax experiment is failing — Uganda lost 25% of transactions; Ghanaian merchants reverting to cash — Twenty Sub-Saharan African countries are running uncoordinated mobile money tax experiments and the evidence is now in: Uganda's transaction levy produced an immediate 25% drop in mobile money volumes and 2.5m fewer internet subscribers; research across the region shows mobile money tax adoption depresses digital financial service usage by up to 39%, with the impact concentrated on the lowest-income users the policies claim to support. The macro context: 514m active mobile money users continent-wide, transaction volumes >$1.43tn annually, ~66% of global mobile money activity. Sitting alongside last week's reporting that Ghanaian merchants are quietly reverting to cash, the trajectory is consistent — tax-driven friction collapses the base it was meant to capture.
Adyen + Starling embed Tap-to-Pay inside the banking app — SME acquiring collapses into the bank UX — Adyen and Starling Bank launched NFC Tap-to-Pay directly inside the Starling app for UK SMEs: onboarding to active acceptance in minutes, next-business-day settlement, payment-link invoicing arriving later in 2026. Transaction data and card details stay in device-NFC infrastructure with no external storage. Sits next to Peach Payments extending Apple Pay to Mauritius this week and last week's Apple Tap to Pay launch in South Africa via Yoco and iStore Pay — three data points making the same point about where SME acquiring is going.
Vertical fintech for iGaming payouts: priority queues, smart batching, risk-throttling as the actual moat — Konstantin Rabin writes through the engineering patterns vertical-fintech payout stacks use that generic processors don't: per-channel priority queues, micro-batching tuned to scheme rails (RTP, FedNow, EFT, mobile money), risk-based throttling that holds high-velocity withdrawals for inspection without blocking the queue, and real-time liquidity dashboards spanning bank float, card prefunding and crypto rails. iGaming is the defining use case where payout latency is a measured competitive differentiator (Kenyan operators settling M-Pesa withdrawals sub-90 seconds; offshore operators settling crypto under an hour vs 3-7 days for wires). The Kenya betting-as-payments-infra report and the technology.org piece on offshore gambling crypto rails make the same architectural argument with different examples.
Pirates one match from their first title in 14 years; Bafana drawn with Benni's Kenya for AFCON 2027 — The situation entering the final matchday is unchanged from what we covered yesterday: Pirates drew 0-0 with Durban City, sit two points behind Sundowns, and must beat Orbit College at Mbombela on Saturday to take the title. New this cycle: Coach Ouaddou is publicly framing the extended title race as good for the PSL — the kind of message you deliver when you still need to win one game. The AFCON 2027 qualifying draw places Bafana in Group D with Kenya (co-host, auto-qualified), Guinea and Eritrea — only one qualifying slot available since Kenya holds the host berth, making Guinea the actual gatekeeper. A four-nation Southern African bid for AFCON 2028 has also been submitted.
Gauteng water inquiry opens — tanker mafias, R268bn in municipal wasteful spend, civil society demanding municipalisation — The SAHRC opened a three-day inquiry into Gauteng's water crisis on 19 May — first witnesses described years of infrastructure collapse, raw sewage on streets, and contaminated supply across residential and farming areas. WaterCAN and the Federation for a Sustainable Environment used the platform to demand municipalisation of water-tanker services (R264m spent across Tshwane over three years, ~R98m annually), independent economic regulation of the water sector, and prosecution of contractors responsible for contamination and price-gouging. In the same news cycle the PSA flagged National Treasury's finding that irregular, fruitless and wasteful municipal spending hit R268.13bn in 2024/25 — driven by procurement dysfunction, leadership instability and weak consequence management. Ekurhuleni's R16bn IPP escrow framework targeting 70% Eskom dependence (down from 100%) is the only constructive offset visible this week.

Read the full briefing with sources →

Generated with AI from public sources — verify before acting on anything important.

May 19: SARB extends crypto capital flow comment window to 30 June, confirms no criminalisation

hello@betabriefing.ai (The Settlement Layer) — Tue, 19 May 2026 09:00:00 +0000

Today on The Settlement Layer: agentic payments graduate from slides to live transactions, SARB extends the crypto consultation while clarifying it isn't a ban, the Gauteng Gambling Board's CEO is fired mid-forensic-report, and Ghanaian traders quietly drift back to cash. Plus Anthropic's June 15 billing split, which will rewrite the cost model for anyone running Claude programmatically.

In this episode

SARB extends crypto capital flow comment window to 30 June, confirms no criminalisation — National Treasury and SARB pushed the public comment deadline on the draft Capital Flow Management Regulations from 18 May to 30 June 2026 after stakeholder pushback, and clarified two things publicly: crypto possession will not be criminalised, and the rules will not apply retrospectively. Crypto assets are being folded into the existing exchange control framework under a risk-based surveillance model — not a separate, lighter regime. A draft cross-border crypto asset manual will be released for comment 'shortly'.
Gauteng Gambling Board CEO fired mid-forensic report; R73m irregular allocations, R23m misdirected SED funding — MEC Vuyiswa Ramokgopa dismissed CEO Dr Karabo Mbele and suspended CFO Oscar Maripane after a forensic investigation documented R73m in irregular SDF/CSI allocations, R1.5m of conflicted recruitment-agency payments, R23m of improperly disbursed SED funding, and systemic PFMA breaches. The board itself has been without quorum since member resignations in December 2025. An administrator will run the entity while a new board is constituted. Backdrop: Gauteng's share of national gambling revenue has collapsed from 35% to roughly 18% since 2019, against a R74.9bn national market.
PhotonPay and Mastercard complete first live cross-border AI agent payment — PhotonPay and Mastercard ran what they describe as the first live agent-initiated cross-border payment in Hong Kong: an autonomous agent booked a mobility service and completed settlement with no human in the loop, using tokenised card provisioning and predefined spending limits over Mastercard's Agent Pay rails. Same week: JD.com signed onto Agent Pay for its e-commerce stack, and Stripe and TRON joined the Agentic AI Foundation as Gold Members.
JPMorgan and Trulioo: agent commerce won't scale until liability and KYA are protocol-level — JPMorgan Payments' Prashant Sharma laid out the bank's view that decades-old payment liability models can't accommodate a fourth party (the agent) without resolving who bears loss when the agent hallucinates or misinterprets intent. In parallel, Trulioo's CPO Zac Cohen argued that a Know-Your-Agent (KYA) verification layer must precede feature scaling. Experian added Akamai to its Agent Trust ecosystem alongside Skyfire, advancing KYAPay — an emerging standard for declaring agent intent and minting tokenised, delegated payment credentials.
Why Ghanaian merchants are quietly returning to cash — Ghanaian small businesses and traders are reverting to cash after years of mobile money adoption. The reasons are operational, not ideological: persistent transaction fees, network failures, doctored-screenshot fraud, reversed transactions, tax-scrutiny exposure from the digital trail, and customer preference for spend control. The E-Levy may have been softened but its psychological residue persists.
Anthropic splits Agent SDK billing from subscriptions on 15 June — From 15 June 2026, Claude Agent SDK (Python/TypeScript), claude -p in non-interactive mode, Claude Code GitHub Actions, and third-party apps authenticating via Agent SDK move off subscription rate limits and onto a separate monthly credit billed at full API rates — $20/month for Pro, $100 for Max 5x and Team Premium, $200 for Max 20x and Enterprise Premium. Credits are per-user, do not pool, and do not roll over. Interactive Claude Code and chat continue using subscription limits. Third-party analysis flags 12x–150x effective cost increases for heavy programmatic workloads previously subsidised under flat-fee subscriptions.
Apple Tap to Pay on iPhone goes live in South Africa via Yoco and iStore Pay — Apple launched Tap to Pay on iPhone in South Africa, letting merchants accept contactless cards, Apple Pay, and digital wallets directly on an iPhone Xs or later — no dock, no terminal. Yoco and iStore Pay are the launch partners. Mastercard and Visa are live; Amex is 'coming soon'.
Mastercard partners Yellow Card on stablecoin rails for EEMEA; Tether invests in LemFi — Two complementary moves landed this week. Mastercard and Yellow Card (licensed stablecoin infra across 20+ African markets) announced a partnership targeting four verticals — cross-border remittance, B2B settlement, digital loyalty, treasury management — with initial focus on Nigeria, Ghana, Kenya, South Africa, and the UAE. Separately, Tether invested in LemFi (2m+ customers across UK, US, Canada, Europe, Africa) to embed USDT as the settlement layer beneath the consumer-facing remittance UX, replacing multi-day SWIFT hops.
UK Gambling Commission's affordability checks head to 21 May board meeting; BGC threatens judicial review — The Betting and Gaming Council has issued its starkest warning yet ahead of the Gambling Commission's 21 May board meeting on Financial Risk Assessments, threatening judicial review. BGC argues FRAs would affect up to 20% of customers (versus the GC's 3% claim), rely on inconsistent credit reference agency data, and push punters to unregulated offshore operators. Current £150 deposit threshold is active; FRAs would trigger at £500 net deposits. Separately, Entain wrote to six Premier League clubs demanding they drop unlicensed offshore sponsors (Stake, 96.com, BJ88, SBOTOP, W88, DEBET).
Chapel Hill: CBN's group-supervision rules hand foreign banks a N300bn capital advantage in Nigeria — Chapel Hill Denham's report 'The Nigerian Banking Paradox' details how Nigeria's consolidated group-supervision framework requires Nigerian banks to hold N500bn for international operations versus N200bn for foreign subsidiaries — a N300bn gap. BOFIA Section 19(8)(c) caps aggregate foreign-subsidiary equity at 10% of shareholders' funds, and the 50% Cash Reserve Ratio compounds the drag. Result: Nigerian banks trade at deep discounts versus SA and Moroccan peers despite strong ROEs.
Claude Code v2.1.144 ships; v2.1.118 patched a deeplink RCE — Claude Code v2.1.144 released with background-session resumption (preserving model selection across resumes), elapsed-duration tracking, plugin dependency enforcement, MCP tool pagination fixes, and ~50 stability fixes across CLI, IDE, and agent workflows. Separately, researcher Joernchen (0day.click) disclosed a critical RCE in Claude Code's CLI via the 'claude-cli://' deeplink handler — context-blind argument parsing in eagerParseCliFlag let attackers inject SessionStart hooks through the 'q' parameter and execute arbitrary commands on click. Patched in v2.1.118 with context-aware parsing.
Authorization must live below the agent: NanoClaw 2.0 and rosud-pay show the pattern — A developer deep-dive on two open-source patterns making the same architectural argument: agent authorization cannot live in the agent's own logic layer. NanoClaw 2.0 intercepts API credentials before the agent ever sees them. rosud-pay applies the same idea to blockchain payments — scoped tokens issued at deployment time, not runtime, so a compromised or prompt-injected agent cannot override policy. Trend Micro published a parallel governance framework the same week mapping four controls: identity, authority, action, evidence.
Orlando Pirates: one match from a first title in 14 years — Pirates drew 0-0 with Durban City at Orlando despite 30 shots, leaving them two points behind Sundowns going into the final matchday against Orbit College at Mbombela Stadium. A win takes the league. Coach Ouaddou criticised the first-half intensity and reckless tackling on goalkeeper Sipho Chaine (20 clean sheets this season). R20m in prize money on the line, plus the last MTN8 slot still contested between Durban City, Stellenbosch and Siwelele.
Eskom's R5.2bn ultimatum to Johannesburg as fixed charges quietly become the new crisis — Eskom set a 8 July 2026 deadline for Johannesburg to clear R5.2bn in arrears or face bulk-supply disconnection of Fourways, Sandton, Soweto and other areas — despite a prior court-ordered settlement. Separately, the country marked 367 days without load shedding (R26.9bn in diesel savings over three years), but tariffs rose 8.76% for direct Eskom customers and fixed monthly charges hit R1,761 for three-phase postpaid in Johannesburg. Government pricing review scheduled July–September. Municipal debt to Eskom now exceeds R110bn with projections to R358bn within five years.

Read the full briefing with sources →

Generated with AI from public sources — verify before acting on anything important.